Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Software Chrome Firefox Internet Explorer Opera Safari Security The Internet

Ask Slashdot: Most Secure Browser In an Age of Surveillance? 391

An anonymous reader writes "With the discovery that the NSA may be gathering extensive amounts of data, and the evidence suggesting makers of some of the most popular browsers may be in on the action, I am more than a little wary of which web browser to use. Thus, I pose a question to the community: is there a 'most secure' browser in terms of avoiding personal data collection? Assuming we all know by know how to 'safely' browse the internet (don't click on that ad offering to free your computer of infections) what can the lay person do have a modicum of protection, or at least peace of mind?"
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Most Secure Browser In an Age of Surveillance?

Comments Filter:
  • by futuramasd ( 2958127 ) on Sunday June 23, 2013 @02:19AM (#44083037)
    IE10 and 11 are superb browses. They containing many very good tactics to secure the browser and computer, for example, true sandboxing and JIT hardening. Most other browsers don't come even close.

    Secondly, the sandboxing means that IE is usually able to block an attack on plug-ins like the Flash Player and JAVA VM. This alone makes surfing with IE remarkably safe.

    IE really is an different kind of beast in the sea of mediocre browsers. It has come long way and is aiming for the top.

    - John Futura
    Security Consultant
    • by NewtonsLaw ( 409638 ) on Sunday June 23, 2013 @02:24AM (#44083051)

      Yes, but how do you know that MS hasn't inserted a nice big back-door for the spooks?

      From a "security" perspective, you'll have to go with an open-source browser -- but even that's not a guarantee.

      To be sure, you'll have to compile it yourself from a set of source files that you have gone through with a fine-toothed comb, checking each line for any chance of hidden functionality.

      Oh, come to think of it -- you'll also have to assemble all the libraries from similarly vetted sources -- oh, and that means you'll need to use a compiler you've built from vetted sources -- but hey, that would involve using another compiler that could already be compromised so...

      You'll have to hand-code (from source to binary) every bite of the compiler you use and then type it in through a BIOS that you've also hand coded -- entering the BIOS code through a set of toggle switches on the front panel.

      Bottom line -- you don't *know* for sure that *any* browser is going to be secure.

      • Have we actually heard anything that suggests that they put in back doors into software? All I've heard is that NSA has collected data going in and out of their datacenter, not individual customers.

        • Re:Internet Explorer (Score:5, Informative)

          by Anonymous Coward on Sunday June 23, 2013 @02:44AM (#44083133)

          They at least get early Zero-Day access. I'm guessing they have more.


          • Re:Internet Explorer (Score:5, Interesting)

            by benjymouse ( 756774 ) on Sunday June 23, 2013 @03:27AM (#44083287)

            They at least get early Zero-Day access. I'm guessing they have more.


            MS gives advance information about security patches to AV vendors. The intention is to allow those AV vendors to create scanning signatures which will enable AV products to pick up the attacks. Attackers have show a lazy tendency to just reverse engineer patches instead of finding vulnerabilities themselves. Less than 1% of attacks are zero-day attacks these days.

            Some of AV vendors that receive such vulnerability information are foreign companies. Yes. Some of those AV companies are Chinese.

            Is it not reasonable to afford the NSA the same advance warning? The advance warning is a few days before the patch is made public, around the same time that the public receive advance notification (with less details than the AV companies and NSA). It is not like they have months to exploit it.

            But tinfoil hatters and Microsoft haters always spin it as something nefarious. There is *nothing* to suggest that there are NSA backdoors in Windows or any other OS for that matter.

            • Some of those AV companies are Chinese.

              Care to list out the name of the AV companies which are owned and/or operated by the CHINESE ??

              I am interested in factual information, not fear mongering !!

        • Re:Internet Explorer (Score:4, Interesting)

          by Yvanhoe ( 564877 ) on Sunday June 23, 2013 @03:00AM (#44083203) Journal
          Yes : the whole NSA key debacle [wikipedia.org]. You are free to choose to believe Microsoft denegations that the item they called _NSAKEY is a key they gave to the NSA. This is not the kind of smoking guns Snowden provided, but I do think this qualifies as "something that suggests they put in back doors into software."
      • Re: (Score:3, Funny)

        by Anonymous Coward

        You actually trust your hardware ???!!!!

