|
|
|
|
@ -1,45 +1,42 @@
|
|
|
|
|
/******
|
|
|
|
|
* name: ghacks user.js
|
|
|
|
|
* date: 21 Jul 2020
|
|
|
|
|
* version 78
|
|
|
|
|
* authors: v52+ github | v51- www.ghacks.net
|
|
|
|
|
* url: https://github.com/ghacksuserjs/ghacks-user.js
|
|
|
|
|
* license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
|
|
|
|
|
|
|
|
|
|
* releases: These are end-of-stable-life-cycle legacy archives.
|
|
|
|
|
*Always* use the master branch user.js for a current up-to-date version
|
|
|
|
|
url: https://github.com/ghacksuserjs/ghacks-user.js/releases
|
|
|
|
|
* name: arkenfox user.js
|
|
|
|
|
* date: 12 Nov 2020
|
|
|
|
|
* version 82
|
|
|
|
|
* url: https://github.com/arkenfox/user.js
|
|
|
|
|
* license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt
|
|
|
|
|
|
|
|
|
|
* README:
|
|
|
|
|
|
|
|
|
|
0. Consider using Tor Browser if it meets your needs or fits your threat model better
|
|
|
|
|
1. Consider using Tor Browser if it meets your needs or fits your threat model better
|
|
|
|
|
* https://www.torproject.org/about/torusers.html.en
|
|
|
|
|
1. READ the full README
|
|
|
|
|
* https://github.com/ghacksuserjs/ghacks-user.js/blob/master/README.md
|
|
|
|
|
2. READ this
|
|
|
|
|
* https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.3-Implementation
|
|
|
|
|
3. If you skipped steps 1 and 2 above (shame on you), then here is the absolute minimum
|
|
|
|
|
* Real time binary checks with Google services are disabled (0412)
|
|
|
|
|
* You will still get prompts to update Firefox, but auto-installing them is disabled (0302a)
|
|
|
|
|
* Some user data is erased on close (section 2800). Change this to suit your needs
|
|
|
|
|
* EACH RELEASE check:
|
|
|
|
|
- 4600s: reset prefs made redundant due to privacy.resistFingerprinting (RPF)
|
|
|
|
|
or enable them as an alternative to RFP (or some of them for ESR users)
|
|
|
|
|
- 9999s: reset deprecated prefs in about:config or enable the relevant section for ESR
|
|
|
|
|
* Site breakage WILL happen
|
|
|
|
|
- There are often trade-offs and conflicts between Security vs Privacy vs Anti-Fingerprinting
|
|
|
|
|
and these need to be balanced against Functionality & Convenience & Breakage
|
|
|
|
|
* You will need to make changes, and to troubleshoot at times (choose wisely, there is always a trade-off).
|
|
|
|
|
While not 100% definitive, search for "[SETUP". If required, add each pref to your overrides section at
|
|
|
|
|
default values (or comment them out and reset them in about:config). Here are the main ones:
|
|
|
|
|
2. Required reading: Overview, Backing Up, Implementing, and Maintenance entries
|
|
|
|
|
* https://github.com/arkenfox/user.js/wiki
|
|
|
|
|
3. If you skipped step 2, return to step 2
|
|
|
|
|
4. Make changes
|
|
|
|
|
* There are often trade-offs and conflicts between security vs privacy vs anti-fingerprinting
|
|
|
|
|
and these need to be balanced against functionality & convenience & breakage
|
|
|
|
|
* Some site breakage and unintended consequences will happen. Everyone's experience will differ
|
|
|
|
|
e.g. some user data is erased on close (section 2800), change this to suit your needs
|
|
|
|
|
* While not 100% definitive, search for "[SETUP" tags
|
|
|
|
|
* Take the wiki link in step 2 and read the Troubleshooting entry
|
|
|
|
|
5. Some tag info
|
|
|
|
|
[SETUP-SECURITY] it's one item, read it
|
|
|
|
|
[SETUP-WEB] can cause some websites to break
|
|
|
|
|
[SETUP-CHROME] changes how Firefox itself behaves (i.e. NOT directly website related)
|
|
|
|
|
[SETUP-CHROME] changes how Firefox itself behaves (i.e. not directly website related)
|
|
|
|
|
[SETUP-PERF] may impact performance
|
|
|
|
|
[SETUP-HARDEN] maybe you should consider using the Tor Browser
|
|
|
|
|
* [WARNING] tags are extra special and used sparingly, so heed them
|
|
|
|
|
4. BACKUP your profile folder before implementing (and/or test in a new/cloned profile)
|
|
|
|
|
5. KEEP UP TO DATE: https://github.com/ghacksuserjs/ghacks-user.js/wiki#small_orange_diamond-maintenance
|
|
|
|
|
[WARNING] used sparingly, heed them
|
|
|
|
|
|
|
|
|
|
* RELEASES: https://github.com/arkenfox/user.js/releases
|
|
|
|
|
|
|
|
|
|
* It is best to use the arkenfox release that is optimized for and matches your Firefox version
|
|
|
|
|
* EVERYONE: each release
|
|
|
|
|
- run prefsCleaner or reset deprecated prefs (9999s) and prefs made redundant by RPF (4600s)
