|
|
|
|
@ -1,8 +1,7 @@
|
|
|
|
|
/******
|
|
|
|
|
* name: ghacks user.js
|
|
|
|
|
* date: 24 May 2020
|
|
|
|
|
* version 76
|
|
|
|
|
* authors: v52+ github | v51- www.ghacks.net
|
|
|
|
|
* date: 13 Aug 2020
|
|
|
|
|
* version 79
|
|
|
|
|
* url: https://github.com/ghacksuserjs/ghacks-user.js
|
|
|
|
|
* license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
|
|
|
|
|
|
|
|
|
|
@ -125,6 +124,9 @@ user_pref("browser.newtabpage.activity-stream.showSponsored", false);
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false); // [FF66+]
|
|
|
|
|
/* 0105d: disable Activity Stream recent Highlights in the Library [FF57+] ***/
|
|
|
|
|
// user_pref("browser.library.activity-stream.enabled", false);
|
|
|
|
|
/* 0105e: clear default topsites
|
|
|
|
|
* [NOTE] This does not block you from adding your own ***/
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.default.sites", "");
|
|
|
|
|
/* 0110: start Firefox in PB (Private Browsing) mode
|
|
|
|
|
* [NOTE] In this mode *all* windows are "private windows" and the PB mode icon is not displayed
|
|
|
|
|
* [WARNING] The P in PB mode is misleading: it means no "persistent" disk storage such as history,
|
|
|
|
|
@ -162,6 +164,13 @@ user_pref("geo.provider.use_gpsd", false); // [LINUX]
|
|
|
|
|
* i.e. ignore all of Mozilla's various search engines in multiple locales ***/
|
|
|
|
|
user_pref("browser.search.geoSpecificDefaults", false);
|
|
|
|
|
user_pref("browser.search.geoSpecificDefaults.url", "");
|
|
|
|
|
/* 0207: disable region updates
|
|
|
|
|
* [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/
|
|
|
|
|
user_pref("browser.region.network.url", ""); // [FF78+]
|
|
|
|
|
user_pref("browser.region.update.enabled", false); // [[FF79+]
|
|
|
|
|
/* 0208: set search region
|
|
|
|
|
* [NOTE] May not be hidden if Firefox has changed your settings due to your region (see 0207) ***/
|
|
|
|
|
// user_pref("browser.search.region", "US"); // [HIDDEN PREF]
|
|
|
|
|
|
|
|
|
|
/** LANGUAGE / LOCALE ***/
|
|
|
|
|
/* 0210: set preferred language for displaying web pages
|
|
|
|
|
@ -172,13 +181,6 @@ user_pref("intl.accept_languages", "en-US, en");
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/867501
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1629630 ***/
|
|
|
|
|
user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF]
|
|
|
|
|
/* 0212: enforce fallback text encoding to match en-US
|
|
|
|
|
* When the content or server doesn't declare a charset the browser will
|
|
|
|
|
* fallback to the "Current locale" based on your application language
|
|
|
|
|
* [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content
|
|
|
|
|
* [TEST] https://hsivonen.com/test/moz/check-charset.htm
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/20025 ***/
|
|
|
|
|
user_pref("intl.charset.fallback.override", "windows-1252");
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 0300]: QUIET FOX
|
|
|
|
|
Starting in user.js v67, we only disable the auto-INSTALL of Firefox. You still get prompts
|
|
|
|
|
@ -205,7 +207,7 @@ user_pref("app.update.auto", false);
|
|
|
|
|
// user_pref("extensions.getAddons.cache.enabled", false);
|
|
|
|
|
/* 0308: disable search engine updates (e.g. OpenSearch)
|
|
|
|
|
* [NOTE] This does not affect Mozilla's built-in or Web Extension search engines
|
|
|
|
|
* [SETTING] General>Firefox Updates>Automatically update search engines ***/
|
|
|
|
|
* [SETTING] General>Firefox Updates>Automatically update search engines (FF72-) ***/
|
|
|
|
|
user_pref("browser.search.update", false);
|
|
|
|
|
/* 0309: disable sending Flash crash reports ***/
|
|
|
|
|
user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
|
|
|
|
|
@ -344,17 +346,14 @@ user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
|
|
|
|
|
* Currently blocked by 'datareporting.healthreport.uploadEnabled' (see 0340) ***/
|
|
|
|
|
user_pref("browser.ping-centre.telemetry", false);
|
|
|
|
|
/* 0515: disable Screenshots
|
|
|
|
|
* alternatively in FF60+, disable uploading to the Screenshots server
|
|
|
|
|
* [1] https://github.com/mozilla-services/screenshots
|
|
|
|
|
* [2] https://www.ghacks.net/2017/05/28/firefox-screenshots-integrated-in-firefox-nightly/ ***/
|
|
|
|
|
* alternatively in FF60+, disable uploading to the Screenshots server ***/
|
|
|
|
|
// user_pref("extensions.screenshots.disabled", true); // [FF55+]
|
|
