Security & Privacy

Everyone needs a web browser, and while Safari comes pre-installed on Macs, many people choose to use a different browser. You may want to do this for compatibility reasons—there may be sites or services you use that Safari doesn’t handle correctly—or because you use a different browser at work; if you want to be able to sync bookmarks and history from your work browser to your personal browser, then it can be useful to use the same app on your computers in both locations.

But another thing to consider is web browser security and privacy. Not all browsers handle your data optimally, and few are developed with privacy and security as a primary focus. In this article, we’ll discuss the three main web browsers for macOS—Safari, Chrome, and Firefox—and look at several alternatives, from a privacy and security perspective.

(You may also want to check out our companion article about which iOS browser is best for security and privacy.)

Safari

The most obvious advantage of using Safari on a Mac is that it’s already there when you set up a new Mac, so you can use Safari immediately, without needing to download anything. As Apple’s default browser, Safari has its advantages, such as built-in functionality to store your bookmarks and browsing history in iCloud, along with your usernames and passwords in iCloud Keychain, making it easy to log in and synchronize your browsing across all your Apple devices associated with your iCloud account.

However, if you work on a Windows computer, then you won’t be able to access all your iCloud data in your browser. Many years ago Apple used to develop a version of Safari for Windows, but Apple silently abandoned the Windows version in 2012. (You can still download it if you really want to, although we strongly advise against using any browser that no longer receives security updates, as doing so puts your computer at a greater risk of infection and exploitation.)

Apple claims to be all about privacy lately, and it’s nice to imagine that this might theoretically give Safari some advantage versus the other major browsers. Safari includes what Apple calls Intelligent Tracking Prevention technology designed to limit the amount of uniquely identifiable information that sites can use to track you, although there remains room for improvement (as you can see four yourself by testing your browser with sites like AmIUnique).

In early 2019, Apple removed Do Not Track functionality from Safari, claiming that the feature ironically made it easier for sites to uniquely identify users, even though the feature was originally intended as a way to increase privacy. The Do Not Track standards, which have yet to gain universal adoption amongst advertising and tracking companies, are currently maintained by the Electronic Frontier Foundation. Chrome and Firefox still allow users to enable the feature.

Google Chrome

Google Chrome is a fast web browser, and it commands a 69 percent desktop and laptop browser market share worldwide, according to NetMarketShare. But it’s a Google app. As such, it’s designed to suck up your data and send it to Google’s servers so Google can better serve you targeted advertisements.

Sure, Chrome’s extension library is second to none (thanks in part to Firefox having abandoned its traditional browser extension format in favor of Chrome’s format), and the browser is compatible with most websites. But you’ll have to consider whether it’s really worth giving away that much of your data to Google. You can somewhat reduce Google’s data collection by using Chrome’s “Incognito” private browsing mode, but just remember that to better take advantage of Incognito you’ll need to avoid logging into a Google account within any open Incognito windows (which behave as a single Incognito browsing session).

Google explains Chrome’s basic security and privacy settings here, and you can read the Google Chrome Privacy Notice and Google Privacy Policy to learn more about what information Google collects and how it uses that data. Google also has a very long and in-depth Google Chrome Privacy Whitepaper page that is kept up to date with much more detailed information.

Mozilla Firefox

Mozilla Firefox is another popular browser, coming in at a distant second place behind Chrome in terms of global market share, claiming nine percent of the desktop and laptop market. Firefox is cross-platform, available on Mac, Windows, and Linux (as well as mobile platforms), and is developed by the non-profit Mozilla Foundation. (Firefox is actually a descendant of the Netscape browser that was popular in the early days of the web.)

Firefox has a robust platform of add-ons, but in late 2017, with the release of Firefox 57, it changed the way add-ons work (Firefox abandoned legacy XUL/XPCOM add-ons in favor of the Chrome-compatible WebExtensions API), so many add-ons that had been around for a long time that no longer function. (For those who find this problematic and miss the advanced functionality of some older Firefox add-ons, there’s hope; see the Waterfox section below.) In theory, the abandonment of legacy extensions could in some cases have positive side effects from a privacy standpoint by reducing the depth of control extensions can have over your browsing data, although at the same time the switch to the new extension format also means that certain security- and privacy-enhancing add-ons can no longer offer some of the unique features that they used to.

Mozilla has a “Protect your privacy” page with information about how to improve your browsing privacy when using Firefox. You can also review a Firefox privacy configuration guide published by Restore Privacy.

Chrome Canary

Google Chrome Canary is the bleeding-edge version of Google Chrome. It allows developers, security professionals, and curious users to try out new features before they are rolled out to the general public.

However, you may not want to use Chrome Canary as your primary browser unless you really need to. It’s much less stable than the normal Google Chrome app, and on very rare occasions you can even get stuck being unable to use the browser until an update is released. But on the bright side, users do occasionally get to try new features related to privacy (whether those changes are for good or for ill) before mainstream Chrome users, so it’s a tradeoff worth considering if you’re heavily entrenched in the Google ecosystem or if you run a web site.

Chrome Canary has the same privacy concerns as the mainstream Chrome browser; it’s developed by Google, a mega-corporation that makes the majority of its money through advertising, and that loves to track and gain insights into its customers’ browsing habits.

Brave

Brave is a web browser that focuses on security and privacy, and that includes an ad and tracker blocker. Its rendering engine is based on Chromium, so it works like Chrome on the back end, but by blocking ads and trackers there’s less data downloaded and your privacy is better respected. You can block embedded content from social media sites (Google, Facebook, Twitter and LinkedIn), and can also disable JavaScript—which can significantly enhance security, but will unfortunately break most websites. Brave is also designed to automatically upgrade sites from HTTP to HTTPS secure versions when possible. It works with most Chrome-compatible extensions, so you can extend Brave’s capabilities easily.

