Skip to content

Commit

Permalink
Add Mull (Mobile Browser) (#2460)
Browse files Browse the repository at this point in the history
  • Loading branch information
jonaharagon committed Mar 30, 2024
1 parent 6aa14e8 commit 97b02db
Show file tree
Hide file tree
Showing 4 changed files with 72 additions and 9 deletions.
2 changes: 1 addition & 1 deletion docs/device-integrity.md
Original file line number Diff line number Diff line change
Expand Up @@ -206,7 +206,7 @@ Using these apps is insufficient to determine that a device is "clean", and not
<details class="downloads" markdown>
<summary>Downloads</summary>

- [:simple-android: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner)
- [:simple-fdroid: F-Droid](https://f-droid.org/packages/us.spotco.malwarescanner)

</details>

Expand Down
78 changes: 70 additions & 8 deletions docs/mobile-browsers.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,6 @@ These are our currently recommended mobile web browsers and configurations for s

## Android

On Android, Firefox is still less secure than Chromium-based alternatives: Mozilla's engine, [GeckoView](https://mozilla.github.io/geckoview), has yet to support [site isolation](https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture) or enable [isolatedProcess](https://bugzilla.mozilla.org/show_bug.cgi?id=1565196).

### Brave

<div class="admonition recommendation" markdown>
Expand All @@ -68,7 +66,7 @@ Brave is built upon the Chromium web browser project, so it should feel familiar

</div>

#### Recommended Configuration
#### Recommended Brave Configuration

Tor Browser is the only way to truly browse the internet anonymously. When you use Brave, we recommend changing the following settings to protect your privacy from certain parties, but all browsers other than the [Tor Browser](tor.md#tor-browser) will be traceable by *somebody* in some regard or another.

Expand Down Expand Up @@ -130,6 +128,72 @@ Brave allows you to select additional content filters within the internal `brave

[Brave Sync](https://support.brave.com/hc/articles/360059793111-Understanding-Brave-Sync) allows your browsing data (history, bookmarks, etc.) to be accessible on all your devices without requiring an account and protects it with E2EE.

### Mull

<div class="admonition danger" markdown>
<p class="admonition-title">Danger</p>

Firefox (Gecko)-based browsers on Android [lack per-site process isolation](https://bugzilla.mozilla.org/show_bug.cgi?id=1565196), a powerful security feature that offers additional protection against a malicious website exploiting a security vulnerability. Missing this feature likely won't pose an issue for low-risk web browsers who keep their browser up-to-date, but those visiting higher-risk sites or at risk of targeted/0-day attacks should strongly consider a Chromium-based browser like [Brave](#brave) instead.

</div>

<div class="admonition recommendation" markdown>

![Mull logo](assets/img/browsers/mull.webp){ align=right }

**Mull** is a privacy oriented and deblobbed Android browser based on Firefox. Compared to Firefox, it offers much greater fingerprinting protection out of the box, and disables Javascript Just-in-Time (JIT) compilation for enhanced security. It also removes all proprietary elements from Firefox, such as replacing some Google Play Services references.

[:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#mull){ .md-button .md-button--primary }
[:octicons-eye-16:](https://divestos.org/pages/privacy_policy){ .card-link title="Privacy Policy" }
[:octicons-info-16:](https://divestos.org/pages/browsers#tuningFenix){ .card-link title=Documentation }
[:octicons-code-16:](https://codeberg.org/divested-mobile/mull-fenix){ .card-link title="Source Code" }

<details class="downloads" markdown>
<summary>Downloads</summary>

- [:simple-fdroid: F-Droid](https://f-droid.org/en/packages/us.spotco.fennec_dos/)

</details>

</div>

Mull enables many features upstreamed by the [Tor uplift project](https://wiki.mozilla.org/Security/Tor_Uplift) using preferences from [Arkenfox](desktop-browsers.md#arkenfox-advanced). Proprietary blobs are removed from Mozilla's code using the scripts developed for Fennec F-Droid.

#### Recommended Mull Configuration

Mull comes with privacy protecting settings configured by default. You might consider configuring the **Delete browsing data on quit** options in Mull's settings if you want to close all your open tabs when quitting the app automatically, or clear other data such as browsing history and cookies automatically.

#### uBlock Origin

You can install add-ons by opening the app's :material-menu: settings menu and selecting **Add-ons**.

<div class="admonition recommendation" markdown>

![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ align=right }

**uBlock Origin** is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts.

[:octicons-repo-16: Repository](https://github.com/gorhill/uBlock#readme){ .md-button .md-button--primary }
[:octicons-eye-16:](https://github.com/gorhill/uBlock/wiki/Privacy-policy){ .card-link title="Privacy Policy" }
[:octicons-info-16:](https://github.com/gorhill/uBlock/wiki){ .card-link title=Documentation}
[:octicons-code-16:](https://github.com/gorhill/uBlock){ .card-link title="Source Code" }

<details class="downloads" markdown>
<summary>Downloads</summary>

- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/ublock-origin)

</details>

</div>

We suggest following the [developer's documentation](https://github.com/gorhill/uBlock/wiki/Blocking-mode) and picking one of the "modes". Additional filter lists can impact performance and [may increase attack surface](https://portswigger.net/research/ublock-i-exfiltrate-exploiting-ad-blockers-with-css).

These are some other [filter lists](https://github.com/gorhill/uBlock/wiki/Dashboard:-Filter-lists) that you may want to consider adding:

- [x] Check **Privacy** > **AdGuard URL Tracking Protection**
- Add [Actually Legitimate URL Shortener Tool](https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt)

## iOS

On iOS, any app that can browse the web is [restricted](https://developer.apple.com/app-store/review/guidelines) to using an Apple-provided [WebKit framework](https://developer.apple.com/documentation/webkit), so there is little reason to use a third-party web browser.
Expand All @@ -150,7 +214,7 @@ On iOS, any app that can browse the web is [restricted](https://developer.apple.

</div>

#### Recommended Configuration
#### Recommended Safari Configuration

These options can be found in :gear: **Settings****Safari**

Expand Down Expand Up @@ -241,11 +305,9 @@ Additional filter lists do slow things down and may increase your attack surface
### Minimum Requirements

- Must support automatic updates.
- Must receive engine updates in 0-1 days from upstream release.
- Must receive engine updates from upstream releases quickly.
- Must support content blocking.
- Any changes required to make the browser more privacy-respecting should not negatively impact user experience.
- Android browsers must use the Chromium engine.
- Unfortunately, Mozilla GeckoView is still less secure than Chromium on Android.
- iOS browsers are limited to WebKit.

### Extension Criteria

Expand Down
1 change: 1 addition & 0 deletions docs/tools.md
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ For more details about each project, why they were chosen, and additional tips o
<div class="grid cards" markdown>

- ![Brave logo](assets/img/browsers/brave.svg){ .twemoji } [Brave (Android)](mobile-browsers.md#brave)
- ![Mull logo](assets/img/browsers/mull.webp){ .twemoji } [Mull (Android)](mobile-browsers.md#mull)
- ![Safari logo](assets/img/browsers/safari.svg){ .twemoji } [Safari (iOS)](mobile-browsers.md#safari)

</div>
Expand Down
Binary file added theme/assets/img/browsers/mull.webp
Binary file not shown.

0 comments on commit 97b02db

Please sign in to comment.