WEB BROWSERS

Web browsers are one area where the wisdom of the crowd does not apply. In the old days, the crowd used Internet Explorer, now it's Google's Chrome browser. Don't use either one. The bottom half of this page has many articles that make the case against the Chrome browser. I would also avoid the Edge browser for two reasons. First, it is popular and thus a high value target. Second, I don't trust Microsoft.

WHICH BROWSER

On a desktop Operating System (Windows, macOS, Linux) I suggest using Firefox, the Brave browser or the Mullvad browser.

Brave has ad blocking and tracker blocking built in, it is based on Chrome, supports all Chrome extensions. It also runs on Android and iOS.

The Mullvad browser is based on Firefox and the Tor browser (which is also based on Firefox). It was first released in April 2023 and I have been using it since the initial release. It seems to be locked down, security-wise, even more than Brave. For example, it gets an excellent rating at the Cover York Tracks tester from the EFF. It is locked down so tight that some websites do not work, or some functions on a website may not work. Still, it is my first choice. Mullvad is a very trustworthy software provider and, despite being a VPN company, the browser does not require the use of any VPN. On Windows, the software is portable and it self-updates automatically. It also runs on macOS and Linux. It has been actively maintained in the 6 months that I have been using it.

I would also consider the Vivaldi and DuckDuckGo browsers on the OSs where they are available.

USING A BROWSER

• Do not logon to a website using your Google or Facebook identity. Your privacy is increased by creating a new account just for that one site.
• Turn off Notifications: Websites normally have to ask to send you Notifications. The problem is that the notifications can be abused to trick people in assorted scams. This Nov. 2020 article from Malwarebytes, Turn off website Notifications explains how turn off Notifications in Chrome, Firefox, Safari, Opera and Edge. For Brave (v1.17.73) do: Settings -> Additional settings -> Privacy and security -> Site and Shields Settings -> Notifications.
• Track me not: If the websites you visit are determined to track you it is all but impossible to prevent it. Still, you can fight back. The biggest hammer in the toolbox to avoid being tracked is Guest mode on a Chromebook, which insures that all traces of your activity are erased when you exit Guest Mode. One step down, is private/incognito mode in your web browser. You are still tracked, but only until you close the browser. Another option is to manually delete cookies and other tracking data in your browser.
  --In Chrome and Brave, enter chrome://settings/siteData in the address bar, then click the Remove All button.
  --In Firefox, enter about:preferences#privacy and click on the Clear Data button. Firefox can also automatically delete cookies when the browser shuts down. Using the same Firefox URL, turn on the checkbox for "Delete cookies and site data when Firefox is closed".
  Perhaps bookmark these URLs.
  Background: What Does Private Browsing Mode Do? by Martin Shelton July 2018.
• Incognito Mode (aka Private Browsing and Private Windows)
  Incognito/Private browsing mode hides your activity from other people using the same device. When you shut down the browser, it deletes all traces of what you were doing. It does not prevent Google or its advertiser friends from logging and profiting off your search history. In fact, the protections from Google are so poor, that Google employees joke about how bad it is. From Even Google's Own Staff Thinks 'Incognito Mode' Isn’t All It’s Cracked Up to Be by Mack DeGeurin of Gizmodo (Oct 2022). Google is being by people who think the branding and messaging around Chrome's Incognito makes it appear much more privacy preserving than it actually is. See the Google documentation: How Chrome Incognito keeps your browsing private.
• Advanced Spell Checking
  --Background: This issue came to light in September 2022. Chrome and Edge both have two spell checking options. The normal type is on by default and it happens in the browser. All good. The advanced spell checking, which is OFF by default, sends the data to be checked to a Google or Microsoft server. The problem is that on many forms in websites, this can send passwords and other personal information to Google or Microsoft. As a rule, forms that accept passwords do not display the passwords as they are entered. But, some forms have a "show password" option that can also be a problem. Neither of these articles say anything about Firefox or other Chromium based browsers such as Brave. See Google, Microsoft can get your passwords via web browser's spellcheck by Ax Sharma and Chrome & Edge Enhanced Spellcheck Features Expose PII, Even Your Passwords by the otto-js Research Team.
  --Chrome: The feature is called Enhanced Spellcheck. To find it in the Settings search for "Enhanced Spell Check". More here: Turn Chrome spell check on and off from Google.
  --Edge: The feature is called Microsoft Editor or Microsoft Editor Spelling & Grammar Checker. It is an extension that needs to be manually installed. Maybe don't install it. You can see the installed extensions with: edge://extensions
  --Brave: version 1.43.93 on Windows does not have an advanced spell check feature
  --Firefox: version 104 on Windows does not have an advanced spell check feature
• Global Privacy Control
  Test your browser at globalprivacycontrol.org. The good result is "GPC signal detected". The bad result is: "GPC signal not detected". As of May 12, 2022 this was supported by default in the Brave and DuckDuckGo browsers. It was available, but not enabled by default in Firefox. It was not available in Chrome, Edge or Safari. Google, Microsoft and Apple want to spy on us. For a detailed verification, go to global-privacy-control.glitch.me where a blue thumbs up is a good test result. More....
• The Privacy Guides website has suggestions for configuring Brave.
• See the macOS topic for tips on using Safari on macOS.
• See also the web browser fingerprinting topic
• Test your web browser: This is only for techies. deviceinfo.me, SSL Client Test from Qualys SSL Labs and How's My SSL?

