Privacy audit to create MVP list of things we should disable in Chromium about brave-browser HOT 13 CLOSED

also:

• battery API
• webusb API
• bluetooth API
• 3rd party dynamic HSTS/expect-CT/HPKP - tracked here - #767
• navigator.credentials
• SharedArrayBuffer

from brave-browser.

cc @riastradh-brave

from brave-browser.

off the top of my head:

• disable anchor ping attribute https://davidwalsh.name/ping-attribute - tracked here: #764
• use safebrowsing update API instead of lookup API and use a proxy instead of connecting directly to Google, cc @jumde
• disable 3rd party cookies, localStorage, and referer (tracked separately)
• disable flash
• disable pdfium TODO(bbondy): I prefer to keep pdfium, or to test to see if pdfjs works better than on browser-laptop.
• disable widevine: (tracked separately)
• disable plugin integration other than flash/widevine
• disable google telemetry
• disable update checks that call out to Google (tracked separately)
• disable automatic downloads and enable 'ask where to save each file before downloading': see https://noncombatant.org/2014/03/11/privacy-and-security-settings-in-chrome/
• disable google cloud print
• disable google accounts integration and chrome sync
• disable whatever is needed for Chrome Remote Desktop
• disable Chromecast support? - tracked here: #763
• disable QUIC - tracked here: #765
• disable autofill (including password manager) until a field is manually focused
• use these privacy settings by default (DNT may be optional though): - tracked here: #766
  

from brave-browser.

We'd want the ability to disable QUIC also, right?

from brave-browser.

yes also QUIC

from brave-browser.

We'd want chromecast but as an extension if that's possible. Or as an opt in option.

from brave-browser.

I think chromecast requires keys

from brave-browser.

• enable site isolation by default: https://www.chromium.org/Home/chromium-security/site-isolation tracked here: #603

from brave-browser.

@diracdeltas that has potential usability issues and I think we should do some testing in chrome before enabling by default

from brave-browser.

@bridiver are there known issues other than the ones listed at https://www.chromium.org/Home/chromium-security/site-isolation#TOC-Known-Issues ?

from brave-browser.

• disable inline extensions: https://developer.chrome.com/webstore/inline_installation - tracked here: #614

from brave-browser.

Here's the default settings as of Developer Channel v0.53.0:

• Consider disabling "Allow sites to check if you have payment methods saved" - tracked here: #768

from brave-browser.

Items are being tracked as separate issues.

from brave-browser.