Mull - Mobile Browsers

[SkewedZeppelin]

Basic Information

Name: Mull
Category: Mobile Browsers
URL: https://f-droid.org/en/packages/us.spotco.fennec_dos/, https://github.com/divested-mobile/mull-fenix, https://divestos.org/index.php?page=our_apps#mull

Description

Mull is a FOSS build of Fenix (Firefox for Android), with slightly altered arkenfox.js included.

Additional context

Originally was Fennec based and started as builds of my patchset I upstreamed here https://bugzilla.mozilla.org/show_bug.cgi?id=1419581 in 2017.

Here is a release date comparison: https://divestos.org/misc/ffa-dates.txt

Previously, privacytools/privacytools.io#2248

My connection with the software

I am the author.

[SkewedZeppelin]

https://old.reddit.com/r/privacytoolsIO/comments/o8sqy5/iceraven_vs_mull_which_is_better/

"but we had to remove it"

🤔

[pm4rcin]

I personally use the Mull and appreciate it exists. Since it's on official f-droid I think it should be added (maybe with Fennec f-droid for less hardened setup). And it should be added a tutorial on how to add more addons for mobile firefox since it's possible.

[FaridZelli]

I don't know why Privacy Guides have been holding this off for so long. Just because it's a less popular project doesn't mean the codebase (or in this case, patches) are lacking by any means. Mull is a very well maintained browser, and as of now the only solid implementation of a prebaked Hardened Firefox for Android. The setup makes sense, and brings less complications compared to other hardening methods.

My current daily drivers are Mull and Bromite, both of which are equally stable at what they do.

[TommyTran732]

If you maintain Mulch as a standalone browser, I may as well just say something like "If you don't care about browser fingerprinting and just want Chromium build with more security hardening patches, use Mulch".

Great idea! Or even perhaps: "If you don't care about per site process isolation, which is not a big deal as both Firefox and Chromium on Android have way more concerning structural vulnerabilities that can be exploited to pull off the same category of attacks anyways, use Mull. A hardened browser with very good content blocking capabilities."

Also regarding this. It is usually very easy to recommending something that is just obviously better than the default option. For example: it is very easy to recommend Vanadium over Google Chrome because it doesn't have any regression that I know of and it has a lot of hardening patches. Similarly, it is very easy to recommend Bromite over Google Chrome if it wasn't outdated like it is right now. It is easy to recommended to recommend Mulch too if it is maintained as a standalone browser.

When recommending something like Firefox or Mull on the other hand you have to think about the regressions that they have compared to Google Chrome/Chromium and see if it is actually worth the trade off or not :/

[TommyTran732]

The bigger issue is that Mulch, while more up to date, doesn't have any fingerprinting or content blocking like Bromite.

Also, I want to go back to this. Are there any technical blockers preventing you from adding those 2 patches to Mulch?

[SkewedZeppelin]

They're massive patchsets that'd be a burden to maintain. And they have no major benefit for the WebView which is my priority.

Before Mull around 2016 or so, I did maintain Chromium builds for what is now DivestOS, and I put off maintaining it again until Lineage started falling behind.
I want to keep maintenance efforts on it minimal.

[TommyTran732]

Fair enough. It really sucks that there is no obvious to recommend right now :/

[FaridZelli]

With a proper sandbox, a deliberately malicious app can't even do anything to compromise your computer, regardless of who makes it.

When recommending something like Firefox or Mull on the other hand you have to think about the regressions that they have compared to Google Chrome/Chromium and see if it is actually worth the trade off or not.

I agree with this. What I'm implying, is that the "Sandbox" implementation on Bromite / Chromium while good in theory, isn't that great either. On Android, there are much more concerning issues regarding Website-Device side interactions, and even cross-webpage interactions. Therefore, not having this feature on Firefox is not really a significant drawback. Actually, Chromium does manage to fix some of those prior vulnerabilities, but only by denying certain system requests, making it an unreliable approach. This is way off my area of expertise, so I'll leave it to you to weigh out the factors.

Besides, the main audience for Privacy Guides aren't privacy and security experts, but new users looking for a reliable source of information regarding these topics. Like you said, what we should be focusing on is "What's best to recommend for the reader." and in this case, users unlikely to adapt the private browsing lifestyle, might even benefit more from a content blocking approach instead. It would be reasonable to have it mentioned at least, because unlike Bromite, I'd doubt that many people have actually heard of Mull.

P.s. the systematic way rocks, thank you for sharing your perspectives 😄

[ghost]

[pm4rcin]

The problem is that it's privacy vs security.

[TommyTran732]

Well you see, when Bromite was recommended, it was up to date, has both security hardening patches (a lot of which is shared with Vanadium) and privacy patches (fingerprint randomization, always on incognito, etc). It also has a bit of content blocking for convenience. It was the perfect solution.

