The New Oil

The “best browser” is a never-ending and often very heated debate that occurs often in the privacy community. When it comes to desktop, it’s generally agreed upon that either Brave or Firefox (with honorable mentions for Tor and Ungoogled Chromium) is best, depending on how you feel about the companies behind each and what you’re looking for. Once you take the debate to mobile, the argument changes considerably, particularly with iOS. One advantage that Android enjoys over iOS is a very relaxed environment. This can be problematic for security, but for privacy it means more access to various apps that typically offer more flexibility and freedom. For example, in Android you can run Firefox with all the same plugins as desktop (and I recommend that). With iOS, you can only run stock Firefox. Even I will admit that without my set of recommended plugins, I’m hesitant to label Firefox the best choice.

So what is the best browser for iOS for those of us who want privacy? Well, that’s been on my mind a lot lately and I decided to finally figure this out myself with empirical evidence. So this week, I downloaded Brave, DuckDuckGo, Firefox Focus, and Safari onto my iPhone 6S put them through a series of objective tests. I will be organizing each section by alphabetical order (Brave, DDG, Firefox, then Safari). This is not order of preference. Keep in mind that results may vary based on your own device and configuration.

Privacy Policy

I firmly believe that privacy policies are always the best first place to start when it comes to vetting a new app. They may not always be telling the truth, but if Company A has a privacy policy a mile long that basically says “we collect and share everything we can get our hands on” and Company B has one that says “we try to collect and share as little as possible unless ordered to by a court,” that’s a pretty indicator where to start. With that said, Apple recently gifted us non-lawyers with a pretty rad little tool called “Privacy Labels.” So let’s start there.

Brave

Brave claims – according to their privacy label – to collect only two pieces of data: “Other Usage Data” and “User ID.” User ID isn’t a big deal as based on Apple’s explanation of the categories, this likely refers to information you voluntarily provide like a Brave account name, but “Other Usage Data” is very vague as Brave doesn’t overtly say in their complete privacy policy what information that details.

DuckDuckGo

DuckDuckGo says it collects “Product Interaction” and “Other Usage Data,” “Other Diagnostic Data,” “Crash Data” and “Performance Data.” The big one here that really bugs me is “Product Interaction” data. While it is useful for a developer to have this information, if one claims to be a privacy-respecting service you have to expect that you’re going to have do without that data. Again, according to Apple, that includes “app launches, taps, clicks, scrolling information, music listening data, video views, saved place in a game, video, or song, or other information about how the user interacts with the app.” Not very privacy respecting. The crash analytics I don’t really mind – it’s important for a developer to be able to identify why a service isn’t working to fix it. “Other” data and “Performance” data are also vague and tip off a small red flag.

Firefox Focus

Firefox Focus’s privacy label is more or less similar to DuckDuckGo’s, just in different categories. As with DDG, I don’t like that they collect “Product Interaction” data. I also don’t understand why they collect “Crash Data” as part of their analytics rather than app fuctionality. According to Apple, analytics are used to understand how users interact with the app and improve it, functionality would include minimizing crashes, performing customer support, and other such uses that would be more acceptable in my opinion. Then again, maybe Mozilla just didn't know which category best fit and decided it made more sense in analytics. I guess the actual use matters more than the label. A rose by any other name is still a rose.

Safari

The fact that I had to take two screenshots to capture all of Apple’s collected data should tell you everything you need to know right off the bat. Safari offers virtually no privacy, collecting “User Content,” “Device ID,” “product interaction,” “Browsing History,” and even “Coarse Location.” I’m not even gonna bother going into detail here. Safari is obviously out.

Winner: Brave

Loser: Safari

Brave is the clear winner by collecting so little data, and most of it being voluntary. While DuckDuckGo and Firefox Focus aren't as good, they're still miles ahead of Safari's invasive policies. And Apple is marketing themselves as a privacy-respecting company...

Browser Fingerprinting

But protecting your data from Apple is probably the lowest concern, honestly. Apple conceivably could already have access to everything on your device. How does your browser protect you from others? For this portion, I used EFF’s Cover Your Tracks to test the level of browser fingerprinting each browser revealed. I chose this tool because unlike other tools, it doesn’t give you a result based on other visitors – which is obviously a biased result (the vast majority of people don't visit those sites, so you're getting a skewed sample right off the bat) – but rather based on commonly used and known tracking technologies to give you an objective score based on how many points of data you leak. So in other words: the less points of data, the better.

