Iridium – Secure Browser

The developers of Iridium don&#x27;t reveal that their browser phones home to their servers, and that&#x27;s cause enough for distrust here.<p>A quick &quot;grep -r iridiumbrowser.de&quot; of the source reveals that they replace calls home to Google with calls home to various hostnames of the form &quot;trk-NNN.iridiumbrowser.de&quot;, where NNN is a three-digit number. Presumably these hosts act as proxies. For example, lines 37-38 of chrome&#x2F;browser&#x2F;history&#x2F;web_history_service.cc:<p><pre><code> const char kHistoryQueryHistoryUrl[] = &quot;https:&#x2F;&#x2F;trk-139.iridiumbrowser.de&#x2F;history.google.com&#x2F;history&#x2F;api&#x2F;lookup?client=chrome&quot;; </code></pre> Edit: The git log for this change:<p><a href="https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commit&#x2F;chrome&#x2F;browser&#x2F;history&#x2F;web_history_service.cc?id=3bb27d9887bef87a41b56f2ec5ef62df81319a0a" rel="nofollow">https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commi...</a><p>&quot;Replace URLs to Google services by URLs to our own server, so as to analyze where we still have to patch the browser to make it stop blurting data out.&quot;<p>That&#x27;s an acceptable excuse in a debug branch, but there&#x27;s no reason for this kind of privacy-impacting debug code to reach a public build.

Given that Chrome (and Google in general) has possibly the best defensive security team in the world, it&#x27;s hard for me to take these security-oriented forks too seriously. Indeed, the last &quot;secure Chromium fork&quot; I heard about, WhiteHat Aviator, turned out to introduce a bunch of new vulnerabilities:<p><a href="https:&#x2F;&#x2F;plus.google.com&#x2F;+JustinSchuh&#x2F;posts&#x2F;69qw9wZVH8z" rel="nofollow">https:&#x2F;&#x2F;plus.google.com&#x2F;+JustinSchuh&#x2F;posts&#x2F;69qw9wZVH8z</a><p>Even if the fork doesn&#x27;t add bugs, you are now relying on the fork&#x27;s maintainer to push security updates. Will they be as good at this as Chrome&#x27;s team? This is unfair, of course: no startup or small project is ever going to have Chrome&#x27;s resources. But when it comes to security, speed of updates really does matter.

The one question you really want answered from any &quot;secure&quot; or &quot;private&quot; browser fork of Chromium or Firefox is: exactly how, in excruciating detail, do they track upstream security fixes? Are they getting notification of issues alongside the browser vendor, or do they find out only when the public does, when the embargo on disclosure is lifted?<p>Keeping up with vulnerabilities in browser codebases is a full-time job and there are very few teams in the world who can fund it, so odds are, forked browsers are going to need creative ways to piggyback on their upstream.

Every time I read a story like this, I&#x27;m reminded of Iron: <a href="http:&#x2F;&#x2F;neugierig.org&#x2F;software&#x2F;chromium&#x2F;notes&#x2F;2009&#x2F;12&#x2F;iron.html" rel="nofollow">http:&#x2F;&#x2F;neugierig.org&#x2F;software&#x2F;chromium&#x2F;notes&#x2F;2009&#x2F;12&#x2F;iron.ht...</a>

Okay, so their current release is based on chrome 41, supposedly with some security improvements. You know what else made security improvements over chrome 41? Chrome 42.

None of these &quot;secure browsers&quot; seem to actually do any real hardening.

Yet Another Chromium Fork. &quot;Iridium has various enhancements where it forces strict security to provide the maximum level of security without compromising compatibility.&quot; -- what does that means, exactly?

All chromium forks seem rather useless IMHO. They don&#x27;t support chrome extensions AFAICT and at best they are a few hours behind Chrome in shipping updates and at worst days&#x2F;weeks&#x2F;months&#x2F;years. Sounds like I have to trade quite a bit for &quot;reproducible builds&quot; which I&#x27;m not saying isn&#x27;t anything, it is but just not something I&#x27;m super interested in giving up so much for. We ALL use code everyday that we can&#x27;t see the full source for (I seriously don&#x27;t believe that anyone actually working in tech and staying up-to-date can run an OS + all open source software, I just don&#x27;t believe it) so adding one more piece doesn&#x27;t seem like that big of a deal.<p>Don&#x27;t get me wrong I think security&#x2F;privacy is HUGE and I don&#x27;t want to sound defeatist but come on... I&#x27;d love if everything was open source and I could inspect&#x2F;debug everything I run but that&#x27;s not the world we live in and you would have to go back to the &quot;dark ages&quot; of computing in order to live by that standard. It&#x27;s similar to people who have android phones with stock roms who will tell me they prefer android because it&#x27;s open source. Oh really? Cause all I see is binary blob in your hand just like me. 1-2 of them play with custom roms and this but NONE of them go as to install F-Droid (or whatever to FOSS marketplace is) and ONLY use apps from it.<p>At some point you have to say &quot;Yes I know I can&#x27;t know 100% the security of this app&#x2F;device&quot; and STILL use it. It&#x27;s that or be a hermit, I don&#x27;t like it but that&#x27;s how it is.

