Privacy-Focused Browser: A Missing Piece in the Digital Life of Southeast Asians

We cannot browse a website without an internet browser, making it an integral part of our lives in the digital age. Whether we are looking for a flight ticket for our vacation, a review of the hotel we have recently booked, or how to go to a restaurant that we are going to meet a friend, the internet browser makes all of this possible. However, have you ever considered how your personal data is treated by the internet browser that you are using? Since our digital life depends on it, an internet browser can be a window that reveals so much about us such as what site we frequently visit and what kind of content we are likely to engage the most.

Market Share of the Internet Browsers of Countries in Southeast Asia on Desktop from Jan - Oct 2019
Market Share of the Internet Browsers of Countries in Southeast Asia on Mobile from Jan - Oct 2019

According to the information gathered by StatCounter above, most of Southeast Asians use Google Chrome as their main internet browser. Looking at the percentage of market share, we can say that if Google Chrome is a runner competing in a race, it would be a very fast runner who reaches the winning point long before the first-runner up would touch it. This is because the usage of Chrome is so huge is Southeast Asia for both mobile and desktop browsers, and the market share is more than 50% in most of the countries in the region.

It is not only Southeast Asia where Chrome is popular. The browser is actually the most popular internet browser in the world, surpassing Internet Explorer in 2012. Users said Chrome provides a faster and better user experience and its functions are convenient to use according to many studies. However, Chrome is not a browser known for privacy. It belongs to Google, whose main source of revenue is advertising. In fact, Google is the world largest digital advertising company, with 85% of total revenue in 2018 coming from advertising. In case you have not already known, Google allegedly funds lobbying for the amendment of the California Consumer Privacy Act (CCPA), the first major data-privacy law in the U.S. that limits how Google can collect and make money from users’ personal data.

Why a Privacy-focused Browser Matters?

As we said earlier, an internet browser is a window to our digital life. In case you do not know, Chrome collects our data extensively. Basically, all the Google products collect data of users. Chrome has the Google search engine by default. If you are also a Gmail user in which your account also links to your YouTube account as well as a person who is also a regular user of Google Map, Google can learn a lot about you due to data synchronization.

As an app runs on the user’s computer or mobile device, the browser can collect histories, bookmarks, passwords, credit card data, and cookies, among others. The collected data can be pushed into the browser vendor’s servers. For this reason, it is extremely important that the browser be trustworthy. Just as one should not install and run a random app due to the risk of malware, one should also scrutinize the browser they choose. The incognito mode or the private browsing mode does not protect your privacy either. This is because it only does not store information on our devices, while our online traffic and information will still be recorded.

Internet Browsers with Agenda

Looking at the market share of internet browsers in Southeast Asia, Firefox ranks the second in most of the countries in the region while Safari is the third in terms of desktop browsers. Browser use varies from country to country. According to available information, Lao PDR and Singapore have a market share of Internet Explorer higher than other countries, while many internet users in Vietnam prefer to use a domestic internet browser called “Cốc Cốc” (“Knock Knock”). In terms of the mobile browser market share, UC Browser is popular in Indonesia and Myanmar. Opera is popular in Brunei, Indonesia, and Timor-Leste.

Let’s take a look closer at some of the browsers here that are used in Southeast Asia.

Let’s start with Internet Explorer, Microsoft’s IE once ruled the world, but it is now outdated. Actually, it has never been known as a browser for security. Things have become worse as it has become outdated. In fact, Microsoft’s Security Chief advises users not to use Internet Explorer anymore since the browser cannot keep up with new web apps. In fact, Microsoft will end support for the Internet Explorer 10 in January 2020 and leave the 11 version as the final version of the software.

We cannot deny that the world has paid more and more attention to privacy given the many scandals that have happened in the past few years such as the Edward Snowden’s disclosure of classified National Security Agency’s documents revealing several global surveillance programs, Cambridge Analytica, and the effects of Chinese high-tech surveillance technology. If Google is on the commercial side of data harvesting for advertising, the Chinese tech firms can stand on the other side. Actually, Chinese tech firms can be even worse due to the persistent allegations of association with state surveillance.

Of course, software like the internet browser cannot escape attention. Opera, once a trusted browser developed by Opera Software, a Norwegian software firm, made big headlines regarding privacy concern after it was sold to a Chinese consortium led by Qihoo 360, China’s largest cybersecurity firm, for $600 million in 2016. Even though the browser has announced that it contains a built-in tracking protection feature, the fact that it is Chinese-owned raises red flags among privacy advocates. Qihoo 360 also has a controversial history. It was accused in 2012 for stealing user information and uninstalling a rival’s software from users’ computers by using a backdoor in its software.

