Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
If you’ve been following my channel for any length of time, then you know that I use graphene OS on my mobile device. My browser of choice is the one that’s bundled with it, which has vanadium. In addition to being bundled with the OS, there are a few other reasons I really like it, which I’ll cover in today’s video on graphene OS vanadium is the user facing browser that’s included with the OS and the provider of web view, which is used by other apps to render content. Now you might be asking what is what view. So as an example, let’s take a look at mastodon. Now there’s a post on Mastodon with a link included with it. And I selected, we can see that the page was opened, but I wasn’t actually taken outside of the Mastadon app to my web browser. Instead, the app displayed the link using web view. So even though you might not think you’re using vanadium, if we select the three dots in the upper right-hand corner, we can see at the bottom running in vanadium. So, that’s what web view is, as the name implies, that lets you view the web vanadium is a chromium-based browser, which means it provides the strongest sandbox implementation available for browsers at this time. Among other security features like exploit protection and site isolation. Vanadium actually improves upon these features, so you get even more protection as compared to using the standard Chrome browser.
Another important feature is that by default, JavaScript JIT is disabled. I’m pretty sure it’s pronounced a JIT and not J. It just like iOS is not ios. But I could be wrong. While JIT is meant to improve performance on load times, it also increases your vulnerability to browser-based exploits. And an article by Microsoft, they noted that looking at CVE data after 2019 shows that roughly 45% of the CVE issued for V eight, which is Chrome’s JavaScript engine, were related to the JIT engine. So blocking JIT by default means that you greatly reduce your vulnerability to browser-based exploits. I hope to go into more detail in the future on topics like sandboxing, JIT and exploit mitigation. When I figured out a decent way to explain and demonstrate them, there was one feature I wish this browser had, and that is a built in ad blocker. The section on graphene os.org that discusses web browsing does mention that they have plans in the near future to add content filtering. Luckily, there are still two popular ways to block ads. The first is if you use a VPN, typically they have an option for ad blocking. This is done via DNS where they filter out any known ad domains. It’s not great, but it works. Another similar method, which uses the same DNS filtering technique is using the secure DNS option and vanadium and specifying a DNS server that filters ads, one that I like to use as the mullvad ad blocking DNS server, research any recommendations before blindly trusting a YouTube stranger? It’s what I like to use, but it might not be the best for you.
Besides adding the custom DNS server, there’s a couple other changes that I like to make under passwords. I don’t use medium for passwords, so I disabled that. Same under Payment Methods addresses, disable that as well. Under privacy and security. I disable autocomplete searches and URLs I’ve mentioned in the past, but I don’t like autocomplete in my browsers, I only want my data to be sent when I click Submit, I enable open External links and incognito. I like this feature. Let’s say your friend sends you a link and you click it. Instead of that link being opened in a normal tab. It’s now opened in an incognito tab, I leave Do Not Track enabled because it’s enabled by default, disabling it would just set you apart from the others using the default settings. And then the last option I change if we go back, I turn off the homepage. This is just personal preference. And then one other tip that I see some people have questions on it. Let’s say you want to use a different search engine such as start page, you don’t see it in the list here. What you need to do is first go to start page.com Once you get there, if you click Set as Default the instructions explain the steps, but what you need to do is go into the Start Page Settings, Settings. Scroll down to the section labeled HTTP request method. Change that to get save your settings confirm and now if we make a search and go back into our browser settings search engine. We now see recently visited start page we can select that and now when we run a search, we can see that start page is used by default.