        You have to start with a handful of diodes and a soldering iron you naive, easily deceived person.

      • by hairyfeet ( 841228 ) <bassbeast1968@gm ... minus herbivore> on Sunday June 23, 2013 @06:40AM (#44083897) Journal

        You are 100% right friend and for those that want a REAL education in what you are potentially up against I urge you all to go take a good hard look at the entries in the various obfuscated C contests and then realize this...you know for a FACT there is malware in those, yet it is DAMN HARD to spot it. Now think about how you have the endless budgets of governments wanting to spy on their citizens and each other and you have those that create malicious code as a business.

        At the end of the day all you can do is keep an eye on your browser and network traffic, see who it is hooking up to, when and why, because with THAT much money involved if a government or group with nefarious intent truly wanted to backdoor a program or even an OS they CAN do so without too much effort required. with the proprietary companies they can just flash a badge and get what they want and with a FOSS project or OS...how many of the projects are gonna turn down a highly skilled coder that volunteers?

      • by meustrus ( 1588597 ) <meustrus @ g m a i l . com> on Sunday June 23, 2013 @10:01AM (#44084633)

        You'll have to hand-code (from source to binary) every bite of the compiler you use and then type it in through a BIOS that you've also hand coded -- entering the BIOS code through a set of toggle switches on the front panel.

        So...you'll have to install Gentoo then?

    • Re:Internet Explorer (Score:5, Informative)

      by Mitchell314 ( 1576581 ) on Sunday June 23, 2013 @02:26AM (#44083061)
      Pretty sure it there's no big difference in security/privacy between modern browsers when you take the usual steps. Y'know, disable the problemchild plugins, limit cookies, use privacy mode, and keep javascript on a white-list basis. Of course, you can still technically be tracked by behavior and server-side stuff, but those have bugger-all to do with the browser.
  • Well... (Score:5, Insightful)

    by Anonymous Coward on Sunday June 23, 2013 @02:24AM (#44083049)

    I'll be uncharacteristically calm here, and ask that someone provide this, "evidence suggesting makers of some of the most popular browsers may be in on the action."

    And in any case, let's be realistic. The NSA doesn't really need help from your browser if they're watching all your traffic. :p

  • No such thing (Score:5, Insightful)

    by Anonymous Coward on Sunday June 23, 2013 @02:26AM (#44083059)

    Security should begin at the hardware level, the kernel should be inaccessible from a hardware perspective. The next best thing is a complete secure OS, so your options are limited to something like TAILS.


    I wouldn't say its 100% secure, its certainly not, but it does raise the bar a little and for them to use anything against you, they would need to admit to having the ability to break encryption. That's not going to happen. That said, always be careful as it will be used in other ways should it be required.

    Other than that, there is no such thing as "safe".

    • Re:No such thing (Score:5, Interesting)

      by UltraZelda64 ( 2309504 ) on Sunday June 23, 2013 @03:04AM (#44083217)

      I was thinking Incognito/TAILS, exactly. Those guys seem incredibly serious about privacy and security. I haven't messed a whole lot with it myself lack of memory, no discs to spare, runs like crap in a VM...), but I recall it even featured Tor and a Tor Firefox extension and it had strict rules about *not* allowing certain "convenience" features in the name of privacy (ie. swap partition). No doubt, with security features and precautions like those, its Firefox browser is probably locked tight as hell by default.

      Aside from this, I figure with all the extensions available and some additional services, you could help to protect yourself. You could start by doing the usual in your browser (disable third-party cookies, install the Adblock Plus, NoScript and DoNotTrackMe extensions, etc.). Reduce your reliance on American companies and/or servers. Example: Since Google's going to be killing off Talk/XMPP support, I decided to look around for alternatives, and chose many XMPP servers to test and decide which one to use. I originally was interested in performance and was going to choose one closest to me, in my own country if possible (the United States). Now, I am almost 100% certain my primary XMPP account will *not* be on an American server, unless I happen to decide to try my hand at setting up and maintaining my own XMPP server.

      And... services. Obviously Tor can work as in Incognito if you want to use that, but another option would be a VNC provider. Specifically, one that respects your privacy (ie. does not store any more log data than they need to operate), and possible more importantly--again--one that is not in the United States. I'm not sure of a good VNC provider, but I can say that it's pretty pathetic when you are forced to subscribe to and pay a foreign provider just to try to ensure your own privacy. But, well, it looks like the U.S. government has no end in sight when it comes to royally fucking up own economy.

