Compare commits

...

36 Commits

Author SHA1 Message Date
e16ede1cdf 79-beta 2020-08-13 14:44:27 +00:00
6905187b3e 0207/0208: region/search (#989) 2020-08-13 04:39:38 +00:00
172118e61b RFP+Alts: fixup sequential numbering, see #987 2020-08-05 01:35:10 +00:00
8452edb94b 4600: see #987 2020-08-04 10:25:29 +00:00
0f6957bbd4 4600: add missing version section 2020-08-04 10:18:29 +00:00
8c2bcc0352 1007: bump to 64mb, see #941 2020-08-03 22:50:58 +00:00
bc832575d8 1003: kibibytes 2020-08-03 14:52:21 +00:00
c4b7e07691 4500: site partitioning 2020-08-02 01:47:48 +00:00
58fb1db838 HTTPS-Only Mode UI 2020-08-02 01:27:30 +00:00
2809854802 font visibility / RFP (#985) 2020-08-01 11:03:17 +00:00
091a71aade browser.urlbar.usepreloadedtopurls.enabled 2020-07-29 02:22:09 +00:00
117ab133b1 remove 0809
not deprecated, just hidden: default is false anyway
2020-07-29 02:19:20 +00:00
c4a06c4689 missing comma 2020-07-23 12:23:14 +00:00
0d27689c64 update to ESR78
and this time add the file extension
2020-07-23 12:22:20 +00:00
771e57480a Delete ghacks-clear-RFP-alternatives 2020-07-23 12:21:10 +00:00
f8fd03482d 79 deprecated 2020-07-23 11:19:49 +00:00
10cc1224d0 Create ghacks-clear-removed.js 2020-07-23 11:00:23 +00:00
52926cca7a Delete ghacks-clear-[removed].js 2020-07-23 10:59:19 +00:00
be64819ce7 update to ESR78 2020-07-23 10:58:22 +00:00
24c228df92 update to ESR78 2020-07-23 10:57:12 +00:00
892b3d9d69 Delete ghacks-clear-FF68inclusive-[deprecated].js 2020-07-23 10:53:38 +00:00
df21798b81 Delete ghacks-clear-FF68inclusive-[RFP-alternatives].js 2020-07-23 10:53:25 +00:00
46d03279d3 79 start, fixup 2429 default info 2020-07-22 12:35:13 +00:00
fe0af3bb34 remove 0709 duplicate, 78 final 2020-07-21 10:40:01 +00:00
84997386c1 78-beta 2020-07-20 05:24:18 +00:00
1a389c0214 dnsResolveSingleWordsAfterSearch (#968) 2020-07-10 10:09:13 +00:00
d0060fed3c 2031: use exceptions if you need to, #969 2020-07-08 13:18:38 +00:00
3d18af19e3 various, #959 (#967)
Co-authored-by: rusty-snake
2020-07-05 14:02:25 +00:00
b5b04454e0 0850a search keywords fixup 2020-07-01 03:46:52 +00:00
618f7bed3f 0850a: add top sites FF78+ 2020-06-29 15:49:11 +00:00
488a825626 update weak ciphers/tests etc, closes #931 (#963)
- adds the new tests including the non-JS JA3

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
Co-authored-by: earthlng <earthlng@users.noreply.github.com>
2020-06-28 15:48:13 +00:00
aaf6cb33d7 4617 restart
- at least for disabling chrome animations
2020-06-27 12:37:32 +00:00
77ecef8be3 78 deprecated, add 2032 (#962) 2020-06-27 12:16:57 +00:00
4be0a80720 update trac tor tickets (#958)
and some other minor tweaks
2020-06-24 17:26:25 +00:00
f573200aa8 ciphers in ESR78
[1496639](https://bugzilla.mozilla.org/show_bug.cgi?id=1496639)
2020-06-18 02:29:54 +00:00
48f258ff53 start 78-alpha 2020-06-14 10:28:32 +00:00
4 changed files with 168 additions and 79 deletions

View File

@ -1,7 +1,9 @@
/***
This will reset the preferences that are under sections 4600 & 4700 in the ghacks user.js
up to and including Firefox/ESR 68. These are the prefs that are no longer necessary,
or they conflict with, privacy.resistFingerprinting if you have that enabled.