|
|
|
|
|
- re-enable section 4600 if you don't use RFP
|
|
|
|
|
ESR78
|
|
|
|
|
- If you are not using arkenfox v78... (not a definitive list)
|
|
|
|
|
- 1401: document fonts is inactive as it is now covered by RFP in FF80+
|
|
|
|
|
- 4600: some prefs may apply even if you use RFP (currently none apply as of FF84)
|
|
|
|
|
- 9999: switch the appropriate deprecated section(s) back on
|
|
|
|
|
|
|
|
|
|
* INDEX:
|
|
|
|
|
|
|
|
|
|
@ -69,7 +66,7 @@
|
|
|
|
|
4000: FPI (FIRST PARTY ISOLATION)
|
|
|
|
|
4500: RFP (RESIST FINGERPRINTING)
|
|
|
|
|
4600: RFP ALTERNATIVES
|
|
|
|
|
4700: RFP ALTERNATIVES (NAVIGATOR / USER AGENT (UA) SPOOFING)
|
|
|
|
|
4700: RFP ALTERNATIVES (USER AGENT SPOOFING)
|
|
|
|
|
5000: PERSONAL
|
|
|
|
|
9999: DEPRECATED / REMOVED / LEGACY / RENAMED
|
|
|
|
|
|
|
|
|
|
@ -117,7 +114,7 @@ user_pref("browser.newtabpage.activity-stream.telemetry", false);
|
|
|
|
|
* Runs code received from a server (aka Remote Code Execution) and sends information back to a metrics server
|
|
|
|
|
* [1] https://abouthome-snippets-service.readthedocs.io/ ***/
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "");
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "{}");
|
|
|
|
|
/* 0105c: disable Activity Stream Top Stories, Pocket-based and/or sponsored content ***/
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
|
|
|
|
|
@ -161,10 +158,13 @@ user_pref("geo.provider.network.url", "https://location.services.mozilla.com/v1/
|
|
|
|
|
user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
|
|
|
|
|
user_pref("geo.provider.use_corelocation", false); // [MAC]
|
|
|
|
|
user_pref("geo.provider.use_gpsd", false); // [LINUX]
|
|
|
|
|
/* 0206: disable geographically specific results/search engines e.g. "browser.search.*.US"
|
|
|
|
|
* i.e. ignore all of Mozilla's various search engines in multiple locales ***/
|
|
|
|
|
user_pref("browser.search.geoSpecificDefaults", false);
|
|
|
|
|
user_pref("browser.search.geoSpecificDefaults.url", "");
|
|
|
|
|
/* 0207: disable region updates
|
|
|
|
|
* [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/
|
|
|
|
|
user_pref("browser.region.network.url", ""); // [FF78+]
|
|
|
|
|
user_pref("browser.region.update.enabled", false); // [[FF79+]
|
|
|
|
|
/* 0208: set search region
|
|
|
|
|
* [NOTE] May not be hidden if Firefox has changed your settings due to your region (see 0207) ***/
|
|
|
|
|
// user_pref("browser.search.region", "US"); // [HIDDEN PREF]
|
|
|
|
|
|
|
|
|
|
/** LANGUAGE / LOCALE ***/
|
|
|
|
|
/* 0210: set preferred language for displaying web pages
|
|
|
|
|
@ -175,13 +175,6 @@ user_pref("intl.accept_languages", "en-US, en");
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/867501
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1629630 ***/
|
|
|
|
|
user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF]
|
|
|
|
|
/* 0212: enforce fallback text encoding to match en-US
|
|
|
|
|
* When the content or server doesn't declare a charset the browser will
|
|
|
|
|
* fallback to the "Current locale" based on your application language
|
|
|
|
|
* [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content (FF72-)
|
|
|
|
|
* [TEST] https://hsivonen.com/test/moz/check-charset.htm
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025 ***/
|
|
|
|
|
user_pref("intl.charset.fallback.override", "windows-1252");
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 0300]: QUIET FOX
|
|
|
|
|
Starting in user.js v67, we only disable the auto-INSTALL of Firefox. You still get prompts
|
|
|
|
|
@ -207,8 +200,7 @@ user_pref("app.update.auto", false);
|
|
|
|
|
* when false, extension detail tabs will have no description ***/
|
|
|
|
|
// user_pref("extensions.getAddons.cache.enabled", false);
|
|
|
|
|
/* 0308: disable search engine updates (e.g. OpenSearch)
|
|
|
|
|
* [NOTE] This does not affect Mozilla's built-in or Web Extension search engines
|
|
|
|
|
* [SETTING] General>Firefox Updates>Automatically update search engines (FF72-) ***/
|
|
|
|
|
* [NOTE] This does not affect Mozilla's built-in or Web Extension search engines ***/
|
|
|
|
|
user_pref("browser.search.update", false);
|
|
|
|
|
/* 0309: disable sending Flash crash reports ***/
|
|
|
|
|
user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
|
|
|
|
|
@ -346,20 +338,16 @@ user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
|
