I heard around the internet that Firefox on Android does not have Site Isolation built-in yet. After a little bit of research, I learned that Site Isolation on Android was added in Firefox Nightly, appearing to have been added sometime in June 2023. What I can’t find, though, is whether this has ever been added to any stable versions of Firefox yet. Does anyone know anything about this?
Update: After further research, it appears that Site Isolation is not currently a feature in stable version of Firefox on Android. I don’t know with certainty if their information is up-to-date, but GrapheneOS (A well-known privacy/security-focused fork of Android) does not recommend using Firefox-based browsers on Android due to it’s (apparently) lack of a Site Isolation feature. A snippet of what Graphene currently have to say about Firefox on Android/GrapheneOS from their usage guide page, is: “Avoid Gecko-based browsers like Firefox as they’re currently much more vulnerable to exploitation and inherently add a huge amount of attack surface.”
On a side-note, they also say about Firefox’s current Site Isolation on desktop being weaker, which I wasn’t aware of. “Even in the desktop version, Firefox’s sandbox is still substantially weaker (especially on Linux) and lacks full support for isolating sites from each other rather than only containing content as a whole.”
It’s still being worked on. https://bugzilla.mozilla.org/show_bug.cgi?id=1565196
Lol
- Bug with high priority
- A person clones it, assigns themselves
- doesnt have time, unassigns themselves
- Priority gets set lower
- A guy wants to work on it
- That guy doesnt work at Mozilla anymore
- The bug went from priority P5 to P1 and doesnt block anything anymore
This is really bad. Especially as it seems like not that big of a change.
- doesnt have time, unassigns themselves
Because someone else took over, as the person even says in a comment.
- Priority gets set lower
Priority got set back to the priority it was at 4 minutes before. The priority being changed was clearly a mistake.
- A guy wants to work on it
- That guy doesnt work at Mozilla anymore
OK?
- The bug went from priority P5 to P1 and doesnt block anything anymore
It got retriaged. There are processes for this and it’s totally normal.
This is really bad. Especially as it seems like not that big of a change.
No it really isn’t bad at all. And it’s a massive change, the linked bug is a meta bug which means it is simply used to track the actual work. See all the bugs in the depends on section? That’s where the real work happens and there has been a ton of progress made.
Also believe it or not, lots of discussion happens outside of bugs. You really have no idea what is going on just by looking at bug activity.
Man, 5 years. I know nothing about building a browser, but that seems… Long.
The answers linked above mention this one
That’s the bug that laid the groundwork
Was also asked about and answered in the recent AMA on reddit:
deleted by creator
What is the actual risk here?
I’m no professional, but from my research I’ve been doing, it appears that the risk (at least one of them) is that a hacker could in theory create a website that exploits this vulnerability. If you access their website, their site could be capable of stealing sensitive information from the other Firefox tabs that you may have loaded on the side, at any given time.
Seems like pretty big risk… Wtf how is this still a thing?
Kinda makes hard to keep telling people to switch
What they said isn’t exactly true. The actual concerns are far more narrow than the way they worded it
it would be nice if you would narrow it down for everybody while we are here?
Well I’m not an expert and I don’t feel like digging up all the specifics but the concerns generally are cookies. The person who replied here made it sound like Mozilla is letting websites steal your credit card number from open tabs or something
I too have a hard time telling whether the isolation features is a huge security risk or a minor one because things get too technical too quickly for me to follow.
Case in point, this website makes it sound relatively trivial just due 8 how technical it is (Ctrl+F for Firefox)
Yeah, the graphene people hate Firefox, but I don’t really put too much stock in their opinion because there are places where they mention it in an alarmist way imo
alright i see, that does make more sense but they can still ID with you a cookie on all your concurrent sessions?
i guess this aint a security risk per see but wtf… why they even need cross site cookies if they can do this.
Cross site cookies specifically are the concern here. Other cookies cannot be read arbitrarily
Because it is hard to implement
If a site can exploit the browser engine they can access other pages. Normally the sandbox would make a exploit stay local
Ty
Shit thats not good if its true
GrapheneOS as a project has no credibility as far as privacy and security goes. Daniel Micay and his minions call Firefox insecure because Micay has a personal grudge against Tor devs that did not exist before August 2019 for some reason. https://lists.torproject.org/pipermail/tor-dev/2019-August/013995.html
Micay wants to steer everyone away from Firefox towards Chrome, towards everything Google, believing in Micay’s vision, believing in closed source security and so on. He also used to shit on Android and believed and propagated the claim that Fuchsia is the future, where Google’s microkernel would rule the mobile world. I think he is a Google fanboy more than anything else, and we have many such Big Tech fanboy specimens in this world.