If you use vanadium or thinking about using vanadium, check out the web browsing section on graphene os.org. It has a lot of great information
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So I’m going to be brave here and to share with you my brave browser settings. Before that, I want to make a quick disclaimer, there is some benefit that comes with just using the default settings the browser comes with, you blend in with all the other default installs instead of using a customized browser. Brave is what I’m using right now on my desktop. On my mobile, I’m using vanadium. Privacy and security are always changing. So what you see now will likely evolve over time and change. But this is what works well for me at the time of this recording. In the past, I used Safari on Googled chromium, chromium, Firefox with a bunch of add ons. So take it with a grain of salt, always do your own research and use my advice as a starting point to figure out what’s best for you. And then lastly, as far as security goes, Chromium is more secure than Firefox at this time, which is why I’m using brave a chromium based browser. The only time I use Firefox is when I’m using Tor browser. So for this demonstration, I’ll be using a fresh install of brave on Windows 11. So once you first install brave, you’ll see this screen, I’m going to just click Skip welcome tour, you’re presented with this busy dashboard. And the first thing we’re going to do to start our customization, click the three bars in the upper right hand corner and go into settings. If you already have brave installed on your computer, you can just follow along and go into the settings. So on the first section getting started, I just leave all this set to the default, I don’t change anything here, you can make brave your default browser if you want.
Next on to appearance. And this one, I like to disable the show side panel button. The side panel is this, I don’t use this reading list at all. So I disabled it. We can then scroll down. I like to enable this setting always show full URLs. And so what that means is you’ll always see the full URL in the address bar when you’re visiting a website, you won’t see an abbreviated version. And that’s the last setting I change on appearance on to New Tab page. So this busy dashboard, we see on a new tab that we saw at the start, I don’t care for this. So in the settings, what I do is I change that to blank page. The dashboard is disabled the settings for it. And now if we open a new tab, we just see this. So again, that’s just preference. I don’t like the busyness of it. So that’s up to you. So on the next setting shields. So on this page, I leave all these the default trackers and ads blocking, you have a couple options here. You can either leave it standard or change it to aggressive. Personally, I leave it on standard. If you change it to aggressive, you might break some site functionality. But again tested out up to you block scripts, if you enable this you will break sites. So I leave it disabled block fingerprinting, this also has a strict may break sites option. To me the jury’s still out on whether or not blocking fingerprinting actually works or if it just makes you more noticeable. I haven’t done much research into exactly what brave does to block fingerprinting. So I just leave it on standard block cookies only cross site. If you block all cookies, again, you’ll break functionality, so I leave it on only cross site. Next is brave rewards. I don’t enable this, I don’t use brave rewards at all. So I like to disable the option in the menu bar. So now we can see that’s gone. Now on to social media blocking, if you use Google or Facebook to log into any third party sites, then you want to leave these enabled. Me personally, I don’t use Google or Facebook to log into any third party sites. So I just disabled these. And the last setting on here allowed Twitter embedded tweets. So if you ever reading a news article, and you see an embedded tweet on there, if you disable this, that tweet will be blocked and you won’t see it. So if you’d like seeing the tweets, leave it enabled if you don’t disable it on to privacy and security.
The first setting autocomplete searches in URLs, I always make sure this is disabled. When you enable this, it starts sending the data as soon as you start typing in the search box. So if you accidentally type something personal, that data is already sent off without you actually even submitting the search. So I always make sure this is disabled so that my searches are only sent when I press enter. The next setting is WebRTC IP handling policy. And click here to learn more. So we can see here the default WebRTC has the right to enumerate all interfaces and bind them to discover public interfaces. That is not a great default setting. The one we’re going to change it to is disabled, non proxied UDP, and I’ll show you why in a moment. So if we go and search for WebRTC leak test, I’m just going to click the first one. So depending on your home network setup, but WebRTC has the ability to potentially leak your real IP address, even if you’re using a VPN service. I’ll leave some more links down below in the description. So you can read more about WebRTC if you want to. I’m not going to cover all the details about it in this video. But in our browser, we’re going to change this from default to this able nonpracticing UDP. Now if we go back here and refresh the page, we can see web RTC is disabled and will not leak your IP address. So that’s just an example of why we want to change that from the default setting, I would suggest reading more about WebRTC, which stands for web real time communication. It’s mostly used for video chat and different things like that. But changing it to this setting will reduce our exposure. Further down, we have allow privacy preserving product analytics, disable, automatically send daily usage ping to brave, disable, I leave the clear browsing data set to default like only Claire manually, but if you want, you can set it up so that on exit your data is cleared. Cookies, I’ll leave this on default. But we are going to click on security. So now Safe Browsing from what I understand is that it takes a hash of your URL that you’re visiting, and compares it against a hash of malicious urls to make sure that you’re not visiting a malicious site. If you are it’ll warn, you know, I