|
|
|
|
/* 0506: disable PingCentre telemetry (used in several System Add-ons) [FF57+]
|
|
|
|
|
* Currently blocked by 'datareporting.healthreport.uploadEnabled' (see 0340) ***/
|
|
|
|
|
user_pref("browser.ping-centre.telemetry", false);
|
|
|
|
|
/* 0515: disable Screenshots
|
|
|
|
|
* alternatively in FF60+, disable uploading to the Screenshots server
|
|
|
|
|
* [1] https://github.com/mozilla-services/screenshots
|
|
|
|
|
* [2] https://www.ghacks.net/2017/05/28/firefox-screenshots-integrated-in-firefox-nightly/ ***/
|
|
|
|
|
/* 0515: disable Screenshots ***/
|
|
|
|
|
// user_pref("extensions.screenshots.disabled", true); // [FF55+]
|
|
|
|
|
// user_pref("extensions.screenshots.upload-disabled", true); // [FF60+]
|
|
|
|
|
/* 0517: disable Form Autofill
|
|
|
|
|
* [NOTE] Stored data is NOT secure (uses a JSON file)
|
|
|
|
|
* [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes
|
|
|
|
|
* [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses (FF74+)
|
|
|
|
|
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill
|
|
|
|
|
* [2] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/ ***/
|
|
|
|
|
* [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses
|
|
|
|
|
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/
|
|
|
|
|
user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+]
|
|
|
|
|
user_pref("extensions.formautofill.available", "off"); // [FF56+]
|
|
|
|
|
user_pref("extensions.formautofill.creditCards.available", false); // [FF57+]
|
|
|
|
|
user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+]
|
|
|
|
|
user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+]
|
|
|
|
|
/* 0518: disable Web Compatibility Reporter [FF56+]
|
|
|
|
|
@ -372,33 +360,32 @@ user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!");
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
|
|
|
|
|
user_pref("network.prefetch-next", false);
|
|
|
|
|
/* 0602: disable DNS prefetching
|
|
|
|
|
* [1] https://www.ghacks.net/2013/04/27/firefox-prefetching-what-you-need-to-know/
|
|
|
|
|
* [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
|
|
|
|
|
user_pref("network.dns.disablePrefetch", true);
|
|
|
|
|
user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF ESR] [DEFAULT: true FF70+]
|
|
|
|
|
user_pref("network.dns.disablePrefetchFromHTTPS", true); // [DEFAULT: true]
|
|
|
|
|
/* 0603: disable predictor / prefetching ***/
|
|
|
|
|
user_pref("network.predictor.enabled", false);
|
|
|
|
|
user_pref("network.predictor.enable-prefetch", false); // [FF48+]
|
|
|
|
|
/* 0605: disable link-mouseover opening connection to linked server
|
|
|
|
|
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests
|
|
|
|
|
* [2] https://www.ghacks.net/2015/08/16/block-firefox-from-connecting-to-sites-when-you-hover-over-links/ ***/
|
|
|
|
|
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/
|
|
|
|
|
user_pref("network.http.speculative-parallel-limit", 0);
|
|
|
|
|
/* 0606: disable "Hyperlink Auditing" (click tracking) and enforce same host in case
|
|
|
|
|
/* 0606: enforce no "Hyperlink Auditing" (click tracking)
|
|
|
|
|
* [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/
|
|
|
|
|
user_pref("browser.send_pings", false); // [DEFAULT: false]
|
|
|
|
|
user_pref("browser.send_pings.require_same_host", true);
|
|
|
|
|
user_pref("browser.send_pings.require_same_host", true); // defense-in-depth
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 0700]: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc ***/
|
|
|
|
|
user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!");
|
|
|
|
|
/* 0701: disable IPv6
|
|
|
|
|
* IPv6 can be abused, especially regarding MAC addresses. They also do not play nice
|
|
|
|
|
* with VPNs. That's even assuming your ISP and/or router and/or website can handle it.
|
|
|
|
|
* IPv6 can be abused, especially with MAC addresses, and they do not play nice with VPNs. That's
|
|
|
|
|
* even assuming your ISP and/or router and/or website can handle it. Sites will fall back to IPv4
|
|
|
|
|
* [STATS] Firefox telemetry (June 2020) shows only 5% of all connections are IPv6
|
|
|
|
|
* [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an
|
|
|
|
|
* OS/network level, and/or configured properly in VPN setups. If you are not masking your IP,
|
|
|
|
|
* then this won't make much difference. If you are masking your IP, then it can only help.
