1 /**
2 * Hardening / optimization tips surfaced in the browser encyclopedia's
3 * "Optimization" subtabs. These are actionable settings the user can
4 * flip INSIDE the browser itself — Warden doesn't apply them, it just
5 * documents the strongest posture each browser supports.
6 *
7 * Keyed by browser id with a tier-based fallback so every browser
8 * gets sensible advice even if it has no bespoke list. Kept short +
9 * concrete — each line is one thing the user can go do right now.
10 */
11 import type { Browser } from './browsers';
12 13 type TipMap = Record<string, string[]>;
14 15 // ─── Security hardening ──────────────────────────────────────────────
16 const SECURITY_TIPS: TipMap = {
17 brave: [
18 'Settings → Security → enable “HTTPS by Default” (Strict).',
19 'brave://flags → set “Disable JavaScript JIT” for a smaller attack surface.',
20 'Keep auto-update on so Chromium CVEs are patched within days.',
21 ],
22 vanadium: [
23 'Hardened defaults — MTE, CFI, hardened_malloc, JIT off by default. Little to tune.',
24 'Leave “Allow JavaScript JIT” off unless a site truly needs it.',
25 ],
26 helium: [
27 'chrome://flags → disable JavaScript JIT to shrink the attack surface.',
28 'Enable HTTPS-Only mode in Security settings.',
29 ],
30 chrome: [
31 'Settings → Privacy and security → enable “Always use secure connections”.',
32 'Turn on Enhanced Safe Browsing for real-time phishing/malware checks.',
33 'Keep the app updated via Play Store auto-update.',
34 ],
35 firefox: [
36 'Settings → enable “HTTPS-Only Mode” in all tabs.',
37 'about:config → javascript.options.* — only if you know what you’re changing.',
38 'Update promptly; Gecko CVEs land on a slower cadence than Chromium.',
39 ],
40 ironfox: [
41 'Ships hardened defaults — keep them; avoid loosening about:config.',
42 'Enable HTTPS-Only Mode for every tab.',
43 'Update via F-Droid / its own channel as soon as releases drop.',
44 ],
45 tor: [
46 'Keep the Security Level at “Safest” for high-risk browsing.',
47 'Never resize the window or install add-ons — both break anonymity.',
48 'Let it update itself; outdated Tor Browser is a real risk.',
49 ],
50 focus: [
51 'Nothing to tune — every session is ephemeral and JIT posture is fixed.',
52 'Tap the erase button (or just close) to wipe the session.',
53 ],
54 duckduckgo: [
55 'Enable “Fire Button” auto-clear on app exit.',
56 'Keep app updates on; the engine tracks Android System WebView.',
57 ],
58 };
59 60 // ─── Privacy hardening ───────────────────────────────────────────────
61 const PRIVACY_TIPS: TipMap = {
62 brave: [
63 'Set Shields to “Aggressive” for trackers + ads globally.',
64 'Enable “Strict, may break sites” fingerprinting protection.',
65 'brave://settings/privacy → WebRTC IP handling → “Disable non-proxied UDP” so WebRTC can’t leak your real IP past a proxy/VPN.',
66 'Block third-party cookies; turn on “Forget me when I close this site”.',
67 'Disable Brave Rewards / News if you don’t use them.',
68 ],
69 vanadium: [
70 'No built-in blocker — pair with a system DNS/firewall (RethinkDNS, etc.).',
71 'Route social + video links through Warden’s privacy proxies.',
72 'WebRTC IP is masked by default — leave Vanadium’s WebRTC policy untouched.',
73 'Use a per-site JS allowlist rather than enabling it globally.',
74 ],
75 helium: [
76 'Install uBlock Origin from the Web Store (Manifest V2 supported).',
77 'Keep WebRTC IP shielding on (default) so STUN can’t expose your real IP.',
78 'Block third-party cookies in Site settings.',
79 ],
80 chrome: [
81 'Privacy Sandbox → turn OFF Ad topics, Site-suggested ads, Ad measurement.',
82 'Block third-party cookies.',
83 'No WebRTC IP-leak toggle on Android Chrome — route through a VPN/proxy that handles WebRTC, or switch to Brave/Vanadium which mask it.',
84 'Route trackable links through Warden’s privacy proxies.',
85 ],
86 firefox: [
87 'Enhanced Tracking Protection → set to “Strict”.',
88 'Install uBlock Origin (full MV2 support on Firefox Android).',
89 'about:config → privacy.resistFingerprinting = true (may break some sites).',
90 'about:config → media.peerconnection.ice.default_address_only = true to stop WebRTC leaking local/VPN-bypass IPs.',
91 'Enable “Delete browsing data on quit”.',
92 ],
93 ironfox: [
94 'Arkenfox-style defaults are pre-applied — keep RFP enabled.',
95 'WebRTC is locked down out of the box (no host IP exposure) — don’t loosen it.',
96 'Add uBlock Origin for cosmetic + extra filter lists.',
97 'Leave “Delete data on quit” on for ephemeral sessions.',
98 ],
99 tor: [
100 'Don’t log into personal accounts — it links your circuits.',
101 'WebRTC is disabled entirely — never re-enable it; it would deanonymise you.',
102 'Use .onion versions of sites when offered.',
103 'Leave fingerprint defenses untouched; they’re tuned for the herd.',
104 ],
105 focus: [
106 'Already maximal — no profile, no history, trackers blocked by default.',
107 'Set the default search to a private engine in Settings.',
108 ],
109 duckduckgo: [
110 'Enable “Global Privacy Control” in settings.',
111 'Turn on email protection / tracker-blocking if you use DDG accounts.',
112 'Use the Fire Button liberally to clear state.',
113 ],
114 };
115 116 function tierSecurityFallback(b: Browser): string[] {
117 return [
118 'Enable HTTPS-Only / “secure connections” mode.',
119 'Keep the browser auto-updating so engine CVEs are patched fast.',
120 'Disable JavaScript JIT in flags if the browser exposes the option.',
121 ];
122 }
123 124 function tierPrivacyFallback(b: Browser): string[] {
125 return [
126 'Set tracker/ad blocking to the strictest level available.',
127 'Block third-party cookies and clear data on exit.',
128 'Disable or restrict WebRTC so it can’t leak your real IP past a proxy/VPN.',
129 'Route social + video links through Warden’s privacy proxies.',
130 ];
131 }
132 133 export function securityTips(b: Browser): string[] {
134 return SECURITY_TIPS[b.id] ?? tierSecurityFallback(b);
135 }
136 137 export function privacyTips(b: Browser): string[] {
138 return PRIVACY_TIPS[b.id] ?? tierPrivacyFallback(b);
139 }
140