Next, let’s look at the UC Browser which is popular in Indonesia. UC browser is owned by Alibaba, a well-known big Chinese conglomorate. Sources such as Bloomberg and the Wall Street Journal claim that Alibaba helps the Chinese government in surveillance. The browser itself is reported to allow “anyone with access to the data traffic to identify users and their devices, and collect their private search data.”

In early October 2019, Apple was also accused of involvement with Chinese technology firm, Tencent. Tencent faces allegations that it helps the Chinese government crackdown on political dissents. Apple has been accused of providing users’ browsing data to Google and Tencent due to its “Fraudulent Website Warning” which states “Before visiting a website, Safari may send information calculated from the website address to Google Safe Browsing and Tencent Safe Browsing to check if the website is fraudulent. These safe browsing providers may also log your IP address.”

The “Fraudulent Website Warning” feature is a feature that notifies users when they are about to visit a known phishing or malware site. Apple defended this by saying that the company does not send information to Google and Tencent. Instead, it actually receives a list of bad websites from the two companies and use it to protect people as they surf the web. Unfortunately, this can be used for tracking users too. It has been reported that a browser is possible to directly submit every link a user clicks to be checked against a blacklist. This would create a comprehensive log of our internet activity with links to our IP address. Concerns have been raised about Tencent in particular as the company works closely with the Chinese Communist Party. Its app, WeChat, censors content based on the Chinese government’s preferences. The company’s technology has also been linked to crackdown of minorities such as Uyghurs and Tibetans.

Samsung Internet is also popular in Southeast Asia,. However, not many third party reviews of Samsung Internet’s privacy are available. The reason that it is ranked the third biggest market share after Chrome and Safari is likely because it is pre-installed on Samsung mobile devices and has become available on all Android phones in 2017. Samsung Internet has branded itself as a pro-privacy browser by having Secret Mode, Biometric Web Login, and Ad Blocker. Its Tracking Blocker extension which blocks all trackers and makes the browsing private is powered by Disconnect Inc,  a privacy protection company. Disconnect is a trusted brand in terms of privacy and has partnered with known pro-privacy software like DuckDuckGo, Tor, and Firefox. However, since there is a limited information about the privacy and security review of the browser by third-parties, we should still be cautious in using it.

Next, let’s look at Puffin since it has quite a number of users in Singapore. This browser needs some special attention because it is a kind of remote or cloud browser which means that it runs and renders on the cloud. Its developer, CloudMosa, uses browser isolation technology to safeguard users’ web browsing in the cloud. Cloud technology makes the browsing experience faster than traditional browsers in which those with restricted internet access or those who are on resource-constrained devices can receive the same fast experience while browsing the internet as those in areas with faster connections.  As Puffin grows, we may see more browsers of this nature in the future. However, due to their architecture, such browsers require users to trust the integrity and security of the vendor’s server infrastructure in addition to the browser. There is also the risk of deanonymization for VPN users as the vendor has control over both ends of the connection between the browser and their servers. When we look at its privacy policy, CloudMosa states that it may collect users’ personal data when they subscribe to the company’s paid apps or services, including trials.

Cốc Cốc is a Vietnam’s success story. It ranks second in the Vietnamese market after Google as a desktop brower, largely because it provides greater Vietnamese-language support and functionality. It offers automatic diacritics and allows access to Facebook, which was blocked in Vietnam. The software also makes downloading from sites like YouTube and other local sites easy for Vietnamese. However, unverified sources criticize the browser for not respecting the privacy of users. Its privacy features are also not known, due to limited third-party reviews. Given continued political repression in Vietnam, it would be interesting to test the browser’s privacy element.

Secured Browsers

Privacy setting or private browsing modes on browsers are not enough. A secured browser is a browser that is transparent in terms how data is used and stored. Private browsing mode or Incognito mode in Chrome are not actually ‘private’. They merely do not store information on our electronic devices. Information about our online behavior is still visible to Google.

Regarding privacy settings, companies that own the browsers can boast about how they would like to protect user’s privacy by introducing private settings. However, it can be difficult to trust if these companies if they have business models based on the sale of  personal data for advertising, participation in surveillance efforts, or have controversial privacy policies.

Browsers that have long been known for privacy are Firefox and Safari. Firefox is owned by Mozilla Foundation, whose revenue is not from advertisement. On October 22, 2019, Mozilla launched Firefox version 70 in which Enhanced Tracking Protection (ETP) is on by default. Its ETP reportedly to blocks Third-Party Tracking Cookies and Cryptomining. It is also said to block Third-Party Tracking Cookies according to a list provided by Disconnect Inc. According to Mozilla, the ETP works behind the scenes to prevent companies from profiling users based on the tracking of users’ browsing behavior across websites, often without their knowledge or consent.

