search

uazo / cromite

Cromite a Bromite fork with ad blocking and privacy enhancements; take back your browser!
https://www.cromite.org/
GNU General Public License v3.0
2.98k stars 68 forks source link

Change Cromite Default Settings #1237

Open Retold3202 opened 1 month ago

Retold3202 commented 1 month ago

Just following up from https://github.com/Retold3202/better-cromite/issues/1, I'd like to give my thoughts & considerations for Cromite's default settings. Still super cool to hear from you, and thanks for your great work on this project.

So I guess first, under Privacy & Security -> Delete browsing data, I think it'd make sense to enable clearing cached images and files at start-up by default. This would serve as a nice privacy boost, and other hardened browsers like Mull also enable this (Firefox's equivalent pref) by default.

From there, also under Privacy & Security, I think it'd make sense to enable Always use secure connections by default. Very few websites use HTTP nowadays, and if they do, it's just a simple prompt to continue. This would notably improve security. For reference, Mull also enables this (Firefox's equivalent HTTPS-Only Mode), and I don't think they've had any issues or complaints over it.

Now, to Adblock Plus:

I think EasyPrivacy should definitely be enabled by default, in addition to EasyList (which we already enable by default). EasyPrivacy is an excellent high quality list focused on blocking tracking & unwanted data collection to enhance user privacy, something that definitely aligns with Cromite's goals. It's enabled in various other content blockers by default for reference, such as uBlock Origin, Brave's Shields, & Vanadium. It's known to not cause breakage or any issues.

For Site settings:

I think we should consider blocking Embedded content & Your device use by default. This functionality is not only blocked by default, but completely removed from other privacy-based Chromium browsers like Brave (as well as not included in browsers with other engines like Firefox & Safari). These "features" are both very concerning from a privacy perspective, and I've yet to see them provide any legitimate functionality.

I think we should also set Protected content to Ask first by default. DRM/Protected content poses privacy & security concerns, and this would at least help to alleviate some of that risk, so that users can make the conscious decision to enable it for websites that need it. This is also how Vanadium & Mulch handle it.

Now, for flags:

I don't see why we shouldn't set #max-connections-per-host to 15 by default. This improves performance & speed of webpages, and I'm not aware of any downsides to it. (FWIW, I think it also might be worth moving this flag & some of the other flags inherited from Bromite to the Cromite section, rather than just leaving them jumbled in with the other Chromium available flags).

I'm also curious why we don't enable #viewport-protection by default, does this cause any issues? This could also be nice to help prevent fingerprinting.

As an aside, it looks like search is broken for Cromite-specific flags, but it appears to work fine for the Available section, not sure if you're aware of this or not.

These are the main points I can think of for now, but I look forward to discussing this with your further @uazo, thanks again for your excellent work with this browser, I look forward to seeing how it develops in the future.

uazo commented 1 month ago

(reserved)

uazo commented 1 month ago

thank you for accepting the invitation. defaults are to be shared and it seemed to me that you also have experience with other browsers, which I do not. the discussion is open to all, just be constructive, and preferably explain why the proposed choices were made.

these are my thoughts, is all in my opinion, and my opinion is not necessarily better than yours:

About the other points you made in your repo:

Retold3202 commented 1 month ago

Privacy & Security -> Delete browsing data: all must be selected by default except autofill, passwords and history. autofill is not needed because, in cromite, is only active after the user clicks on the textbox. passwords for obvious reasons and history because in my opinion the retention default should be changed to 1 days.

I generally agree with this, but I think my only concern is regarding clearing Cookies and site data. I'm not sure that's a good idea to enable by default, primarily because you don't seem to be able to set per-site exceptions yet, like you can on ex. Brave & Firefox. If you had the ability to only allow cookies & data for certain sites, then I'd agree this should be cleared by default, but since it doesn't have this functionality, I'm concerned from a usability perspective. I feel like you'll be flooded with reports.

Enable Always use secure connections by default: I honestly don't know if it's preferable for the user to be warned rather than making an automatic redirect.

