[Cider9986]

What threat model should you use Mullvad browser in? What threat model should you avoid Firefox-based browsers?

Please talk in terms of specific threats instead of fearmongering. For people wanting to avoid surveillance capitalism, which is a very common threat, I think Mullvad Browser is a fantastic choice.

For journalists targetted by nation states, perhaps it would be better to use Brave or Chrome inside of Qubes.

[prophesi]

> For journalists targetted by nation states, perhaps it would be better to use Brave or Chrome inside of Qubes.

Curious why Chrome/Brave is recommended? I don't think any modern browser is better for anti-fingerprinting like the Firefox-based ones, including TOR and Mullvad Browser? Don't install random extensions outside the defaults and you're doing a lot better than a Brave/Chrome install if you want a usable internet.

[Cider9986]

I mentioned those because they are more focused on security than privacy/anonymity.

Chrome takes security a lot more seriously than Firefox, but Firefox does more for privacy. It would depend on the specific person, whether they are more worried about zero days or more worried about being identified.

Zero days for chrome will cost more than zero days for Firefox because Chrome takes security more seriously, there are more exploit preventions.

Brave is based on chromium and has a good update schedule, but it has some regressions like allowing manifest v2. Chrome is going to have the best update schedule.

Vanadium is the only browser that improves on Chrome's security.

(Don't get your opsec advice from HN)

(I learned this from GrapheneOS)

[jcgl]

> Zero days for chrome will cost more than zero days for Firefox because Chrome takes security more seriously

They may cost more for Chrome, but it needn’t be because Chrome takes security more seriously; Chrome’s greater market share alone would be enough to account for this.

Not that I’m denying the overall conclusion. Just this bit of reasoning.

[radical_halogen]

Well with qubes your security comes from VM isolation, so wouldn't that make using a gecko browser safer? If a browser exploit gets through the browser its stuck in a disposable VM with nothing else on it. Also the mullvad client is on another proxy netVM