Micay and GrapheneOS, and fans/members associated like OP are well known for promoting Chromium monopoly in the cloak of catcalling Firefox insecure all over the internet discussion boards and forums. Ignore them if you must have an open free web that provides privacy.
While it may be true that site isolation is experimental to enable on Firefox Android, it has far better protection against fingerprinting, trackers, ads, crypto, malware, allows using uBO to its full capabilities, has process isolation and DOM storage isolation. Chrome lacks various kinds of protections, nerfs adblockers, disallows script blocking, and leaks metadata through WebRTC intentionally ever since it was made. There are multitude of reasons why Tor Project uses Firefox/Gecko over Chrome/Blink.
Tor Project has infinitely more credibility than a lazy, snake oil Android fork GrapheneOS.
The moment anyone starts calling Firefox insecure, immediately become alert. This is usually a GrapheneOS or Big Tech “security” shill that is comfortable with harming FOSS/privacy cause.
Both things can be true. Firefox is less secure in the site isolation area, but that’s just a backup to the things Firefox is already doing. Firefox is still plenty secure, though it would be quite nice to have this feature.
I use Mull because it takes the best parts of Tor Browser and ships it through F-Droid. For those unaware, it’s basically Firefox with additional privacy settings enabled by default, and it syncs just fine with Firefox browsers.
Yes, don’t buy into FUD about Firefox being insecure, but also don’t misrepresent the value this feature brings. It’s not a must-have for me, but I do very much want it.
misrepresent the value this feature
So, is it okay for Daniel Micay and security clowns like him to maliciously misrepresent the value of Firefox, because of his personal agenda?
Does this mean Tor Project uses “insecure” Firefox over “secure” Chrome base? Is Tor Project insecure?
You fell for the “Firefox insecure” propaganda in some capacity.
If site isolation isn’t a critical security feature, why would Mozilla implement it and say that it is?
Without Site Isolation, Firefox might load a malicious site in the same process as a site that is handling sensitive information. In the worst case scenario, a malicious site might execute a Spectre-like attack to gain access to memory of the other site.
…
Despite existing security mitigations, the only way to provide memory protections necessary to defend against Spectre-like attacks is to rely on the security guarantees that come with isolating content from different sites using the operating system’s process separation.
So Firefox for Android not having this feature makes it less secure than browsers that do, at least for this class of attack.
Tor Browser being built on Firefox shouldn’t imply that Firefox is more secure than anything else, it means Firefox is closest to its requirements, which are a lot more than security features. The two biggest reasons, from what I can glean, are:
- LTS release - means users are far more likely to report the same fingerprint and whatnot, and releases only need to be closely scrutinized on major releases; this is an anonymity feature, not a security feature
- only needs a handful of patches to meet goals instead of a big reengineering - it says more about Firefox’s config options than security features
Don’t get me wrong, Firefox absolutely is a secure browser (incl. Android), but it is missing certain security features vs Chromium-based browsers. Tor is more interested in privacy and anonymity than security (though security is still a priority), so pointing at them isn’t really a valid argument (it’s an appeal to authority at best).
Google is really interested in security, and not interested in privacy or anonymity, because being secure gets orgs interested, and orgs have valuable data and users. If your primary concern is security, you’ll probably be better off with Chromium browsers, and that seems to be where Micay is coming from. But if privacy and/or anonymity is your goal, Firefox is easier to configure to meet those goals, and it’s pretty secure too.
That’s why I use Firefox despite being fully aware of Firefox’s security limitations. I’m told per site isolation is in progress on Android, so that’s pretty cool.
If site isolation isn’t a critical security feature, why would [Mozilla implement it and say that it is
to rely on the security guarantees that come with isolating content from different sites
Do you know the better method to defend against such attacks? Blocking 3rd party scripts and frames, and even 1st party on different levels. Firefox provides this function since you can actually use uBlock Origin, whereas you cannot use a script blocker on Chrome browsers at all on phone, and even on desktop I have not seen those addons in years. You can selectively put uBO on easy, medium, hard or nightmare modes. Medium mode takes care of these things.
Another method to complement it is systemwide HOSTS ruleset (like Hagezi) or uBO filter rules for malware domain protection.