Unless I'm misunderstanding, isn't that what the 'Always use secure connections' feature does? To quote the description:

'Use HTTPS whenever possible and get warned before loading sites that don't support it'

don't you think a warning makes people realize that maybe it's better to stay away from that site?

I agree, I think that's more desirable, which is what I thought enabling that feature by default would accomplish, but again, I could just be misunderstanding it.

EasyPrivacy should definitely be enabled by default, I agree with this, although I would like to consider using more comprehensive lists by default, such as https://github.com/badmojr/1Hosts

I agree with this as well. I myself maintain a few comprehensive blocklists here that may be of interest for this, but regardless, I think it'd also be worth including some of HaGeZi's lists as well, they're of very high quality. I could go more into detail on this and give some other suggestions for what specific lists to use as well.

Block "Embedded content" i think "ask" is still better than "block". that site settings controls the ability for sites to enable storage in iframes, useful for example to allow login. in chrome that site setting controls shared storage, but that is turned off by default in cromite and cannot be activated, so, I don't think there could be any privacy issues if the user activates that option. perhaps there is only the problem defined in https://github.com/uazo/cromite/issues/1232, and the possibility of communication through "hacks" such as those used in https://github.com/jcubic/sysend.js (perfectly legitimate hacks) but likely those possibilities are minimized if you enable automatic deletion on restart.

I guess my concern with this is from a tracking perspective, to quote the description:

`Sites you visit can embed content from other sites, for example images, ads, and text. These other sites can ask for permission to use info they've saved about you as you browse the site'.

This just sounds plain creepy to me, especially the parts about using it for ads & "using info they've saved about you as you browse the site". I'm not aware of any legitimate functionality using this feature at the moment, and seeing as how other browsers like Brave just fully remove it, and haven't seemed to have any issues, I still think it might be worth just blocking this.

set #max-connections-per-host to 15 by default. the reason is related to the standards that prescribe 3 simultaneous connections per host (I seem to remember). It is to reduce DoS attacks, I do not agree to the change, in fact, it would probably be better to delete the patch itself

Fair point, I didn't realize that it was causing DoS attacks. I'll remove this from my repo in that case. I agree, you should probably just delete the patch.

Search engine: DuckDuckGo obviously of the user's choice.

I agree, I think the way Cromite handles this right now is perfect. As an aside, I'd love to see Brave Search added as an option as well.

Show NTP at startup: I would like to understand why you are against default activation (which by the way, it already is, there is a problem in the ui)

I think my concern was that it states it allows selection of the last open tab. This probably doesn't matter though if we start sanitizing browser data by default like we're talking about here (which we should).

Pop-ups and redirects: Block all popups it would take comparison and mass testing but I theoretically agree with disabling all popups, my fear is to be flooded with reports about no go that and this

Fair point. I usually just disable it myself to prevent annoyances and I haven't encountered any issues with it, but I think you're right, this will probably need more testing & it might be best to just leave this as it is for now.

Dark theme for sites: on I tell you more, I would make it on and unmodifiable.

💯

Timezone override: Random (for each page) I agree. long ago was incredulous about the effectiveness, but as fingerprinting is widely used, and, since I am convinced that no browser can't hide in the crowd (of chrome), I would enable it by default.

100%, I think this does help. We can't defeat advanced fingerprinting (Only Tor Browser & Mullvad Browser can), but I feel like naive fingerprinters (which most are) would take the bait on this.

Automatically open PDFs: off i don't know, maybe it's better on. i think it's much safer to see them in the browser than in another program.

This is actually a fair point. I guess I was just thinking to turn it off because I use the GrapheneOS PDF Viewer, but clearly not everyone will use a private & secure PDF Viewer like that, so it might be best to just keep in the browser by default to deter the use of any sketchy PDF viewers. I think I'll add a note on this in my repo.

cleartext-permitted -> Disabled

Yes, I agree, I would try to put it in default, I've never seen what gets broken. can you tell me?