Version: up to and including FF/ESR78
This will reset the preferences that are under sections 4600 & 4700 in the
ghacks user.js. These are the prefs that are no longer necessary, or they
conflict with, privacy.resistFingerprinting if you have that enabled.
For instructions see:
https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
@ -24,6 +26,8 @@
'webgl.enable-debug-renderer-info',
'dom.w3c_pointer_events.enabled',
'ui.use_standins_for_native_colors',
'ui.systemUsesDarkTheme',
'ui.prefersReducedMotion',
/* section 4700 */
'general.useragent.override',
'general.buildID.override',

View File

@ -1,6 +1,8 @@
/***
Version: up to and including FF/ESR78
This will reset the preferences that have been deprecated by Mozilla
and used in the ghacks user.js up to and including Firefox/ESR 68
and used in the ghacks user.js
It is in reverse order, so feel free to remove sections that do not apply
@ -12,6 +14,31 @@
let ops = [
/* deprecated */
/* 78 */
'media.autoplay.enabled.user-gestures-needed',
'toolkit.cosmeticAnimations.enabled',
/* 77 */
'browser.urlbar.oneOffSearches',
'browser.tabs.remote.allowLinkedWebInFileUriProcess',
/* 76 */
'extensions.blocklist.url',
/* 74 */
'geo.wifi.uri',
'geo.wifi.logging.enabled',
'privacy.userContext.longPressBehavior',
'webgl.disable-extensions',
/* 72 */
'browser.newtabpage.activity-stream.telemetry.ping.endpoint',
'toolkit.telemetry.hybridContent.enabled',
'dom.indexedDB.enabled',
/* 71 */
'devtools.webide.enabled',
'devtools.webide.autoinstallADBExtension',
'offline-apps.allow_by_default',
/* 69 */
'gfx.downloadable_fonts.woff2.enabled',
'plugins.click_to_play',
'media.autoplay.allow-muted',
/* 68 */
'browser.newtabpage.activity-stream.disableSnippets',
'browser.aboutHomeSnippets.updateUrl',

View File

@ -1,7 +1,7 @@
/***
This will reset the preferences that have been removed completely from the ghacks user.js.
Last updated: 12-April-2020
Last updated: 28-July-2020
For instructions see:
https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts]
@ -221,6 +221,8 @@
/* 75-beta */
'browser.search.geoip.url',
'browser.search.region',
/* 79-beta */
'browser.urlbar.usepreloadedtopurls.enabled',
/* reset parrot: check your open about:config after running the script */
'_user.js.parrot'
]

204
user.js
View File

@ -1,7 +1,7 @@
/******
* name: ghacks user.js
* date: 14 Jun 2020
* version 77
* date: 13 Aug 2020
* version 79-beta
* authors: v52+ github | v51- www.ghacks.net
* url: https://github.com/ghacksuserjs/ghacks-user.js
* license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
@ -125,6 +125,9 @@ user_pref("browser.newtabpage.activity-stream.showSponsored", false);
user_pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false); // [FF66+]
/* 0105d: disable Activity Stream recent Highlights in the Library [FF57+] ***/
// user_pref("browser.library.activity-stream.enabled", false);
/* 0105e: clear default topsites
* [NOTE] This does not block you from adding your own ***/
user_pref("browser.newtabpage.activity-stream.default.sites", "");
/* 0110: start Firefox in PB (Private Browsing) mode
* [NOTE] In this mode *all* windows are "private windows" and the PB mode icon is not displayed
* [WARNING] The P in PB mode is misleading: it means no "persistent" disk storage such as history,
@ -162,6 +165,13 @@ user_pref("geo.provider.use_gpsd", false); // [LINUX]
* i.e. ignore all of Mozilla's various search engines in multiple locales ***/
user_pref("browser.search.geoSpecificDefaults", false);
user_pref("browser.search.geoSpecificDefaults.url", "");
/* 0207: disable region updates
* [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/
user_pref("browser.region.network.url", ""); // [FF78+]
user_pref("browser.region.update.enabled", false); // [[FF79+]
/* 0208: set search region