EXTENSIONS

Web browser extensions are a double-edged sword. If you let them, they can read and modify the contents of every displayed page. This is necessary, for example, with an ad blocking extension. However, it can be abused too. The security around browser extensions is miserable, so I suggest a default posture of installing as few as possible. A very reasonable stance is to only install uBlock Origin and nothing else.

• When installing extensions pay close attention to the permissions it requests. I have seen non-techies be tricked into installing malicious extensions.
• When installing extensions pay close attention to who/what created the extension. There are very few trusted sources and no system for defining a trusted source. You are on your own, it is the Wild West.
• From Brian Krebs: The Case for Limiting Your Browser Extensions (February 2020). Quoting: "it's not uncommon for extension makers to sell or lease their user base to shady advertising firms, or in some cases abandon them to outright cybercriminals."
• Also from Krebs (in the above article): never install an extension just because some Web site says you need it.
• A Chromebook in Guest mode does not allow any extensions.
• In June 2023, many malicious Chrome browser extensions were detected, and not by Google. See Google's Android and Chrome extensions are a very sad place. Here’s why by Dan Goodin for Ars Technica. Quoting: " ... researchers have reported that hundreds of Android apps and Chrome extensions with millions of installs from the company's official marketplaces have included functions for snooping on user files, manipulating the contents of clipboards, and injecting deliberately unknown code into webpages ... Google has removed many but not all of the malicious entries ... Other than issuing canned statements saying Google takes user security seriously, company representatives pretty much maintain radio silence in response to questions about malicious wares available in its marketplace ... Google generally doesn’t notify users once it discovers they have installed one of its malicious offerings." As I said above, it is the Wild West. You have been warned.
• I blogged about potentially dangerous extensions here and here and here.
• A Reddit user wrote Why I removed Grammarly chrome extension and deleted my Grammarly account in March 2019.
• Sam Jadali spent much time researching malicious extensions and issued a detailed report called DataSpii that served as the basis for articles in the Washington Post and Ars Technica (July 2019). Neither article suggested a Chromebook in Guest mode.
• Best to avoid extensions from Avast and AVG as per this story: Senator Wyden Asks Avast Antivirus Why it Sells Users' Browsing Data. by Joseph Cox for Vice (December 2019). Mozilla removed Avast's and AVG's extensions for harvesting user data.
• Install an ad blocker extension in your web browser. I say this not because it makes web pages load faster (it does) but because ads have been abused too many times to install malicious software or take you to scam websites. Even Chromebook users can be scammed at websites (no malware though). One highly recommended ad-blocker is uBlock Origin by Raymond Hill. The down sides are that some sites won't display without their ads, and that it prevents sites from earning needed revenue. But, the ad blocker can be disabled on sites you wish to support. No website can be trusted to only show non-malicious ads because the website itself does not choose the ads. Except Krebs on Security.
• Maybe install a tracker blocker extension such as Privacy Badger from the EFF or Disconnect.
• Periodically review the installed extensions and remove any you do not recognize or no longer use. To display the installed extensions, use these address bar URLs (perhaps bookmark them):
  In chrome chrome://extensions
  In Brave brave://extensions
  In Firefox about:addons

ANDROID

May 2023: I have been very impressed with the DuckDuckGo Privacy browser. As a browser it does a great job of telling what trackers it has blocked on each web page. In addition, it can do tracker blocking system-wide. Like many such apps, it does this by installing a fake VPN. The downside is that the blocking feature can not be enabled while there is an active VPN connection. The tracker blocking feature is currently in BETA but it seemed to work very well when I tried it. It even tells you the type of data that each app was trying to collect. More: Your Android apps are tracking you. Here's how to stop them by Jack Wallen for ZDNet (May 10, 2023). Some apps will not function if you block their spying. This is discussed here: How to disable DuckDuckGo App Tracking Protection for a specific app on Android by Jack Wallen for ZDNet (May 19, 2023).

DESKTOP FIREFOX

ARTICLES SUGGESTING NOT TO USE CHROME