I am currently doing a deep dive into whether or not Chromium is more secure than Firefox, and I will make a very long and comprehensive Lemmy post outlining my findings with specific sources. I expected this to take a few days, maybe a week, but after finding out many of the claims for both sides give no real sources, I expect this to take a month or longer. I will be reaching out to multiple first-party sources (Mozilla, GrapheneOS, etc.) to get their detailed statements on the matter. I want to provide something that actually covers the full picture of the issue with up to date sources, to hopefully put this to rest for anyone who doesn’t want to do the research.

I’m making this post in case anyone wants to provide any extra resources they have about the issue. Do not fight about this issue in the comments, save that until after I am able to release my work. I’m tired of the constant back and forth about this with little to no direct sources. This means that my other project, Open Source Everything, will be put on pause. The FAQ section of that very project is what sparked this, because I realized the issue was far more complex than I outlined in there. (Don’t trust the information in the FAQ just yet: it is still in the works.)

As always, don’t just give blind support to this just because I am making promises, but if you feel your support is needed then by all means go for it.

If any of you want me to turn this post into an update log, let me know and I will.

  • Maestro@fedia.io
    link
    fedilink
    arrow-up
    108
    arrow-down
    2
    ·
    1 month ago

    Secure from what exactly? You need to have a threat model here. For most personal use cases I’d argue that protection from adtech tracking is more important than e.g. sandboxing. Most people run into adtech continuously, but few people browse shady exploit-ridden sites.

    In that case, Firefox us the clear winner. It supports manifest v2 for better adblocking, and it is the only mobile browser with extension support allowing you to use adblocking on mobile as well.

    • doctortran@lemm.ee
      link
      fedilink
      English
      arrow-up
      20
      arrow-down
      1
      ·
      edit-2
      1 month ago

      Secure from what exactly? You need to have a threat model here.

      Which is funny, because developers use “secure” like this all the time as a way of scaring users into compliance for any changes they implement. If they voiced aloud what the actual threat was, they’d have to admit that often its the user’s freedom they’re afraid of. The user may do something stupid, therefore their ability to do it is dangerous for everyone.

      They’d remove the front door on your home and call it more secure, all because some people don’t lock it.

      • reksas@sopuli.xyz
        link
        fedilink
        arrow-up
        9
        arrow-down
        1
        ·
        1 month ago

        they wouldnt remove your frontdoor, they would install their own lock to it and charge you for privilege of using it

  • Godort@lemm.ee
    link
    fedilink
    arrow-up
    70
    arrow-down
    2
    ·
    1 month ago

    Ultimately, in terms of security, you’re likely to find that both are similarly good.

    What makes Firefox desirable over Chrome is that it’s not beng developed by massive corporation that gets the majority of its profits selling user data and delivering targeted adverts.

    The other thing that may act as a deciding factor is the “MacOS doesn’t have viruses” effect. Wherein that because firefox has such a small userbase in comparison to chromium, it’s far more profitable to find exploits in chromium.

    • The 8232 Project@lemmy.mlOP
      link
      fedilink
      arrow-up
      24
      arrow-down
      5
      ·
      1 month ago

      What makes Firefox desirable over Chrome is that it’s not beng developed by massive corporation that gets the majority of its profits selling user data and delivering targeted adverts.

      This is a separate issue of being able to trust developers, which is not being covered here. Projects like ungoogled-chromium exist, after all. I will be inspecting the software as a whole, and not any future interference that may happen.

      • bisby@lemmy.world
        link
        fedilink
        English
        arrow-up
        26
        arrow-down
        2
        ·
        1 month ago

        It isn’t just about ungoogling things though. Having a monoculture in the browser space means that if Google makes a push to favor ads, say by removing certain extension support from their browser engine that everyone uses, then the entire internet suffers. It is effectively a monopoly.

        Mozilla tries really hard sometimes to be unappealing, but there is value in not just letting Google have full control over the internet.

        • brrt@sh.itjust.works
          link
          fedilink
          arrow-up
          2
          arrow-down
          8
          ·
          1 month ago

          So you are saying this should make Firefox exempt from scrutiny when it comes to how its security compares to that of Chromium?

              • BluescreenOfDeath@lemmy.world
                link
                fedilink
                English
                arrow-up
                3
                ·
                1 month ago

                I don’t think anyone is advocating for turning a blind eye to Mozilla. I think the argument being made is that a monoculture for browsers is a concern that can outweigh some blunders Mozilla makes.

                I’m old enough to remember what a shit show ActiveX was for web security.

    • ForgotAboutDre@lemmy.world
      link
      fedilink
      arrow-up
      18
      arrow-down
      2
      ·
      1 month ago

      Chrome excites arbitrary code from google.com (this wasn’t something widely known until recently and appears to effect all the chromium downstream browsers). This sort of back door and the design approach that made google do this means you can never really trust Chrome. The same issue with Firefox would be a bug, in chrome it’s a feature.

      • floofloof@lemmy.ca
        link
        fedilink
        English
        arrow-up
        12
        ·
        1 month ago

        Chrome excites arbitrary code from google.com (this wasn’t something widely known until recently and appears to effect all the chromium downstream browsers).