* [NOTE] May not be hidden if Firefox has changed your settings due to your region (see 0207) ***/
// user_pref("browser.search.region", "US"); // [HIDDEN PREF]
/** LANGUAGE / LOCALE ***/
/* 0210: set preferred language for displaying web pages
@ -172,13 +182,6 @@ user_pref("intl.accept_languages", "en-US, en");
* [1] https://bugzilla.mozilla.org/867501
* [2] https://bugzilla.mozilla.org/1629630 ***/
user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF]
/* 0212: enforce fallback text encoding to match en-US
* When the content or server doesn't declare a charset the browser will
* fallback to the "Current locale" based on your application language
* [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content
* [TEST] https://hsivonen.com/test/moz/check-charset.htm
* [1] https://trac.torproject.org/projects/tor/ticket/20025 ***/
user_pref("intl.charset.fallback.override", "windows-1252");
/*** [SECTION 0300]: QUIET FOX
Starting in user.js v67, we only disable the auto-INSTALL of Firefox. You still get prompts
@ -205,7 +208,7 @@ user_pref("app.update.auto", false);
// user_pref("extensions.getAddons.cache.enabled", false);
/* 0308: disable search engine updates (e.g. OpenSearch)
* [NOTE] This does not affect Mozilla's built-in or Web Extension search engines
* [SETTING] General>Firefox Updates>Automatically update search engines ***/
* [SETTING] General>Firefox Updates>Automatically update search engines (FF72-) ***/
user_pref("browser.search.update", false);
/* 0309: disable sending Flash crash reports ***/
user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
@ -390,7 +393,7 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost
/* 0701: disable IPv6
* IPv6 can be abused, especially regarding MAC addresses. They also do not play nice
* with VPNs. That's even assuming your ISP and/or router and/or website can handle it.
* Firefox telemetry (April 2019) shows only 5% of all connections are IPv6
* [STATS] Firefox telemetry (June 2020) shows only 5% of all connections are IPv6
* [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an
* OS/network level, and/or configured properly in VPN setups. If you are not masking your IP,
* then this won't make much difference. If you are masking your IP, then it can only help.
@ -430,22 +433,17 @@ user_pref("network.proxy.socks_remote_dns", true);
// user_pref("network.ftp.enabled", false);
/* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+]
* [SETUP-CHROME] Can break extensions for profiles on network shares
* [1] https://trac.torproject.org/projects/tor/ticket/26424 ***/
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/
user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF]
/* 0710: disable GIO as a potential proxy bypass vector
* Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda,
* gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64)
* [1] https://bugzilla.mozilla.org/1433507
* [2] https://trac.torproject.org/23044
* [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/23044
* [3] https://en.wikipedia.org/wiki/GVfs
* [4] https://en.wikipedia.org/wiki/GIO_(software) ***/
user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF]
/*** [SECTION 0709]: HOTFIX for FF77, FIXED in FF78 ***/
/* 0709: disabling UNC can cause extension storage to fail
* [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/923 ***/
user_pref("network.file.disable_unc_paths", false); // [HIDDEN PREF]
/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS
Change items 0850 and above to suit for privacy vs convenience and functionality. Consider
your environment (no unwanted eyeballs), your device (restricted access), your device's
@ -458,9 +456,8 @@ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!");
/* 0801: disable location bar using search
* Don't leak URL typos to a search engine, give an error message instead.
* Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com"
* [NOTE] Search buttons in the dropdown work, but hitting 'enter' in the location bar will fail
* [TIP] You can add keywords to search engines in options (e.g. 'd' for DuckDuckGo) and
* the dropdown will now auto-select it and you can then hit 'enter' and it will work
* [NOTE] This does **not** affect explicit user action such as using search buttons in the
* dropdown, or using keyword search shortcuts you configure in options (e.g. 'd' for DuckDuckGo)
* [SETUP-CHROME] If you don't, or rarely, type URLs, or you use a default search
* engine that respects privacy, then you probably don't need this ***/
user_pref("keyword.enabled", false);
@ -488,18 +485,20 @@ user_pref("layout.css.visited_links_enabled", false);
* [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.urlbar.suggest.searches", false);
/* 0809: disable location bar suggesting "preloaded" top websites [FF54+]
* [1] https://bugzilla.mozilla.org/1211726 ***/
user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
/* 0810: disable location bar making speculative connections [FF56+]
* [1] https://bugzilla.mozilla.org/1348275 ***/
user_pref("browser.urlbar.speculativeConnect.enabled", false);
/* 0811: disable location bar leaking single words to a DNS provider **after searching** [FF78+]
* 0=never resolve single words, 1=heuristic (default), 2=always resolve
* [NOTE] For FF78 value 1 and 2 are the same and always resolve but that will change in future versions
* [1] https://bugzilla.mozilla.org/1642623 ***/
user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);
/* 0850a: disable location bar suggestion types
* If all three suggestion types are false, search engine keywords are disabled
* [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest ***/
// user_pref("browser.urlbar.suggest.history", false);
// user_pref("browser.urlbar.suggest.bookmark", false);
// user_pref("browser.urlbar.suggest.openpage", false);
// user_pref("browser.urlbar.suggest.topsites", false); // [FF78+]
/* 0850c: disable location bar dropdown
* This value controls the total number of entries to appear in the location bar dropdown
* [NOTE] Items (bookmarks/history/openpages) with a high "frecency"/"bonus" will always
@ -585,7 +584,7 @@ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is m
* [NOTE] We also clear cache on exiting Firefox (see 2803) ***/
user_pref("browser.cache.disk.enable", false);
/* 1003: disable memory cache
/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes ***/
* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/
// user_pref("browser.cache.memory.enable", false);
// user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF ESR]
/* 1006: disable permissions manager from writing to disk [RESTART]
@ -593,9 +592,9 @@ user_pref("browser.cache.disk.enable", false);
* [1] https://bugzilla.mozilla.org/967812 ***/
// user_pref("permissions.memory_only", true); // [HIDDEN PREF]
/* 1007: disable media cache from writing to disk in Private Browsing
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB */
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+]
user_pref("media.memory_cache_max_size", 16384);
user_pref("media.memory_cache_max_size", 65536);
/** SESSIONS & SESSION RESTORE ***/
/* 1020: exclude "Undo Closed Tabs" in Session Restore ***/
@ -637,6 +636,8 @@ user_pref("browser.shell.shortcutFavicons", false);
/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS)
Your cipher and other settings can be used in server side fingerprinting
[TEST] https://www.ssllabs.com/ssltest/viewMyClient.html
[TEST] https://browserleaks.com/ssl
[TEST] https://ja3er.com/
[1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
***/
user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
@ -653,10 +654,10 @@ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
user_pref("security.ssl.require_safe_negotiation", true);
/* 1202: control TLS versions with min and max
* 1=TLS 1.0, 2=TLS 1.1, 3=TLS 1.2, 4=TLS 1.3
* [STATS] Firefox telemetry (June 2020) shows only 0.16% of SSL handshakes use 1.0 or 1.1
* [WARNING] Leave these at default, otherwise you alter your TLS fingerprint.