don’t want to install a new build. Different browsers implement this in different ways I wrote about how brave does it I’ll link that down below. It sounds like their implementation is better than how Google Chrome doesn’t. But I’m still not the biggest fan of it. So for me, I disable it, even though that’s not recommended. But I would suggest you read about it, the pros and cons of it, how it works, and then make that determination for yourself and what’s best for you. And the last setting I like to enable on this page is always use secure connections. And what that does is if you browse to a site over HTTP, and for some reason, the website doesn’t automatically redirect you to HTTPS, brave will handle that for you, and redirect you automatically. And if for some reason the site doesn’t support HTTPS, it’ll warn you before loading sites that don’t support it. So that’s the last option I change on this page. So we can scroll back up, go back. And on the same page, we’re now going to go into site and shield settings. So these next settings will be personal to you and how you use your browser. So under permissions. For me personally, I never use location in my browser. So I’m going to click on location. And then I’m going to select don’t allow sites to see your location. So instead of a site showing a pop up asking if they can see your location, I like to disable that completely. So I don’t even see the pop up, we can then go back. And the rest of these I’m going to leave enabled, I use video chatting in my browser. So I need to use the microphone and camera for that. If you don’t go ahead and disable those notifications, if you don’t like them, disable them. Then everything else on this page, I just leave set to the default screen, scroll up again, go back.
The last thing I like to disable is this private window with Tor. If I want to use Tor, I just use the Tor Browser. I don’t want brave handling that at all. So I like to disable that functionality. So that’s all on this page. Next is sync, I don’t use sync search engine. So this is personal preference. There’s a bunch of options here. So I’ve been using brave search for a while and it’s been working well. Sometimes I use start page or DuckDuckGo haven’t really had a chance yet to settle on one. And then sometimes if I’m looking for something specific, that’s technical, I’ll actually use Google because sometimes I get better results there. I know I’m a fraud. But that’s what works for me. And then on to extensions, I disabled the Hangouts option. This next one about unstoppable domains. I just disabled This, along with the method to resolve the Ethereum Name Service. I also disabled this, if you use either of these, you should probably leave this setting enabled. If you don’t like me, then you can probably disable them. Web torrent, I disabled this one I don’t want my browser opening torrent files or magnet links the setting here for Widevine if you use any streaming sites such as Netflix or Amazon Prime video, you’ll likely have to enable this. Otherwise the content will not play in your browser. For me, I don’t use those so I just leave it disabled. So there’s nothing else will be changing on this page. So next we can go on to Wallet. So brave also has support for cryptocurrency wallets. I don’t use it. So I just disable all these seven to none. So since I don’t use the wallet feature in Brave, I don’t need the icon in the toolbar. So I disabled that. On to IPFS IPFS stands for interplanetary file system. They have some links here if you want to learn more about it, you can click and read. I don’t use it at all. So I set it to disabled next week and go on to autofill so if you’ve seen any of my previous videos, you might know that I use one password I’m still in the process of testing out and migrating to bit Warden But with all that being said I don’t use any browser Password Manager. So I like to go into the settings and disable that. Let’s go back. So besides passwords I don’t let brave store my payment methods solely To disable this as well,
I can go back. And the last one addresses, I don’t let brave store my addresses either. Disable that, go back onto languages, I don’t like to use brave translate. If I want to translate something, I’ll just paste it into a website to translate it. So I disabled that on to downloads, I just leave this set to default help tips. So this setting is actually pretty cool show Wayback Machine prompt on four or four pages. So if you get a 404 and a web page, which means Page Not Found brave will give you the option to go to the Wayback Machine and see if there’s a cached copy of the page there. So that can be pretty handy. So I just leave that enabled on to system. I don’t like this continue running background apps on Brave is closed. So I disabled that. And that is the last browser setting that I change. So as far as additional extensions go, I do use the one password extension. I also use something called bypass paywalls. It’s on GitHub, and it does exactly what it’s named. But besides those, that’s it I try to keep my browser as stock as possible and not loaded down with extensions. Most people think the more privacy extensions you had, the better but really, you’re just making yourself more unique compared to someone who’s using a default setup. So again, this is what works for me now. I hope we can help get you started in your own research and testing. As this was a browser preference video. I’m sure there will be some feedback. So if you have any feel free to let me know down below in the comments.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
If you’ve ever explored the privacy settings in your browser, you’ve likely come across a setting related to do not track. Let’s talk about what this is. I’ll show you exactly what the setting does. And then we’ll talk about how Microsoft killed it. DNT or do not track was proposed by the EFF in 2009. It will be implemented by your browser is sending an additional header to the website that you are visiting, indicating that you wished not to be tracked. The W3C standard for DNT explicitly stated that it’s only used when the user made a deliberate choice to enable it. While this feature had the best of intentions, some early studies indicated that it was largely being ignored by the trucking industry. Before we continue, let’s take a look at exactly how DNT works.