      And last... you run Windows? Mac? Might want to change your operating system. It's already been discovered that various U.S. government agencies have deals with Microsoft to learn about zero-day exploits before anyone else in the world... who knows what other deals they might have, or what other American companies also have deals. Definite possibility of backdoors as well.

      The real problem is that PRISM works (from what I can understand) by splitting the signal in between, for example, Microsoft's or Google's servers and their respective ISPs (Steve Gibson brings some pretty good points in a recent episode of Security Now). This means they get *everything*, so if it's encrypted (https:// for example) the government *may* not be able to read the data itself as it's transferred for storage in their own top-secret storage rooms... but they can definitely look at the activity to find out what IP address communications are between at any given time (or... just ask the company running the servers who that user is).

      • by evilsofa ( 947078 ) on Sunday June 23, 2013 @04:54AM (#44083527)
        Doing what you prescribe will do the very thing that you are trying to avoid - get you on the NSA's list of people who are probably not American and must be up to something really interesting.

        http://yro.slashdot.org/story/13/06/21/1443204/use-tor-get-targeted-by-the-nsa [slashdot.org]
        • So in other words: There is absolutely NOTHING AT ALL you can do? Any suggestions yourself, then?

          But actually, say I use an XMPP server in some country in Europe and everyone I know also uses that server (ie. no need to use federation, which would possibly go through American servers)... I'd say that's protection. Unless we find out that the country it is based in is helping/sharing with the NSA as well. But as it is, XMPP is decentralized into so many small servers around the world I seriously doubt it

          • by Lumpy ( 12016 )

            "So in other words: There is absolutely NOTHING AT ALL you can do? Any suggestions yourself, then?"

            Yes I do.

            1 - you MUST abandon any OS that does not give you complete control of the networking. Linux or BSD or it's derivatives is required.
            2 - you MUST never surf from home. Always use coffee shops and other places not attached to you
            3 - you MUST use non US VPN servers. to get your traffic outside the USA before it it's the internet unencrypted, Again use several of them.
            4 - Encrypted communications chann

          • by Clsid ( 564627 )

            This is my take on this issue, and I do believe not only that you can do a lot, but that the feds had to say that crap that if you do they will focus on you since they are worried a lot of people will think extra hard now to avoid them. It's like the Borg saying resistance is futile. Anyways, this is my list:

            -Install Hardened Gentoo. If you want to be extra paranoid download the source packages directly from the creators and compare hash keys.

            -Get a Linux VPS in a country that either has strong privacy laws

    • Have you noticed that most sites have gone https:/// [https] only since a workable man-in-the-middle was devised ...

    • How does it raise the bar? The site is a binary download, which asserts that it takes my privacy seriously.

      Can I download the source? Oh, sure, but between the Obfuscated C contest, Underhanded C, and compiler bugs/"quirks", can I really trust it?

      I would prefer the recommendation of a privacy group, not Anonymous Coward. And for the record I would trust Linux and GCC if I were to compile from source. I wouldn't trust a binary from a random ass website.

  • by Anonymous Coward on Sunday June 23, 2013 @02:27AM (#44083065)

    A LiveCD with TBB:

    https://www.torproject.org/ [torproject.org]

    for LiveDVD/USB preconfigured not to leak try TAILS:

    https://tails.boum.org/ [boum.org]

    in both instances unplug your HDD(s) before use.

    • Tor is fine, except that most end points are likely run by the likes of the NSA and FBI...
      • by Nutria ( 679911 )

        most end points are likely run by the likes of the NSA and FBI...

        Then why isn't the FBI rounding up scads of drug buyers and paedophiles on a daily basis?

        Tin-foil Hat Boy says, "because they *are* drug pushers and paedophiles", but that's a stretch.

  • Lynx (Score:5, Insightful)

    by Anonymous Coward on Sunday June 23, 2013 @02:28AM (#44083067)

    Face it, who's going to bother writing anything to exploit flaws in lynx? It just isn't worth it.