* Firefox telemetry (April 2020) shows only 0.25% of TLS web traffic uses 1.0 or 1.1
* [1] https://www.ssllabs.com/ssl-pulse/ ***/
// user_pref("security.tls.version.min", 3);
// user_pref("security.tls.version.min", 3); // [DEFAULT: 3 FF78+]
// user_pref("security.tls.version.max", 4);
/* 1203: enforce TLS 1.0 and 1.1 downgrades as session only */
user_pref("security.tls.version.enable-deprecated", false);
@ -715,7 +716,7 @@ user_pref("security.pki.sha1_enforcement_level", 1);
* 0=disable detecting Family Safety mode and importing the root
* 1=only attempt to detect Family Safety mode (don't import the root)
* 2=detect Family Safety mode and import the root
* [1] https://trac.torproject.org/projects/tor/ticket/21686 ***/
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/
user_pref("security.family_safety.mode", 0);
/* 1222: disable intermediate certificate caching (fingerprinting attack vector) [FF41+] [RESTART]
* [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
@ -726,12 +727,12 @@ user_pref("security.family_safety.mode", 0);
* PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict
* [SETUP-WEB] If you rely on an AV (antivirus) to protect your web browsing
* by inspecting ALL your web traffic, then leave at current default=1
* [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/
user_pref("security.cert_pinning.enforcement_level", 2);
/** MIXED CONTENT ***/
/* 1240: disable insecure active content on https pages
* [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/
user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true]
/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/
user_pref("security.mixed_content.block_display_content", true);
@ -740,32 +741,42 @@ user_pref("security.mixed_content.block_display_content", true);
user_pref("security.mixed_content.block_object_subrequest", true);
/* 1244: enable https-only-mode [FF76+]
* [NOTE] This is experimental
* [SETTING] Privacy & Security>HTTPS-Only Mode (FF81+)
* [1] https://bugzilla.mozilla.org/1613063 */
// user_pref("dom.security.https_only_mode", true); // [FF76+]
// user_pref("dom.security.https_only_mode.upgrade_local", true); // [FF77+]
/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro] ***/
/* 1261: disable 3DES (effective key size < 128)
/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro]
* These are all the ciphers still using SHA-1 and CBC which are weaker than the available alternatives. (see "Cipher Suites" in [1])
* Additionally some have other weaknesses like key sizes of 128 (or lower) [2] and/or no Perfect Forward Secrecy [3].
* [1] https://browserleaks.com/ssl
* [2] https://en.wikipedia.org/wiki/Key_size
* [3] https://en.wikipedia.org/wiki/Forward_secrecy
***/
/* 1261: disable 3DES (effective key size < 128 and no PFS)
* [1] https://en.wikipedia.org/wiki/3des#Security
* [2] https://en.wikipedia.org/wiki/Meet-in-the-middle_attack
* [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/
// user_pref("security.ssl3.rsa_des_ede3_sha", false);
/* 1262: disable 128 bits ***/
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
/* 1263: disable DHE (Diffie-Hellman Key Exchange)
* [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/
// user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); // [DEFAULT: false FF79+]
// user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); // [DEFAULT: false FF79+]
/* 1264: disable the remaining non-modern cipher suites as of FF52 ***/
// user_pref("security.ssl3.rsa_aes_128_sha", false);
// user_pref("security.ssl3.rsa_aes_256_sha", false);
// user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); // [DEFAULT: false FF78+]
// user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); // [DEFAULT: false FF78+]
/* 1264: disable the remaining non-modern cipher suites as of FF78 (in order of preferred by FF) ***/
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
// user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS
// user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS
/** UI (User Interface) ***/
/* 1270: display warning on the padlock for "broken security" (if 1201 is false)
* Bug: warning padlock not indicated for subresources on a secure page! [2]
* [STATS] SSL Labs (June 2020) reports 98.8% of sites have secure renegotiation [3]
* [1] https://wiki.mozilla.org/Security:Renegotiation
* [2] https://bugzilla.mozilla.org/1353705 ***/
* [2] https://bugzilla.mozilla.org/1353705
* [3] https://www.ssllabs.com/ssl-pulse/ ***/
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
/* 1271: control "Add Security Exception" dialog on SSL warnings
* 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default)
@ -789,7 +800,7 @@ user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!");
user_pref("browser.display.use_document_fonts", 0);
/* 1403: disable icon fonts (glyphs) and local fallback rendering
* [1] https://bugzilla.mozilla.org/789788
* [2] https://trac.torproject.org/projects/tor/ticket/8455 ***/
* [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/
// user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+]
// user_pref("gfx.downloadable_fonts.fallback_delay", -1);
/* 1404: disable rendering of SVG OpenType fonts
@ -801,7 +812,8 @@ user_pref("gfx.font_rendering.opentype_svg.enabled", false);
* [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/
user_pref("gfx.font_rendering.graphite.enabled", false);
/* 1409: limit system font exposure to a whitelist [FF52+] [RESTART]
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed
* [NOTE] RFP in FF80+ restricts the whitelist to bundled and "Base Fonts" (see 4618)
* [WARNING] Creating your own probably highly-unique whitelist will raise your entropy.
