Prologue
TL;DR
Install Librewolf or Ungoogled-Chromium if you need a big browser and you just wanna watch YouTube and Netflix.
Install webbrowser or palememe (note: only install PaleMoon if you use Windows or macOS, and be sure to mitigate it before use) if you want something in the middle.
Links, Netsurf and Kristall for minimalists.
Write your websites in XHTML without JavaScript and use static generation instead of CMSs. And/or use Gemini and Gopher (there's also Spartan).
Long Version
The WWW is fraught with all sorts of spooky stuff. Betwixt JavaScript and all its perils, DRM (Digital Right Management, managing your rights to make sure you don't have to many™!), and HTML5 it makes for a mix of complicated stuff. Here's a good XMPP discussion regarding the subject. Let's try and break it down.
First off, what should you look for in a browser?
You should seek minimalism to where the browser you use has a few features beyond what you use. If you use Facebook and YouTube.com then you probably need something really big, that's managed by a corporation so it can keep up with the constant moving standard[1]. Or maybe you try to stay away from that stuff, you use pipe-viewer for youtube, you don't even have a facebook, and you try to avoid javascript requiring websites wherever possible. If that's the case, it's more a question of how much of that you need. Do you need full CSS support? Do you even need JavaScript at all? You can definetly go with a smaller browser, the only question is how small. The other thing you should look for is if it has nanonymity-enforcing or helping abilities. This can come in the form of extension support (most of the major browsers have these, but they don't always matter if the browser is just phoning home anyway) for extensions such as uMatrix. Or in a more minimal way, an (ad)blocklist, totally disabling JavaScript, and GreaseMonkey scripts. Most major browsers plus the UXP based ones would fall into both categories, whereas smaller operations such as Falkon or NetSurf might be more in the latter camp.
But what's so bad about JavaScript anyway? Well it can spy on you[2] for one, and the only way to know is to read the scripts yourselves (impractical) or watch the packet flow everytime you visit an untrusted site (also impractical). It makes webpages harder to access, it implements features that smaller browsers can't hope to keep up with, and it contributes to the unnecessary obsoleting of older computers. You shouldn't need the latest computer with 16gbs of RAM to read, talk, check email (you should be doing that with a client anyway), read the news, check the weather, or talk to your friends (for VOIP Mumble and SIP such as Linphone is recommended).
Okay so JavaScript is bad, what do you do about it? Disable it by default, and only enable it when you really need to. Try to use websites that do not require it, or find other ways of using a service if possible. Such as using ATMs or phone/SIP rather than online banking. Maybe go to a store instead of buying online. Use a weather radio, and curl https://wttr.in/[zip code here]
, instead of weather.com or WunderMap. There's also other protocols out there such as Gemini and Gopher that allow a more minimal approach to content distribution, as well as plenty of server-side web applications that aren't total cancer (MediaGoblin, GNUSocial, Mastodon, cgit, stagit-xhtml, asmbb, and picochan, just to name a few).
The simple fact is the entire web has become bloated and centralized way past what it was initially intended to be. Soydev web developers, instead of writing static pages, have increasingly chosen to write dynamic JavaScript-laden ones (often using bloated frameworks as well) that put the processing burden on the client (aka your browser & computer). To make matters worse, these aren't standards set by some non-biased and experienced consumer group, it's set by a group of corporations[3] comprising the WHATWG (Web Hypertext Application Technology Working Group). Of course, they, with their corporate money, can implement this nonsensical stuff, but an independent developer or two have no hope.
One particularly large source of the aforementioned bloat is Cloudflare (aka Crimeflare), the MITM (Man In The Middle) that "protects" (controls) 19.1%[4] of all websites. Cloudflare (and other DDOS "protection" systems) often block users using Tor or with lesser used or no UA (user agent). This makes Cloudflare et al a single point of failure both in terms of availability and privacy. It is strongly suggested you contact your provider for DDOS protection or simply setup a capable firewall with timeouts.
It should also be noted that out of the big 5 web browsers (Google Chrome, Opera, Mozilla Firefox, Apple Safari, and Microsoft Edge) 4 of them are either based on Google's Chromium engine (Edge[5], Opera, and of course Chrome) or are funded by Google (Mozilla)[6][7]. This leaves Safari as the odd one out, but that doesn't make it any better considering the walled garden, information silo, PRISM member[8] and spyware lover that CrApple is. Even if Safari was good (it isn't), it only supports macOS[9].