Although Apple has always branded itself as pro-privacy, the company has been facing some skepticism lately. The incident about the “Fraudulent Website Warning” mentioned earlier is one area for concern. Allegations that its voice-activated assistant, Siri, records voice data for secret review by having human listening in has led Apple to formally apologize. The company later announced several changes to the voice assistant’s privacy policy. Users can now delete all Siri recordings from the company’s server. Recently, Apple has published four new white papers on the matter. One discusses privacy on the Safari browser. It now also has “built-in fingerprinting defense” making it “more difficult” for data companies to identify the user. Although it looks like Apple is trying hard in provide privacy-protection, many sources still say that the company needs to be more transparent.

A good alternative browser highly regarded by privacy advocates is the Tor browser. The initial “Tor” stands for The Onion Router which represents the way data is transferred. In this case, data has to go through a series of other computers, much like layers in an onion. The route is encrypted making tracking difficult. To the website that receives the request to access, it appears as if the data traffic comes from the last computer in the chain rather than the person who makes the request.  This is how an individual can browse a website with anonymity. TOR encrypts users’ traffic as well as hides their location. Despite Tor’s advantage in terms of privacy, it can be slower compared to other browsers. However, it is worth to keep an eye on it because Tor seems to only improve overtime. The company recently released its official browser on Android. There is no official browser of Tor on iOS yet, but it endorses the Onion Browser, allowing iOS users can browse the web anonymously.

Brave is also a good choice. It brands itself as a pro-privacy browser and has been well reviewed by third-parties. It was developed by Brave Software, whose CEO is Brendan Eich, a co-founder of Mozilla. It is faster than Chrome, has a built-in ad and trackers blocker called “Shields”. You can browse Tor in its private mode. Although this function does not work on iOS, its private mode on iOS asks the user to set 6-digits pin code before it can be used. However, even though Brave does not use your data to personalize ads for you, this private mode can still work like other private modes and information may still be visible to websites you visit, owners or administrators of the network, and your internet service provider. This is because your IP address will still be visible. You can read more about the browser here and here. One drawback is that many sites might mistake you as a bot because of the browser’s blocker for ads and trackers, and you might have to go through CAPTCHAs and other security checks more than usual.

Brave offers a Private Window with Tor

What Can We Do?

Perhaps the reasons why people use Chrome is because of its convenient functionality. The information collected might not be for surveillance purposes but to personalize ads since advertising is the main source of Google’s revenue. However, we might want to ask ourselves whether we want to live with our personal data is being taken from us without our consent for some unknown entity to monetise?

You can figure out here how much Google knows about you and how to manage it. If you still want to use Chrome, you might want to install extensions like Cookie AutoDelete, uBlock Origin, Privacy Badger, and HTTPS Everywhere. However, if you are concerned about your privacy, you might want to change to known pro-privacy internet browsers such as Firefox and Brave while using Tor as a second alternative browser due its slower functionality. 

One thing that we must remember is that privacy does not always mean security. There is no guarantee that using a pro-privacy web browser will protect you from malware. We cannot trust one browser to be everything-in-one even though it is pro-privacy. It requires layers of protection to be safe. Using trusted Virtual Private Network (VPN) will also increase protection since our IP address will be hidden. Free VPN services can also be dangerous as VPN services require a lot of bandwidth and the costs must be covered somehow. A poorly operated or dubious VPN service is more dangerous on both security and privacy-wise than not having one. A good VPN service that protect your privacy should have zero-logging guarantees. This means it does not store any information about users.

Trusted extensions to block ads and trackers for your browser should also be considered. This is because ad networks can inadvertently serve advertisements that carry malware. A big selling point of privacy-focused browsers is that they are faster! They block the multitude of scripts used to serve ads or track users (a website often uses more than one ad provider). These scripts take up bandwidth and make pages slower to load.

If you have a question on how would you know whether you can trust any browser or any software, look at who owns it, consider reviews by known independent third-parties, and go through their privacy policies.

Latest Updates

September 4, 2019
What is the (Real) Point of an Internet Shutdown?
On August 21, 2019, Indonesia ordered internet services to be temporarily blocked in Papua before partially lifting it on September 5, 2019. This incident followed similar […]
April 2, 2020
TraceTogether: Not Easy to Verify the State’s Privacy Claims
Update as of May 7, 2020: Some of the content in this article is outdated. The ‘reference implementation’ of the BlueTrace protocol called OpenTrace has been […]
June 30, 2020
Open Letter to KOMINFO Requesting for Strong User Privacy Protections in the PeduliLindungi App
26 June 2020 H.E. Johnny G. Plate Minister of Communication and Information Technology Ministry of Communication and Information Technology (KOMINFO) Jl. Medan Merdeka Barat no. 9, […]