Choosing a Browser

Almost all browsing happens in a browser that runs code you did not write, on a page controlled by someone else, over a connection you cannot see. The browser is therefore the highest-leverage place to make privacy decisions.

The realistic shortlist

Firefox. Open source, from a non-profit foundation, and the only mainstream browser with a built-in preference (privacy.resistFingerprinting) that standardises the properties a fingerprint is built from. It also has strong cookie isolation and dFPMR for total cookie protection. The trade-off: this configuration breaks some sites, and Firefox’s market share is small enough that it is not the default configuration many sites test against.

Brave. Built on Chromium, ships third-party cookie blocking and fingerprint resistance by default, and funds its own search index so it does not depend on search-ad revenue in the way that constrains Chrome. The trade-off: it is not open source in the usual sense, and its own additions are trust decisions you are making.

Tor Browser. Firefox with a much stronger configuration: every user gets identical values, so users are indistinguishable from each other. The trade-off is throughput and that some sites block it. If your model includes not wanting to be identifiable at all, this is the only good answer.

A decision order

1. Do I need to be unidentifiable? If yes, use Tor Browser and accept the slowness. Nothing else gets you there.
2. Do I need to browse normally, with far less fingerprinting? Use Firefox with privacy.resistFingerprinting enabled, or a hardened Chromium build.
3. Do I mainly want tracking blocked? Any of the above, with content blocking turned on.
4. Is my main concern corporate data collection rather than tracking? A browser choice barely helps. See search engine privacy.

Turning things on

In Firefox, in about:config:

// Standardise fingerprintable properties
privacy.resistFingerprinting            = true
// Reject trackers in strict mode and isolate state
privacy.trackingprotection.enabled      = true
privacy.trackingprotection.pbmode.enabled = true
// Ask sites not to fingerprint, and treat refusals as breakage
privacy.donottrackheader.enabled        = true

Extensions worth having

Keep the list short. Each extension is code with your browsing history in scope, so a small trusted set beats a large one.

• uBlock Origin — content blocking, with the annoyance of periodic breakage when sites change their scripts. It is the single highest-value extension for reducing passive collection.
• A password manager extension — see using a password manager.
• Nothing else, unless you have a specific reason. Extension sync is a channel too; check what yours sends.

Sources

• Firefox privacy features — Mozilla’s own description of what it enables and when.
• Tor Browser download and design notes — the strongest anti-fingerprinting configuration available in a browser.
• Brave privacy — described by the vendor; treat the self-hosted search claim as a source claim until you have checked it.