* Eventually privacy.resistFingerprinting (see 4500) will cover this
* [1] https://bugzilla.mozilla.org/1121643 ***/
@ -908,7 +920,7 @@ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
* [1] https://www.privacytools.io/#webrtc ***/
user_pref("media.peerconnection.enabled", false);
/* 2002: limit WebRTC IP leaks if using WebRTC
* In FF70+ these settings match Mode 4 (Mode 3 in older versions) (see [3])
* In FF70+ these settings match Mode 4 (Mode 3 in older versions), see [3]
* [TEST] https://browserleaks.com/webrtc
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy
@ -941,8 +953,11 @@ user_pref("media.getusermedia.audiocapture.enabled", false);
* [NOTE] You can set exceptions under site permissions
* [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/
// user_pref("media.autoplay.default", 5);
/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] ***/
user_pref("media.autoplay.enabled.user-gestures-needed", false);
/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+]
* 0=sticky (default), 1=transient, 2=user
* [NOTE] If you have trouble with some video sites, then add an exception (see 2030)
* [1] https://html.spec.whatwg.org/multipage/interaction.html#sticky-activation ***/
user_pref("media.autoplay.blocking_policy", 2);
/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/
user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!");
@ -962,7 +977,7 @@ user_pref("dom.disable_window_move_resize", true);
* This stops malicious window sizes and some screen resolution leaks.
* You can still right-click a link and open in a new window.
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
* [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
user_pref("browser.link.open_newwindow", 3);
user_pref("browser.link.open_newwindow.restriction", 0);
/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
@ -1078,7 +1093,7 @@ user_pref("javascript.options.wasm", false);
// user_pref("dom.IntersectionObserver.enabled", false);
/* 2429: enable (limited but sufficient) window.opener protection [FF65+]
* Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF78+]
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+]
/*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/
user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!");
@ -1086,7 +1101,7 @@ user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is m
* Initially a Linux issue (high precision readout) that was fixed.
* However, it is still another metric for fingerprinting, used to raise entropy.
* e.g. do you have a battery or not, current charging status, charge level, times remaining etc
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1]
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code, see [1]
* [1] https://bugzilla.mozilla.org/1313580 ***/
// user_pref("dom.battery.enabled", false);
/* 2505: disable media device enumeration [FF29+]
@ -1142,7 +1157,7 @@ user_pref("browser.uitour.url", "");
* [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/
user_pref("devtools.chrome.enabled", false);
/* 2608: disable remote debugging
* [1] https://trac.torproject.org/projects/tor/ticket/16222 ***/
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN]
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc
@ -1154,7 +1169,7 @@ user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
* [1] https://bugzilla.mozilla.org/1216893 ***/
// user_pref("svg.disabled", true);
/* 2611: disable middle mouse click opening links from clipboard
* [1] https://trac.torproject.org/projects/tor/ticket/10089 ***/
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/
user_pref("middlemouse.contentLoadURL", false);
/* 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS)
* [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins)
@ -1354,6 +1369,7 @@ user_pref("privacy.cpd.siteSettings", false); // Site Preferences
user_pref("privacy.sanitize.timeSpan", 0);
/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION)
4001: FPI
** 1278037 - isolate indexedDB (FF51+)
** 1277803 - isolate favicons (FF52+)
** 1264562 - isolate OCSP cache (FF52+)
@ -1372,22 +1388,29 @@ user_pref("privacy.sanitize.timeSpan", 0);
** 1506693 - isolate pdfjs range-based requests (FF68+)
** 1330467 - isolate site permissions (FF69+)
** 1534339 - isolate IPv6 (FF73+)
4003: NETWORK PARTITON
** 1647732 - isolate font cache (FF80+)
** 1649673 - isolate speculative connections (FF80+)
***/
user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
/* 4001: enable First Party Isolation [FF51+]
* [SETUP-WEB] May break cross-domain logins and site functionality until perfected
* [1] https://bugzilla.mozilla.org/1260931 ***/
* [1] https://bugzilla.mozilla.org/1260931
* [2] https://bugzilla.mozilla.org/1299996 [META] ***/
user_pref("privacy.firstparty.isolate", true);
/* 4002: enforce FPI restriction for window.opener [FF54+]
* [NOTE] Setting this to false may reduce the breakage in 4001
* FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute, see [2],[3]
* The 2nd pref removes that limitation and will only allow communication if FPDs also match.
