The Most Secure Browsers: How Much Data Do They Send When They 'Call Home'?

There was a time when the only thing that mattered about browsers was their speed. How quickly their JavaScript engines could process data without sacrificing compatibility. Today, everything revolves around security and privacy: how good they are at blocking threats, how much data they share with their mother ships, and what elements they leak under their standard configuration. A recent study from Trinity College Dublin pits a total of six popular browsers against each other and reveals some very interesting details.

The average browser must not only offer the best of both worlds, but from a certain point of view, it is obliged to do so to stay competitive. However, we know they are not perfect. Sometimes a bug leads them to share details that should remain under user control, and in other cases... the process is by design. The argument is that developers need that additional information to evaluate the browser's performance and implement improvements in future versions, but if the price to pay is our privacy... it's logical to have doubts.

The Study

For this reason, different experts and organizations are evaluating the behavior of the main browsers on the market. In late February, Douglas J. Leith of the School of Computer Science and Statistics at Trinity College in Dublin published a fifteen-page study in which he pits six browsers against each other: Google Chrome, Mozilla Firefox, Apple Safari, Brave, Edge Chromium, and Yandex. The study fundamentally focuses on the sending of data by these browsers, including unique identifiers, and other details in written addresses that could enable tracking of a user over time.

The Worst Offenders

Starting with the worst... at the bottom of the table are Edge Chromium and Yandex. Both send persistent identifiers that can be used to track requests (including any associated location and IP address) to backend servers. Furthermore, Edge sends the device UUID (Universally Unique Identifier) to Microsoft, and Yandex does something similar by transmitting a hashed hardware identifier. This cannot be disabled, and as if that weren't enough, the autocomplete feature shares details of the visited web pages (both browsers offer an option to disable it).

The Middle Ground

Chrome, Firefox, and Safari are essentially stuck in the middle. Google's browser sends a persistent identifier along with web addresses, allowing the two to be linked. Firefox includes identifiers in its telemetry transmissions (can be disabled) and opens a permanent websocket for push notifications, which in turn is associated with another unique identifier. And Safari has, by default, a start page that can leak information to third parties and preload pages with identifiers, while iCloud processes make connections with identifiers.

The Winner: Brave

The 'winner,' so to speak, was Brave. Its default configuration offers the most privacy to the user, without identifiers that allow IP tracking, and without sharing details of visited pages.

The Rebuttals

Naturally, with any study there is a right to reply. Microsoft has an entire article dedicated to data collection and privacy settings in Edge Chromium. Apple reminded that Safari has the ability to block third-party cookies and has the Intelligent Tracking Prevention tool, which further limits the amount of shared information. And Mozilla representatives indicated that browsing history is only sent (with end-to-end encryption) if the user uses the Sync feature. Technical information does not include history, and identifiers are randomly generated. IP addresses are only retained for a brief time (citing security and fraud detection issues) and anonymized. Google had no comments for now.

The Takeaway

Of course, the study doesn't have the last word, and with the release of new versions further improvements are expected, but at least it serves as a reminder of the privacy issues associated with the autocomplete function. If you want your browser to be a bit more private, you should start there.

[Editor's note: The evaluated versions are Chrome (v80.0.3987.87), Firefox (v73.0), Brave (v1.3.115), Safari (v13.0.3), Edge (v80.0.361.48) and Yandex (v20.2.0.1145)]

Access the study (PDF, in English): Click here