|
|
|
// user_pref("extensions.screenshots.upload-disabled", true); // [FF60+]
|
|
|
|
|
/* 0517: disable Form Autofill
|
|
|
|
|
* [NOTE] Stored data is NOT secure (uses a JSON file)
|
|
|
|
|
* [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes
|
|
|
|
|
* [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses (FF74+)
|
|
|
|
|
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill
|
|
|
|
|
* [2] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/ ***/
|
|
|
|
|
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/
|
|
|
|
|
user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+]
|
|
|
|
|
user_pref("extensions.formautofill.available", "off"); // [FF56+]
|
|
|
|
|
user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+]
|
|
|
|
|
@ -369,16 +368,14 @@ user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!");
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
|
|
|
|
|
user_pref("network.prefetch-next", false);
|
|
|
|
|
/* 0602: disable DNS prefetching
|
|
|
|
|
* [1] https://www.ghacks.net/2013/04/27/firefox-prefetching-what-you-need-to-know/
|
|
|
|
|
* [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
|
|
|
|
|
user_pref("network.dns.disablePrefetch", true);
|
|
|
|
|
user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF ESR] [DEFAULT: true FF70+]
|
|
|
|
|
/* 0603: disable predictor / prefetching ***/
|
|
|
|
|
user_pref("network.predictor.enabled", false);
|
|
|
|
|
user_pref("network.predictor.enable-prefetch", false); // [FF48+]
|
|
|
|
|
/* 0605: disable link-mouseover opening connection to linked server
|
|
|
|
|
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests
|
|
|
|
|
* [2] https://www.ghacks.net/2015/08/16/block-firefox-from-connecting-to-sites-when-you-hover-over-links/ ***/
|
|
|
|
|
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/
|
|
|
|
|
user_pref("network.http.speculative-parallel-limit", 0);
|
|
|
|
|
/* 0606: disable "Hyperlink Auditing" (click tracking) and enforce same host in case
|
|
|
|
|
* [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/
|
|
|
|
|
@ -390,7 +387,7 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost
|
|
|
|
|
/* 0701: disable IPv6
|
|
|
|
|
* IPv6 can be abused, especially regarding MAC addresses. They also do not play nice
|
|
|
|
|
* with VPNs. That's even assuming your ISP and/or router and/or website can handle it.
|
|
|
|
|
* Firefox telemetry (April 2019) shows only 5% of all connections are IPv6
|
|
|
|
|
* [STATS] Firefox telemetry (June 2020) shows only 5% of all connections are IPv6
|
|
|
|
|
* [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an
|
|
|
|
|
* OS/network level, and/or configured properly in VPN setups. If you are not masking your IP,
|
|
|
|
|
* then this won't make much difference. If you are masking your IP, then it can only help.
|
|
|
|
|
@ -426,17 +423,17 @@ user_pref("network.http.altsvc.oe", false);
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
|
|
|
|
|
user_pref("network.proxy.socks_remote_dns", true);
|
|
|
|
|
/* 0708: disable FTP [FF60+]
|
|
|
|
|
* [1] https://www.ghacks.net/2018/02/20/firefox-60-with-new-preference-to-disable-ftp/ ***/
|
|
|
|
|
* [1] https://www.fxsitecompat.dev/en-CA/docs/2020/ftp-support-will-be-removed/ ***/
|
|
|
|
|
// user_pref("network.ftp.enabled", false);
|
|
|
|
|
/* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+]
|
|
|
|
|
* [SETUP-CHROME] Can break extensions for profiles on network shares
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/26424 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/
|
|
|
|
|
user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF]
|
|
|
|
|
/* 0710: disable GIO as a potential proxy bypass vector
|
|
|
|
|
* Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda,
|
|
|
|
|
* gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1433507
|
|
|
|
|
* [2] https://trac.torproject.org/23044
|
|
|
|
|
* [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/23044
|
|
|
|
|
* [3] https://en.wikipedia.org/wiki/GVfs
|
|
|
|
|
* [4] https://en.wikipedia.org/wiki/GIO_(software) ***/
|
|
|
|
|
user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF]
|
|
|
|
|
@ -453,9 +450,8 @@ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!");
|
|
|
|
|
/* 0801: disable location bar using search
|
|
|
|
|
* Don't leak URL typos to a search engine, give an error message instead.