    • Re:Lynx (Score:5, Insightful)

      by stox ( 131684 ) on Sunday June 23, 2013 @02:31AM (#44083079) Homepage

      Not only that, but it lacks the features to exploit. Which is actually an important point in security, to only have the features you need and nothing else. Less surface area to attack.

      • Why not even go a step further and don't use the web at all?

      • by dbIII ( 701233 )
        True, lynx saved me from goatse completely and I never got to hear that Rick person.
        I had to follow a few dubious links in squid cache at various points when bosses were annoyed about people accessing very unusual content at work and lynx saved me from seeing some things that may have resulted in a loss of a bit of sanity.

        I still use it on every new linux install to download nvidia drivers. It starts the download before firefox would have finished showing the front page animation (which is fair enough si
  • by LoneHighway ( 1625681 ) on Sunday June 23, 2013 @02:28AM (#44083069)

    The EFF has provided an up to date list of privacy-enabling tools in the age of Prism. http://prism-break.org/ [prism-break.org]

  • w3m / lynx (Score:5, Funny)

    by smash ( 1351 ) on Sunday June 23, 2013 @02:33AM (#44083091) Homepage Journal
    sacrifices may be required
  • by smash ( 1351 ) on Sunday June 23, 2013 @02:35AM (#44083099) Homepage Journal
    ... the snooping is done on your ISP's backbone, and the browser you use makes little difference. Government level snooping is a whole different kettle of fish to bad companies stealing info from you via tracking cookies.
    • You'll have to block the tracking cookies too, otherwise the government will just ask the companies for the information.

    • by Anonymous Coward on Sunday June 23, 2013 @03:37AM (#44083305)

      Except that Chrome phones home the first time you start it up to check for upgrades. This has the unfortunate 'effect' of informing Google of the browser ID at this IP address, and as a consequence it informs the NSA of the linkage of browser ID and IP address.

      Post NSA, I try to avoid Google services. They try to grab data for themselves, but in the process grab it for the NSA, and if the choice is NSA+Google or no Google, then I go without Google.

      I opt for Firefox with the 'check for updates' turned to manual checks.

      It's a minor thing, but it helps in as much that the choice of browser can help (not much if you're in the USA, quite a bit if you're not and behind an ISP NAT).

      • by Nutria ( 679911 )

        Post NSA, I try to avoid Google services.

        Since the NSA has been around for 60 years, and Google for 14, what exactly do you mean by "Post NSA"?

        not much if you're in the USA, quite a bit if you're not and behind an ISP NAT

        What if you're in the USA and not behind an ISP NAT?

        BTW, WTH does ISP NATting have to do with this?

      • Except that Chrome phones home the first time you start it up to check for upgrades.

        This hasn't been true for more than three years. [h-online.com] In fact Google is very transparent about all privacy issues within Chrome [google.com].

      • by smash ( 1351 )
        If you think the NSA need your browser to phone home to identify you, you're in for a shock when you figure out how the NSA snooping really works.
    • by bill_mcgonigle ( 4333 ) * on Sunday June 23, 2013 @07:50AM (#44084105) Homepage Journal

      ... the snooping is done on your ISP's backbone, and the browser you use makes little difference.

      If you're just using a stock browser, this is somewhat true. But for privacy you wouldn't do that.

      For instance, installing the HTTPS Everywhere extension will get you secure connections to as many sites as possible. That's a direct counter to pervasive snooping. I use it with Firefox and also NoScript, Ghostery, RefControl, and CookieMonster, and that set does a fairly decent job of having a more privacy-oriented (and faster) browsing experience. It also makes the NSA's eavesdropping more difficult, but that's just a nice side effect of not sharing your every move with the commercial trackers out there (I installed them all well before I'd ever heard of Snowden). The nice thing about solid security approaches is that they proactively defend against unknown attackers.

      • by nullhero ( 2983 )

        ... I use it with Firefox and also NoScript, Ghostery, RefControl, and CookieMonster, and that set does a fairly decent job of having a more privacy-oriented (and faster) browsing experience.