So, here I am on my website site of burritos.com. I currently have the Do Not Track setting enabled in my browser. If we right-click, go to inspect, go to the Network tab, and then refresh the website. We’re going to select the initial request. And if we scroll down to the section labeled request headers, we can see a header here called the DN T with a value of one. So, when you have this setting enabled in your browser, your browser will then send the DNT header on all requests indicating that you have it enabled. Now if I disable the Do Not Track setting and go back to the same page, we were just on, refresh the page again. Click on the newest request, scroll down to the request headers, and we no longer see that d and t header 13 years later in 2022. This feature is actually having the opposite effect of what it originally intended. So, since so few users have this feature enabled, and it’s making little to no difference in preventing tracking, companies and marketers are using the DNT header we saw in the demonstration as another way to track visitors. So instead of helping you, it’s hurting you by actually creating an additional data point that can be used to fingerprint you.
The last reason not to use it is that Microsoft killed it. As I mentioned, the W3C standard stated that this feature had to be a deliberate choice by the user. In 2012. Internet Explorer 10 was released with DNT enabled by default, which violated the standard and gave the tracking industry a reason to officially ignore it, since it could no longer be assumed the user enabled the feature. In May 2014. Yahoo announced they would stop supporting the Do Not Track privacy header. And in the years following, Google, Facebook and Twitter made similar announcements. More recently, in 2019, Apple removed the DN T feature from their Safari browser completely. I remember when this feature was originally announced, and I was pretty excited we were finally making some progress in terms of user privacy. As we can see, now the feature is dead, and it can actually cause more harm than good. So make sure you don’t have it enabled in your browser. And if you do, I would suggest disabling, and I’ll leave links down below in the description and how you can verify in popular browsers whether or not you have this setting enabled.
]]>More From DuckDuckGoDuckDuckGo Desktop App → press Join waitlistFor some reason, I wasn’t able to get Firefox to send a blank header even with the Empty header mode enabled. Perhaps it’s something with the browser. As a workaround, enter a space in the Value box once you get to step 5. Click the Value box, and hit your space bar once. After that, everything should work as expected. If you know why it’s not working, please reach out.
ModHeader for your browser (links below)+ and click Request Header.Name box enter If-None-Match. Since we want to send an empty header, leave the Value box empty (Firefox users enter a space).Empty header mode.Send empty header option.Your configuration should look similar to this image
At this point your browser is now configured to send an empty If-None-Match HTTP Header. To test, visit the follow URL -
https://hinternesch.com/page1.html. If everything is working as expected, you should see Your ID is . if you see something else, then it’s not working as expected.
Privacy & Security on the left.Enhanced Tracking Protection select CustomCookies box, click the dropdown next to it, and select All third-party cookiesTracking content, Cryptominers, and Fingerprinters.Privacy and Security on the left.Cookies and other site dataGeneratl settings select the Block third-party cookies radio button.Safari in the top menu bar and select Preferences....Privacy tab.Website tracking: that says Prevent cross-site trackingCookies and site permissions on the left.Cookies and data stored click Manage and delete cookies and site data.Block third-party cookies.