The concept of browser fingerprinting, which is often used as an excuse to use a corporate browser in stock configuration, is largely a lost cause and therefore can not practically be taken into consideration when choosing a browser. The argument for fingerprinting is that by using an obscure or lesser-used browser with unusual capabilities (ie has uMatrix, uBlock installed, or is using Netsurf), your fingerprint becomes unique and therefore easy to track. This becomes less of a good thing to base your decision off of when you consider what it would take to make yourself un-fingerprintable (an unachievable misnomer), and how that would make your overall privacy, security and anonymity worse than if you had just used a far more basic browser, devoid of vulnerable features.
The perils of JavaScript, telemetry, corporate (also government) collusion, using your bare IP address, and unsafe networks are far bigger issues. To get rid of these things requires a comparatively unique setup. No, you cannot achieve privacy, security and anonymity by using stock Chrome or just "switching to Firefox", the amount of data harvested from doing so alone is more than enough of a fingerprint. Even the lauded Tor Browser offers 3 "security" settings, which allows the user to decrease the amount of elements (bloat) or poorly implemented website features the browser can load.[10] The "safest" setting disables JavaScript and several other things, due to it being the source of vulnerabilities. Despite that it may worsen fingerprinting, the decrease in attack surface is that important.
It is possible to change the UserAgent in most if not all browsers, which reports the browser engine type, operating system and versions among other things, which can reduce (or worsen) fingerprinting (and can in some cases, depending on which UA is used, bypass Cloudflare's captchas and the like) if changed to a more common one, at the expense of contributing to perceived browser and OS market homogeneity. Some browsers, such as Werefox, do not set a UA for most websites as they believe UAs are for debugging and have been misused for fingerprinting. Fingerprinting is mainly an issue due to the majority of users only using what are essentially 3 browsers.
Okay, so all that sounds terrible. What do we do about it? From the user's perspective: Use a browser not based on Chromium or (Google funded) Firefox. Use (good) alternative websites and protocols (more on that in other articles).
If you ever make a website, do it properly (I suggest you read the Open Letter to Webmasters)! Make it in XHTML, which is like HTML but stricter, has more broad compliance, wasn't made up by corporations, and is overall just better. Also don't use any JavaScript at all (you don't need it). If you need a CMS ("Content Management System") just use a static site generator if the site is too much to handle with manual XHTML. There's tools for this like cat-v's Werc, ikiwiki, zs, HSC, NAMAC which powers this very wiki, or any of the many others of static site generators/markdowns that exist. You can also use CGI ("Common Gateway Interface") if you absolutely need dynamic content, libraries for CGI exist in a plethora of programming languages. Don't use WordPress, and you probably don't need Drupal, Plone or any of these others. If all this sounds too complicated, consider hiring a competent web developer, and telling them what you want.
- 1. Commits on whatwg/html - GitHub, ? https://github.com/whatwg/html/commits
- 2. The JavaScript Trap by Richard Stallman - gnu.org, ? https://www.gnu.org/philosophy/javascript-trap.html
- 3. WHATWG - FAQ - What is the WHATWG?, ? https://whatwg.org/faq#what-is-the-whatwg
- 4. Usage Statistics and Market Share of Cloudflare - w3techs, current https://w3techs.com/technologies/details/cn-cloudflare
- 5. Download the new Microsoft Edge based on Chromium, ? https://support.microsoft.com/en-us/microsoft-edge/download-the-new-microsoft-edge-based-on-chromium-0f4a3dd7-55df-60f5-739f-00010dba52cf http://web.archive.org/web/20210115223628/https://support.microsoft.com/en-us/microsoft-edge/download-the-new-microsoft-edge-based-on-chromium-0f4a3dd7-55df-60f5-739f-00010dba52cf
- 6. Why Google Continues to Fund Firefox - Wired, 12/27/2011 https://www.wired.com/2011/12/why-google-continues-to-fund-firefox