You can read the Brave Browser Privacy Policy here.

Opera

Opera has been around for a long time; its first public release was in 1996. One advantage of Opera is that it includes a built-in, browsing-only VPN, allowing your browsing to remain somewhat more anonymous by hiding your IP address (and implicit geographic location). However, you can’t choose which country the VPN connects you to, and some web sites (like Google search) load in the default the language of the country where you appear to be located, which can make browsing a bit of a hassle. Opera can also blocks ads, but page loads can be slow.

Opera has a help page with details about the browser’s security and privacy features and settings. You can also read Opera Software’s privacy and cookie policy documents.

Waterfox

Waterfox is a fork (offshoot) of Firefox with a number of specific advantages over Firefox: it allows the older style Firefox add-ons (as mentioned above), it doesn’t use any of Mozilla’s tracking or collect any telemetry (data about your browsing), and it’s compatible with much older versions of macOS than the other browsers on this list.

One unique feature of Waterfox is that it retains compatibility with the older style Firefox add-ons (for which Firefox dropped support in version 57 in late 2017), in addition to being compatible with newer style extensions built with the WebExtensions API (i.e. designed for compatibility with Chrome, Opera, or the latest version of Firefox). The support for older style extensions may be dropped eventually, but for now the lead developer of Waterfox plans to maintain the current version of the browser (which is based on Firefox 56), and will soon release a version of Waterfox based on Firefox 68 ESR; the latter will require legacy extensions to be ported, but will add additional features introduced in more recent versions of Firefox.

Waterfox is also unique in supporting much older versions of macOS than other actively maintained browsers; it’s compatible with OS X Lion (10.7) and later. However, it’s important to note that we recommend always using the latest version of macOS to ensure you’re getting security updates; Apple traditionally releases updates for the current and two previous versions of macOS.

You can read Waterfox’s privacy policy here.

Puffin

Puffin, developed by CloudMosa, is a browser that’s available on a number of platforms—even the Raspberry Pi. The company claims that the browser can block zero-day vulnerabilities (security threats that have just been discovered), but it’s not clear how well this works, or how exactly it does so; the company’s vague explanation is that “your Puffin browsing sessions are in the cloud, [so] your devices won’t be affected by zero-day attacks.” Puffin is the only browser in this list that isn’t free; for personal use on a Mac, it currently costs $12 a year.

You can read Puffin’s privacy policy here.

Microsoft Edge

Microsoft Edge is the company’s current browser, which in 2015 replaced Internet Explorer as the default browser in Windows 10, and was later released for iOS and Android in 2017. You probably don’t have any reason to use Edge on a Mac, unless you use Windows and want to sync your bookmarks and browsing history across platforms, or unless you’re a web developer who wants to get a better idea of how your site might look on the default Windows browser.

Currently in preview, Edge for Mac is likely to have a mainstream public release later in 2019. If you’re interested in trying it out, you can get it here.

You can read more about Privacy at Microsoft and read the company’s privacy policy.

Honorable mentions: Vivaldi and Tor Browser

Vivaldi is an oft-mentioned alternative browser for Windows, and they happen to make a Mac version, too. You can read more about its security and privacy and other features, and read the company’s privacy policy.

Tor Browser is often mentioned in discussions of private browsers. “Tor” was originally an acronym for “The Onion Router,” and the idea behind the Tor network is similar to the concept of a VPN, except with randomly chosen routes and “exit nodes” offered by many anonymous parties rather than a single company. While Tor was once considered a novel way to improve privacy, there are numerous privacy concerns about how the Tor network operates, not the least of which is that anyone—including malicious parties and intelligence agencies—can operate exit nodes to spy on Tor users. The Tor browser itself is based on Firefox ESR, and comes with several privacy-enhancing extensions such as NoScript and HTTPS Everywhere (which are also available for Firefox and Waterfox, and similar features are built into Brave). Strangely, the Tor Project doesn’t seem to have a privacy policy relating to the browser itself, but they do have a donor privacy policy.

Which browser to choose?

Choosing a web browser is a balance between convenience and security.

Safari is fairly advanced as far as privacy is concerned, and Apple has introduced a number of new features that prevent websites from getting too much of your data. You can reinforce this protection by installing extensions to block ads and trackers.

If privacy is particularly important to you, then Brave is a great choice, because it defaults to give out as little user data as possible and comes with built-in features that have to be added onto most other browsers.

But the question of compatibility and how you synchronize data across your devices means that you need to consider which web browsers also work on iOS, if you also use an iPhone, iPad, or iPod touch. See our companion article, Is Safari the most private browser for iPhone and iPad?

Related: How to use Private Browsing mode in Safari, Chrome, and Firefox

How can I learn more?

Each week on the Intego Mac Podcast, Intego’s Mac security experts discuss the latest Apple news, security and privacy stories, and offer practical advice on getting the most out of your Apple devices. Be sure to follow the podcast to make sure you don’t miss any episodes.

We discussed which browser is best for privacy and more in episode 90 of the Intego Mac Podcast.

You can also subscribe to our e-mail newsletter and keep an eye here on Mac Security Blog for the latest Apple security and privacy news. And don’t forget to follow Intego on your favorite social media channels: Facebook, Instagram, Twitter, and YouTube.

About Kirk McElhearn