I haven't noticed any issues with it myself. I imagine it'd break the 1 or 2 sites out there still exclusively using HTTP, but I think that'd be in the minority and users impacted by it could just toggle the flag for their specific use case, so I think I also agree with setting this by default.

share-intent-ui -> Disabled What scares you about this?

Eh, you're right. I'm not sure why I even disabled this, it's harmless & actually useful. Going to remove from my repo.

drogga commented 1 month ago

httpS by default -> This will most probably be annoying for those that from time to time run a http server that can't be made secure (localhost?) or regularly visit pages that don't necessarily have to have and don't use a secure connection. Personally this will be yet another thing that I have to change if it gets enabled by default.

max-connections-per-host -> Isn't this what DL accelerators like IDM, 1DM, ADM, FDM increase to actually DL a file faster from hosts that limit the speed or don't have enough bandwidth to handle and satisfy everyone currently using it ?, because if YES, then removing it is a bad idea/choice, because it can be used for video streaming speed boost, because some sites don't offer enough speed for normal watching at 1x, let alone 2 or 3 (which is what I'm using thanks to an extension to watch certain content and I didn't know about that flag, but always wanted to have a video accelerator, same as download one, instead of having to DL those that are otherwise unwatchable at 720p because there's not enough speed.

Making a Dark Theme setting/flag unmodifiable ? -> That's a bad idea, IDK which one you mean exactly, but I hate things being unnecessarily locked-out or restricted, I use a dark theme (non-image elements) and on whatever else possible, but regarding a browser and sites - there are some pages that have problems with non-native dark mode enforced/applied by the browser, so I have exceptions and sometimes have to turn it off temporarily to see a content properly or at all (not a problem on my side), also it tells a lot that this has been a flag for years, but Google still haven't exposed/enabled it by default to show up in the theme settings, which confirms that there's more work that has to be done with it, it's not fully ready and unproblematic.

Timezone override: Random (for each page) -> This could be problematic for sites that use it to show timestamps/clock or whatever relative to your time zone. It's not everything about "privacy", or the most important thing in the world, think about usability for a sec. I just hope that it goes unproblematic somehow and that there won't be a lot of new issue tickets and complaints, because for everything you suddenly change as default, you have to think about certain scenarios and consequences. The same goes for the ClearText flag.

Unfortunately enabling JIT by default wasn't proposed here, but it should've, because it's more important to load and be able to use a page at all, than be concerned so/that much about "privacy" for majority of users and I'm not even counting the performance impact when is off by default (like currently, I keep it enabled obv.), that's why there are often new issue tickets being created (maybe even discussion topics) regarding it.

uazo commented 4 weeks ago

Privacy & Security -> Delete browsing data: all must be selected by default except autofill, passwords and history.

I generally agree with this but ... primarily because you don't seem to be able to set per-site exceptions yet

you are right and you gave me the right motivation to develop it.

Enable Always use secure connections by default:

isn't that what the 'Always use secure connections' feature does?

no, the flag enables https-first mode. you are right though, the description is misleading (Unfortunately, I am a technician and cromite documentation is bad). from code:

// A class that attempts to intercept HTTP navigation requests and redirect them
// to HTTPS, and then if the upgraded requests fail redirect them back to HTTP.

It basically does not tell the user but tries to do the upgrade automatically. I not active it by default for the reasons I wrote about.

I myself maintain a few comprehensive blocklists here that may be of interest for this

I hadn't seen that, and I like your readme. And yes, I am interested. you know what is missing in my opinion? some kind of "guarantee of good intentions". let me explain better: some rules simulate the click, others modify the csp, sometimes for the worse, enabling, for example, evals. in cromite those rules are disabled by default (and maybe that's why adblock is not always so effective), not having the time to develop a parser that would disable those rules if worse. how do you guarantee that they are not present?

I could go more into detail on this and give some other suggestions for what specific lists to use as well.

Yes, I'm very interested, let's break it into another issue.