|
|
|
|
|
* [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT"
|
|
|
|
|
* [TEST] https://ipleak.org/
|
|
|
|
|
* [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/437#issuecomment-403740626
|
|
|
|
|
* [1] https://github.com/arkenfox/user.js/issues/437#issuecomment-403740626
|
|
|
|
|
* [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/
|
|
|
|
|
user_pref("network.dns.disableIPv6", true);
|
|
|
|
|
/* 0702: disable HTTP2
|
|
|
|
|
@ -428,8 +415,7 @@ user_pref("network.http.altsvc.oe", false);
|
|
|
|
|
* as a remote Tor node will handle the DNS request
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
|
|
|
|
|
user_pref("network.proxy.socks_remote_dns", true);
|
|
|
|
|
/* 0708: disable FTP [FF60+]
|
|
|
|
|
* [1] https://www.ghacks.net/2018/02/20/firefox-60-with-new-preference-to-disable-ftp/ ***/
|
|
|
|
|
/* 0708: disable FTP [FF60+] ***/
|
|
|
|
|
// user_pref("network.ftp.enabled", false);
|
|
|
|
|
/* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+]
|
|
|
|
|
* [SETUP-CHROME] Can break extensions for profiles on network shares
|
|
|
|
|
@ -485,9 +471,6 @@ user_pref("layout.css.visited_links_enabled", false);
|
|
|
|
|
* [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/
|
|
|
|
|
user_pref("browser.search.suggest.enabled", false);
|
|
|
|
|
user_pref("browser.urlbar.suggest.searches", false);
|
|
|
|
|
/* 0809: disable location bar suggesting "preloaded" top websites [FF54+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1211726 ***/
|
|
|
|
|
user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
|
|
|
|
|
/* 0810: disable location bar making speculative connections [FF56+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1348275 ***/
|
|
|
|
|
user_pref("browser.urlbar.speculativeConnect.enabled", false);
|
|
|
|
|
@ -514,7 +497,7 @@ user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);
|
|
|
|
|
* [1] https://support.mozilla.org/en-US/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/
|
|
|
|
|
// user_pref("browser.urlbar.autoFill", false);
|
|
|
|
|
/* 0860: disable search and form history
|
|
|
|
|
* [SETUP-WEB] Be aware thet autocomplete form data can be read by third parties, see [1] [2]
|
|
|
|
|
* [SETUP-WEB] Be aware that autocomplete form data can be read by third parties, see [1] [2]
|
|
|
|
|
* [NOTE] We also clear formdata on exit (see 2803)
|
|
|
|
|
* [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history
|
|
|
|
|
* [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html
|
|
|
|
|
@ -538,20 +521,21 @@ user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!");
|
|
|
|
|
* [NOTE] This does not clear any passwords already saved
|
|
|
|
|
* [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/
|
|
|
|
|
// user_pref("signon.rememberSignons", false);
|
|
|
|
|
/* 0902: use a master password
|
|
|
|
|
/* 0902: use a primary password
|
|
|
|
|
* There are no preferences for this. It is all handled internally.
|
|
|
|
|
* [SETTING] Privacy & Security>Logins and Passwords>Use a master password
|
|
|
|
|
* [1] https://support.mozilla.org/kb/use-master-password-protect-stored-logins ***/
|
|
|
|
|
/* 0903: set how often Firefox should ask for the master password
|
|
|
|
|
* [SETTING] Privacy & Security>Logins and Passwords>Use a Primary Password
|
|
|
|
|
* [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas ***/
|
|
|
|
|
/* 0903: set how often Firefox should ask for the primary password
|
|
|
|
|
* 0=the first time (default), 1=every time it's needed, 2=every n minutes (see 0904) ***/
|
|
|
|
|
user_pref("security.ask_for_password", 2);
|
|
|
|
|
/* 0904: set how often in minutes Firefox should ask for the master password (see 0903)
|
|
|
|
|
/* 0904: set how often in minutes Firefox should ask for the primary password (see 0903)
|
|
|
|
|
* in minutes, default is 30 ***/
|
|
|
|
|
user_pref("security.password_lifetime", 5);
|
|
|
|
|
/* 0905: disable auto-filling username & password form fields
|
|
|
|
|
* can leak in cross-site forms *and* be spoofed
|
|
|
|
|
* [NOTE] Username & password is still available when you enter the field
|
|
|
|
|
* [SETTING] Privacy & Security>Logins and Passwords>Autofill logins and passwords ***/
|
|
|
|
|
* [SETTING] Privacy & Security>Logins and Passwords>Autofill logins and passwords
|
|
|
|
|
* [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ ***/
|
|
|
|
|
user_pref("signon.autofillForms", false);
|
|
|
|
|
/* 0909: disable formless login capture for Password Manager [FF51+] ***/
|
|
|
|
|
user_pref("signon.formlessCapture.enabled", false);
|
|
|
|
|
