Privacy audit to create MVP list of things we should disable in Chromium

[bbondy]

Emphasis on MVP for something we'd be able to release as 1.0. This should be similar to what we have privacy wise with Muon. This is just a task for the audit itself.

[diracdeltas]

cc @riastradh-brave

[diracdeltas]

off the top of my head:

• disable anchor ping attribute https://davidwalsh.name/ping-attribute - tracked here: Disable anchor ping attribute #764
• use safebrowsing update API instead of lookup API and use a proxy instead of connecting directly to Google, cc @jumde
• disable 3rd party cookies, localStorage, and referer (tracked separately)
• disable flash
• disable pdfium TODO(bbondy): I prefer to keep pdfium, or to test to see if pdfjs works better than on browser-laptop.
• disable widevine: (tracked separately)
• disable plugin integration other than flash/widevine
• disable google telemetry
• disable update checks that call out to Google (tracked separately)
• disable automatic downloads and enable 'ask where to save each file before downloading': see https://noncombatant.org/2014/03/11/privacy-and-security-settings-in-chrome/
• disable google cloud print
• disable google accounts integration and chrome sync
• disable whatever is needed for Chrome Remote Desktop
• disable Chromecast support? - tracked here: Disable Chromecast support #763
• disable QUIC - tracked here: Disable QUIC #765
• disable autofill (including password manager) until a field is manually focused
• use these privacy settings by default (DNT may be optional though): - tracked here: Disable 'Use a Prediction Service to load sites quickly' #766
  

[bsclifton]

We'd want the ability to disable QUIC also, right?

[diracdeltas]

yes also QUIC

[bbondy]

We'd want chromecast but as an extension if that's possible. Or as an opt in option.

[bridiver]

I think chromecast requires keys

[diracdeltas]

• enable site isolation by default: https://www.chromium.org/Home/chromium-security/site-isolation tracked here: Enable strict site isolation by default #603

[bridiver]

@diracdeltas that has potential usability issues and I think we should do some testing in chrome before enabling by default

[diracdeltas]

@bridiver are there known issues other than the ones listed at https://www.chromium.org/Home/chromium-security/site-isolation#TOC-Known-Issues ?

[diracdeltas]

also:

• battery API
• webusb API
• bluetooth API
• 3rd party dynamic HSTS/expect-CT/HPKP - tracked here - Enable HPKP/expect-CT for brave domains #767
• navigator.credentials
• SharedArrayBuffer

[diracdeltas]

• disable inline extensions: https://developer.chrome.com/webstore/inline_installation - tracked here: disable chrome.webstore.install for inline extensions #614

[diracdeltas]

Here's the default settings as of Developer Channel v0.53.0:

• Consider disabling "Allow sites to check if you have payment methods saved" - tracked here: Consider disabling "Allow sites to check if you have payment methods saved" #768