- 7. Mozilla and Google renew Firefox search agreement - The Verge, 8/15/2020 https://www.theverge.com/2020/8/15/21370020/mozilla-google-firefox-search-engine-browser
- 8. NSA Prism program taps in to user data of Apple, Google and others - The Guardian, by Glenn Greenwald and Ewen MacAskill, 6/7/2013 https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data
- 9. Apple apparently kills Windows PC support in Safari 6.0, 7/25/2012 https://web.archive.org/web/20201126201635/https://appleinsider.com/articles/12/07/25/apple_kills_windows_pc_support_in_safari_60
- 10. SECURITY SETTINGS - Tor Browser Manual, ? http://dsbqrprgkqqifztta6h3w7i2htjhnq7d3qkh3c7gvc35e66rrcv66did.onion/security-settings/index.html https://tb-manual.torproject.org/security-settings/ https://web.archive.org/web/20211109165329/https://tb-manual.torproject.org/security-settings/
The Table of Browsers
Name | Spyware Rating | Offered Toolkits (Where applicable) | Based on | Operating System |
Abaco | Not Rated | plan9 | ||
Arora | Not Rated | |||
Atlas Nyxt | Not Rated | WebKit, Chromium | Mac, Linux, BSD | |
BadWolf | Not Spyware | WebKit | Linux, BSD | |
Basilisk | Not Rated | UXP | ||
Brave | High | Chromium | Windows, Mac, Linux | |
Dillo | ||||
Dissenter | High | Brave & Chromium | ||
Dooble | Not Rated | Chromium | Mac, Linux | |
Edge | Not Rated, known to be bad | EdgeHTML (Legacy), Chromium (since 2019) | Windows, Mac, Linux | |
EndorphinBrowser | Not Rated | |||
Eolie | Not Rated | WebKit | Linux | |
Falkon | Probably not Spyware | qtwebengine | Windows, Linux, Haiku | |
Fiber | Unreleased | |||
Fifth | Not Rated | FLTK | WebKit | Linux |
GNOME Web | Not Rated | WebKit | Linux | |
GNU IceCat | Not Spyware | Firefox | Linux, Android | |
Google Chrome | EXTREMELY HIGH | Chromium | Windows, Mac, Linux, Android, iOS | |
Internet Explorer | EXTREMELY HIGH | Windows | ||
IceWeaselUXP | ||||
Iridium | Low | Chromium | ||
K-Melon | Not Rated | Gecko | Windows | |
K-Melon G | Not Rated | Goanna | Windows | |
Kristall | Not Rated | Windows, Linux, BSD | ||
Lariza | Not Rated | WebKit | "POSIX-ish" | |
Librewolf | Low | Firefox | Linux, Mac | |
Luakit | Not Spyware | WebKit | Windows (WSL), BSD, Linux | |
Lynx | Not Spyware | fork of libwww | Windows, Mac, Linux, VMS, DOS386+, OS/2 EMX | |
Midori | Not Rated | WebKit (historical), Electron (current) | ||
Minbrowser | Not Rated | |||
Floodgap Mosanic-CK | Not Rated | Motif | NCSA Mosaic | Linux, Mac |
Mozilla Firefox | High | Netscape Navigator | Windows, Linux, Mac, iOS | |
Netsurf | Low | GTK3, GTK2, Framebuffer | N/A | Windows, Mac, Linux, BSD, Solaris, Haiku/BeOS, AmigaOS, 9front, Atari TOS, RISC OS |
Opera | EXTREMELY HIGH | Presto (historical), Chromium (current) | ||
Opera Gaming | ||||
Orbit Navigator | Goanna | |||
Otter Browser | Not Spyware | qtwebkit | ||
Pale Moon | Medium | forked from Firefox, UXP | Windows, Mac, Linux, Android | |
Paprika | Not Rated | |||
Pocket Browser | Not Rated | |||
Qutebrowser | Not Spyware | qtwebengine | ||
Suckless Surf | Not Spyware | WebKit2/GTK3 | ||
SeaMonkey | High | Netscape Navigator | Windows, Mac, Linux | |
SecBrowser | Deprecated. | |||
SlimJet | EXTREMELY HIGH | Chromium | ||
Sphere Browser | Possible Spyware | ? | ||
SRWare Iron | EXTREMELY HIGH | Chromium | Windows, Mac, Linux, iOS, Android | |
Superbird | Not Rated | Chromium | Windows, Mac, Linux | |
Taokaizen | Not Rated | Chromium | Windows, Linux | |
thdwd | ||||
Tobin Borealis | Not Rated | UXP | ||
Tor Browser | Low | Firefox | Windows, Mac, Linux, BSD, Android, iOS | |
Trinity Konqueror | Not Rated | KHTML | Linux, BSD | |
Twibright Links | Not Rated | N/A | Windows, Linux, BSD, DOS, OS/2, VMS, | |
Ungoogled Chromium | Not Spyware | Chromium (with patch sets from Iridium & Bromite) | Windows, Mac, Linux | |
Uzbl | Unmaintained | |||
Viper | Not Rated | QT5 | QtWebEngine/Chromium | Linux, probably Windows and Mac |
Vivaldi | High | Chromium | Windows, Mac, Linux, Android | |
Waterfox Classic | High | fork of Firefox | Windows, Mac, Linux | |
Waterfox G3 | Not Rated | fork of Firefox | ||
Webbrowser/WereFox | Not Spyware | GTK2 | Fork of Palemoon | Linux, BSD |
WebDiscover | EXTREMELY HIGH | Windows | ||
w3m | Not Rated | Itself | ||
Xombrero | Unmaintained | |||
Yandex | Not Rated | Chromium | Linux, Windows, Mac, Android, iOS |
Browser Notes
Abaco
Arora
Atlas Nyxt
BadWolf
Basilisk
Dillo
There is a DilloNG repository where development appears to be slow rather than non-existant.
