Configure other Firefox variants/clones? Other Browsers?
Mozilla lost something like 12% of it's market share last year, at least some of the exodus was driven to Firefox variant projects, and at least some of these projects seem to have the ability to provide updates to the browser that they distribute which basically track the security updates provided by upstream Firefox. Waterfox has gone from "Meme Fork" to "Controversial Corporation" in a very short time. At this point, Mozilla is a pretty controversial corporation. IceCat has existed for a pretty long time, entirely to build a fork of Firefox which makes it difficult to run non-free Javascript and Browser Extensions. Both seem to be able to provide updates to their users. If the user makes the decision to trust a non-Mozilla Firefox variant, perhaps we should make things easier for them too?
Setting some hypothetical criteria for support:
- Must have continuously provided browser updates for at least one year
- Must have a web site with contact information for reporting issues
- Must make source code available to users
... probably more?
It could work by adding Waterfox, IceCat after Tor Browser and Firefox in i2pbrowser.bat, i2pbrowser-private.bat and i2pconfig.bat. In this case, Waterfox and IceCat would only be used if Firefox is not present. I'm not really in favor of making this configurable until somebody asks for it to be configurable. We need minimum variance between users, for example if Waterfox is distinguishable from Firefox in our configuration(I don't know that it is) we should always choose Firefox if it's available. This will serve to minimize the number of people who can be fingerprinted by such an attack.
As for Chromiums, they're a lot more work to support and a lot harder to find a good one to use. Google has their hooks pretty deep into vanilla Chrome, which is what we'll most commonly find. To use it is to acknowledge that Google can de-anonymize a user at any time. Chromium is safer, but few Windows users will be using it. Ungoogled-Chromium replaces google domains with nulls, loopbacks, or random strings depending on the context, so that telemetry will be disabled or dropped. Brave is probably OK in some configurations, but BAT might not be. It's easier to fork Chromium, there are more variants, they have more unique behaviors, and in general they're harder to support. Probably not the time right now.