        FYI: Ghostery is created and used by advertisors :

        ...Originally developed by David Cancel, Ghostery was acquired by the privacy technology company Evidon (previously named The Better Advertising Project) in January 2010. Currently, through the use of a reporting function named "GhostRank" that users can opt into, Ghostery provides reports to Evidon about advertisers and data collectors, which Evidon then provides to advertising industry groups including the Better Business Bureau (BBB) and the Direct Marketing Association, parts of the Digital Advertising Alliance (DAA).[3] These agencies then use those reports to monitor how Online Behavioral Advertisers operate and, when needed, refer them to the Federal Trade Commission.

        Source: wikipedia [wikipedia.org] So they are still receiving tracking information.

      • by smash ( 1351 )
        HTTPS relies on the keys in use not being compromised or broken. It also doesn't do anything for detecting what sites you are looking at, it just encrypts the content. Logs can be subpoenaed from the host once they identify which sites you are hitting anyhow.
  • by Viking2054 ( 2919437 ) on Sunday June 23, 2013 @02:51AM (#44083163)

    Considering that the internet transmits your public IP address in every header you send across the internet and also contains the IP address of the destination, there is no way for you to hide what sites you visit without going through a proxy server. As far as I know, Header information in every packet is plain text and there is no way to encrypt that because if it was encrypted then no router would be able to forward your packets onto the next step in its final destination. So your browser, e-mail program, or anything else that sends and receives data through the internet is going to leave a trail for the government to potentially record. It may not lead back to you specifically, but it will lead to someone in your household or in your neighborhood that is using your wi-fi for internet access, provided you haven't locked down your wi-fi. If you have locked down your wi-fi then the government can claim it was only you, someone in your household or someone you have given your wi-fi password to, which significantly lowers their potential suspects or targets.

    If you send everything you do through a proxy server with a vpn connection to the proxy, then that has a very good chance of making you mostly anonymous. However, a warrant and the cooperation of the proxy service owner might make it possible for the government to still connect the dots back to you. Also, sending everything through a proxy server with all the non-routing information encrypted (via vpn) may actually lead to you being watched more closely then if you don't.

    If what you are really after is encryption of the contents of what you see and do on the internet, your best bet is probably still a VPN through a proxy server. Especially since SSL and some of the other methods for encrypting data between two end points on the internet aren't as secure as they were once thought to be. I don't know of anyone that has come up with a replacement for SSL that has been adopted by very many content providers. And even if the web browsers may have adopted some new security encryption scheme, it won't be effective until most if not all content providers also adopt and implement it.

  • by OzPeter ( 195038 ) on Sunday June 23, 2013 @02:57AM (#44083185)

    So you fix your browser .. are you also going to fix your ISP, whoever they buy their feed from etc etc until you get all the way to the actual web server? And how do you know to trust them?

    Or are you going to build your own internet ,. with hookers and blackjack?

  • by fustakrakich ( 1673220 ) on Sunday June 23, 2013 @02:57AM (#44083187) Journal

    They do nothing!

  • by Bob_Who ( 926234 ) on Sunday June 23, 2013 @02:59AM (#44083199) Homepage Journal

    Identity theft assures your privacy, so to speak. However, that would be illegal. Good thing they're looking for authentic criminals.

  • by Johann Lau ( 1040920 ) on Sunday June 23, 2013 @03:03AM (#44083207) Homepage Journal

    .. that can only be solved politically. If you want peace of mind, prepare for decades of serious struggle, and learn to be okay with that.

    If your ISP and the websites you use hand over everything, if things gets collected at packet level wholesale; what does it even matter what browser you use? It doesn't, not one bit.

  • In all honesty I don't know whom to believe anymore when it comes to security one day you are secure and the next day you're not. Either way you be-damned. Your not secure even when you are secure so just pick a browser and enjoy the ride. Your mileage will vary.
  • None of them (Score:5, Insightful)

    by timmyf2371 ( 586051 ) on Sunday June 23, 2013 @03:10AM (#44083241)

    None of the browsers will protect you from surveillance.

    Work on the basis that your ISP is compromised and that the web services you use have shared their databases with Government agencies. When you consider this, changing your browser is going to have little to no impact.

    I think the only way you can really be secure from surveillance is to use the tor browser and only use web services which can't trace you. So, no Google, Apple, social networking or any of the cool stuff we take for granted these days.

    • by cheros ( 223479 )

      The OP is right insofar that a browser is only one part of the chain of events that ties an identity (and associated habits) to you. Even when you use something Firefox or Opera in so-called "private" mode, your traffic still originates from the same point, creating a common item between things that happen (and BTW, you should set your browser to be something else than the default "OS + browser ID").