Block "Embedded content"

`Sites you visit can embed content from other sites, for example images, ads, and text. These other sites can ask for permission to use info they've saved about you as you browse the site'. This just sounds plain creepy to me, especially the parts about using it for ads & "using info they've saved about you as you browse the site".

again, you are right. i will look for another more appropriate description.

I'm not aware of any legitimate functionality using this feature at the moment, and seeing as how other browsers like Brave just fully remove it, and haven't seemed to have any issues, I still think it might be worth just blocking this.

brave removed it completely? didn't know that, I will look in his code for why.

As an aside, I'd love to see Brave Search added as an option as well.

I would not want to insert any new engine, theoretically for the user to add it in cromite is very simple.

Show NTP at startup:

I think my concern was that it states it allows selection of the last open tab

feature is: do not open any pages at startup (so that you have a clean browser) but allow the user to quickly return to the last page they had open. How would you write this?

Pop-ups and redirects: Block all popups

this will probably need more testing & it might be best to just leave this as it is for now.

Yeah, it's the number 1 issue of cromite, no test. users do it... As a professional developer, every time I think about it, I feel uncomfortable.

We can't defeat advanced fingerprinting (Only Tor Browser & Mullvad Browser can)

Could you elaborate on this sentence?

uazo commented 4 weeks ago

This will most probably be annoying for those that from time to time run a http server that can't be made secure (localhost?)

From what I remember, localhost is exempt.

max-connections-per-host ... then removing it is a bad idea/choice, because it can be used for video streaming speed boost

in that case it is a website issue, not a browser problem.

Isn't this what DL accelerators like IDM, 1DM, ADM, FDM increase to actually DL a file faster from hosts that limit the speed or don't have enough bandwidth to handle and satisfy everyone currently using it ?

downloaders are not "driven" by javascript and in any case that setting does not change the behavior of the internal chromium downloader.

Making a Dark Theme setting/flag unmodifiable ? -> That's a bad idea,

from the point of view of privacy is a very good idea. the alternative is to disable it by default and make it unmodifiable. someone still loses out.

Timezone override: Random (for each page) -> This could be problematic for sites that use it to show timestamps/clock or whatever relative to your time zone.

you are right, for example the weather sites would definitely not work. however, then the user can edit it as they like.

think about usability for a sec. It's not everything about "privacy", or the most important thing in the world, think about usability for a sec.

no I'm sorry: it is true that they are choices, but they must be made with a certain purpose, that is, in line with the goals of cromite.

enabling JIT by default

the problem, from my point of view, is not jit, but webassembly, and not so much the language itself, which is extremely better than javascript since it does not support goto and therefore extremely more secure, but the support for SharedArrayBuffer. and webassembly does not work if jit is not active.

drogga commented 4 weeks ago

Is it still a local host when I run a simple web server on my phone, make it also public (accessible by my public IP) and load it on another device not necessary on my local network ? archive.org for example doesn't use a secure connection by default, nor does it redirect to one when loaded, instead I see a blank page in my browser, so I have to edit the URL address to manually add an "s" to http://, almost the same for web.archive.org, just it at least load unsecure, sure enabling the always secure option will/might resolve this, but that doesn't mean that I want it enabled by default, but NVM, I will change it on new installs if necessary, along with other things.

max-connections-per-host - "in that case it is a website issue, not a browser problem." -> Nobody said that it's a browser problem, just something that sounds useful and I don't want it removed, before I even have the chance to try it (given that I didn't know it exists until now). Can't basically all sites be problematic, but the browser always correct / perfect, we can't always blame the sites when something's wrong, even tho in most cases they might be the problem (example: problem - ads, for those that don't run/inject them and rely on for income, solution - not Cromite with it's current implementation), being DDoS-ed is also site's problem, or you you mean that we can get DDoSed ?, anyway most video sharing sites have a bandwidth problem and don't allocate anywhere near enough for every client (example: adult prn sites), but you try running such and constantly having hundreds or thousands online active users at any moment, all streaming/playing an HD (720p and more) videos at the same time, not GB/s, but TB/s bandwidth won't probably be enough (I'm speculating/guessing, as I'm not a network admin, nor I have a site, in fact I barely know anything on the topic). "downloaders are not "driven" by javascript and in any case that setting does not change the behavior of the internal chromium downloader." -> Nobody said it did, I didn't even think about the browser internal DLer when I wrote the response to the proposal of the patch/flag removal. I don't even think that the "Parallel" flag does improve or do anything, even tho it's enabled by default (I try/tend to not DL files).