@ -559,8 +543,7 @@ user_pref("signon.formlessCapture.enabled", false);
|
|
|
|
|
* hardens against potential credentials phishing
|
|
|
|
|
* 0=don't allow sub-resources to open HTTP authentication credentials dialogs
|
|
|
|
|
* 1=don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs
|
|
|
|
|
* 2=allow sub-resources to open HTTP authentication credentials dialogs (default)
|
|
|
|
|
* [1] https://www.fxsitecompat.com/en-CA/docs/2015/http-auth-dialog-can-no-longer-be-triggered-by-cross-origin-resources/ ***/
|
|
|
|
|
* 2=allow sub-resources to open HTTP authentication credentials dialogs (default) ***/
|
|
|
|
|
user_pref("network.auth.subresource-http-auth-allow", 1);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 1000]: CACHE / SESSION (RE)STORE / FAVICONS
|
|
|
|
|
@ -577,7 +560,7 @@ user_pref("network.auth.subresource-http-auth-allow", 1);
|
|
|
|
|
[2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/
|
|
|
|
|
[3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache
|
|
|
|
|
[4] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
|
|
|
|
|
[5] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
|
|
|
|
|
[5] https://github.com/arkenfox/user.js/wiki/4.2.4-Header-Editor
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
|
|
|
|
|
/** CACHE ***/
|
|
|
|
|
@ -587,17 +570,18 @@ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is m
|
|
|
|
|
* [NOTE] We also clear cache on exiting Firefox (see 2803) ***/
|
|
|
|
|
user_pref("browser.cache.disk.enable", false);
|
|
|
|
|
/* 1003: disable memory cache
|
|
|
|
|
/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes ***/
|
|
|
|
|
* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/
|
|
|
|
|
// user_pref("browser.cache.memory.enable", false);
|
|
|
|
|
// user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF ESR]
|
|
|
|
|
// user_pref("browser.cache.memory.capacity", 0);
|
|
|
|
|
/* 1006: disable permissions manager from writing to disk [RESTART]
|
|
|
|
|
* [NOTE] This means any permission changes are session only
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/967812 ***/
|
|
|
|
|
// user_pref("permissions.memory_only", true); // [HIDDEN PREF]
|
|
|
|
|
/* 1007: disable media cache from writing to disk in Private Browsing
|
|
|
|
|
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB */
|
|
|
|
|
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB
|
|
|
|
|
* [SETUP-WEB] ESR78: playback might break on subsequent loading (1650281) ***/
|
|
|
|
|
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+]
|
|
|
|
|
user_pref("media.memory_cache_max_size", 16384);
|
|
|
|
|
user_pref("media.memory_cache_max_size", 65536);
|
|
|
|
|
|
|
|
|
|
/** SESSIONS & SESSION RESTORE ***/
|
|
|
|
|
/* 1020: exclude "Undo Closed Tabs" in Session Restore ***/
|
|
|
|
|
@ -660,7 +644,7 @@ user_pref("security.ssl.require_safe_negotiation", true);
|
|
|
|
|
* [STATS] Firefox telemetry (June 2020) shows only 0.16% of SSL handshakes use 1.0 or 1.1
|
|
|
|
|
* [WARNING] Leave these at default, otherwise you alter your TLS fingerprint.
|
|
|
|
|
* [1] https://www.ssllabs.com/ssl-pulse/ ***/
|
|
|
|
|
// user_pref("security.tls.version.min", 3); // [DEFAULT: 3 FF78+]
|
|
|
|
|
// user_pref("security.tls.version.min", 3); // [DEFAULT: 3]
|
|
|
|
|
// user_pref("security.tls.version.max", 4);
|
|
|
|
|
/* 1203: enforce TLS 1.0 and 1.1 downgrades as session only */
|
|
|
|
|
user_pref("security.tls.version.enable-deprecated", false);
|
|
|
|
|
@ -734,7 +718,7 @@ user_pref("security.family_safety.mode", 0);
|
|
|
|
|
user_pref("security.cert_pinning.enforcement_level", 2);
|
|
|
|
|
|
|
|
|
|
/** MIXED CONTENT ***/
|
|
|
|
|
/* 1240: disable insecure active content on https pages
|
|
|
|
|
/* 1240: enforce no insecure active content on https pages
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/
|
|
|
|
|
user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true]
|
|
|
|
|
/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/
|
|
|
|
|
@ -742,10 +726,15 @@ user_pref("security.mixed_content.block_display_content", true);
|
|
|
|
|
/* 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1190623 ***/
|
|
|
|
|
user_pref("security.mixed_content.block_object_subrequest", true);
|
|
|
|
|
/* 1244: enable https-only-mode [FF76+]
|
|
|
|
|
* [NOTE] This is experimental
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1613063 */
|
|
|
|
|
/* 1244: enable HTTPS-Only mode [FF76+]
|
|
|
|
|
* When "https_only_mode" (all windows) is true, "https_only_mode_pbm" (private windows only) is ignored
|
|
|
|
|
