Solved Vivaldi Browser: Privacy Review

Catweazle

@ImaginaryFreedom , precisely because I know the importance of Fingerprinting, I use Trace, which avoids this and a whole series of other tracking techniques, at least until Vivaldi adds his own functions in this regard.
In any case, it is recommended to use a VPN today, even if it is a free one, such as the free versions of Proton (no limits of monthly data) or Windscribe (Limited data/month), both no logs and stron encryption.

ImaginaryFreedom

@Catweazle said in Vivaldi Browser: Privacy Review:

@ImaginaryFreedom , precisely because I know the importance of Fingerprinting, I use Trace, which avoids this and a whole series of other tracking techniques, at least until Vivaldi adds his own functions in this regard.

Thanks for that reference, I will take a look at Trace.

In any case, it is recommended to use a VPN today, even if it is a free one, such as the free versions of Proton (no limits of monthly data) or Windscribe (Limited data/month), both no logs and stron encryption.

VPN's are not any solution to browser fingerprinting, in fact one of the key reasons that browser fingerprinting is on the rise these days is that it allows people to be tracked regardless whether they are using a VPN or not.

Also I do not recommend any "free" VPN services because if you're not paying for something you're the product, and that's a really bad idea when it comes to VPNs. (Many "free" VPN's have been caught in various privacy scandals)

Catweazle

@ImaginaryFreedom , I also know that free VPNs in most cases are not reliable or even log and sell user data. But there are exceptions to this rule and ProtonVPN is one of them and a trusted one.
ProtonVPN was developed by scientists from CERN in Switzerland, they make money with the paid version and offer with this also a free version, somewhat simpler and naturally limited in the number of servers available (23 servers in 3 countries), apart from only allowing one instance, either on the PC or on the mobile. But it has strong military-grade encryption and reasonable speed, no user log in and no ads.
Highly recommended if you need a VPN occasionally, even for streaming as there is no data limit.
Also using ProtonMail like me, you don't even need a new registration, the VPN runs with the same account.
Windscribe is equally reliable, although due to monthly data caps at 10Gb, more suitable for mobile use, for example to connect to a public WiFi or the like.
I also know that a VPN does not avoid fingerprint and other tracking methods, but for this I already use the corresponding extensions that randomize or block this data.

ImaginaryFreedom

@Catweazle

I know about Proton's VPN service. As I recall it has a rather low data limit or something for the free version.

One of the very few free VPN services I would remotely consider, though.

Catweazle

@ImaginaryFreedom , Proton VPN free don't have any data limits, is the only free VPN reliable without limits in the use of data. The only limits in the free version are the few servers and that you can't install it in more than one terminal, PC or Mobile. Apart from fewer settings as in the paid version. But yo can use the monthly Gb you want, no limits. Speed ~35-45Mbs depending of the server you use, enough for streaming or online gaming.

privacytests

@MattEclipsed Unfortunately the post marked as "solution" seems to reflect a misunderstanding of what my website, PrivacyTests.org, is revealing. The tests on the page are not heuristics. Rather they are showing how each browser is leaking private data.

While it's good that Vivaldi's tracker blocking exists, it is my contention that this approach is inadequate for a number of reasons:

Vivaldi's tracker blocking is not enabled by default (not even in Private Windows). Why not?
Vivaldi is not blocking all third-party trackers. For example, my testing indicates that Vivaldi does not block scripts from bat.bing.com, even with "Block Trackers" enabled. Bing Ads has been reported as one of the top trackers by https://whotracks.me/trackers.html. Why isn't Bing blocked? (Note that Bing is also Vivaldi's default search engine.)
Vivaldi is relying on blocklists to stop tracking without any (apparent) strategy for preventing tracking done by trackers that aren't on the blocklist.

Now let's look at some of the important gaps in Vivaldi's protections, according to results of my tests:

Third-party cookies are neither blocked or isolated in Vivaldi by default.
Vivaldi is not blocking tracking query parameters on any website I tested. (Tracking query parameters are a common way that users are tracked across sites.)
Vivaldi does not offer a proxy, VPN or Tor mode, so, in general, users' IP addresses are revealed to all websites they visit and there is no built-in option to avoid that.

These are a few key privacy leaks that Vivaldi could fix, as other browsers are doing. Given that Vivaldi is portraying itself as a anti-tracking, it should work to improve and expand its privacy protections, instead of telling people that my site is "misleading".

As I have mentioned to the Vivaldi team previously, I would be happy to have a discussion regarding the test results and how Vivaldi might improve. I hope Vivaldi will be more open to constructive feedback for the sake of their users' privacy.

luetage

@privacytests Dude, no one cares about your silly test. But just to make one thing clear: introducing a Tor mode in third party browsers is detrimental to the goals of the project. Tor should be used with the Tor browser alone and with standard settings. Even that isn’t good enough, but it’s a start. So no, Vivaldi shouldn’t introduce a Tor mode and when you talk about VPN I can only assume you are pointing towards Opera… it’s not a real VPN and I wouldn’t trust it personally.