|
|
|
|
|
* Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com"
|
|
|
|
|
* [NOTE] Search buttons in the dropdown work, but hitting 'enter' in the location bar will fail
|
|
|
|
|
* [TIP] You can add keywords to search engines in options (e.g. 'd' for DuckDuckGo) and
|
|
|
|
|
* the dropdown will now auto-select it and you can then hit 'enter' and it will work
|
|
|
|
|
* [NOTE] This does **not** affect explicit user action such as using search buttons in the
|
|
|
|
|
* dropdown, or using keyword search shortcuts you configure in options (e.g. 'd' for DuckDuckGo)
|
|
|
|
|
* [SETUP-CHROME] If you don't, or rarely, type URLs, or you use a default search
|
|
|
|
|
* engine that respects privacy, then you probably don't need this ***/
|
|
|
|
|
user_pref("keyword.enabled", false);
|
|
|
|
|
@ -483,18 +479,20 @@ user_pref("layout.css.visited_links_enabled", false);
|
|
|
|
|
* [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/
|
|
|
|
|
user_pref("browser.search.suggest.enabled", false);
|
|
|
|
|
user_pref("browser.urlbar.suggest.searches", false);
|
|
|
|
|
/* 0809: disable location bar suggesting "preloaded" top websites [FF54+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1211726 ***/
|
|
|
|
|
user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
|
|
|
|
|
/* 0810: disable location bar making speculative connections [FF56+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1348275 ***/
|
|
|
|
|
user_pref("browser.urlbar.speculativeConnect.enabled", false);
|
|
|
|
|
/* 0811: disable location bar leaking single words to a DNS provider **after searching** [FF78+]
|
|
|
|
|
* 0=never resolve single words, 1=heuristic (default), 2=always resolve
|
|
|
|
|
* [NOTE] For FF78 value 1 and 2 are the same and always resolve but that will change in future versions
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1642623 ***/
|
|
|
|
|
user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);
|
|
|
|
|
/* 0850a: disable location bar suggestion types
|
|
|
|
|
* If all three suggestion types are false, search engine keywords are disabled
|
|
|
|
|
* [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest ***/
|
|
|
|
|
// user_pref("browser.urlbar.suggest.history", false);
|
|
|
|
|
// user_pref("browser.urlbar.suggest.bookmark", false);
|
|
|
|
|
// user_pref("browser.urlbar.suggest.openpage", false);
|
|
|
|
|
// user_pref("browser.urlbar.suggest.topsites", false); // [FF78+]
|
|
|
|
|
/* 0850c: disable location bar dropdown
|
|
|
|
|
* This value controls the total number of entries to appear in the location bar dropdown
|
|
|
|
|
* [NOTE] Items (bookmarks/history/openpages) with a high "frecency"/"bonus" will always
|
|
|
|
|
@ -506,9 +504,6 @@ user_pref("browser.urlbar.speculativeConnect.enabled", false);
|
|
|
|
|
/* 0850d: disable location bar autofill
|
|
|
|
|
* [1] https://support.mozilla.org/en-US/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/
|
|
|
|
|
// user_pref("browser.urlbar.autoFill", false);
|
|
|
|
|
/* 0850e: disable location bar one-off searches [FF51+]
|
|
|
|
|
* [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ ***/
|
|
|
|
|
// user_pref("browser.urlbar.oneOffSearches", false);
|
|
|
|
|
/* 0860: disable search and form history
|
|
|
|
|
* [SETUP-WEB] Be aware thet autocomplete form data can be read by third parties, see [1] [2]
|
|
|
|
|
* [NOTE] We also clear formdata on exit (see 2803)
|
|
|
|
|
@ -537,7 +532,7 @@ user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!");
|
|
|
|
|
/* 0902: use a master password
|
|
|
|
|
* There are no preferences for this. It is all handled internally.
|
|
|
|
|
* [SETTING] Privacy & Security>Logins and Passwords>Use a master password
|
|
|
|
|
* [1] https://support.mozilla.org/kb/use-master-password-protect-stored-logins ***/
|
|
|
|
|
* [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas ***/
|
|
|
|
|
/* 0903: set how often Firefox should ask for the master password
|
|
|
|
|
* 0=the first time (default), 1=every time it's needed, 2=every n minutes (see 0904) ***/
|
|
|
|
|
user_pref("security.ask_for_password", 2);
|
|
|
|
|
@ -583,7 +578,7 @@ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is m
|
|
|
|
|
* [NOTE] We also clear cache on exiting Firefox (see 2803) ***/
|
|
|
|
|
user_pref("browser.cache.disk.enable", false);
|
|
|
|
|
/* 1003: disable memory cache
|
|
|
|
|
/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes ***/
|
|
|
|
|
* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/
|
|
|
|
|
// user_pref("browser.cache.memory.enable", false);
|
|
|
|
|
// user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF ESR]
|
|
|
|
|
/* 1006: disable permissions manager from writing to disk [RESTART]
|
|
|
|
|
@ -591,9 +586,9 @@ user_pref("browser.cache.disk.enable", false);
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/967812 ***/
|
|
|
|
|
// user_pref("permissions.memory_only", true); // [HIDDEN PREF]
|
|
|
|
|
/* 1007: disable media cache from writing to disk in Private Browsing
|
|
|
|
|
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB */
|
|
|
|
|
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/
|
|
|
|
|
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+]
|
|
|
|
|
user_pref("media.memory_cache_max_size", 16384);
|
|
|
|
|
user_pref("media.memory_cache_max_size", 65536);
|
|
|
|
|
|
|
|
|
|
/** SESSIONS & SESSION RESTORE ***/
|
|
|
|
|
/* 1020: exclude "Undo Closed Tabs" in Session Restore ***/
|
|
|
|
|
@ -635,6 +630,8 @@ user_pref("browser.shell.shortcutFavicons", false);
|
|
|
|
|
/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS)
|
|
|
|
|
Your cipher and other settings can be used in server side fingerprinting
|
|
|
|
|
[TEST] https://www.ssllabs.com/ssltest/viewMyClient.html
|
|
|
|
|
[TEST] https://browserleaks.com/ssl
|
|
|
|
|
[TEST] https://ja3er.com/
|
|
|
|
|
[1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
|
|
|
|
|
@ -651,10 +648,10 @@ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
|
|
|
|
|
user_pref("security.ssl.require_safe_negotiation", true);
|
|
|
|
|
/* 1202: control TLS versions with min and max
|
|
|
|
|
* 1=TLS 1.0, 2=TLS 1.1, 3=TLS 1.2, 4=TLS 1.3
|
|
|
|
|
* [STATS] Firefox telemetry (June 2020) shows only 0.16% of SSL handshakes use 1.0 or 1.1
|
|
|
|
|
* [WARNING] Leave these at default, otherwise you alter your TLS fingerprint.