* [WARNING] This is experimental [1] and you can't set exceptions if FPI is enabled [2] (fixed in FF83)
|
|
|
|
|
* [SETTING] to add site exceptions: Page Info>Permissions>Use insecure HTTP (FF80+)
|
|
|
|
|
* [SETTING] Privacy & Security>HTTPS-Only Mode (FF80+ with browser.preferences.exposeHTTPSOnly = true)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1613063 [META]
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1647829 ***/
|
|
|
|
|
// user_pref("dom.security.https_only_mode", true); // [FF76+]
|
|
|
|
|
// user_pref("dom.security.https_only_mode_pbm", true); // [FF80+]
|
|
|
|
|
// user_pref("dom.security.https_only_mode.upgrade_local", true); // [FF77+]
|
|
|
|
|
|
|
|
|
|
/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro]
|
|
|
|
|
@ -760,10 +749,6 @@ user_pref("security.mixed_content.block_object_subrequest", true);
|
|
|
|
|
* [2] https://en.wikipedia.org/wiki/Meet-in-the-middle_attack
|
|
|
|
|
* [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/
|
|
|
|
|
// user_pref("security.ssl3.rsa_des_ede3_sha", false);
|
|
|
|
|
/* 1263: disable DHE (Diffie-Hellman Key Exchange)
|
|
|
|
|
* [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); // [DEFAULT: false FF78+]
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); // [DEFAULT: false FF78+]
|
|
|
|
|
/* 1264: disable the remaining non-modern cipher suites as of FF78 (in order of preferred by FF) ***/
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
|
|
|
|
|
@ -790,16 +775,16 @@ user_pref("browser.ssl_override_behavior", 1);
|
|
|
|
|
* [TEST] https://expired.badssl.com/ ***/
|
|
|
|
|
user_pref("browser.xul.error_pages.expert_bad_cert", true);
|
|
|
|
|
/* 1273: display "insecure" icon and "Not Secure" text on HTTP sites ***/
|
|
|
|
|
user_pref("security.insecure_connection_icon.enabled", true); // [FF59+] [DEFAULT: true FF70+]
|
|
|
|
|
// user_pref("security.insecure_connection_icon.enabled", true); // [FF59+] [DEFAULT: true]
|
|
|
|
|
user_pref("security.insecure_connection_text.enabled", true); // [FF60+]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 1400]: FONTS ***/
|
|
|
|
|
user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!");
|
|
|
|
|
/* 1401: disable websites choosing fonts (0=block, 1=allow)
|
|
|
|
|
* This can limit most (but not all) JS font enumeration which is a high entropy fingerprinting vector
|
|
|
|
|
* [SETUP-WEB] Can break some PDFs (missing text). Limiting to default fonts can "uglify" the web
|
|
|
|
|
* [WARNING] **DO NOT USE**: in FF80+ RFP covers this, and non-RFP users should use font vis (4618)
|
|
|
|
|
* [SETTING] General>Language and Appearance>Fonts & Colors>Advanced>Allow pages to choose... ***/
|
|
|
|
|
user_pref("browser.display.use_document_fonts", 0);
|
|
|
|
|
// user_pref("browser.display.use_document_fonts", 0);
|
|
|
|
|
/* 1403: disable icon fonts (glyphs) and local fallback rendering
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/789788
|
|
|
|
|
* [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/
|
|
|
|
|
@ -814,9 +799,9 @@ user_pref("gfx.font_rendering.opentype_svg.enabled", false);
|
|
|
|
|
* [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/
|
|
|
|
|
user_pref("gfx.font_rendering.graphite.enabled", false);
|
|
|
|
|
/* 1409: limit system font exposure to a whitelist [FF52+] [RESTART]
|
|
|
|
|
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
|
|
|
|
|
* [WARNING] Creating your own probably highly-unique whitelist will raise your entropy.
|
|
|
|
|
* Eventually privacy.resistFingerprinting (see 4500) will cover this
|
|
|
|
|
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed
|
|
|
|
|
* [WARNING] **DO NOT USE**: in FF80+ RFP covers this, and non-RFP users should use font vis (4618)
|
|
|
|
|
* [NOTE] In FF81+ the whitelist **overrides** RFP's font visibility (see 4618)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1121643 ***/
|
|
|
|
|
// user_pref("font.system.whitelist", ""); // [HIDDEN PREF]
|
|
|
|
|
|
|
|
|
|
@ -826,9 +811,7 @@ user_pref("gfx.font_rendering.graphite.enabled", false);
|
|
|
|
|
harden it a bit: set XOriginPolicy (1603) to 1 (as per the settings below)
|
|
|
|
|
harden it a bit more: set XOriginPolicy (1603) to 2 (and optionally 1604 to 1 or 2), expect breakage
|
|
|
|
|
---
|
|
|
|
|
If you want any REAL control over referers and breakage, then use an extension. Either:
|
|
|
|
|
uMatrix: limited by scope, all requests are spoofed or not-spoofed
|
|
|
|
|
Smart Referrer: granular with source<->destination, whitelists
|
|
|
|
|
If you want any REAL control over referers and breakage, then use an extension
|