There isn’t much to say about each section, I didn’t want to go into detailed results, so instead I’ll just list them. Surprisingly, Safari comes out on top here with only 15.7 bits of information. An interesting thing worth noting: when I originally ran this test, I forgot to shut off my AdGuard DNS and tell Firefox Focus not to integrate with Safari, which resulted in a much higher number (16.02, if I remember correctly). So remember that sometimes doing too much makes you stand out more.

Brave: 18.03 DuckDuckGo: 16.03 Firefox Focus: 16.02 Safari: 15.7

Winner: Safari

Loser: Brave/DuckDuckGo

The reason I call the loser here a toss-up is because it turns out that Brave has a built-in fingerprint randomization feature. So while Brave technically leaks more bits of data, that data should – in theory – be different every time, making it effectively useless for tracking. Personally I would prefer my browser simply leak as little data as possible, and if you agree then Brave is the clear loser here. However, if you see the value in a randomized fingerprint – which I think is a clever solution to the problem – then DuckDuckGo is the loser here by a narrow margin.

Browser Speed

For my last objective test, I decided I wanted to see what browser was fastest. For this, I used Speedometer 2.0, a general browser speed test developed by Apple that simulates a variety of user actions and measures the speed of various points like CSS, JavaScript, and DOM APIs. The results are measured in “runs per minute” with a margin of error. As with everything on this list, your exact speeds may vary with your hardware and internet connection (I used an iPhone 6S on a gigabit wifi network), but I tried my best to pick a service that would remove those variables as much as possible from the equation.

Brave: 49 (+/–.53) DuckDuckGo: 54.4 (+/– .81) Firefox Focus: 53.86 (+/– .5) Safari: 51.8 (+/– 1.9)

Winner: Brave

Loser: DuckDuckGo

Features

Now let’s get down to some subjective features that are harder to quantify.

Brave

Brave has the unique feature of being built privacy-first. Brave ships by default with an ad-blocker and HTTPS Everywhere, meaning it will automatically upgrade all sites eligible to a secure connection, as well as some light script blocking. That’s definitely something most browsers can’t say. However, the ad-blocking can be easily replicated with the mobile DNS of your choice, and HTTPS Everywhere isn’t really necessary in today’s day and age where 95%+ of the average user’s time on the internet is encrypted. I do have a couple of deal-breaker issues with Brave, but based on my research I think these are bugs (possibly based on my having such an older device) rather than actual shortcomings. First is that I was unable to easily find a way to clear my entire history. I think it’s been removed in the newest mobile version for my device. Personally I view having web history in general to be a huge risk. Past malware – both desktop and mobile – and malicious apps have been able to scoop that up before. So for me I value having a browser that will clear my history without me thinking about it. One way to get around this – which brings us to my second issue – is to use Private Browsing, however as soon as you close and reopen the app you end up back in regular browsing mode. Others have not reported this issue – either the history clearing or the private mode – but this ticket shows that I’m not the only one with this issue.

DuckDuckgo

DuckDuckGo has a few unique features that I actually like, and I don’t really have anything to knock it for. I’m sketchy of DDG as a company overall, if we’re being honest, but they seem to have built a really solid browser. First off, DDG is another company that like Brave was built with user privacy in mind. The browser comes prepackaged with tracker blocking software, as well as HTTPS Everywhere. In fact, DDG and EFF recently teamed up to use DDG’s web-crawling bot to make HTTPS Everywhere even more effective and comprehensive – constantly learning via AI rather than occasionally updating with crowdsourcing. And DDG has two ways to clear your browsing data: automatically (upon app exit, optionally with a time delay) or manually with the simple tap of a button. As a neat little UI feature, they also tell you everything they’ve blocked on each site (though Brave does also give you both a site total as well as an overall total when you first open the app).

Firefox Focus

Firefox Focus is a pretty standard browser with a couple of drawbacks that I could live with but would prefer not to. First the good side: it automatically clears data on close without any prompting, and it offers to integrate with Safari so that anything that opens in Safari will benefit from Mozilla’s tracking protection. The downsides: there are no tabs (you only get the single page you’re on), you can’t download images by holding them and saving them to the camera roll, and Mozilla has straight up said that Focus is a low priority for them, so even though it claims to be extra focused on privacy (no pun intended), it rarely gets updates, which includes the tracking protection lists. For example, the last four update versions at the time of writing were released as follows: April 13, 2021; November 13, 2020; September 1, 2020; and February 26, 2020. DuckDuckGo, by comparison, seems to push out updates at least once per month, usually two or three times. All this to say that while Firefox Focus is not a “hard pass” for me, I don’t think it’s the best choice.

