jcs.org
iOS web browser with a focus on security and privacy
1###Endless
2
3[](https://itunes.apple.com/us/app/endless-browser/id974745755?mt=8)
4
5An open-source MobileSafari-like web browser for iOS ([wrapping around
6UIWebView](#infrequently-asked-questions)) with a design goal of increased security and privacy.
7
8Current builds are available for free in the
9[App Store](https://itunes.apple.com/us/app/endless-browser/id974745755?mt=8)
10and include (completely optional) in-app purchases to contribute to the funding
11of continued development.
12
13While this software is open source and you are free to modify it and use
14it on your own devices, redistribution of this software in binary
15form, with or without modification, is not permitted.
16Please see the [LICENSE](https://github.com/jcs/endless/blob/master/LICENSE)
17for redistribution terms.
18Commercial redistribution license exclusions are available; please
19[contact me](https://jcs.org/about) for more information.
20
21####Screenshots
22
23 
24
25####Basic browser functionality implemented:
26
27- Basics of entering URLs, following redirections, back, forward, cookie
28 storage, HTTP basic authentication
29
30- Multiple tabs with support for `window.open()` and `<a target="_blank">`
31 automatically opening new tab windows, but blocks calls not made via user
32 interaction events (similar to most desktop browser popup blockers)
33
34- Bookmark list with management, re-ordering, and editing
35
36- Custom long-press menu for links to open in a new tab, and to save images
37 to the device; shows image or link alt text (useful for sites like
38 [xkcd](http://xkcd.com/))
39
40- Swipe left and right to go back and forward
41
42- Search from URL bar with DDG, Google, or Startpage
43
44- Optional dark/night-time interface
45
46- Full hardware keyboard support for websites that support keyboard shortcuts,
47 as well as global shortcuts for common functions like Command+T for new tab,
48 Command+W to close, Command+L to focus URL field, etc.
49
50#####Security and privacy-focused features implemented:
51
52- Per-host/domain security and privacy settings:
53
54 - Disables SSL 2 and SSL 3 by default with a configurable minimum TLS
55 version to require from the host, such as TLS 1.2-only. Also disables
56 weak TLS ciphers.
57
58 - Configurable security policy:
59
60 - Open (default, normal browsing mode)
61
62 - No after-load connections (blocks XMLHTTPRequest/AJAX requests,
63 WebSockets, and \<video\> and \<audio\> elements)
64
65 - Strict (blocks all of the above plus embedded fonts and Javascript)
66
67 - Blocks mixed-content requests (http elements on an https page) unless
68 disabled (useful for RSS readers), shows broken padlock
69
70 - Blocks pages loaded from non-local networks (i.e., the internet) from
71 trying to load sub-requests (e.g., images, iframes, ajax) from hosts that
72 are on local IPv4 and IPv6 networks such as routers and other insecure
73 devices
74
75 - Defaults to only accepting cookies and local storage for the duration of
76 the session (until the last tab accessing that data closes) but allows
77 persistent storage from configured hosts
78
79- Auto-destroys non-whitelisted cookies and local storage (even within the same
80 tab) that has not been accessed by any other tab within a configurable amount
81 of time (defaults to 30 minutes) to improve privacy while browsing within a
82 long-running tab
83
84- Cookie and localStorage database listing and deletion per-host
85
86- Integrated full [HTTPS Everywhere](https://www.eff.org/HTTPS-EVERYWHERE)
87 ruleset to do on-the-fly URL rewriting to force requests over SSL where
88 supported, including setting the secure bit on received cookies and
89 auto-detection of redirection loops
90
91- HTTP Strict Transport Security (RFC6797) implementation (in addition to
92 WebKit's mystery built-in one) with Chromium's large preload list
93
94- Integrated URL blocker with a small included ruleset of behavior-tracking
95 advertising, analytics, and social networking widgets (this list is intended
96 for enhancing privacy and not to be an AdBlock-style comprehensive ad-blocking
97 list)
98
99- Shows locked padlock for fully SSL-encrypted URLs, and organization name for
100 sites with EV SSL certs
101
102- Integrated SSL certificate viewer by tapping on padlock icon, highlighting
103 weak SSL certificate signature algorithms and showing per-connection
104 negotiated TLS/SSL protocol version and cipher information
105
106- Optional sending of Do-Not-Track header on all requests
107
108- Integrated [1Password button](https://github.com/AgileBits/onepassword-app-extension)
109 to autofill website logins, passwords, credit card numbers, etc.; requires
110 the 1Password iOS app to be installed (and is not enabled if not installed)
111
112####Infrequently Asked Questions
113
1141. Why does this software still use UIWebView instead of the newer WKWebView?
115
116WKWebView was introduced in iOS 8 to replace UIWebView and it brought about a bunch of
117new features that are useful when creating a web browser (Firefox and Chrome for iOS
118both use WKWebView) such as page loading progress callbacks and a newer, faster
119Javascript engine. Unfortunately Apple [removed the ability](https://github.com/brave/browser-ios/issues/96)
120to use a custom NSURLProtocol class, which can intercept each request and response
121between the browser engine and the web server.
122
123This is a critical component to Endless and is how it does things like change TLS
124ciphers, block tracking scripts, and do restrictive CSP header manipulation.