|
|
|
|
---
|
|
|
|
|
full URI: https://example.com:8888/foo/bar.html?id=1234
|
|
|
|
|
scheme+host+port+path: https://example.com:8888/foo/bar.html
|
|
|
|
|
@ -897,8 +880,7 @@ user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies
|
|
|
|
|
/* 1803: disable Flash plugin
|
|
|
|
|
* 0=deactivated, 1=ask, 2=enabled
|
|
|
|
|
* ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash
|
|
|
|
|
* [NOTE] You can still override individual sites via site permissions
|
|
|
|
|
* [1] https://www.ghacks.net/2013/07/09/how-to-make-sure-that-a-firefox-plugin-never-activates-again/ ***/
|
|
|
|
|
* [NOTE] You can still override individual sites via site permissions ***/
|
|
|
|
|
user_pref("plugin.state.flash", 0);
|
|
|
|
|
/* 1820: disable GMP (Gecko Media Plugins)
|
|
|
|
|
* [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/
|
|
|
|
|
@ -921,7 +903,7 @@ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
|
|
|
|
|
* [1] https://www.privacytools.io/#webrtc ***/
|
|
|
|
|
user_pref("media.peerconnection.enabled", false);
|
|
|
|
|
/* 2002: limit WebRTC IP leaks if using WebRTC
|
|
|
|
|
* In FF70+ these settings match Mode 4 (Mode 3 in older versions) (see [3])
|
|
|
|
|
* In FF70+ these settings match Mode 4 (Mode 3 in older versions), see [3]
|
|
|
|
|
* [TEST] https://browserleaks.com/webrtc
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713
|
|
|
|
|
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy
|
|
|
|
|
@ -956,35 +938,26 @@ user_pref("media.getusermedia.audiocapture.enabled", false);
|
|
|
|
|
// user_pref("media.autoplay.default", 5);
|
|
|
|
|
/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+]
|
|
|
|
|
* 0=sticky (default), 1=transient, 2=user
|
|
|
|
|
* Firefox's Autoplay Policy Documentation [PDF] is linked below via SUMO
|
|
|
|
|
* [NOTE] If you have trouble with some video sites, then add an exception (see 2030)
|
|
|
|
|
* [1] https://html.spec.whatwg.org/multipage/interaction.html#sticky-activation ***/
|
|
|
|
|
* [1] https://support.mozilla.org/questions/1293231 ***/
|
|
|
|
|
user_pref("media.autoplay.blocking_policy", 2);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!");
|
|
|
|
|
/* 2201: prevent websites from disabling new window features ***/
|
|
|
|
|
user_pref("dom.disable_window_open_feature.close", true);
|
|
|
|
|
user_pref("dom.disable_window_open_feature.location", true); // [DEFAULT: true]
|
|
|
|
|
user_pref("dom.disable_window_open_feature.menubar", true);
|
|
|
|
|
user_pref("dom.disable_window_open_feature.minimizable", true);
|
|
|
|
|
user_pref("dom.disable_window_open_feature.personalbar", true); // bookmarks toolbar
|
|
|
|
|
user_pref("dom.disable_window_open_feature.resizable", true); // [DEFAULT: true]
|
|
|
|
|
user_pref("dom.disable_window_open_feature.status", true); // [DEFAULT: true]
|
|
|
|
|
user_pref("dom.disable_window_open_feature.titlebar", true);
|
|
|
|
|
user_pref("dom.disable_window_open_feature.toolbar", true);
|
|
|
|
|
/* 2202: prevent scripts from moving and resizing open windows ***/
|
|
|
|
|
user_pref("dom.disable_window_move_resize", true);
|
|
|
|
|
/* 2203: open links targeting new windows in a new tab instead
|
|
|
|
|
* This stops malicious window sizes and some screen resolution leaks.
|
|
|
|
|
* You can still right-click a link and open in a new window.
|
|
|
|
|
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
|
|
|
|
|
* [TEST] https://arkenfox.github.io/TZP/tzp.html#screen
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
|
|
|
|
|
user_pref("browser.link.open_newwindow", 3);
|
|
|
|
|
user_pref("browser.link.open_newwindow", 3); // 1=most recent window or tab 2=new window, 3=new tab
|
|
|
|
|
user_pref("browser.link.open_newwindow.restriction", 0);
|
|
|
|
|
/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
|
|
|
|
|
* [NOTE] You can still manually toggle the browser's fullscreen state (F11),
|
|
|
|
|
* but this pref will disable embedded video/game fullscreen controls, e.g. youtube
|
|
|
|
|
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen ***/
|
|
|
|
|
* [TEST] https://arkenfox.github.io/TZP/tzp.html#screen ***/
|
|
|
|
|
// user_pref("full-screen-api.enabled", false);
|
|
|
|
|
/* 2210: block popup windows
|
|
|
|
|
* [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/
|
|
|
|
|
@ -999,9 +972,6 @@ user_pref("dom.popup_allowed_events", "click dblclick");
|
|
|
|
|
including service and shared workers. Shared workers can be utilized by multiple scripts and
|
|
|
|
|
communicate between browsing contexts (windows/tabs/iframes) and can even control your cache.
