Web Browser
Donate
Web Browsers Comparisons
Introduction
[edit]A browser is a program you use to access and view websites on the internet, like Chrome, Safari, or Firefox. It lets you search for information, watch videos, check email, and more by showing web pages.
Kicksecure Default Browser
[edit]- At time of writing: Firefox is installed by default inside Kicksecure.
- Future: For a future version of Kicksecure, it is planned to no longer install a browser by default inside Kicksecure.
No Default Browser
[edit]Coming soon!
Most operating systems come with a web browser already installed. But Kicksecure, a security-focused system, does not. This might seem unusual, but there’s a good reason behind it.
Kicksecure’s main goal is to protect your security (and privacy). See also Privacy Goals and Non-Goals of Kicksecure.
Web browsers are one of the most dangerous programs on any computer. They connect to the internet, can be targeted by hackers, and might collect information about you. Some browsers, even well-known ones, include tracking features or need extra work to be truly private. Because of this, Kicksecure doesn’t want to assume which browser is best for everyone.
Instead of picking a browser for you, Kicksecure lets you choose the one that fits your needs. Different people have different goals. Some want to avoid advertisements, while others need strong protection against online spying. By not including a browser, Kicksecure avoids making a risky or biased choice.
In short, Kicksecure doesn’t include a browser by default because no browser today is perfect for security (and privacy). It leaves the choice up to you, the user, so you can pick what’s best for your situation.
Recommended reading:
Recommended Browser
[edit]None.
No browser exists at time of writing that can be wholeheartedly recommended for users of Kicksecure according to technical Criteria (security, privacy and user freedom).
Issues with Browsers
[edit]Most mainstream browsers are considered spyware by many people. See also Firefox Selling User Data.
This issue cannot be solved by operating system vendors such as Kicksecure. For reasons why that is, see In-House Browser Development.
Browser Comparison
[edit]Browser Comparison - Introduction
[edit]Here is a list of commonly discussed browser within the security and privacy communities with their main disadvantages.
The browsers are listed in rough order of their market share and popularity.
Chrome
[edit]Advantages:
- Most popular and therefore presumably most compatible browser.
Disadvantages:
- Closed source, non-freedom software.
- concerns about user autonomy related to browser market dominance
- data harvesting / tracking issues
Based on: Chromium.
Why not default in Kicksecure:
- Not Open Source. See Open Source Browsers Only.
User documentation: Chrome
Chromium
[edit]Advantages:
- Might be similarly compatible as Chrome due to its shared code base.
Disadvantages:
- Similar to Chrome, see above, except Chromium is Open Source.
- security issues with the Chromium package in Debian
- data harvesting / tracking issues
Why not default in Kicksecure:
- No official binary builds.
- Refer to disadvantages.
Based on: Not based on any other browser.
User documentation: Chromium
More technical details: Chromium (developers)
Firefox
[edit]Advantages:
- Might be similarly compatible as Chrome due to its past popularity.
Disadvantages:
- Needs hardening: Not as hardened by default (lower attack surface, disabled telemetry) as it could be, creating demand for a hardened Firefox fork or Firefox settings project such as Arkenfox.
- Punicode security issue: Very hard to notice phishing scam - Firefox / Tor Browser URL not showing real domain name - Homograph attack (Punycode)
A homograph attack is a type of phishing attack where characters from different writing systems are used to create deceptive URLs. These URLs appear identical or very similar to legitimate ones. Punycode is a way of encoding these special characters so they can be used in domain names.
Why not default in Kicksecure: Planned!
- The issue of Firefox Selling User Data was perceived very badly by the community. Therefore Firefox will be no longer installed by default inside Kicksecure in a future version as soon as Dev/browser-choice has been implemented.
Based on: Not based on any other browser.
User documentation: Firefox
More technical details: See Original Firefox (developers).
Mullvad Browser
[edit]Advantages:
- Anti-browser fingerprinting: Makes it harder for websites to track you based on your browser’s settings. This helps protect your privacy.
- Security features: Includes a "security level" setting that lets you choose stronger protection. Higher levels may break some websites but offer better security.