If you have the money, perhaps consider donating to their project.
Dissenter
Dooble
Microsoft Edge
- 11. What's powering Spartan? Internet Explorer, of course, 1/23/2015 https://www.neowin.net/news/whats-powering-spartan-internet-explorer-of-course
- 12. Microsoft details its legacy Edge browser phase-out strategy, 2/5/2021 https://www.zdnet.com/article/microsoft-details-its-legacy-edge-browser-phase-out-strategy/
EndorphinBrowser
Eolie
Falkon
Fiber
- 13. Fiber: Yet Another Web Browser For Qt/KDE - Phoronix, 7/19/2015 https://www.phoronix.com/scan.php?page=news_item&px=Fiber-Web-Browser-KDE https://web.archive.org/web/20160806013620/http://www.phoronix.com/scan.php?page=news_item&px=Fiber-Web-Browser-KDE
- 14. The New KDE "Fiber" Web Browser Deciding Between Qt WebEngine & Chromium - Phoronix, 8/5/2015 https://www.phoronix.com/scan.php?page=news_item&px=Fiber-Web-Browser-Engines https://web.archive.org/web/20200921095231/https://www.phoronix.com/scan.php?page=news_item&px=Fiber-Web-Browser-Engines
- 15. Spooky Scary Post-Halloween Monster Post, 11/2/2015 https://kver.wordpress.com/2015/11/02/spooky-scary-post-halloween-monster-post/ https://web.archive.org/web/20201108105212/https://kver.wordpress.com/2015/11/02/spooky-scary-post-halloween-monster-post/
Fifth
GNOME Web
GNU IceCat
Google Chrome
Internet Explorer
IceWeaselUXP
Iridium
Better than Chromium, worse than Ungoogled-Chromium. UGC incorporates it's patches along with others, and is rated at a lower spyware level. I don't know of a good reason to use this browser.
K-Melon
K-Melon G
Kristall
Lariza
Librewolf
Luakit
Lynx
Midori
- 16. Midori Web Browser and its evolution, 11/18/2020 https://astian.org/en/midori-web-browser-and-its-evolution/ https://web.archive.org/web/20201119185306/https://astian.org/en/midori-web-browser-and-its-evolution/#
Minbrowser
Floodgap Mosaic-CK
Mozilla Firefox
Netsurf
It's an actually independent browser, that uses it's own layout engine. Makes web browsing very fast and minimal, though it lacks support for many things, which in a way is a good thing. However, it's so minimal it can't even display this page properly. I've heard JavaScript on it is best left disabled.
If you have the money, maybe consider donating to Netsurf.
Opera
There are patches (called OpenOpera) for the old Presto engine, licensing around this is unclear.
Opera Gaming
Orbit Navigator
Otter
PaleMoon
Paprika
Pocket Browser
Qutebrowser
Suckless Surf
Viper
SeaMonkey
SecBrowser
SlimJet
Sphere Browser
SRWare Iron
Superbird
Taokaizen
thdwd
Tobin Borealis
Tor Browser
Trinity Konqueror
Twibright Links
Ungoogled-Chromium
Probably the best Chromium based browser. UGC tries to disable all of the spyware inherent in Chromium using a mix of patches from Bromite, Iridium and others. However, this is an inherently up hill battle as changes to Chromium's very large code base continue. As digdeeper says, it doesn't "fully free you from Google's chains".
If you are using Windows (you shouldn't be if you really care about nanonymity), you can set UGC in the chrlauncher config for easier updating (if you are on Windows and are using UGC you should get chrlauncher). Note: it requires administrator mode to actually update.
If you want to access the Google Chrome Store (for extensions and whatnot) you can install an extension.
Uzbl
Vivaldi
- 17. Vivaldi is building “Opera as it should’ve been”, 1/16/2017 https://arstechnica.com/information-technology/2017/01/vivaldi-opera-one-million-users/ https://web.archive.org/web/20201111190946/https://arstechnica.com/information-technology/2017/01/vivaldi-opera-one-million-users/
Waterfox Classic
Waterfox G3
Webbrowser
WebDiscover
w3m
Xombrero
Digdeeper said this:
digdeeper: xombrero had big potential
digdeeper: it was the ONLY browser out there caring about security / privacy BY DEFAULT
digdeeper: and then it died
Yandex
The Table of Mobile Browsers
Bromite and Tor Browser Mobile seem like the best/least spyware.Bromite | Not Rated | Chromium | Android |
Browser Notes
Bromite
IceCatMobile
So far even with all the adjustments in "about:configs" I still got a connection to "icecat.settings.services.mozilla.com".