For which Dark Theme option/flag we are specifically and exactly talking about here (it's unclear - there are 2, one of them is to expose the checkbox in the themes setting, the other is for the preferred mode) ?, please elaborate/specify. That's why having an option is important, taking away that choice by removing, locking, restricting means censoring something and make it not a choice anymore. While we are at it, let's restrict Cromite to not be able to change absolutely any preference pr flag, lock it out completely, even remove the bookmarks and make it so it access only 1 page, like the Cromite site, that way we won't have problems with privacy or fingerprinting, unless you start using such there.

TimeZone Override to random - "then the user can edit it as they like" -> Weather sites are the least of the problem, sure change it, but be prepared for the issue tickets flood, or some users will just try it, have a problem and get rid of the browser, unlike us that are monitoring the repo and getting involved, because we still care.

I thought Jit is another word for WebAssembly and that it's the same thing... You previously admitted that you, yourself change the default setting of it when testing with BrowserStack, so I think that the default should be changed for all.

uazo commented 4 weeks ago

brave removed it completely? didn't know that, I will look in his code for why.

then, with regard to this point, for now I have not looked at the code but at the behaviour:

1) url: https://xchrdw.github.io/browsing-data/siteDataMultiEmbedded.html

Cromite Brave
image image
document.hasStorageAccess(): false document.hasStorageAccess(): true

2) Press Write:

Cromite Brave
image image
storage not allowed storage allowed

3) Clean all data, go to https://xchrdw.github.io/browsing-data/siteDataEmbedded2.html and press Write

Cromite Brave
image image

4) Reopen https://xchrdw.github.io/browsing-data/siteDataTester.html

Cromite Brave
image image
SS=None --> empty SS=None --> not empty

With these results, I don't think I will look at what brave did ;) Regarding point 4 in brave, I consider it serious, because it allows iframe sites to track user behaviour.

Retold3202 commented 4 weeks ago

re: @uazo

(Unfortunately, I am a technician and cromite documentation is bad).

I'd be happy to help improve it, just let me know what I can do. :)

you know what is missing in my opinion? some kind of "guarantee of good intentions". let me explain better: some rules simulate the click, others modify the csp, sometimes for the worse, enabling, for example, evals. in cromite those rules are disabled by default (and maybe that's why adblock is not always so effective), not having the time to develop a parser that would disable those rules if worse. how do you guarantee that they are not present?

This is an interesting and fair point - I guess the guarantees I can make are the same as any other list maintainers, or really any developers as well. I guess it'd be the same as you guaranteeing not to push out any malicious updates to Cromite (Not to say you would, I personally trust you and your work, otherwise I wouldn't be here, but I guess its a similar principle).

That being said, if you have any ideas how I could add a guarantee of good intentions, please let me know, I'm 100% open to hearing and implementing them, I'd love to improve the safety of my lists. I develop them completely in the open and as transparently as possible, with the only goal to help users improve privacy & security (just like my other work). The domains added are also carefully considered & taken from my own research, so I don't just rely on or blindly import other sources like a lot of other lists do, which could also add more confidence from a security perspective.

I think the ideal solution here would be reducing as much as trust as possible in the first place given to lists, so like you said, maybe its best to just disable dangerous rules like that, or at least give caution over them.

I could go more into detail on this and give some other suggestions for what specific lists to use as well. Yes, I'm very interested, let's break it into another issue.

