WardPearce

Open source developer & privacy advocate.

  • 5 Posts
  • 32 Comments
Joined 1 year ago
cake
Cake day: June 7th, 2023

help-circle











  • Per-site process isolation is a powerful security feature that seeks to limit exposure of a malicious website/script abusing a security vulnerability. Firefox calls per-site process isolation Fission and is enabled by default on desktop. Fission is not yet enabled by default on Android, and when manually enabled it results in a severely degraded/broken experience. Furthermore Firefox on Android does not take advantage of Android’s isolatedProcess flag for completely sandboxing application services.

    Obviously Firefox has it own data isolation, but this doesn’t matter if someone can execute bad actiing code due to lack of process isolation.


  • As I said I not a fan of Brave (mostly because of the crypto stuff), calling it spyware you could say is hhmmmm “misinformation”. Yes security and privacy are different concepts but they are closely linked. If your browser fails to stop malicious code from being executed, you might find this impacts your privacy.

    Matter of facts is, Android Firefox lacks site isolation. Yes you can enable a highly experimental version of site isolation what will break your browser (admitted by your source) and may even fail to isolate sites altogether. Android Firefox doesn’t use isolated processes, a functionality what can’t be enabled.

    I’m not sure what your goal is with this discussion, but obviously you don’t have any regard for privacy or security. Your arguments over semantics are obviously in bad fair (and not even accurate to the original discussion).

    To reiterate for the millionth time, feel free to use Firefox on Android, I’m avoiding using Firefox due to large security concerns. Once Mozilla finishes implementing site isolation and process isolation, I’ll be the 1st one to move off Brave and into Firefox.

    But for your own future reference, actually source articles what support your statements. Otherwise don’t get upset when someone points that out.




  • From the article you linked yourself

    Firefox calls per-site process isolation Fission and is enabled by default on desktop. Fission is not yet enabled by default on Android, and when manually enabled it results in a severely degraded/broken experience. Furthermore Firefox on Android does not take advantage of Android’s isolatedProcess flag for completely sandboxing application services.

    Read before you send :)

    I use Firefox on my PC, but as I stated Firefox on Android is lacking basic security features.







  • Not sure if this is entirely true, it is possible Proton mail is encrypting everything at rest (with the users public key) and only following PGP mail limitations during transit.

    Like for example plaintext emails are encrypted at rest on Proton mail, what isn’t ideally (compared to e2ee) but still minimizes the attack surface.

    Actually for reference this is exactly the case

    Message storage All messages in your Proton Mail mailbox are stored with zero-access encryption. This means we cannot read any of your messages or hand them over to third parties. This includes messages sent to you by non-Proton Mail users, although keep in mind if an email is sent to you from Gmail, Gmail likely retains a copy of that message as well. Password-protected Emails are also stored end-to-end encrypted. Subject lines and recipient/sender email addresses are encrypted but not end-to-end encrypted.

    https://proton.me/support/proton-mail-encryption-explained


  • Thought this comment he made was odd about Proton mail.

    The site is filled by beautiful black screen without JavaScript enabled.

    Like yes, its a bit difficult implementing local encryption or decryption without js enabled.

    Has some good messaging, I’d say most of his comments are pretty widely known concerns or limitations.

    Like obviously web apps still rely on trust from the host, but it minimizes the attack surface massively.