        I hadn’t heard about that. Can you link me to some info about it?

        • ForgotAboutDre@lemmy.world
          link
          fedilink
          arrow-up
          1
          arrow-down
          2
          ·
          1 month ago

          No it doesn’t, or at least it didn’t for years if that has changed recently.

          No one that knew about this was talking about it or doing anything about it.

          The reality of the situation is only three organisations are capable of producing fully fledged browsers. Google, Apple and Firefox. Every variant, spin and de-whatever is nothing compared to developing a browser. All the chrome derivatives had this in them, arbitrarily execution of code from google. Code that wasn’t included in the binary when you downloaded or updated it. The sort of thing a virus would do. The sort of tool you would use to compromise the security of a system.

          If you want a de-googled chrome the only option is safari, it’s chrome before google got its hands on it. If you want properly open and accessible browsers you need to use something else entirely like Firefox.

          De-googled chrome is a myth.

    • galileopie@lemmy.ml
      link
      fedilink
      English
      arrow-up
      10
      arrow-down
      7
      ·
      1 month ago

      It would be no suprise if chromium is more secure but Firefox is more private.

    • 0x0
      link
      fedilink
      arrow-up
      1
      arrow-down
      2
      ·
      1 month ago

      it’s not beng developed by massive corporation that gets the majority of its profits selling user data and delivering targeted adverts.

      No but it’s largely funded by one, now has “ad technology” and i wouldn’t be surprised if it gets bought by Google sooner or later.

      A fork in the horizon…

  • TranquilTurbulence@lemmy.zip
    link
    fedilink
    arrow-up
    36
    arrow-down
    1
    ·
    edit-2
    1 month ago

    When you start studying a topic like this, you need to define some terms clearly. For example, if hackers grab your passwords, is that a breach in privacy, security or both? If Google is stalking you and knows your every move, desire and plan, what does that violate?

    Once you have clear definitions for these things, it would be more helpful to see how different browsers compare on this scale.

    • The 8232 Project@lemmy.mlOP
      link
      fedilink
      arrow-up
      15
      arrow-down
      1
      ·
      1 month ago

      I agree, and this is no easy task. For now, I am hoping I can gather information and let some of the pieces fall together before I can begin making hard decisions.

      • anar@lemmy.ml
        link
        fedilink
        arrow-up
        7
        arrow-down
        1
        ·
        edit-2
        1 month ago

        You are probably already aware of this, but it is worth noting that categorisation needn’t have hard boundaries, e.g. Lack of Privacy may not translate to lack of Security for everyone, but for example, a whistleblower, that can literally mean getting Boing’d

  • geoma@lemmy.ml
    link
    fedilink
    arrow-up
    30
    ·
    1 month ago

    Beyond technicalities, there are social and political issues. Is it secure for the long term of humankind to use a browser which is one of the tentacles of one of the biggest conpanies in the world, which monopolizes the internet and relies on selling private people’s data?

  • dingdongitsabear@lemmy.ml
    link
    fedilink
    arrow-up
    31
    arrow-down
    1
    ·
    1 month ago

    first off, I have serious doubts that any one dude - or even a group of those for that matter - can ascertain the security of such a complex system; a browser is essentially an operating system, with all the layers and complexities that entails.

    even if you’re somewhat successful in such an endeavor, I don’t really care if it potentially is. chromium comes from those shitmakers and I’m not willingly using anything they had their nasty fingers in. they threw one shovel of shit too many on the heap and they are now forever on my ignore list. if that means that I don’t get to access certain domains, sites, and/or apps - so be it, I’ll make do without.

  • echolalia@lemmy.ml
    link
    fedilink
    arrow-up
    17
    arrow-down
    1
    ·
    1 month ago

    Are you a single person or a group of people? Do you have any credentials that you’d like to share that might give some context to your research?

    Where is the quote in your bio from?

      • echolalia@lemmy.ml
        link
        fedilink
        arrow-up
        2
        ·
        edit-2
        1 month ago

        Thank you. That answers my question. I figured you wanted to remain anonymous, but I liked your answer and I’ll be interested in what you find.

        I was trying to word my initial post in a way to prevent you from becoming defensive, perhaps I failed. Though, I do feel quoting yourself is a bit… gauche, no? Especially since you are remaining anonymous.

  • preasket@lemy.lol
    link
    fedilink
    arrow-up
    16
    arrow-down
    2
    ·
    1 month ago

    AFAIK, the main difference is that Firefox’s process isolation on Linux specifically is incomplete. They’re working on fixing that.

  • MimicJar@lemmy.world
    link
    fedilink
    arrow-up
    12
    ·
    1 month ago
    1. Do you have your current list of sources? You mentioned you want more, but where are you looking to start? For example are you looking at the CVE database? Are you looking at competitions like Pwn2Own? Or detailed project group like Google Project Zero?
    2. Is it fair to compare Chromium, which is not an end user product, to Firefox which is? Do you plan to look at or compare forks of the software? As an example both Google Chrome and Mozilla Firefox enable “Google Safe Browsing” by default, however the fork “ungoogled-chromium” does not include “Google Safe Browsing” (and they provide their reasoning).
    • The 8232 Project@lemmy.mlOP
      link
      fedilink
      arrow-up
      8
      ·
      edit-2
      1 month ago

      Fantastic questions! Thank you for asking.

