privacyguides.org icon indicating copy to clipboard operation
privacyguides.org copied to clipboard

update: Add Vanadium guide

Open dngray opened this issue 2 years ago • 34 comments

Going to add this, as we don't want GrapheneOS users to think they should be using Brave instead.

https://discuss.privacyguides.net/t/vanadium-grapheneos-web-browser/12828

dngray avatar Feb 14 '23 16:02 dngray

Deploy Preview for privacyguides ready!

Name Link
Latest commit 2396a849d31af9d767b7fc5b31683c840680f111
Latest deploy log https://app.netlify.com/sites/privacyguides/deploys/64857cb4696f6b0008e11f1b
Deploy Preview https://deploy-preview-1978.preview.privacyguides.dev
Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

netlify[bot] avatar Feb 14 '23 17:02 netlify[bot]

I don't know if this is relevant to the section you're planning to write, but I thought I would mention this here. Since fairly recently, Vanadium only on GrapheneOS can be updated without requiring an OS update via the "Apps" app that comes with GrapheneOS, which should result in people getting new Vanadium updates very quickly, especially if they opt into the alpha release channel for Vanadium (within the "Apps" app).

If someone outside of GrapheneOS install "Apps", they won't see Vanadium listed, so it might not be immediately obvious that people on GrapheneOS have that available to them.

image

matchboxbananasynergy avatar Feb 14 '23 17:02 matchboxbananasynergy

Vanadium only on GrapheneOS can be updated [...]

Vanadium is exclusive to GrapheneOS anyways, no?

Also does anyone know if Vanadium supports password managers yet? I think it does not judging by issue 276 on their repo (which I won't link to here for obvious reasons).

jonaharagon avatar Feb 15 '23 17:02 jonaharagon

Vanadium only on GrapheneOS can be updated [...]

Vanadium is exclusive to GrapheneOS anyways, no?

Yes. What I meant to imply there is that people won't be able to get it by Downloading "Apps" on another OS at this time.

Also does anyone know if Vanadium supports password managers yet? I think it does not judging by issue 276 on their repo

Vanadium used to have the app id "org.chromium.chrome" but uses original-package to change that to "app.vanadium.browser" for new installations (it is also changed if you factory reset your existing installation).

My understanding is that Bitwarden can be made to work with Vanadium for people with the new app id. Unsure about KeePassDX as my installation has the old app ID, not the new one.

matchboxbananasynergy avatar Feb 15 '23 17:02 matchboxbananasynergy

Vanadium only on GrapheneOS can be updated [...]

Vanadium is exclusive to GrapheneOS anyways, no?

Also does anyone know if Vanadium supports password managers yet? I think it does not judging by issue 276 on their repo (which I won't link to here for obvious reasons).

only does via keyboard support so not really, also no adblocking.

ph00lt0 avatar Feb 15 '23 17:02 ph00lt0

https://github.com/bitwarden/mobile/pull/2199#issuecomment-1426435642

@ph00lt0 The comment above suggests that you're able to get it working with the new app ID.

matchboxbananasynergy avatar Feb 15 '23 17:02 matchboxbananasynergy

bitwarden/mobile#2199 (comment)

@ph00lt0 The comment above suggests that you're able to get it working with the new app ID.

Right seems to be resolved I wasn't aware. Yet adblocking still not existing.

ph00lt0 avatar Feb 16 '23 11:02 ph00lt0

So just to be clear: i do believe grapheneOS users should be using Brave. Using an adblocker creates more security benefits for ordinary people. Chances of users clicking on malicious links from ads is a lot higher than some very complex browser attack.

ph00lt0 avatar Feb 16 '23 11:02 ph00lt0

So just to be clear: i do believe grapheneOS users should be using Brave. Using an adblocker creates more security benefits for ordinary people. Chances of users clicking on malicious links from ads is a lot higher than some very complex browser attack.

DNS blocking can be used, which can even be set in Vanadium specifically.

matchboxbananasynergy avatar Feb 16 '23 11:02 matchboxbananasynergy

There are more things to add to this, such as:

Noting that JIT is disabled by default with a per-site toggle to enable it. We should make people aware of that in case they stumble upon a website that doesn't play well without JIT. etc.

matchboxbananasynergy avatar Feb 16 '23 11:02 matchboxbananasynergy

So just to be clear: i do believe grapheneOS users should be using Brave. Using an adblocker creates more security benefits for ordinary people. Chances of users clicking on malicious links from ads is a lot higher than some very complex browser attack.

DNS blocking can be used, which can even be set in Vanadium specifically.

sure but this doesn't work nearly as well as default adblocking in Brave, and haven't we concluded that when using a VPN it is not wise to use different DNS providers?

ph00lt0 avatar Feb 16 '23 13:02 ph00lt0

So just to be clear: i do believe grapheneOS users should be using Brave. Using an adblocker creates more security benefits for ordinary people. Chances of users clicking on malicious links from ads is a lot higher than some very complex browser attack.

DNS blocking can be used, which can even be set in Vanadium specifically.

sure but this doesn't work nearly as well as default adblocking in Brave, and haven't we concluded that when using a VPN it is not wise to use different DNS providers?

Sure but most VPN providers provide adblocking functionality on their end

matchboxbananasynergy avatar Feb 16 '23 13:02 matchboxbananasynergy

Noting that JIT is disabled by default with a per-site toggle to enable it. We should make people aware of that in case they stumble upon a website that doesn't play well without JIT. etc.

