Chromium/Vanadium vs Gecko/Firefox or alternatives on GrapheneOS

PearOfJudes

In the online privacy/security community, especially on desktop, modified variants of Firefox are generally known as the best browser, and if you need chromium, a de-bloated brave is usually recommended above other variants. Vanadium is a very unique browser, and doesn't get recommended unless by GrapheneOS directly or some Graphene users. GrapheneOS recommends and uses Chromium for webview, and better sandboxing I believe, and Vanadium uses hardened chromium with implementation of GrapheneOS features. I am not used to using the default browser in an operating system, and am especially wary with chromium, as I am unsure why gecko isn't viewed as secure/private on android as it is on desktop. Any help please?

Grapi

PearOfJudes modified variants of Firefox are generally known as the best browser, and if you need chromium, a de-bloated brave is usually recommended above other variants

This is generally wrong.

The only solution is ungoogled chromium.

Here is some more investigations:
[Link Removed]

Xtreix

PearOfJudes Here is some stuff that might help you understand the problem with Firefox and understand browser security and privacy in general. The first article is three years old, but I am not aware of any changes since then:

https://madaidans-insecurities.github.io/firefox-chromium.html
https://github.com/RKNF404/chromium-hardening-guide?tab=readme-ov-file#selecting-a-browser
https://github.com/RKNF404/chromium-hardening-guide?tab=readme-ov-file#firefox

Grapi The only solution is ungoogled chromium.

Wrong:

https://qua3k.github.io/ungoogled/
https://github.com/RKNF404/chromium-hardening-guide?tab=readme-ov-file#ungoogled-chromium

harp

PearOfJudes modified variants of Firefox are generally known as the best browser

Not in terms of security. Even on desktop Chromium-based browsers are much more secure than Firefox-/Gecko-based ones. They have a much better per-site-isolation - and as written before the situation on Android is even worse than on desktop.

PearOfJudes Vanadium is a very unique browser, and doesn't get recommended unless by GrapheneOS directly or some Graphene users.

The reason is that Vanadium is only available for GrapheneOS at the moment. It's planed to publish versions for Android in general, but that may not be an major issue for the devs at the moment.

PearOfJudes GrapheneOS recommends and uses Chromium for webview

GOS doesn't "recommend" anything for webview nor uses Chromium. GOS uses Vanadium for webview. Even if you use other browsers on GOS, you'll still use Vanadium for webview.

Don't know what your concerns with Chromium expecailly are, but Vanadium is completely "ungoogled", it does not more connections or sending data to Google than other browsers and doesn't have any of the Google integration of Chrome or even Chromium.

Vanadium is probably the most secure available browser (but only for GOS at the moment, see above).

wuseman

PearOfJudes modified variants of Firefox are generally known as the best browser,

Best for raw privacy on desktop, maybe. But when it comes to security on mobile? Lol no.

Maybe when virtualization of apps comes to GrapheneOS I'd consider using IronFox or something, but I'd never run it now.

blusterpilgrim

https://grapheneos.org/usage#web-browsing explains the issues with Firefox on Android and why you should use Vanadium. Vanadium is a hardened fork of Chromium that complements GrapheneOS very well and makes zero calls to Google. Firefox on Android unfortunately lacks per-site isolation and is therefore not as secure. I mainly use Vanadium, though admittedly I do use Firefox but only to copy paste websites synced with my desktop Firefox browser.

archbtw

The insecurities site is often quite outdated or biased though.

Anyways, firefox is not good on android I would say. I always use firefox based stuff on desktop (it looks better and has better linux support) but on android chromium browsers are way to go unfortunately.

Vanadium is secure, but I had issues with some sites, including my bank site which has weird 1 minute delays.
Cromite is quite great, it has a lot of settings exposed to the user as well.

PearOfJudes

harp ven on desktop Chromium-based browsers are much more secure than Firefox-/Gecko-based ones

Right. So if chromium, an opensource software is more secure, even on desktop, without a privacy inhibiting company such as google chrome collecting information straight from the browser, what advantages does firefox have on the privacy front?

harp The reason is that Vanadium is only available for GrapheneOS at the moment.

This makes sense why Vanadium is only recommended by Graphene users, but still makes it hard to compare with other browsers.

harp GOS doesn't "recommend" anything for webview nor uses Chromium. GOS uses Vanadium for webview.

Graphene recommends chromium for general browsing in the web browsing section of there usage guide. I meant It both recommends chromium in general, and uses chromium in its subproject.

harp Don't know what your concerns with Chromium expecailly are

I don't have any specific concerns, I am not technical enough to figure out the reasons for or against technologies or web browsers in general, what I can do is follow smarter people's recommended guides to making a private life, but I have no idea the technical reasons chromium or gecko are better for privacy or security. This is why I come to these forums. I come with the knowledge that I and many others use a gecko browser on my desktop, for privacy purposes and frankly I hardly know the differences between chromium and gecko.

harp Vanadium is probably the most secure available browser

I believe I will use vanadium for logging into accounts, due to its security.