- Installation: Debian package repository available. This allows users on Debian-based systems, including Kicksecure, to easily install and update Mullvad Browser using tools like
apt.
Disadvantages:
Why not default in Kicksecure:
- Not vendor neutral
- Includes Mullvad branding, uses Mullvad DNS by default, and promotes its VPN service, tying it to a specific commercial provider.
- Creates potential reputational risks for Kicksecure by suggesting endorsement or sponsorship by a VPN company.
- Could lead to user suspicion of paid promotion, harming the project's perception of independence and trustworthiness.
Based on: Base Browser, which is based on Firefox ESR.
User documentation: Mullvad Browser
More technical details: Mullvad Browser (developers)
Tor Browser
[edit]Advantages:
- Same privacy and security benefits as Mullvad Browser.
Disadvantages:
Why not default in Kicksecure:
- Sends all web traffic through the Tor network. This is good for anonymity (like in Whonix), but Kicksecure needs a regular (clearnet) browser instead.
Based on: Base Browser, which is based on Firefox ESR.
User documentation: Tor Browser
More technical details: Tor Browser (developers)
Brave Browser
[edit]Advantages:
- Built-in ad blocker: Brave includes an advertisement blocker by default, which helps reduce tracking and speeds up web browsing.
Disadvantages:
- Ad-funded business model: Despite blocking ads, Brave is itself an advertising company. It replaces traditional ads with its own ad system.
- Controversies: Brave has faced criticism for certain business decisions and privacy concerns.
Why not default in Kicksecure:
- Because of disadvantages listed above.
Based on: Chromium.
User documentation: Brave Browser
More technical details: Brave Browser (developers)
LibreWolf
[edit]Advantages:
- Firefox Rapid Release instead of ESR.
Disadvantages:
- LibreWolf - Lack of Radio Silence as a Development Goal
- LibreWolf - IJWY (I Just Want You To Shut Up) Feature Removal
Why not default in Kicksecure:
- Due to disadvantages listed above.
Based on: Firefox Rapid Release
User documentation: No dedicated wiki page (yet).
More technical details: See LibreWolf (developers).
Other Browsers
[edit]Other browsers might be listed on Kicksecure Default Browser - Development Considerations.
What Users Can Do
[edit]The situation is clearly unsatisfactory. Here is what users can do:
- Stay in the loop. Subscribe to relevant discussions.
- Conduct deep research.
- Stay vigilant.
- Demand transparency.
- Demand radio silence.
- Support Geminispace, SmolNet.
- Wait for privacy-respecting browsers to become available.
Activist Statement
[edit]Market Stance: Using any browser other than Firefox or Chrome(ium) is seen by some as a stand against the dominance of Firefox and Chrome.
Extended Support Release - ESR
[edit]Browsers based on Firefox ESR might be less secure than browsers based on Firefox Rapid Release, see Firefox Security - ESR (Extended Support Release) versus Rapid Release.
Open Source Browsers Only
[edit]Browsers that are non-freedom software (closed source) (not Open Source) are only briefly mentioned and discouraged. See also Reasons for Freedom Software / Open Source.
Browser Built-In Password Manager
[edit]The vault domain is an ultimately trusted one where I generate and keep all my passwords (using keepass) and master GPG keys. Of course, this vault domain has no networking access. Most of those passwords, such as the email server access password is also kept in the specific domains which uses them, such as the work domain, and more specifically in the Thunderbird client (there is absolutely no point in not allowing e.g. Thunderbird to remember the password – if it got compromised it would just steal it the next time I manually enter it)Joanna Rutkowska, security researcher and founder of Qubes OS blog post Partitioning my digital life into security domains
- Low value account passwords:
- Such as news websites' login walls, forums, Reddit to ask for support, recommendations, accounts unlikely to get hacked, with no personal relationships, and no financial impact.
- The browser built-in password manager can be used without hesitation for convenience.
- High value passwords
- Such as bank accounts.
- The browser built-in password manager might have some caveats, such as:
- synchronization: The user might want to disable synchronization when using high value passwords to avoid uploading the passwords to the browser vendor's cloud, even if encrypted, in case of security issues with their implementation.