|
|
|
|
|
* Firefox telemetry (April 2020) shows only 0.25% of TLS web traffic uses 1.0 or 1.1
|
|
|
|
|
* [1] https://www.ssllabs.com/ssl-pulse/ ***/
|
|
|
|
|
// user_pref("security.tls.version.min", 3);
|
|
|
|
|
// user_pref("security.tls.version.min", 3); // [DEFAULT: 3 FF78+]
|
|
|
|
|
// user_pref("security.tls.version.max", 4);
|
|
|
|
|
/* 1203: enforce TLS 1.0 and 1.1 downgrades as session only */
|
|
|
|
|
user_pref("security.tls.version.enable-deprecated", false);
|
|
|
|
|
@ -713,7 +710,7 @@ user_pref("security.pki.sha1_enforcement_level", 1);
|
|
|
|
|
* 0=disable detecting Family Safety mode and importing the root
|
|
|
|
|
* 1=only attempt to detect Family Safety mode (don't import the root)
|
|
|
|
|
* 2=detect Family Safety mode and import the root
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/21686 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/
|
|
|
|
|
user_pref("security.family_safety.mode", 0);
|
|
|
|
|
/* 1222: disable intermediate certificate caching (fingerprinting attack vector) [FF41+] [RESTART]
|
|
|
|
|
* [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
|
|
|
|
|
@ -724,12 +721,12 @@ user_pref("security.family_safety.mode", 0);
|
|
|
|
|
* PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict
|
|
|
|
|
* [SETUP-WEB] If you rely on an AV (antivirus) to protect your web browsing
|
|
|
|
|
* by inspecting ALL your web traffic, then leave at current default=1
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/
|
|
|
|
|
user_pref("security.cert_pinning.enforcement_level", 2);
|
|
|
|
|
|
|
|
|
|
/** MIXED CONTENT ***/
|
|
|
|
|
/* 1240: disable insecure active content on https pages
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/
|
|
|
|
|
user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true]
|
|
|
|
|
/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/
|
|
|
|
|
user_pref("security.mixed_content.block_display_content", true);
|
|
|
|
|
@ -738,31 +735,42 @@ user_pref("security.mixed_content.block_display_content", true);
|
|
|
|
|
user_pref("security.mixed_content.block_object_subrequest", true);
|
|
|
|
|
/* 1244: enable https-only-mode [FF76+]
|
|
|
|
|
* [NOTE] This is experimental
|
|
|
|
|
* [SETTING] Privacy & Security>HTTPS-Only Mode (FF81+)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1613063 */
|
|
|
|
|
// user_pref("dom.security.https_only_mode", true);
|
|
|
|
|
// user_pref("dom.security.https_only_mode", true); // [FF76+]
|
|
|
|
|
// user_pref("dom.security.https_only_mode.upgrade_local", true); // [FF77+]
|
|
|
|
|
|
|
|
|
|
/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro] ***/
|
|
|
|
|
/* 1261: disable 3DES (effective key size < 128)
|
|
|
|
|
/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro]
|
|
|
|
|
* These are all the ciphers still using SHA-1 and CBC which are weaker than the available alternatives. (see "Cipher Suites" in [1])
|
|
|
|
|
* Additionally some have other weaknesses like key sizes of 128 (or lower) [2] and/or no Perfect Forward Secrecy [3].
|
|
|
|
|
* [1] https://browserleaks.com/ssl
|
|
|
|
|
* [2] https://en.wikipedia.org/wiki/Key_size
|
|
|
|
|
* [3] https://en.wikipedia.org/wiki/Forward_secrecy
|
|
|
|
|
***/
|
|
|
|
|
/* 1261: disable 3DES (effective key size < 128 and no PFS)
|
|
|
|
|
* [1] https://en.wikipedia.org/wiki/3des#Security
|
|
|
|
|
* [2] https://en.wikipedia.org/wiki/Meet-in-the-middle_attack
|
|
|
|
|
* [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/
|
|
|
|
|
// user_pref("security.ssl3.rsa_des_ede3_sha", false);
|
|
|
|
|
/* 1262: disable 128 bits ***/
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
|
|
|
|
|
/* 1263: disable DHE (Diffie-Hellman Key Exchange)
|
|
|
|
|
* [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_256_sha", false);
|
|
|
|
|
/* 1264: disable the remaining non-modern cipher suites as of FF52 ***/
|
|
|
|
|
// user_pref("security.ssl3.rsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.rsa_aes_256_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); // [DEFAULT: false FF78+]
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); // [DEFAULT: false FF78+]
|
|
|
|
|
/* 1264: disable the remaining non-modern cipher suites as of FF78 (in order of preferred by FF) ***/
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS
|
|
|
|
|
// user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS
|
|
|
|
|
|
|
|
|
|
/** UI (User Interface) ***/
|
|
|
|
|
/* 1270: display warning on the padlock for "broken security" (if 1201 is false)
|
|
|
|
|
* Bug: warning padlock not indicated for subresources on a secure page! [2]
|
|
|
|
|
* [STATS] SSL Labs (June 2020) reports 98.8% of sites have secure renegotiation [3]
|
|
|
|
|
* [1] https://wiki.mozilla.org/Security:Renegotiation
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1353705 ***/
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1353705
|
|
|
|
|
* [3] https://www.ssllabs.com/ssl-pulse/ ***/
|
|
|
|
|
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
|
|
|
|
|
/* 1271: control "Add Security Exception" dialog on SSL warnings
|
|
|
|
|
* 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default)
|
|
|
|
|
@ -786,7 +794,7 @@ user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!");
|
|
|
|
|
user_pref("browser.display.use_document_fonts", 0);
|
|
|
|
|
/* 1403: disable icon fonts (glyphs) and local fallback rendering
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/789788
|
|
|
|
|
* [2] https://trac.torproject.org/projects/tor/ticket/8455 ***/
|
|
|
|
|
* [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/
|
|
|
|
|
// user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+]
|
|
|
|
|
// user_pref("gfx.downloadable_fonts.fallback_delay", -1);
|
|
|
|
|
/* 1404: disable rendering of SVG OpenType fonts
|
|
|
|
|
@ -798,7 +806,8 @@ user_pref("gfx.font_rendering.opentype_svg.enabled", false);
|
|
|
|
|
* [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/
|
|
|
|
|
user_pref("gfx.font_rendering.graphite.enabled", false);
|
|
|
|
|
/* 1409: limit system font exposure to a whitelist [FF52+] [RESTART]
|
|
|
|
|
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
|
|
|
|
|
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed
|
|
|
|
|
* [NOTE] RFP in FF80+ restricts the whitelist to bundled and "Base Fonts" (see 4618)
|
|
|
|
|
* [WARNING] Creating your own probably highly-unique whitelist will raise your entropy.