Now that it is falling behind, I am not sure what to do about it yet. Ideally, whatever we recommend should not have regressions (or any major regressions) over the default option. Mull's (or Firefox's) lack of site isolation is a regression, making them not really ideal :/

[TommyTran732]

No offense but saying some Chromium browser has fingerprinting protections is a complete joke. I give you a test - visit browserleaks and in javascript page report back what you find in connections section. You can include Bromite or any other. And that's just scratching the surface. And I'm not even an expert.

FPing protections in any chromium browser are in my humble opinion incomplete, wonky. And I use it still as only Chromium browser somewhat usable.

Back to main point, real world implications of lack of site isolation? It wasn't in desktop FF few months ago.

Both Mull/Arkenfox/Brave/Bromite/whatever can only fool naive scripts. If a script is smart enough, knowing which lies each browser gives, then discard it from the fingerprint, then the browser can be fingerprinted :/

[TommyTran732]

Plus you can tighten security through my rules page in uBO further and that's without mentioning different modes yet. More than enough reasons to atleast consider Mull.

I like your work, honestly do. And so just one request - let's just keep this thread short so main point doesn't get lost somewhere.

If you would add Mull or not add it - all fine. I'm using it and will keep using it. And after seeing THAT in Bromite I'm not using any chromium browser ever - Bromite was the last.

You can refer to this other reply I just posted a minute ago xd

https://github.com/privacyguides/privacyguides.org/discussions/59#discussioncomment-2114379

[SkewedZeppelin]

whatever can only fool naive scripts

My personal experience shows that these scripts are often not that impressive as they seem to be.
Combining uBO and an extensive blocklist like the one I maintain with reasonably strong anti-fingerprinting measures (like arkenfox sets) seems to be very effective.

[darkvadd7]

It seems Mull has now fission in about:config. Maybe it is now as good as Bromite?

[pm4rcin]

Not really. Afair it was in about:config for a long time but it's locked preference.

[darkvadd7]

In the last version (100+), I can set it to true.

[SkewedZeppelin]

Check about:processes, you'll only see one shared process, meaning it doesn't work.

If it worked, I'd would've enabled it by now.

[SkewedZeppelin]

Mull 102.1.1 now enables Fission and disables both JITs: https://divestos.org/images/Mull_Fission-102.jpg

It is still not strongly enforced via isolatedProcess, but upstream does seem to be working towards it.

[d4rklynk]

So that is site isolation or isolated process ?
It seems to be both

[d4rklynk]

Oh, that is site isolation. So we just missing isolated process, and if I understand the team, I think we can add it (as soon as isolated process come out)

[SkewedZeppelin]

Of note, I've had to revert this. Multiple issues were found:

• Loading HTTP websites when HTTPS only mode was enabled was impossible
• Loading HTTPS websites with self signed certificates was impossible
• Media notifications were broken/wouldn't show
• USB debugging for websites was non-functional

[ghost]

Is it possible to re-enable in about config? Those issues don't affect me

[SkewedZeppelin]

@donefool
yes, but it is irreversible, as the real preference is locked: apply all of these deleted changes manually.

[pm4rcin]

I don't understand one thing: Tor for android is now recommended despite having the same issues as Mull when it comes to site isolation. So it's not really consistent because we recommend one browser and not the other because it provides anonymity. If we want it to be like that the criteria should be changed because:

On Android, Firefox is still less secure than Chromium-based alternatives: Mozilla's engine, GeckoView, has yet to support site isolation or enable isolatedProcess.

[d4rklynk]

Yes

[d4rklynk]

Mull does the same btw

[SkewedZeppelin]

No they don't afaik.

[jonaharagon]

But screen size could be an issue for fingerprinting

The reason we recommend Tor Browser on Android is because fingerprinting on its own is not anonymity-breaking, it just fucks you if you also have bad opsec. Tor on its own inherently provides anonymity regardless of the browser you use (which is why people even use it with non-browser apps).

Imagine you're the only person using Tor on a pretty unique device like the Galaxy Fold. Adversaries who might be monitoring the sites you connect to are going to see that a Galaxy Fold connected to different websites, and correlate that together to make the assumption that "oh, this must be the same person visiting all these websites." But that does not de-anonymize you, they still can't determine your identity from that information because the Tor network is protecting you.

The real problem arises when you use Tor on your Galaxy Fold to visit a website that is tied to your identity, like using it to log in to Facebook or your bank or whatever, because then they can change their assumption to "John Doe who logged into Facebook must also have visited all these websites."

Of course this is a pretty tricky problem to avoid, which is why Tor Browser on desktop is very focused on anti-fingerprinting, because people make mistakes and slip up or whatever. But the other problem is that on Android... What else are you gonna use? This is how you browse anonymously on Android and thus it is recommended.

TL;DR Tor Browser on Android provides anonymity. It is also definitely more fingerprintable, which can (but certainly won't always) deanonymize you.

[ph00lt0]

I do agree with the above, although it might actually be good to add the explanation of this limitation to the website. Tor on desktop can be used more "freely" and prevents your behavior much better. I personally think that therefor Tor on android is not super useful and avoid doing stuff that require anonymity on a phone all together.