From https://divestos.org/pages/browsers:
The lack of per-site process isolation means a successful exploit is likely able to gain more access (to other site data/browser settings/passwords) without needing a second exploit. It would still need an Android system/kernel exploit to further escape the system sandbox. It is an important hardening feature, but the browser isn’t completely insecure without it assuming it is up-to-date and that you aren’t on the receiving end of targeted/zero-day attacks. Furthermore (in Chromium) with isolated renderer processes there is still some inherent attack surface of the main process that can allow a single exploit, just like in Firefox.
People who fall for “Firefox insecure” propaganda are usually half educated on these topics and do not understand the broader level of system fortifications. They are just focused on maximising one particular tool or feature, ignoring how everything ultimately works in coherence.
Google is really interested in security, and not interested in privacy or anonymity
You made this point? Impressive, because not many do. However GrapheneOS/madaidan and “security” fanboys always claim that there is no privacy without security, and intentionally spread this fallacy everywhere. The only method to counter their malicious narrative is nullifying their advice and proposed/developed tools. And this is partly where my opposition towards them stems from — inventing fallacies and dogmas and spreading them everywhere.
Fission has existed since many versions as experimental on Android, and I have tried it, but it causes bugs and crashes after using browser for a while.
Firefox has process isolation, dFPI borrowed from Tor Project, JIT disabled, excellent content/tracker blocking, other features like editable user.js and ability to use uBO, and also does not intentionally leak metadata through WebRTC. FPI is not a thing on GrapheneOS’ Vanadium browser for example. Cromite is decent for a Chrome based browser, but none of them allow extensions. The only Chrome based browsers that allow extensions are Yandex and Kiwi browser, and Kiwi is open source, whereas Yandex has a ton of tracking.
It is not a problem talking to most people about these things, but it fucking boils my blood when I encounter all this nonsense through people that originally stems from them, and it just does not stop. I have been trying to nip that bud for a very long time for this reason. They are de-educating people about digital privacy, security and anonymity for personal benefit.
Blocking 3rd party scripts and frames
Yes, there are multiple ways to address a given problem, with different tradeoffs. I don’t know the specifics of per-site isolation, but I’m guessing it also protects against non-JS attacks like CSS or HTML-processing attacks, which could trigger those same Spectre/Meltdown-style attacks. That’s a pretty niche case, but hopefully it shows that even a good plan has potential holes.
Ideally, we could eat our cake and have it too, and hopefully Mozilla is working on that. In the meantime, you need to decide if you want something more configurable (Tor, you, and I seem to prefer this) and accept tradeoffs, or solve for the general case of scripting enabled (e.g. Chromium’s isolation). Micay isn’t wrong for his preference, and you and I aren’t wrong for ours.
there is no privacy without security
That’s close to the truth, but it’s a system of degrees. You need enough security to make protecting privacy feasible. But they are separate goals, especially if adding Anonymity into the mix. For example:
- secure, but not private or anonymous - Google services; you can’t get much better security than gmail, but it’s horrendous for privacy because Google’s reading your stuff; or a more tangible example, it’s like living in a bulletproof glass house
- private, but not secure or anonymous - closing the blinds at your house, and not locking doors; nobody can see what you’re doing, but home ownership is public record and anyone can walk in
- anonymous, but not secure or private - counter-protesting - they don’t know who you are, but everyone can see and hear you, and they can come beat you up
But there’s a lot of overlap too. Really good privacy often requires pretty good security, especially depending on your threat model. Effective anonymity also requires good security and often provides good privacy. So it’s not necessarily wrong to say they’re extremely closely related, so I could see it being shortened to “no privacy without security” as a general rule of thumb.
The only method to counter their malicious narrative is nullifying their advice and proposed/developed tools
I disagree on all accounts:
- I don’t think their narrative is malicious, I think it’s overly simplified, which is what you want in a sales pitch
- nullifying their advice isn’t worthwhile, there’s more than one way to solve a problem, and different problems can look similar
Instead of attacking them, I think it’s better to provide accurate information that they’re omitting. If you aggressively attack something, it puts people who like/support that thing on the defensive (relevant Louis Rossmann video, who you should like because he ripped into Daniel Micay as well). Instead, highlight the benefits of your proposed solution, and limit your criticism of other solutions to only those that negatively impact your target audience.
At least that’s my takeaway from various sources (laws of power, how to win friends and influence people, etc).
Fission has existed since many versions as experimental on Android, and I have tried it, but it causes bugs and crashes after using browser for a while.