|
|
|
|
|
* Eventually privacy.resistFingerprinting (see 4500) will cover this
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1121643 ***/
|
|
|
|
|
@ -881,8 +890,7 @@ user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies
|
|
|
|
|
/* 1803: disable Flash plugin
|
|
|
|
|
* 0=deactivated, 1=ask, 2=enabled
|
|
|
|
|
* ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash
|
|
|
|
|
* [NOTE] You can still override individual sites via site permissions
|
|
|
|
|
* [1] https://www.ghacks.net/2013/07/09/how-to-make-sure-that-a-firefox-plugin-never-activates-again/ ***/
|
|
|
|
|
* [NOTE] You can still override individual sites via site permissions ***/
|
|
|
|
|
user_pref("plugin.state.flash", 0);
|
|
|
|
|
/* 1820: disable GMP (Gecko Media Plugins)
|
|
|
|
|
* [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/
|
|
|
|
|
@ -905,7 +913,7 @@ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
|
|
|
|
|
* [1] https://www.privacytools.io/#webrtc ***/
|
|
|
|
|
user_pref("media.peerconnection.enabled", false);
|
|
|
|
|
/* 2002: limit WebRTC IP leaks if using WebRTC
|
|
|
|
|
* In FF70+ these settings match Mode 4 (Mode 3 in older versions) (see [3])
|
|
|
|
|
* In FF70+ these settings match Mode 4 (Mode 3 in older versions), see [3]
|
|
|
|
|
* [TEST] https://browserleaks.com/webrtc
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713
|
|
|
|
|
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy
|
|
|
|
|
@ -938,8 +946,11 @@ user_pref("media.getusermedia.audiocapture.enabled", false);
|
|
|
|
|
* [NOTE] You can set exceptions under site permissions
|
|
|
|
|
* [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/
|
|
|
|
|
// user_pref("media.autoplay.default", 5);
|
|
|
|
|
/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] ***/
|
|
|
|
|
user_pref("media.autoplay.enabled.user-gestures-needed", false);
|
|
|
|
|
/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+]
|
|
|
|
|
* 0=sticky (default), 1=transient, 2=user
|
|
|
|
|
* [NOTE] If you have trouble with some video sites, then add an exception (see 2030)
|
|
|
|
|
* [1] https://html.spec.whatwg.org/multipage/interaction.html#sticky-activation ***/
|
|
|
|
|
user_pref("media.autoplay.blocking_policy", 2);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!");
|
|
|
|
|
@ -959,7 +970,7 @@ user_pref("dom.disable_window_move_resize", true);
|
|
|
|
|
* This stops malicious window sizes and some screen resolution leaks.
|
|
|
|
|
* You can still right-click a link and open in a new window.
|
|
|
|
|
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
|
|
|
|
|
user_pref("browser.link.open_newwindow", 3);
|
|
|
|
|
user_pref("browser.link.open_newwindow.restriction", 0);
|
|
|
|
|
/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
|
|
|
|
|
@ -1033,9 +1044,8 @@ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!
|
|
|
|
|
* [NOTE] This will break some sites' functionality e.g. Outlook, Twitter, Facebook, Wordpress
|
|
|
|
|
* This applies to onCut/onCopy/onPaste events - i.e. it requires interaction with the website
|
|
|
|
|
* [WARNING] If both 'middlemouse.paste' and 'general.autoScroll' are true (at least one
|
|
|
|
|
* is default false) then enabling this pref can leak clipboard content, see [2]
|
|
|
|
|
* [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1528289 */
|
|
|
|
|
* is default false) then enabling this pref can leak clipboard content, see [1]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1528289 */
|
|
|
|
|
// user_pref("dom.event.clipboardevents.enabled", false);
|
|
|
|
|
/* 2404: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+]
|
|
|
|
|
* this disables document.execCommand("cut"/"copy") to protect your clipboard
|
|
|
|
|
@ -1075,7 +1085,7 @@ user_pref("javascript.options.wasm", false);
|
|
|
|
|
// user_pref("dom.IntersectionObserver.enabled", false);
|
|
|
|
|
/* 2429: enable (limited but sufficient) window.opener protection [FF65+]
|
|
|
|
|
* Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/
|
|
|
|
|
user_pref("dom.targetBlankNoOpener.enabled", true);
|
|
|
|
|
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!");
|
|
|
|
|
@ -1083,7 +1093,7 @@ user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is m
|
|
|
|
|
* Initially a Linux issue (high precision readout) that was fixed.