* [1] https://bugzilla.mozilla.org/1319773#c22
* [2] https://bugzilla.mozilla.org/1492607
* [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
// user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true]
// user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR]
/* 4003: enable site partitioning (FF78+)
* [1] https://bugzilla.mozilla.org/1590107 [META] */
user_pref("privacy.partition.network_state", true);
/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING)
This master switch will be used for a wide range of items, many of which will
@ -1444,17 +1467,18 @@ user_pref("privacy.firstparty.isolate", true);
FF60: Fix keydown/keyup events (1438795)
** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+)
** 1479239 - return "no-preference" with prefers-reduced-motion (see 4617) (FF63+)
** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+)
** 1479239 - return "no-preference" with prefers-reduced-motion (see 4614) (FF63+)
** 1363508 - spoof/suppress Pointer Events (see 4615) (FF64+)
FF65: pointerEvent.pointerid (1492766)
** 1485266 - disable exposure of system colors to CSS or canvas (see 4615) (FF67+)
** 1485266 - disable exposure of system colors to CSS or canvas (see 4616) (FF67+)
** 1407366 - enable inner window letterboxing (see 4504) (FF67+)
** 1494034 - return "light" with prefers-color-scheme (see 4616) (FF67+)
** 1494034 - return "light" with prefers-color-scheme (see 4617) (FF67+)
[1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme
** 1564422 - spoof audioContext outputLatency (FF70+)
** 1595823 - spoof audioContext sampleRate (FF72+)
** 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+)
** 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+)
** 1653987 - limit font visibility to bundled and "Base Fonts" (see 4618) (non-ANDROID) (FF80+)
***/
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
/* 4501: enable privacy.resistFingerprinting [FF41+]
@ -1489,6 +1513,9 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF]
* When default true (FF62+) this no longer masks the RFP chrome resizing activity
* [1] https://bugzilla.mozilla.org/1448423 ***/
user_pref("browser.startup.blankWindow", false);
/* 4520: disable chrome animations [FF77+] [RESTART]
* [NOTE] pref added in FF63, but applied to chrome in FF77. RFP spoofs this for web content ***/
user_pref("ui.prefersReducedMotion", 1); // [HIDDEN PREF]
/*** [SECTION 4600]: RFP ALTERNATIVES
* non-RFP users:
@ -1507,8 +1534,8 @@ user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan
// 4601: [2514] spoof (or limit?) number of CPU cores [FF48+]
// [NOTE] *may* affect core chrome/Firefox performance, will affect content.