- local encryption: The browser's local encryption of the password database might not be as strong as Full Disk Encryption (FDE). Therefore, FDE might be preferable.
Standalone Password Manager versus Browser Built-In Password Manager
[edit]| Feature | Browser Internal Password Manager | Standalone Password Manager | Standalone Password Manager in Separate Vault VM |
|---|---|---|---|
| No potentially insecure synchronization cloud upload feature | No | Yes | Yes |
| Not compromised in case of browser compromise by malware, encrypted browser password database file stolen, and brute force against password database | No | Yes | No |
| No password compromised in case of browser compromise by malware with keylogger | No | No | No |
| Password safe against keylogger / clipboard stealer only once saved | Yes | No? [2] | No? [3] |
| Not all passwords leak at time of browser compromise | No | Yes | Yes |
| No frequent copy/paste of passwords (without using standalone password manager browser connector plugin) and risk of pasting password into browser default search engine or browser form input fields (where JavaScript can steal it once pasted) | Yes | No | No |
| No frequent copy/paste of passwords and risk of accidental password paste when using standalone password manager browser connector plugin | Yes | Yes | Yes |
| No master password protection enforcement | Some [4] | Yes | Yes |
| Two-factor authentication (2FA) support | No | Yes | Yes |
| Easy multi-device access | Yes | Yes [5] | ? |
| User control over password storage location | No | Yes | Yes |
| Minimal network attack surface | No | Depends [6] | Yes |
| Easy to use for non-technical users | Yes | Depends | No |
| Can store TOTP, notes, license keys, etc. | No | Yes | Yes |
| Supports hardware security keys (e.g., YubiKey) | No | Yes [7] | Yes [8] |
| Easy and secure backup & recovery | Depends | Yes | Yes |
| Fully offline access | Yes | Yes | Yes |
| Usable in air-gapped environments | No | No | Yes |
Advanced Topics
[edit]The following topics are for Advanced Users only.
Browser DDOS Vulnerabilities
[edit]Can browser be frozen by heavy JavaScript as an attack? Other vulnerabilities? What happens if JavaScript is constantly fetched or if the browser's DOM is 1 GB++ large?
Advanced users only!
- Vulnerabilities
- Infinite Loops / Infinite Recursion :
while(true) {}can cause the browser to freeze andfunction recursive() { recursive(); }can crash the browser due to stack overflow. There are safeguards in place in modern browsers but it's still a risk especially if combined with other attacks - Memory consumption : By creating an extremely large DOM or an extremely large array the memory can be consumed leading to slowdown of the OS or crash of the browser
- Fetching humongous data : Constantly / infinitely fetching giant data files can slow down the browser or freeze it
- Forced reflows and layouts : By constantly changing huge parts of the layout of the page in short intervals the browser can be slowed down
- iframe overload : Creating a huge amount of iframes - even without source - and adding them to the page can slow down the browser
- iframe inception : an iframe references the same page it is on, which in turn creates another iframe that references the same page, and so on. This can lead to an infinite loop, causing the browser to consume significant resources and potentially become unresponsive or crash.
- Infinite Loops / Infinite Recursion :
- These are the most common and even some less likely DDOS vulnerabilites for the browser. Most modern browsers are safeguarded against this as much as possible. But as there is often no way to differentiate if a huge memory consumption is benevolent or malevolent the browser has to accept most of these commands
- In the past Javascript was more powerful in the browsers giving it some OS access. But due to virusses and malware all browsers now use a sandbox to severely limit Javascript capabilities
Footnotes
[edit]- ↑
https://forums.whonix.org/t/would-stable-tor-browser-deb-package-help-or-burden-whonix-devs/19995
- ↑ Since the password gets re-pasted every time.
- ↑ Since the password gets re-pasted every time.
- ↑ Some browsers do not enforce a master password by default.
- ↑ If cloud sync is enabled.
- ↑ Depends on whether cloud sync/browser plugins are used.
- ↑ Depends on the specific manager.
- ↑ Depends on the specific manager.
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2025 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!