|
|
|
|
|
* However, it is still another metric for fingerprinting, used to raise entropy.
|
|
|
|
|
* e.g. do you have a battery or not, current charging status, charge level, times remaining etc
|
|
|
|
|
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1]
|
|
|
|
|
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code, see [1]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1313580 ***/
|
|
|
|
|
// user_pref("dom.battery.enabled", false);
|
|
|
|
|
/* 2505: disable media device enumeration [FF29+]
|
|
|
|
|
@ -1131,10 +1141,6 @@ user_pref("browser.helperApps.deleteTempFileOnExit", true);
|
|
|
|
|
/* 2604: disable page thumbnail collection
|
|
|
|
|
* look in profile/thumbnails directory - you may want to clean that out ***/
|
|
|
|
|
user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF]
|
|
|
|
|
/* 2605: block web content in file processes [FF55+]
|
|
|
|
|
* [SETUP-WEB] You may want to disable this for corporate or developer environments
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1343184 ***/
|
|
|
|
|
user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false); // [DEFAULT: false FF76+]
|
|
|
|
|
/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
|
|
|
|
|
user_pref("browser.uitour.enabled", false);
|
|
|
|
|
user_pref("browser.uitour.url", "");
|
|
|
|
|
@ -1143,8 +1149,8 @@ user_pref("browser.uitour.url", "");
|
|
|
|
|
* [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/
|
|
|
|
|
user_pref("devtools.chrome.enabled", false);
|
|
|
|
|
/* 2608: disable remote debugging
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/16222 ***/
|
|
|
|
|
user_pref("devtools.debugger.remote-enabled", false);
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
|
|
|
|
|
user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
|
|
|
|
|
/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN]
|
|
|
|
|
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1173199 ***/
|
|
|
|
|
@ -1155,7 +1161,7 @@ user_pref("devtools.debugger.remote-enabled", false);
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1216893 ***/
|
|
|
|
|
// user_pref("svg.disabled", true);
|
|
|
|
|
/* 2611: disable middle mouse click opening links from clipboard
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/10089 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/
|
|
|
|
|
user_pref("middlemouse.contentLoadURL", false);
|
|
|
|
|
/* 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS)
|
|
|
|
|
* [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins)
|
|
|
|
|
@ -1190,8 +1196,7 @@ user_pref("network.IDN_show_punycode", true);
|
|
|
|
|
* CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare)
|
|
|
|
|
* [SETTING] General>Applications>Portable Document Format (PDF) ***/
|
|
|
|
|
user_pref("pdfjs.disabled", false); // [DEFAULT: false]
|
|
|
|
|
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS]
|
|
|
|
|
* [1] https://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ ***/
|
|
|
|
|
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/
|
|
|
|
|
user_pref("network.protocol-handler.external.ms-windows-store", false);
|
|
|
|
|
/* 2622: enforce no system colors; they can be fingerprinted
|
|
|
|
|
* [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/
|
|
|
|
|
@ -1355,6 +1360,7 @@ user_pref("privacy.cpd.siteSettings", false); // Site Preferences
|
|
|
|
|
user_pref("privacy.sanitize.timeSpan", 0);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION)
|
|
|
|
|
4001: FPI
|
|
|
|
|
** 1278037 - isolate indexedDB (FF51+)
|
|
|
|
|
** 1277803 - isolate favicons (FF52+)
|
|
|
|
|
** 1264562 - isolate OCSP cache (FF52+)
|
|
|
|
|
@ -1373,22 +1379,29 @@ user_pref("privacy.sanitize.timeSpan", 0);
|
|
|
|
|
** 1506693 - isolate pdfjs range-based requests (FF68+)
|
|
|
|
|
** 1330467 - isolate site permissions (FF69+)
|
|
|
|
|
** 1534339 - isolate IPv6 (FF73+)
|
|
|
|
|
4003: NETWORK PARTITON
|
|
|
|
|
** 1647732 - isolate font cache (FF80+)
|
|
|
|
|
** 1649673 - isolate speculative connections (FF80+)
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
|
|
|
|
|
/* 4001: enable First Party Isolation [FF51+]
|
|
|
|
|
* [SETUP-WEB] May break cross-domain logins and site functionality until perfected
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1260931 ***/
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1260931
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1299996 [META] ***/
|
|
|
|
|
user_pref("privacy.firstparty.isolate", true);
|
|
|
|
|
/* 4002: enforce FPI restriction for window.opener [FF54+]
|
|
|
|
|
* [NOTE] Setting this to false may reduce the breakage in 4001
|
|
|
|
|
* FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But
|
|
|
|
|
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
|
|
|
|
|
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute, see [2],[3]
|
|
|
|
|
* The 2nd pref removes that limitation and will only allow communication if FPDs also match.