I would have picked a different name since there is already an Iridium in the tech space (satellite phone company). Not sure if it matters in Germany.

I don&#x27;t trust them. They have not a single contact information and no imprint on their website. Which is in fact illegal as their website ist hosted in Germany and uses a german top-level-domain.<p>They advertise their product as ”a secure browser“ without making any significant changes under the hood. As ”unicornporn“ said: ”privacy“ != ”security“. Especially when you replace one villain by another.

Another big issue I found is that it does not really start with a clean slate. It copies over your existing google profile to make the setup seamless. I think that must be part of their debian packaging, but the profile path it is using (&#x2F;home&#x2F;nemo&#x2F;.config&#x2F;iridium&#x2F;Default) is freshly created in my file-system and yet I can see my history from my current chrome profile in there.

There are lots of other &#x27;flavours&#x27; of Chromium out there. Try to avoid any closed source binary blobs like Comodo Dragon, and others. I like this because at least we can inspect the source: <a href="https:&#x2F;&#x2F;iridiumbrowser.de&#x2F;development" rel="nofollow">https:&#x2F;&#x2F;iridiumbrowser.de&#x2F;development</a> Rather than download from their site, I would much prefer to build this from the source code they provide.<p>All the browser does is prevent phoning home to Google, which is preferable if you&#x27;ve decided to permaban Goog. from your Internet traffic. Google is so tightly woven into Chrome and is a huge privacy risk.<p>On the other hand, you could route all your vanilla privacy waiving stuff through Chrome and use Firefox to do real surfing. Excuse the bias here, but I know my way around the web and Chrome likes to think I don&#x27;t. I suspect Chrome is some sort of fisher price browser designed for non tech savvy folk.<p>So use Chrome for Facebook, Youtube, other Google products. But don&#x27;t use it for actually surfing the web.

It would be nice to see how Iridium fares against WhiteHat aviator <a href="https:&#x2F;&#x2F;www.whitehatsec.com&#x2F;aviator&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.whitehatsec.com&#x2F;aviator&#x2F;</a><p>I personally find aviator to be more trustworthy at this point though.

How does extensions update happen in Iridium? I noticed in Chromium, they check for updates frequently by connecting to the Google store. Does the same happen in Iridium? If not, how?

There are a bunch of things I don&#x27;t understand in the patches. I wish they&#x27;d link to a bugtracker or something. (Incidentally, Chrome&#x2F;Chromium has a public bugtracker: Iridium seems to have a Trac that nobody used apart from creating two tickets.)<p>* Enabling Do-Not-Track by default: <a href="https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commit&#x2F;?id=9db15d3834683bcb621c263e9aef49ba17f413a2" rel="nofollow">https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commi...</a><p>This is widely considered to be a questionable plan, and violates the Internet-Draft (section 6.3: &quot;It MUST NOT transmit OPT-IN without explicit user consent.&quot;). Are they asserting that merely having Iridium over Chromium is explicit user consent?<p>* Disabling hyperlink auditing: <a href="https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commit&#x2F;?id=411e31b4bcefdff1e93704c5c4ff76572d0c2596" rel="nofollow">https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commi...</a><p>As the HTML spec (<a href="https:&#x2F;&#x2F;html.spec.whatwg.org&#x2F;multipage&#x2F;semantics.html#hyperlink-auditing" rel="nofollow">https:&#x2F;&#x2F;html.spec.whatwg.org&#x2F;multipage&#x2F;semantics.html#hyperl...</a>) points out, the behavior of hyperlink auditing in terms of privacy impact is already achievable in several ways, like server-side redirects, JavaScript, etc. The goal with the feature was to make performance and user experience better, while not changing the privacy standard. Is it being changed in Iridium for privacy reasons or for other reasons?<p>* Increasing the default client certificate (?) length to 2048 bits from 1024 bits: <a href="https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commit&#x2F;?id=4b16cfc4abc4482a0b4ccf9321c547685f26c927" rel="nofollow">https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commi...</a><p>Given how much Google&#x27;s been yelling about 1024-bit server certs, this seems like an obvious thing to change upstream. Has it been submitted &#x2F; is there a reason they haven&#x27;t changed it in Chromium?<p>* Disabling globally-installed NPAPI plugins on OS X, but still allowing those installed in your homedir: <a href="https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commit&#x2F;?id=fd5b986d422963f5466c94ab0bae012c9e059902" rel="nofollow">https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commi...</a><p>Why? (There&#x27;s probably a reason, I just have no idea what it might be.)<p>* Emptying the list of CAs allowed to sign EV certs: <a href="https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commit&#x2F;?id=2b97ce66913b9e6e1c03214132e9432e75fc21ea" rel="nofollow">https:&#x2F;&#x2F;git.iridiumbrowser.de&#x2F;cgit.cgi&#x2F;iridium-browser&#x2F;commi...</a><p>Why? As far as I can tell, the only effect is that EV certs will show up as normal certs (green lock, instead of bar showing the organization name). What does this have to do with improving security or privacy?

Wow, these guys seem to be using an ancient and vulnerable version of cgit.