      The expensive way to address that is to route your traffic via some privacy proxy. The expensive way to do

  • Failure of Premise (Score:5, Interesting)

    by mrbene ( 1380531 ) on Sunday June 23, 2013 @03:26AM (#44083277)

    OP says "what browser should I use" I automatically add "for the Facebooks".

    Here's the low-down:

    1. If you install any software, it can identify your machine uniquely. This goes for apps, doubly.
    2. If you use an ISP without TOR or other proxy, your ISP knows exactly what sites you're going to.
    3. Even if you use obfuscation techniques (TOR, other proxy), the exit node knows where you're going. TOR is designed to prevent the exit node from knowing where you entered from, but this fails if you send unencrypted identifying data across the wire.
    4. Additionally, using TOR obfuscates your country of origin, thereby giving NSA the freedom to retain your activity indefinitely.
    5. If you authenticate anywhere, you've provided that party (and the NSA) with a unique ID for yourself.
    6. If you authenticate and also provide actual information about yourself, a link to your physical self can be made. Remember, there's an 87% chance that your DOB, ZIP, and Gender [blogspot.com] are a unique combination. And if it isn't unique, you probably only share these with one or two other people.

    That's just off the top of my head. The software you use to disclose the information isn't the problem - you are.

  • wget (Score:2, Interesting)

    by Anonymous Coward

    wget -m -k -K -E -l 1000 -t 3 -w 1 http://www.website.com/

    Then after waiting a while (ok, maybe a long while), open the page/articles you *really* wanted to read in a text editor. Sure, the NSA might know which *site* you visited through normal spying means, but they'll never figure out which *page* you were really after.

    Of course, they might think you read all the pages, and spend a few million dollars of taxpayer money trying to determine whether it's possible for someone to read 1 page per second and whe

    • Hmm, I think that you are onto something. One could make an obfuscating browser that sends out page requests to random sites to keep the network link full and defeat NSA traffic analysis. It should also log into sites like Slashdot, Al Jazeera and Facebook and post random comments...
  • by b4upoo ( 166390 ) on Sunday June 23, 2013 @03:34AM (#44083301)

    You can bet that any browser worth its salt has had agents involved in its creation whether or not the people who built the product were aware of it at all. You can also bet that encryption products whether free or commercial often have back doors or keys built in. That is the very essence of intelligence gathering. Do not assume that physical or software products are free of snooping abilities.
                    I suppose your best chance might be a browser that was never popular or used by many people at all.
                    Think back a few years and recall the tunnel that we put under the Berlin Wall in order to tie into a major Soviet phone trunk line. We intercepted phone calls for years from that tunnel. If we could do that about 1968 or 1970 just imagine what could be done today. DARPA was the motive force behind the creation of the net. DARPA more than any other entity would have great reason to spy on communications. This is not a new issue.

  • When data collection occurs on the server side, and the network protocol is mostly happening in cleartext, what good is having a "secure" browser?
  • If you are concerned about the NSA then their is no secure browser as the browser is only as secure as the ISP's and content providers you are accessing and given what the US Government is demanding they share that means no browser is secure.
  • regression (Score:4, Insightful)

    by __aaqvdr516 ( 975138 ) on Sunday June 23, 2013 @09:26AM (#44084435)

    Your "secure browser" can be compromised by the Operating System. The Operating System can be compromised by the hardware.

    The safest way to do your computing is to make all your own chips, assemble it yourself, and write your own OS. Even then you're subject to Man-in-the-Middle attacks, so you're going to have to go lay all your own fiber and do it all over again for those on the other side.

  • Surveillance happens today at the server level: the Feds claim that, under the PATRIOT act, they can get the records of all visits and all 'cloud' data straight from the server - this is the "PRISM" project, but shades of it have been going for the past decade.

    They don't need your client end. They get the server logs, they get the server history of visits, and reverse-lookup you and then collate all visits to as many web services as they can from the particular IP and MAC address, and that's how they put together your history.

    Cookies, SSL, HTTPS, none of that matters. The only thing that would escape it is to route through anonymous proxies.

Never worry about theory as long as the machinery does what it's supposed to do. -- R. A. Heinlein