Yup, it’s not ready yet on Firefox, hence why I don’t use that experimental feature.
dFPI
Well yeah, Google is an ad company, so they’re going to be slow in adopting things that make advertising less effective/gives them less data. I’m guessing they’ll implement it once they can effectively use first party cookies to serve ads (would require websites to help).
FPI isn’t really a security feature (login cookies and whatnot are first party and thus not sent to third parties), it’s a privacy feature. Google doesn’t particularly care about privacy, only security.
Their narrative is malicious, I disagree. If it serves to destroy privacy and anonymity at the expense of them getting to control privacy community, and to help Google monopolise the open free web, it is malicious. Most of what he does stems from personal hatred beliefs, and his minions cheering him up.
Instead of attacking them, I think it’s better to provide accurate information that they’re omitting. If you aggressively attack something, it puts people who like/support that thing on the defensive
That approach (my guides and constant engagement with people is an endeavour towards that) does not work too well when you realise how much damage disinformation causes and how fast it spreads compared to facts. Trump is treated as a disease in USA due to this very reason, him claiming “China virus” needs to be cured using eating bleach, fentanyl, other people claiming to eat tidepods and all kinds of mentally deranged nonsense.
The problem is, I am alone, and regardless of how legitimate my reasoning is, it just is not as “spicy” as what GrapheneOS trolls do. It is easier to tell people to consume junk food and buy stones for solving their life problems, rather than making them eat healthy, do exercise, yoga and meditation.
After years of endlessly engaging with people trying to make them understand, there are not enough people listening to me. It may be best to let the privacy community be destroyed and run over by these Big Tech security clowns, so that any leftover privacy and anonymity endeavours suffer, because my tireless effort has been in vain. I do not care about convincing 2 people, I care about convincing everyone bar those few stubborn ones.
I know very well that GrapheneOS mods/team and Daniel Micay keep a track on everything I write, and they will even read this. But I do not give a fuck. Maybe I should stop giving a fuck about privacy community, because that is what has been done to me. I may be the removed and the biggest loser in all of this.
If it serves to destroy privacy and anonymity at the expense of them getting to control privacy community
Again, this seems blatantly false. Nothing GrapheneOS does destroys privacy or anonymity, they just prioritize security.
And they don’t control “the privacy community,” they just control a few popular, privacy-oriented corners of the web. By its vary nature, you can’t control “the privacy community” because the privacy community is all about bucking control. In fact, “privacy community” is kind of an oxy-moron, privacy enthusiasts try to limit talking about themselves. If you pair privacy and anonymity, you’ll get discussions about solutions, but people probably won’t try to sell you on any one solution.
GrapheneOS is a security-focused OS with strong privacy and anonymity features you can choose to use. Here’s their tagline from their webpage:
The private and secure mobile operating system with Android app compatibility.
That’s what they deliver, privacy and security, and they do both reasonably well. If you look at their FAQ, private or privacy appears about 60 times, secure or security appears over 100, and anonymous appears once. If you read their documentation, it’s clear that their focus is security first, privacy second, and that’s about it.
They’re not the only game in town, but they do have the most effective marketing. If that gets people interested in security and privacy that otherwise wouldn’t, that’s a good thing! Like any org, I think they have flaws, but I think they’re generally a force for good.
Trump is treated as a disease in USA due to this very reason, him claiming “China virus” needs to be cured using eating bleach, fentanyl, other people claiming to eat tidepods and all kinds of mentally deranged nonsense.
Again, more inaccuracies. The FBI thinks COVID-19 likely came from a lab, so “China virus,” while inflammatory, isn’t necessarily too far from the truth. I doubt it was intentional, but that explanation seems more likely than the official explanation of “wet market.” The US was also likely complicit here since the CDC was likely helping fund “gain of function” research (compare recent Congressional investigations vs the original statements).
Trump is problematic because he’s a narcissist that will say anything to get attention, regardless of the truth. But sometimes he says true things, if they benefit him (or he gets lucky; I doubt he researches much).
After years of endlessly engaging with people trying to make them understand, there are not enough people listening to me.
Why are you making this about you? We were talking about the technical merits of various policies, but you seem to keep bringing up Daniel Micay and yourself. I don’t see how either is relevant.
I honestly don’t care too much about you (no offense intended) or Daniel Micay, I care about technical merits of apps and hardware. I’m reasonably technical, so I think I can do a decent job judging for myself which products fit what I want, and I recommend them accordingly. I’ll often point out if a project has toxic leadership, but a good product is a good product.
So if you want to engage with me, it’ll be on a technical level with no personal attacks.