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1319773#c22
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1492607
|
|
|
|
|
* [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
|
|
|
|
|
// user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true]
|
|
|
|
|
// user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR]
|
|
|
|
|
/* 4003: enable site partitioning (FF78+)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1590107 [META] */
|
|
|
|
|
user_pref("privacy.partition.network_state", true);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING)
|
|
|
|
|
This master switch will be used for a wide range of items, many of which will
|
|
|
|
|
@ -1445,17 +1458,18 @@ user_pref("privacy.firstparty.isolate", true);
|
|
|
|
|
FF60: Fix keydown/keyup events (1438795)
|
|
|
|
|
** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
|
|
|
|
|
** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+)
|
|
|
|
|
** 1479239 - return "no-preference" with prefers-reduced-motion (FF63+)
|
|
|
|
|
** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+)
|
|
|
|
|
** 1479239 - return "no-preference" with prefers-reduced-motion (see 4614) (FF63+)
|
|
|
|
|
** 1363508 - spoof/suppress Pointer Events (see 4615) (FF64+)
|
|
|
|
|
FF65: pointerEvent.pointerid (1492766)
|
|
|
|
|
** 1485266 - disable exposure of system colors to CSS or canvas (see 4615) (FF67+)
|
|
|
|
|
** 1485266 - disable exposure of system colors to CSS or canvas (see 4616) (FF67+)
|
|
|
|
|
** 1407366 - enable inner window letterboxing (see 4504) (FF67+)
|
|
|
|
|
** 1494034 - return "light" with prefers-color-scheme (see 4616) (FF67+)
|
|
|
|
|
** 1494034 - return "light" with prefers-color-scheme (see 4617) (FF67+)
|
|
|
|
|
[1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme
|
|
|
|
|
** 1564422 - spoof audioContext outputLatency (FF70+)
|
|
|
|
|
** 1595823 - spoof audioContext sampleRate (FF72+)
|
|
|
|
|
** 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+)
|
|
|
|
|
** 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+)
|
|
|
|
|
** 1653987 - limit font visibility to bundled and "Base Fonts" (see 4618) (non-ANDROID) (FF80+)
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
|
|
|
|
|
/* 4501: enable privacy.resistFingerprinting [FF41+]
|
|
|
|
|
@ -1490,6 +1504,9 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF]
|
|
|
|
|
* When default true (FF62+) this no longer masks the RFP chrome resizing activity
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1448423 ***/
|
|
|
|
|
user_pref("browser.startup.blankWindow", false);
|
|
|
|
|
/* 4520: disable chrome animations [FF77+] [RESTART]
|
|
|
|
|
* [NOTE] pref added in FF63, but applied to chrome in FF77. RFP spoofs this for web content ***/
|
|
|
|
|
user_pref("ui.prefersReducedMotion", 1); // [HIDDEN PREF]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4600]: RFP ALTERNATIVES
|
|
|
|
|
* non-RFP users:
|
|
|
|
|
@ -1508,8 +1525,8 @@ user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan
|
|
|
|
|
// 4601: [2514] spoof (or limit?) number of CPU cores [FF48+]
|
|
|
|
|
// [NOTE] *may* affect core chrome/Firefox performance, will affect content.
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/1008453
|
|
|
|
|
// [2] https://trac.torproject.org/projects/tor/ticket/21675
|
|
|
|
|
// [3] https://trac.torproject.org/projects/tor/ticket/22127
|
|
|
|
|
// [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21675
|
|
|
|
|
// [3] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22127
|
|
|
|
|
// [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency
|
|
|
|
|
// user_pref("dom.maxHardwareConcurrency", 2);
|
|
|
|
|
// * * * /
|
|
|
|
|
@ -1521,7 +1538,7 @@ user_pref("dom.enable_resource_timing", false);
|
|
|
|
|
user_pref("dom.enable_performance", false);
|
|
|
|
|
// 4604: [2512] disable device sensor API
|
|
|
|
|
// Optional protection depending on your device
|
|
|
|
|
// [1] https://trac.torproject.org/projects/tor/ticket/15758
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15758
|
|
|
|
|
// [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/
|
|
|
|
|
// [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751
|
|
|
|
|
// user_pref("device.sensors.enabled", false);
|
|
|
|
|
@ -1532,7 +1549,7 @@ user_pref("dom.enable_performance", false);
|
|
|
|
|
user_pref("browser.zoom.siteSpecific", false);
|
|
|
|
|
// 4606: [2501] disable gamepad API - USB device ID enumeration
|
|
|
|
|
// Optional protection depending on your connected devices
|
|
|
|
|
// [1] https://trac.torproject.org/projects/tor/ticket/13023
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/13023
|
|
|
|
|
// user_pref("dom.gamepad.enabled", false);
|
|
|
|
|
// 4607: [2503] disable giving away network info [FF31+]
|
|
|
|
|
// e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none
|
|
|
|
|
@ -1548,7 +1565,7 @@ user_pref("media.webspeech.synth.enabled", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF57+
|
|
|
|
|
// 4610: [2506] disable video statistics - JS performance fingerprinting [FF25+]
|
|
|
|
|
// [1] https://trac.torproject.org/projects/tor/ticket/15757
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15757
|
|
|
|
|
// [2] https://bugzilla.mozilla.org/654550
|
|
|
|
|
user_pref("media.video_stats.enabled", false);
|
|
|
|
|
// 4611: [2509] disable touch events
|
|
|
|
|
@ -1556,7 +1573,7 @@ user_pref("media.video_stats.enabled", false);
|
|
|
|
|
// 0=disabled, 1=enabled, 2=autodetect
|
|
|
|
|
// Optional protection depending on your device
|
|
|
|
|
// [1] https://developer.mozilla.org/docs/Web/API/Touch_events
|
|
|
|
|
// [2] https://trac.torproject.org/projects/tor/ticket/10286
|
|
|
|
|
// [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10286
|
|
|
|
|