Safari

As far as I’m concerned, Safari only has two things that make it worthwhile: it naturally integrates very well into the iOS platform, and the private mode stays active even when you leave the app. If I set Safari into private mode and close it, when I re-open it it will stay in private mode (remember that for most users, Brave will do this, too, but if Brave doesn't for whatever reason Safari should). I will still be responsible for manually closing out my tabs, and I will have to enable HTTPS Everywhere via the menu. Likewise, I will need to use an alternate DNS if I want to block any ads. As of iOS 14, Safari does block some third party trackers so there is a baseline level of privacy there. The only major ding I can think of on Safari is that the app integration doesn’t preserve Private Browsing. For example, if I peruse Mastodon and see a link I want to click on, the link will natively open in Mastodon but will not open in a private browsing window, meaning that link now goes on my browser history and the data gets preserved until I manually go in and clear my browsing data, at which point I have to also set back to a private-browsing tab.

Winner: Brave/DuckDuckGo

Loser: Firefox Focus

Putting aside my personal bugs that I experienced with Brave, I think Brave and DDG both offer competitive results in terms of features. Tabs, ability to clear history automatically, built-in security and privacy features, etc. I think the only small edge DDG has is the one-click burner button that allows you to clear your current session instantly (and maybe the fact that it doesn't save your history by default, though I guess some people may want to save their history for whatever reason). With Brave you would have to close it out and re-open it to simulate the same effect. Firefox is clearly the loser here as it has almost no features or advantages and in fact has a few drawbacks (the lack of image saving and the single tab).

Final Verdict

Winner: Brave

Brave won the privacy policy section, but only by a thin margin (compared to DDG and Firefox Focus). Safari won the fingerprinting section by an impressive shot, but I think Brave’s low performance can be excused when you remember that the fingerprint is randomized every time, meaning that tracking is considerably more difficult and the bits shared may vary depending on the fingerprint used. For the speed portion, Brave blew everyone out of the water. However, I think the features section is where things start to get muddy. Due to the major issues I – and others – have with Brave’s functionality, I do want to list my suggested runner-up: DuckDuckGo. While DDG scored mediocre on most of the tests, I found the wide range of features and functionality made it superior to Firefox Focus, and compared to Safari you lose almost no features but gain a massive privacy improvement. If Brave works correctly for you (ex, clears your history and allows for always-private mode), I think Brave is the winner. But I think DDG makes a very close runner-up and is acceptable if Brave doesn't work for you for any number of reasons.

“But WebKit...”

There are two main arguments for why you should just use Safari on iOS as opposed to any of the other popular choices, and while I know this blog is getting long, I want to address them here and now.

1) “It’s all WebKit.” Basically, Apple has locked down their ecosystem so tightly – at least in part due to security – that all browsers are essentially just forks of Safari. This is true. But the logical assumption is that because it’s a fork of Safari, Apple can see anything you do on that browser as well. As far as my research can tell, this does not happen. I was unable to determine if that’s due to Apple’s policies or due to technical limitations, but at this point in time unless someone comes forward with an empirical, documented case and not just anecdotal evidence or hypothetical conjecture, I’m forced to conclude that this is a non-issue. I don't like to spend too much time on unsubstantiated “what-ifs.” It makes things paranoid and untrustworthy very quickly.

2) JavaScript. Once upon a time, Apple would hamstring competition by forcing them to use WebKit’s older version of JavaScript instead of the new JavaScript Nitro, which was reserved for Safari alone. This however stopped being true as of iOS 8. Therefore this is also a non-issue.

Conclusion

The entire idea of a mobile browser is that you use it in emergencies, limited situations, or as an alternative to an app. Ideally, you should use your mobile device as a whole, including the browser, as little as possible. Rather, you should browse on desktop where you have significantly more control over things like blocking JavaScript, using Containers, virtual machines (if necessary), and stronger anti-virus. I realize that for some people that’s not an option, but for those who do have that luxury, use it!

I realize that browsers are one of those areas where everybody’s going to have an opinion. It’s also important to remember that what matters to you remains a critical factor here. In my situation, Brave wasn’t the winner – despite objective superiority – due to bugs. In your situation, you may prefer Firefox because you don’t trust Brave or DuckDuckGo. Some people may be willing to give up some privacy for Safari so they can have the integration or sync across the Apple ecosystem for whatever reason. My goal with this site was never to tell you what to think, only to give you the tools you needed to make an educated decision. You now have some information. Good luck!

You can find more recommended services and programs at TheNewOil.org, and you can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...