      Do you have your current list of sources?

      The answer to this is a bit complicated: I had a list of sources, but many of them were not primary sources, and so I am currently in the process of recollecting sources and better categorizing them. I’m currently collecting as many different types of sources as I can, and I will find out what is actually useful later.

      You mentioned you want more, but where are you looking to start? For example are you looking at the CVE database?

      CVE databases will be some of the primary sources I will use in the article, and I may even try to get in touch with the individuals who documented some of the CVEs. I can’t make any promises about that, though.

      Are you looking at competitions like Pwn2Own? Or detailed project group like Google Project Zero?

      I am not familiar with these yet, so I will look into them.

      Is it fair to compare Chromium, which is not an end user product, to Firefox which is? Do you plan to look at or compare forks of the software?

      For the sake of clarity in this post I used “Chromium” and “Firefox” to simplify what I am doing for users who aren’t as aware of the fine details. I will be comparing a wide variety of projects, such as Chromium, Vanadium, Brave, ungoogled-chromium, whatever hardened Chromium Secureblue uses, etc. to a variety of Gecko-based projects such as Firefox, the Tor Browser, Mullvad Browser, and other varieties I may be unfamiliar with. These will be compared on their various platforms, such as Windows, macOS, various Linux distros (where available), iOS, Android, and special cases such as Qubes, Tails, and Firejail. Essentially, I want to compare what the most and least secure varieties of each browser pose, and make observations from there.

      As an example both Google Chrome and Mozilla Firefox enable “Google Safe Browsing” by default, however the fork “ungoogled-chromium” does not include “Google Safe Browsing” (and they provide their reasoning).

      As far as I currently know (and please note I am still in the early research stages), Google Safe Browsing is a feature that primarily affects privacy and is more of a failsafe. For one, it warns you about malicious websites. This is a failsafe for users who are not aware of which websites are malicious. This isn’t directly a security protection, but rather a security “suggestion” for non-advanced users. It also sends data to Google to report websites, which mainly affects privacy. I’m pulling most of this from my head, and so I may be off base with this. Either way, it will not be the main focus of this, as it doesn’t matter if Google Safe Browsing is safe or not if it can simply be disabled. I plan to mainly focus on sandboxing issues with Firefox and any related topics that sprout up from that.

      • MimicJar@lemmy.world
        link
        fedilink
        arrow-up
        3
        arrow-down
        1
        ·
        1 month ago

        Re Google Safe Browsing

        I would argue it’s a security feature with potential privacy concerns, however I would agree it is more of a failsafe or suggestion.

        However it being disabled by default or not included at compile time versus enabled by default may also be relevant when it comes to security. As a hypothetical a high severity bug with Google Safe Browsing could arguably make a browser less secure. However even as a failsafe/suggestion, the small security benefit may make the overall browser more secure, e.g. filtering known bad websites that attack known vulnerabilities.

        I’m also just using Safe Browsing as an example here, it may or may not be worth focusing on since a browser is basically an operating system.

        You mentioned sandboxing, which I think is perhaps a more reasonable scope.

  • masterofn001@lemmy.ca
    link
    fedilink
    arrow-up
    9
    ·
    1 month ago

    OOTB Firefox is a security and privacy concern.

    But it allows for nearly unlimited tweaking, modding, blob removal, etc. Which many serious threat model browsers are based on. Eg Tor.

    If the Tor browser is less secure than chromium, there are potentially devastating consequences for some very at risk people.

    Will you be analyzing forks such as tor and mull?

  • biscuitswalrus@aussie.zone
    link
    fedilink
    arrow-up
    8
    arrow-down
    1
    ·
    1 month ago

    Don’t waste time on pandering to proof of ability when actions speak louder than words. The release of your research is personally something I’m looking forward to regardless of your history or experience. I will interpret your research and evaluation with my own bias and sceptical stance. I’d rather question you afterwards if your article left questions unanswered or unclear.

    Jumping the gun now and questioning you before we start just wastes both our time.

    Good luck with your research!

  • toni_bmw@lemmy.world
    link
    fedilink
    arrow-up
    7
    ·
    1 month ago

    I don’t use chromium on Linux, because the times I tried it, I see that it is not easy to close it (its service is in the background with an icon in the tray) and I see that it consumes CPU, as if you are doing some activity, type of cryptocurrency mined or similar. I suppose it will be easy to check, but I prefer not to waste time on it and I use Firefox. I’m lately trying Librewolf

  • DaTingGoBrrr@lemmy.ml
    link
    fedilink
    arrow-up
    6
    ·
    1 month ago

    I personally don’t trust Google and Chrome enough to use it and I don’t like the Manifest V3 stuff, but I am interested to stay in the loop. Please post updates!