// user_pref("dom.w3c_touch_events.enabled", 0);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF59+
|
|
|
|
|
@ -1571,20 +1588,31 @@ user_pref("media.ondevicechange.enabled", false);
|
|
|
|
|
// [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info
|
|
|
|
|
user_pref("webgl.enable-debug-renderer-info", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF65+
|
|
|
|
|
// 4614: [2516] disable PointerEvents
|
|
|
|
|
// FF63+
|
|
|
|
|
// 4614: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART]
|
|
|
|
|
// 0=no-preference, 1=reduce
|
|
|
|
|
user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF]
|
|
|
|
|
// FF64+
|
|
|
|
|
// 4615: [2516] disable PointerEvents
|
|
|
|
|
// [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent
|
|
|
|
|
user_pref("dom.w3c_pointer_events.enabled", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF67+
|
|
|
|
|
// 4615: [2618] disable exposure of system colors to CSS or canvas [FF44+]
|
|
|
|
|
// 4616: [2618] disable exposure of system colors to CSS or canvas [FF44+]
|
|
|
|
|
// [NOTE] See second listed bug: may cause black on black for elements with undefined colors
|
|
|
|
|
// [SETUP-CHROME] Might affect CSS in themes and extensions
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876
|
|
|
|
|
user_pref("ui.use_standins_for_native_colors", true);
|
|
|
|
|
// 4616: enforce prefers-color-scheme as light [FF67+]
|
|
|
|
|
// 4617: enforce prefers-color-scheme as light [FF67+]
|
|
|
|
|
// 0=light, 1=dark : This overrides your OS value
|
|
|
|
|
user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF]
|
|
|
|
|
// FF80+
|
|
|
|
|
// 4618: limit font visbility (non-ANDROID) [FF79+]
|
|
|
|
|
// Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts, see [1]
|
|
|
|
|
// 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts
|
|
|
|
|
// [NOTE] Bundled fonts are auto-allowed
|
|
|
|
|
// [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc
|
|
|
|
|
user_pref("layout.css.font-visibility.level", 1);
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
@ -1593,8 +1621,8 @@ user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF]
|
|
|
|
|
to use RFP (4500) or an extension, in which case they become POINTLESS.
|
|
|
|
|
(a) Many of the components that make up your UA can be derived by other means.
|
|
|
|
|
And when those values differ, you provide more bits and raise entropy.
|
|
|
|
|
Examples of leaks include navigator objects, date locale/formats, iframes,
|
|
|
|
|
headers, tcp/ip attributes, feature detection, and **many** more.
|
|
|
|
|
Examples of leaks include workers, navigator objects, date locale/formats,
|
|
|
|
|
iframes, headers, tcp/ip attributes, feature detection, and **many** more.
|
|
|
|
|
ALL values below intentionally left blank - use RFP, or get a vetted, tested
|
|
|
|
|
extension and mimic RFP values to *lower* entropy, or randomize to *raise* it
|
|
|
|
|
***/
|
|
|
|
|
@ -1631,7 +1659,6 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
|
|
|
|
|
// user_pref("full-screen-api.warning.timeout", 0);
|
|
|
|
|
/* APPEARANCE ***/
|
|
|
|
|
// user_pref("browser.download.autohideButton", false); // [FF57+]
|
|
|
|
|
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
|
|
|
|
|
// user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent
|
|
|
|
|
/* CONTENT BEHAVIOR ***/
|
|
|
|
|
// user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type"
|
|
|
|
|
@ -1665,6 +1692,20 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
|
|
|
|
|
[1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
|
|
|
|
|
/* ESR78.x still uses all the following prefs
|
|
|
|
|
// [NOTE] replace the * with a slash in the line above to re-enable them
|
|
|
|
|
// FF79
|
|
|
|
|
// 0212: enforce fallback text encoding to match en-US
|
|
|
|
|
// When the content or server doesn't declare a charset the browser will
|
|
|
|
|
// fallback to the "Current locale" based on your application language
|
|
|
|
|
// [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content (FF72-)
|
|
|
|
|
// [TEST] https://hsivonen.com/test/moz/check-charset.htm
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1603712
|
|
|
|
|
user_pref("intl.charset.fallback.override", "windows-1252");
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
/* ESR68.x still uses all the following prefs
|
|
|
|
|
// [NOTE] replace the * with a slash in the line above to re-enable them
|
|
|
|
|
// FF69
|
|
|
|
|
@ -1728,6 +1769,24 @@ user_pref("webgl.disable-extensions", true);
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1618188
|
|
|
|
|
user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/");
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF77
|
|
|
|
|
// 0850e: disable location bar one-off searches [FF51+]
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1628926
|
|
|
|
|
// user_pref("browser.urlbar.oneOffSearches", false);
|
|
|
|
|
// 2605: block web content in file processes [FF55+]
|
|
|
|
|
// [SETUP-WEB] You may want to disable this for corporate or developer environments
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/1343184
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1603007
|
|
|
|
|
user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF78
|
|
|
|
|
// 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] - replaced by 'media.autoplay.blocking_policy'
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1509933
|
|
|
|
|
user_pref("media.autoplay.enabled.user-gestures-needed", false);
|
|
|
|
|
// 5000's: disable chrome animations - replaced FF77+ by 'ui.prefersReducedMotion' (4520)
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1640501
|
|
|
|
|
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
/* END: internal custom pref to test for syntax errors ***/
|
|
|
|
|
|
