While FF forks are good for privacy, I refuse to blindly trust them. I understand they are still open source but I doubt there are as many people as those who are actively reviewing FF's code. I'd rather let FF do the telemetry (if I'm too lazy tweaking it) than some malicious code accidentally went into its more privacy-focused forks.
this post was submitted on 19 Feb 2022
0 points (NaN% liked)
Security
5142 readers
7 users here now
Confidentiality Integrity Availability
founded 5 years ago
MODERATORS
Librewolf should not be bouncing around on the Internet without the user explicitly asking it to do so.
I find this argument to be too extreme. Librewolf already acknowledges that it still needs to connect to some essential services but tries to minimizes which. content-signature-2.cdn.mozilla.net for example is necessary for OCSP (and HTTPS) to work, I've seen some blocklists block it in the name of "blocking telemetry" but it causes massive breakage. Just listing domain names isn't a very useful argument.
For HTTPS you can rely on local CA-Certificates perfectly which are upgraded by the OS.
The problem is that your offline CA stores won't use OCSP revocation logs or certificate transparency. You need live updates for those. The latter is especially important, as without it you're completely dependent on one group of CAs.
Usually not so fast, download a list is still needed (e.g. if there are security problems with some CA). IMHO, a completely "mute" browser isn't necessarily good, but of course every connection should be explained
If you're concerned about your browser "phoning home", you can find out exactly what it's chattering about using key logs and a packet sniffer (I recommend Wireshark or derivatives). Key logs are required for decrypting TLS traffic, and Firefox + Chromium support them.
Considering the amount of conflict of interests and scare with using browser, I think the only, least risky way is to use someone else's internet to browse or to use TUI browser.
Then again, a non-programmer (i.e. me) would be having difficulties. I think one of the more important aspects of security is to know what you are up against. It's far easier to be secure on the internet if your goal is defined as "not being hacked by script kiddies" rather than broadly defining "government-agency sponsored, state-level threat" stuff.
As long as you're not a billionaire, I think the minimum steps to undertake is to limit your use of the internet. Kinda scary for a layman like me to see the internet and see everywhere that each click can get you hacked. Again, that sort of stuff would most likely apply to high value targets anyways... which I am not.