UR Browser

A browser built around privacy, on the same engine everything else uses, with the tracking removed and blocking switched on from the start. That was the proposition, and UR Browser assembled a reasonable set of parts around it.

UR Browser blocked advertising and trackers by default, resisted fingerprinting, offered three levels of protection to choose between, and stripped the mainstream browser’s reporting out of the base.

That approach survives in maintained software, and a browser running permanently in private mode takes the same position considerably further. Downloads were scanned before opening, and the default search options were the privacy-oriented ones rather than the usual.

For anybody comparing privacy browsers, that list reads well. Two things about it need stating before you decide anything.

The VPN that was not a VPN

The headline UR Browser feature was a built-in VPN, and independent security analysis found it was nothing of the sort.

What it actually provided was a plain proxy, and the connection between the browser and that proxy was not encrypted. A VPN encrypts traffic between your machine and the server, which is the entire point, and this did not.

That matters beyond the technical detail. Somebody choosing a browser specifically for privacy, on the strength of an encrypted tunnel being included, was getting an unencrypted relay while believing otherwise.

To be fair about what followed, the feature was removed once the finding was published, and the arrangement later changed to a separate paid service from another provider. The problem was corrected rather than defended.

For an actual tunnel covering the whole machine rather than a browser feature, Mullvad is designed around knowing as little about you as possible.

The engine underneath was behind

The second UR Browser finding matters more for a browser than it would for anything else.

The same analysis noted the base engine was several releases behind the current stable version. Each of those releases had closed security flaws, and a browser is the software most exposed to hostile input, since it fetches code from strangers and runs it thousands of times a day.

That is the structural problem every browser fork faces. Fixes come from upstream, the fork applies them to its own modifications, and the interval between the two is a window during which the fork carries a flaw the mainstream browser has already closed. A fork several releases behind is a wide window.

Slimjet occupies the same territory and faces the same arithmetic, which is worth weighing whenever a fork is the choice.

It appears to have stopped

UR Browser development has been quiet for a long time. Directories that track such things list it as discontinued, and there are reports of the download not working at all.

There was some indication of the project continuing at one point, so the picture is not entirely clear, and nothing suggests recent activity.

Among forks on the mainstream engine, Vivaldi is the maintained option, with a large organisation closing the gap between upstream fixes and its own releases.

For a browser that combination is decisive rather than a matter of preference. An engine already behind when it was current, plus years without maintenance, means the gap between it and a patched browser has only widened.

What to use instead

The UR Browser approach has better-maintained representatives now.

Firefox runs its own engine rather than a fork of somebody else’s, so its fixes are its own rather than inherited, and its privacy controls are thorough for anybody prepared to configure them.

Conclusion

UR Browser assembled the right list of features for the audience it wanted. Blocking by default, the mainstream reporting stripped out, scanned downloads and privacy-minded search options are all sensible choices, and the interface was pleasant.

Two findings sit against that. The feature it led with was not what it claimed, and the engine underneath was behind on security fixes while the project was still active. Add years of silence since and the case closes on its own. Choose something maintained, and if privacy is the reason, choose something whose central claim has been examined and held up.