Mozilla has a history of harming me. I’ve documented this as one more case of attacks from Mozilla to go along with everything else. I see no reason to put up with it or tolerate it. Mozilla should expect that one day they’re going to be held accountable. If people at Mozilla aren’t aware of the unethical behavior it regularly engages in including an exploitative approach to contributors, they should inform themselves.
- Daniel Micay (im the linked mailing list thread)
it doesn’t seem like Micay had feuds previous to 2019 with Mozilla , though I was unable to find what he is referring to unfortunately .
Might be interesting to go through the section “So why is Micay’s behaviour so weird?” here :
Spoiler: I wrote it as part of my 5 year investigation into security zealots in FOSS/privacy communities. I have talked to Micay on occasions and studied his behaviour among others to get an idea of how people behave on internet.
I’m not taking sides because I don’t currently have time or energy to look into the issues GrapheneOS and/or Micay may or may not have, but I will say that I don’t know how you could think (at least based on the information I referenced from Graphene in my post) that they are saying or implying to people that Firefox is less secure. They did say it was inherently less secure on Android, but not in general. They did say that the Site Isolation feature specifically is less secure even on Desktop, but they didn’t say that Firefox as a whole is inherently less secure, just that it currently is on Android. I can see how an average reader may interpret that as Firefox being less secure than Chromium as a whole, but that would simply be their own misinterpretation of what’s being said.
and “The moment anyone starts calling Firefox insecure, immediately become alert”. Why? Anything is capable of being insecure and Firefox equally so. At any given time, Firefox could have security vulnerabilities (as it does), so it’s quite ridiculous to automatically assume that anyone calling Firefox out for being insecure in some way is just Daniel Micay or his “minions”
“Micay and GrapheneOS, and fans/members associated like OP are well known for…”. Are you accusing me of being associated with Micay and GrapheneOS, or am I misunderstanding you?
Are you accusing me of being associated with Micay and GrapheneOS
Accused you of promoting Chrome monopoly in browser space in this context.
https://discuss.grapheneos.org/d/11831-equivalent-of-vanadium-but-for-desktop
They deleted this thread, but if you scour enough, you will find them shilling Brave and some random Chrome based browser, BUT NEVER FIREFOX.
They did say it was inherently less secure on Android
They say it because they follow or worship Micay, and Micay has personal grudge against Mozilla. He is an evil person wanting people to use Chrome just to satisfy his egoistic hunger of destroying Mozilla.
“The moment anyone starts calling Firefox insecure, immediately become alert”. Why? Anything is capable of being insecure and Firefox equally so.
Because that has been the pattern in privacy community for the past 5 years I have investigated, atleast 95% of the time. Rarely have I ever seen legitimate criticism, that does not backtrack to Daniel Micay or madaidan or some Big Tech security shill.
I’m not going to argue with you, because I can see it won’t accomplish anything good, so I’ll just leave it at this:
No, I did not promote the Chromium monopoly, I simply asked a question, about a security issue with Firefox; this is not the same as promotion. If I wanted to promote the monopoly, this post would have been telling people why they shouldn’t use Firefox and I would have posted it on a more broad community about Web Browsers and done so on Reddit for the most impact. I’m against this monopoly, and I intentionally go out of my way to not recommend Chromium-based browsers to people. Discussion about issues with something you love is only healthy, not a promotion of another side.
would have posted it on a more broad community about Web Browsers and done so on Reddit for the most impact
You are already doing it here, considering Lemmy and Fediverse demographic cares about privacy and uses Firefox for reasons you are contradicting.
GrapheneOS itself is snake oil, and you are parroting their nonsense takes on browser security. You can read more here. https://lemmy.ml/post/16947066/11696895
Considering Vanadium itself lacks any fingerprinting protection, it is funny they pretend to care about privacy and anonymity, and make dogmatic claims of privacy and anonymity being extensions of security, even though their version of security has nothing to do with providing privacy or anonymity to users. You cannot even use an adblocker on Vanadium, let alone uBlock Origin. Worthless browser and worthless takes on browsers.
deleted by creator
Reason for deletion: Decided it wasn’t worth arguing like my last comment said. The readers are smart enough to see what’s stupid about your comment without me having to defend myself.
Update: Oh, you deleted all your comments, good job.
Searching for
fission(their site isolation is called like that) inabout:configon Mull (FF Android 127) didnt give any obvious resultsdeleted by creator
Well I personally wouldn’t trust anything Graphene says