👍

Yeah, it's the number 1 issue of cromite, no test. users do it... As a professional developer, every time I think about it, I feel uncomfortable.

Yeah, I can understand. I wonder if it'd be worth considering making a testing branch of Cromite for things like this? For instance, I know ex. Firefox & Brave have "nightly" builds where they test changes that could cause issues before putting them in the stable/main releases, so that interested users can test them first & leave feedback on any potential issues, but without having to roll out the changes for the masses. I'm not sure how much extra maintenance that'd be though.

We can't defeat advanced fingerprinting (Only Tor Browser & Mullvad Browser can)

Could you elaborate on this sentence?

Tor Browser & Mullvad Browser are the only browsers I'm aware of that can actually "blend in with the crowd" so to speak, they basically have an identical fingerprint across all users. I think only might've been a poor word choice, because technically other browsers could as well, but right now they're the only 2 that have actually been able to pull it off.

This approach can defeat more sophisticated/"advanced" fingerprinting, but it comes at the cost of usability and UX.

I don't really think this is an issue for Cromite, because:

  1. Through the built-in content blocker, we block the majority of fingerprinters from loading in the first place.

  2. For any that do slip by, most fingerprinters are "naive", so they will fall for fake or randomized values.

Therefore, for the vast majority of threat models & use cases, I think we're covered. I might not be doing this justice either, so I'd recommend taking a look at Arkenfox's Wiki entry on this as well, it explains this very well.

Retold3202 commented 4 weeks ago

re: @drogga

Is it still a local host when I run a simple web server on my phone, make it also public (accessible by my public IP) and load it on another device not necessary on my local network ?

Not necessarily, but to me that seems like an edge case. I doubt the majority of users are going to use web servers like this, and if they do, then they could just disable the setting or just hit 'Continue' on the warning. I can sympathize with your concerns here though, as I've ran servers myself, but we have to remember the vast majority of people aren't like us, and I don't think we should reduce everyone's privacy & security for that.

archive.org for example doesn't use a secure connection by default, nor does it redirect to one when loaded, instead I see a blank page in my browser, so I have to edit the URL address to manually add an "s" to http://, almost the same for web.archive.org, just it at least load unsecure, sure enabling the always secure option will/might resolve this, but that doesn't mean that I want it enabled by default, but NVM, I will change it on new installs if necessary, along with other things.

Sounds like poor web design and something they should fix, you should probably inform them about this.

I thought Jit is another word for WebAssembly and that it's the same thing...

No, JIT and WASM are different. I think JIT should definitely always be disabled by default, due to the security concerns associated with it. JIT also doesn't cause breakage, it can just make websites slower (Though this has been heavily improved and in most cases, there isn't even a noticeable difference IMO).

Like @uazo said, WASM is the real issue here, since WASM does cause breakage in some cases. I think the best move would be to separate the JIT toggle from the WASM toggle, so that you could ex. still have the security benefits of no JIT, but without the breakage of no WASM if desired. (I generally disable both myself though since WASM also has its own security concerns, but I understand this might not be desirable for all users).

uazo commented 4 weeks ago

I'd be happy to help improve it, just let me know what I can do. :)

ah, you catch me unprepared. but if you are really interested I will make a list.

That being said, if you have any ideas how I could add a guarantee of good intentions, please let me know,

I will tell you about it in #1245

I wonder if it'd be worth considering making a testing branch of Cromite for things like this?

for now I am trying to prepare automated tests, but I thought it would be easier :)

Tor Browser & Mullvad Browser are the only browsers I'm aware of that can actually "blend in with the crowd" so to speak, they basically have an identical fingerprint across all users.

well, if that is true, I will start studying the firefox code! However, when I finish the test infrastructure, I will be able to tell you exactly if it is true.

Retold3202 commented 4 weeks ago

ah, you catch me unprepared. but if you are really interested I will make a list.

I'm serious, would be glad to help however I can. :)

well, if that is true, I will start studying the firefox code!

This might be of interest.