Catweazle

@privacytests , a browser VPN never can substitute a desktop VPN, because only can create a tunel AFTER the browser conect to the server of your ISP. As @luetage said, Opera VPN is a simple proxie in the own servers of Opera, which logs also your activity. Good for access country retricted videos, but no more.
The ad and tracker blocker is quite efficient, apart permits to add the filters you want, it lacks only (yet) the context option and the advanced mode that uBO has, but use the same filters and all these you want, even those against thes annoying cookie pop-ups.
The only what Vivaldi don't has (yet= is the protection against fingerprinting, but for this you can use Trace or Privacy Badger, which make a good job.
For a privacy check I prefer Browserleaks, where my Vivaldi mostly shows N/D or wrong values in thr results, that is enough for me.

DoctorG

@Jknapp1208 If such privacy enhancements from Brave were easy to add and the licence gives the freedom to use, Vivaldi devs could would do it. May be in some next years.

Currently patching and workaround of Chromium issues take much time for the small Vivaldi dev team.

Hadden89

@DoctorG Also improving privacy shouldn't impair functionality. Pretty sure several fixes might easily break the overall browsing experience; very uneasy to do these things in the right way ^^

Ayespy

@Jknapp1208 So weird that the tests designed by the designer of privacy features of Brave browser score the Brave browser highest. I mean what are the odds that Arthur Edelstein would design how Brave should operate, and then design tests that score his own design higher than any other. I'm sure it's pure coincidence.

leo32345

I feel like the site is somewhat misleading. Strangely, Vivaldi has nearly the same results as Chrome, even though Vivaldi has a built in tracker/ad blocker, but you couldn't dream of a built-in tracker blocker in Chrome.

Also, you can install extensions (like Privacy Badger from the EFF) to improve your privacy.

Catweazle

This 'test' is irrelevant to me for various reasons.
First of all, it is not a test, as the title promises, but simply a list of Browsers with results where it is not specified, how they were obtained and that can be elaborated even in an interested way, especially with a result so suspiciously favored that Brave appears. .
To get a real idea about Vivaldi, there are more serious testing possibilities, to mention Browserleaks, CoverYourTracks, DeviceInfo and a few others, where each one can do the test with Vivaldi in real conditions and with the configuration that each one uses.

Catweazle

@Echosyn , I use several mail providers, apart from the Vivaldi mail, principally Proton, Tutanota and Murena (Nextcloud mail), no problems until now, nor with ProtonVPN. Nor using the mail with a front-end service.

WildEnte

@Echosyn Vivaldi recommends Fastmail

bravesampson

@Ayespy It's not weird at all. From our start, we (at Brave) have been focused on building the most private, compatible, and user-friendly browser available on the market. Part of this process involves routine surveys of security and privacy tests, which yields further hardening of the Brave browser.

The author of privacytests.org has been involved in browser privacy for quite some time, previously working on Firefox and the Tor Browser. Edelstein archives test result pages, which show that Brave wasn't always doing as well as it is today. Here's an example from October of 2021.

Edelstein joined Brave in May of 2022 (not more than 3 months ago from the time of this writing). As you'd expect, some took issue with him joining one of the projects reflected in his test results. This feedback was addressed in a short Twitter thread.

The project is open source; you can contribute tests and more via GitHub. If you feel there are crucial scenarios which lack coverage or inclusion, please consider opening an issue, or submitting a pull request.

bravesampson

@Catweazle The project is open source (github.com/…/privacytests.org); you can review and run the tests yourself.

Catweazle

@bravesampson , all what you want, but this list in Privacytesting.org a pre rendered test, not a realtime test with my browser.

GitHub Read Me

...the HTML pages where results are published

As say, its a simple list of results which someone made with this script using all of these browser listed in it, nobody knows in which conditions and settings, not a real test.
A realtime test is for example Browserleaks

luetage

The project is open source; you can contribute tests and more via GitHub. If you feel there are crucial scenarios which lack coverage or inclusion, please consider opening an issue, or submitting a pull request.

@bravesampson Or we could just ignore it, because it doesn’t matter at all. A Chromium browser will never be “safe” or “secure.” Include “speed” and “fast” and you got all the trend words browser makers feel forced to put somewhere in their description to check all the right boxes fake power users expect. Vivaldi does it too, it’s silly.

There are 2 main reasons no one should be using Brave:

Cryptocurrency shenanigans
Outside investors

And before you tell me that cryptocurrency features can be disabled and the outside investors share your ~VISION!!… please spare me.

Catweazle

There is no truly private browser, whatever you do, as soon as you go online everybody know it, it doesn't matter if you use TOR, the VPN you want, you move only in the darknet or in decentralized networks.

A browser can only hide or block little data, the user can with the configuration or extensions make tracking a little more difficult, but the techniques used by web pages to profile and track the user are also becoming more sophisticated, because they win money with this and they know perfectly well that everyone uses ad and trackerblocker that make traditional methods useless.

Regardless of the browser that is used more or less 'private', what leaks user data the most, are the main search engines, Google, Bing, Yandex and Yahoo. that log the searches to profile the user and putting him in what is called a filter bubble.
But the biggest online privacy problem is ultimately the user himself.