Onlyfun

harp it does not more connections or sending data to Google than other browsers

I am able to only see Vanadium connecting to google when it is triggered by visited sites that are somehow related to google or use google functionality e.g. reddit login.
Ice Raven pings google right upon launch. And it requires allowing it DCL. Vanadium makes less connections to google. Though some bank sites seem to be banning Vanadium.

Curious

Isn't Brave the solution? I mean it is not as hardened as Vanadium I guess but it is way more better in terms of privacy and I saw and checked myself about unique profiling, Brave was the best in terms of it blends on the Oher hand Vanadium was the worst (if we not count Chrome).

I know Devs wrote that they wanna add more privacy options for Vanadium, but that is not on top of the list I guess now, so we have to wait.

The thing is I am trying to understand is, in which case you want to use Vanadium and in which Brave?
I guess for normal browsing/shopping etc. Brave and Vanadium maybe for Banking or if you are checking sketchy sites? Idk

PearOfJudes

Curious Right, so brave offers better privacy, and vanadium better security? For now I've decided not to use firefox on android, as it apparently is less secure and private than chromium, and will use brave for general browsing and vanadium for logging into accounts.

Grapi

It looks like a lot of people do not understand the difference between security and privacy.

Curious

I found also this video:
https://www.youtube.com/watch?v=4CS7lq3wr7w

It somehow a comparison of the main known browsers.
Honestly... can someone from people who are knowledgeable about this topic, when you should rank browsers (top 3 lets say) for privacy/security point of view what it would be and what they should be used for?
I mean to my understanding for security on sites that you are trusting (like banking, some sensitive account etc.) and one have access to Vanadium then this is the go to browser but for example on Desktop I still think the Brave is the go to since it is chromium based and mostly do it's job what you expect it from today usage if you wanna go without any plugins etc. (and Vanadium is not desktop browser right now)

But that is my understanding to it I guess, but Idk maybe best way is not to use phone browsing for account logging etc.?

Grapi

Curious

Read this:
[Link Removed]

or jump to the summary table:
[Link Removed]

Curious

Grapi What is this site?
It look suspcicious to me, run some url scans as it showed low trust score etc.

Can you please elaborate what is this site?
Anyone else know this site?

amid-salad-anyway

What about IronFox now available from the Accrescent app store. I'm deep on the Firefox ship and would prefer to use it but don't want to compromise too much security.

Also with Vanadium it doesn't seem to block youtube ads very well even though ad blocking is turned on for that site.

Also there doesn't seem to be a place to install extensions on Vanadium.

If anyone has any input on this it would be appreciated. Many thanks.

n3t_admin

amid-salad-anyway Also with Vanadium it doesn't seem to block youtube ads very well even though ad blocking is turned on for that site.

If you want ad blocking for YouTube, you should either go the Brave route (which is the second best option after Vanadium) or straight up opt for a patched YT app via ReVanced.

Onlyfun

n3t_admin If you want ad blocking for YouTube, you should either go the Brave route (which is the second best option after Vanadium) or straight up opt for a patched YT app via ReVanced.

amid-salad-anyway

Get NewPipe for good youtube eperience.

TheGodfather

amid-salad-anyway I'm deep on the Firefox ship and would prefer to use it but don't want to compromise too much security.

Not possible to use FF-based browsers and don't compromise too much security on Android at the same time. Switch to Brave or Vanadium.

Curious

@n3t_admin You know this web [Link Removed] that was recommended to me to chech on some browser stuff? Not sure if its legit or safe to check.

Xtreix

Curious Here is a good source without nonsense for security and privacy of web browsers : https://github.com/RKNF404/chromium-hardening-guide?tab=readme-ov-file#chromium-hardening-guide

Curious

Xtreix Thank you but, why is that nonsense that was provided? You know that site or what is it about?

Xtreix

Curious I think I browsed this site a long time ago before, the layout and user interface are awful, and reading it gives me a headache, so I didn't read it all, far from it, but I advise you not to take it seriously, just when you read that Ungoogled Chromium and Pale Moon are ou were serious with privacy. Pale Moon is a completely obsolete browser on every level, based on Goanna (a fork of Gecko), which still runs in single-process mode rather than the multi-process mode that should be used. It is developed by Moonchild, and his other browsers, such as Basilisk and K-Meleon, are just as broken and obsolete. Most websites work very poorly on these browsers.

Misconceptions about Ungoogled Chromium = private and secure are explained here: https://qua3k.github.io/ungoogled/