// [1] https://bugzilla.mozilla.org/1008453
// [2] https://trac.torproject.org/projects/tor/ticket/21675
// [3] https://trac.torproject.org/projects/tor/ticket/22127
// [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21675
// [3] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22127
// [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency
// user_pref("dom.maxHardwareConcurrency", 2);
// * * * /
@ -1520,7 +1547,7 @@ user_pref("dom.enable_resource_timing", false);
user_pref("dom.enable_performance", false);
// 4604: [2512] disable device sensor API
// Optional protection depending on your device
// [1] https://trac.torproject.org/projects/tor/ticket/15758
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15758
// [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/
// [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751
// user_pref("device.sensors.enabled", false);
@ -1531,7 +1558,7 @@ user_pref("dom.enable_performance", false);
user_pref("browser.zoom.siteSpecific", false);
// 4606: [2501] disable gamepad API - USB device ID enumeration
// Optional protection depending on your connected devices
// [1] https://trac.torproject.org/projects/tor/ticket/13023
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/13023
// user_pref("dom.gamepad.enabled", false);
// 4607: [2503] disable giving away network info [FF31+]
// e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none
@ -1547,7 +1574,7 @@ user_pref("media.webspeech.synth.enabled", false);
// * * * /
// FF57+
// 4610: [2506] disable video statistics - JS performance fingerprinting [FF25+]
// [1] https://trac.torproject.org/projects/tor/ticket/15757
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15757
// [2] https://bugzilla.mozilla.org/654550
user_pref("media.video_stats.enabled", false);
// 4611: [2509] disable touch events
@ -1555,7 +1582,7 @@ user_pref("media.video_stats.enabled", false);
// 0=disabled, 1=enabled, 2=autodetect
// Optional protection depending on your device
// [1] https://developer.mozilla.org/docs/Web/API/Touch_events
// [2] https://trac.torproject.org/projects/tor/ticket/10286
// [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10286
// user_pref("dom.w3c_touch_events.enabled", 0);
// * * * /
// FF59+
@ -1570,23 +1597,31 @@ user_pref("media.ondevicechange.enabled", false);
// [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info
user_pref("webgl.enable-debug-renderer-info", false);
// * * * /
// FF65+
// 4614: [2516] disable PointerEvents
// FF63+
// 4614: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART]
// 0=no-preference, 1=reduce
user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF]
// FF64+
// 4615: [2516] disable PointerEvents
// [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent
user_pref("dom.w3c_pointer_events.enabled", false);
// * * * /
// FF67+
// 4615: [2618] disable exposure of system colors to CSS or canvas [FF44+]
// 4616: [2618] disable exposure of system colors to CSS or canvas [FF44+]
// [NOTE] See second listed bug: may cause black on black for elements with undefined colors
// [SETUP-CHROME] Might affect CSS in themes and extensions
// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876
user_pref("ui.use_standins_for_native_colors", true);
// 4616: enforce prefers-color-scheme as light [FF67+]
// 4617: enforce prefers-color-scheme as light [FF67+]
// 0=light, 1=dark : This overrides your OS value
user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF]
// 4617: enforce prefers-reduced-motion as no-preference [FF63+]
// 0=no-preference, 1=reduce
user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF]
// FF80+
// 4618: limit font visbility (non-ANDROID) [FF79+]
// Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts, see [1]
// 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts
// [NOTE] Bundled fonts are auto-allowed
// [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc
user_pref("layout.css.font-visibility.level", 1);
// * * * /
// ***/
@ -1633,7 +1668,6 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
// user_pref("full-screen-api.warning.timeout", 0);
/* APPEARANCE ***/
// user_pref("browser.download.autohideButton", false); // [FF57+]
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
// user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent
/* CONTENT BEHAVIOR ***/
// user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type"
@ -1667,6 +1701,20 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
[1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
***/
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
/* ESR78.x still uses all the following prefs
// [NOTE] replace the * with a slash in the line above to re-enable them
// FF79
// 0212: enforce fallback text encoding to match en-US
// When the content or server doesn't declare a charset the browser will
// fallback to the "Current locale" based on your application language
// [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content (FF72-)
// [TEST] https://hsivonen.com/test/moz/check-charset.htm
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025
// [-] https://bugzilla.mozilla.org/1603712
user_pref("intl.charset.fallback.override", "windows-1252");
// * * * /
// ***/
/* ESR68.x still uses all the following prefs
// [NOTE] replace the * with a slash in the line above to re-enable them
// FF69
@ -1741,6 +1789,14 @@ user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozi
// [-] https://bugzilla.mozilla.org/1603007
user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
// * * * /
// FF78
// 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] - replaced by 'media.autoplay.blocking_policy'
// [-] https://bugzilla.mozilla.org/1509933
user_pref("media.autoplay.enabled.user-gestures-needed", false);
// 5000's: disable chrome animations - replaced FF77+ by 'ui.prefersReducedMotion' (4520)
// [-] https://bugzilla.mozilla.org/1640501
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
// * * * /
// ***/
/* END: internal custom pref to test for syntax errors ***/