Good point, I forgot about that.

dngray avatar Feb 17 '23 11:02 dngray

So just to be clear: i do believe grapheneOS users should be using Brave. Using an adblocker creates more security benefits for ordinary people. Chances of users clicking on malicious links from ads is a lot higher than some very complex browser attack.

DNS blocking can be used, which can even be set in Vanadium specifically.

sure but this doesn't work nearly as well as default adblocking in Brave, and haven't we concluded that when using a VPN it is not wise to use different DNS providers?

Sure but most VPN providers provide adblocking functionality on their end

Right but I think we can agree it doesn't work as well. Many ads won't be blocked this way. F.x. displaying of certain search ads, this is also the reason the CISA and the FBI recommend using an adblocker.

ph00lt0 avatar Feb 17 '23 12:02 ph00lt0

It does seem there was some interest in an adblocker https://github.com/GrapheneOS/Vanadium/issues/10 but not sure if it's stalled.

dngray avatar Feb 18 '23 07:02 dngray

https://github.com/GrapheneOS/Vanadium/releases/tag/110.0.5481.154.1 Autofill support.

matchboxbananasynergy avatar Feb 27 '23 11:02 matchboxbananasynergy

Where are we at with this PR? To be honest, after thinking about this I don't think the benefits of Vanadium over our current recommendation have really been demonstrated. I'm tempted to mark this as missing discussion and push this back to the forum- thoughts?

jonaharagon avatar Apr 11 '23 04:04 jonaharagon

In fact, the previous discussions about Vanadium I can find ended with rejection. Consensus on the forum seems to be that Brave is perfectly fine as well. I definitely would rather see a forum thread opened with actual specific reasons and evidence that this PR needs to exist at all.

https://github.com/privacyguides/privacyguides.org/discussions/527#discussioncomment-1893756

jonaharagon avatar Apr 11 '23 04:04 jonaharagon

bitwarden/mobile#2199 (comment) @ph00lt0 The comment above suggests that you're able to get it working with the new app ID.

Right seems to be resolved I wasn't aware. Yet adblocking still not existing.

I think the proper way to do it is to disable JS on sites by default and whitelist sites as needed. This will remove most ads/ad tracking. The few sites with really bad ads that you also need JS enabled can usually be circumvented using an alternate frontend like with YouTube. I only see adblockers as useful in browsers where you can't whitelist JS per-site.

ghost avatar May 19 '23 10:05 ghost

well JS is not the only problem this is really bad advise. It practially makes everything unusable. You can't recommend this to the average user who is vunerable to ads @mfwmyfacewhen. We need adblockers.

ph00lt0 avatar May 19 '23 16:05 ph00lt0

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/recommend-vanadium/12828/2

privacyguides-bot avatar Jun 11 '23 07:06 privacyguides-bot

Vanadium has built-in content blocking now: https://github.com/GrapheneOS/Vanadium/issues/10

friadev avatar Mar 17 '24 19:03 friadev

Are you accepting suggestions/contributions for this PR? If so, I'm happy to help draft/write this guide as I have some time on my hands.

As @kimg45 noted, Vanadium has had built-in content blocking since mid-February 2024, so it currently meets all the minimum requirements for recommendation. Privacy Guides also recommends GrapheneOS as a recommended Android OS, so it seems sensible to recommend the browser that comes with it.

redoomed1 avatar Apr 12 '24 17:04 redoomed1

Your preview is ready!

Name Link
Latest commit 2b353eacc3164d96c622296d509e7e087ba46b18
Preview https://1978--glowing-salamander-8d7127.netlify.app/

github-actions[bot] avatar Apr 14 '24 04:04 github-actions[bot]

Are you accepting suggestions/contributions for this PR? If so, I'm happy to help draft/write this guide as I have some time on my hands.

I think we should otherwise it sort of says that Vanadium isn't good enough you're on GrapheneOS which simply isn't true.

Also Vanadium now has a content blocker so there is that.

dngray avatar Apr 14 '24 07:04 dngray

@all-contributors add @redoomed1 for review

jonaharagon avatar Apr 14 '24 15:04 jonaharagon

@jonaharagon

I've put up a pull request to add @redoomed1! :tada:

allcontributors[bot] avatar Apr 14 '24 15:04 allcontributors[bot]

For people using [GrapheneOS] (android.md#grapheneos) on a [Google Pixel] (android.md#google-pixel), we recommend using Vanadium

I'm not okay with telling GrapheneOS users they must use Vanadium at this time, and I'm not okay with the first mobile browser we list only being available on a niche custom ROM and not all of Android.

In fact, I would prefer these headers in this order unless we are also going to add Mulch (https://discuss.privacyguides.net/t/mulch-android-browser/14461) which is more widely available:

  1. Brave
  2. Mull
  3. Vanadium (GrapheneOS)

This is consistent with how we handle ordering based on platform availability and popularity across the site.

jonaharagon avatar Apr 16 '24 00:04 jonaharagon

I'm not okay with telling GrapheneOS users they must use Vanadium at this time, and I'm not okay with the first mobile browser we list only being available on a niche custom ROM and not all of Android.

Fair point, given it only works on GOS. Lets just keep it alphabetical and have the random table at the top maybe.

dngray avatar Apr 16 '24 08:04 dngray

This is consistent with how we handle ordering based on platform availability and popularity across the site.

Makes sense, I appreciate all the reasoning you gave.

have the random table at the top maybe.

I like this idea and see high value in adding it, considering that there have been posts on the forum like Chromite vs Vanadium (gOS) for which a randomized comparison table would have been useful.

redoomed1 avatar Apr 16 '24 13:04 redoomed1