|
|
|
|
|
|
|
|
|
|
[NOTE] uMatrix 1.2.0+ allows a per-scope control for workers (2301-deprecated) and service workers (2302)
|
|
|
|
|
#Required reading [#] https://github.com/gorhill/uMatrix/releases/tag/1.2.0
|
|
|
|
|
|
|
|
|
|
[1] Web Workers: https://developer.mozilla.org/docs/Web/API/Web_Workers_API
|
|
|
|
|
[2] Worker: https://developer.mozilla.org/docs/Web/API/Worker
|
|
|
|
|
[3] Service Worker: https://developer.mozilla.org/docs/Web/API/Service_Worker_API
|
|
|
|
|
@ -1052,9 +1022,8 @@ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!
|
|
|
|
|
* [NOTE] This will break some sites' functionality e.g. Outlook, Twitter, Facebook, Wordpress
|
|
|
|
|
* This applies to onCut/onCopy/onPaste events - i.e. it requires interaction with the website
|
|
|
|
|
* [WARNING] If both 'middlemouse.paste' and 'general.autoScroll' are true (at least one
|
|
|
|
|
* is default false) then enabling this pref can leak clipboard content, see [2]
|
|
|
|
|
* [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1528289 */
|
|
|
|
|
* is default false) then enabling this pref can leak clipboard content, see [1]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1528289 */
|
|
|
|
|
// user_pref("dom.event.clipboardevents.enabled", false);
|
|
|
|
|
/* 2404: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+]
|
|
|
|
|
* this disables document.execCommand("cut"/"copy") to protect your clipboard
|
|
|
|
|
@ -1083,18 +1052,18 @@ user_pref("javascript.options.asmjs", false);
|
|
|
|
|
// user_pref("javascript.options.ion", false);
|
|
|
|
|
// user_pref("javascript.options.baselinejit", false);
|
|
|
|
|
// user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF]
|
|
|
|
|
/* 2422: disable WebAssembly [FF52+] [SETUP-PERF]
|
|
|
|
|
* [NOTE] In FF71+ this no longer affects extensions (1576254)
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/WebAssembly ***/
|
|
|
|
|
/* 2422: disable WebAssembly [FF52+]
|
|
|
|
|
* Vulnerabilities have increasingly been found, including those known and fixed
|
|
|
|
|
* in native programs years ago [2]. WASM has powerful low-level access, making
|
|
|
|
|
* certain attacks (brute-force) and vulnerabilities more possible
|
|
|
|
|
* [STATS] ~0.2% of websites, about half of which are for crytopmining / malvertising [2][3]
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/WebAssembly
|
|
|
|
|
* [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly
|
|
|
|
|
* [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/
|
|
|
|
|
user_pref("javascript.options.wasm", false);
|
|
|
|
|
/* 2426: disable Intersection Observer API [FF55+]
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API
|
|
|
|
|
* [2] https://w3c.github.io/IntersectionObserver/
|
|
|
|
|
* [3] https://bugzilla.mozilla.org/1243846 ***/
|
|
|
|
|
// user_pref("dom.IntersectionObserver.enabled", false);
|
|
|
|
|
/* 2429: enable (limited but sufficient) window.opener protection [FF65+]
|
|
|
|
|
* Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/
|
|
|
|
|
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF78+]
|
|
|
|
|
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!");
|
|
|
|
|
@ -1102,7 +1071,7 @@ user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is m
|
|
|
|
|
* Initially a Linux issue (high precision readout) that was fixed.
|
|
|
|
|
* However, it is still another metric for fingerprinting, used to raise entropy.
|
|
|
|
|
* e.g. do you have a battery or not, current charging status, charge level, times remaining etc
|
|
|
|
|
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1]
|
|
|
|
|
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code, see [1]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1313580 ***/
|
|
|
|
|
// user_pref("dom.battery.enabled", false);
|
|
|
|
|
/* 2505: disable media device enumeration [FF29+]
|
|
|
|
|
@ -1138,7 +1107,7 @@ user_pref("dom.webaudio.enabled", false);
|
|
|
|
|
/*** [SECTION 2600]: MISCELLANEOUS ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!");
|
|
|
|
|
/* 2601: prevent accessibility services from accessing your browser [RESTART]
|
|
|
|
|
* [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser
|
|
|
|
|
* [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser (FF80 or lower)
|
|
|
|
|
* [1] https://support.mozilla.org/kb/accessibility-services ***/
|
|
|
|
|
user_pref("accessibility.force_disabled", 1);
|
|
|
|
|
/* 2602: disable sending additional analytics to web servers
|
|
|
|
|
@ -1157,15 +1126,14 @@ user_pref("browser.uitour.url", "");
|
|
|
|
|
* [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes
|
|
|
|
|
* [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/
|
|
|
|
|
user_pref("devtools.chrome.enabled", false);
|
|
|
|
|
/* 2608: disable remote debugging
|
|
|
|
|
/* 2608: reset remote debugging to disabled
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
|
|
|
|
|
user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
|
|
|
|
|
/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN]
|
|
|
|
|
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc
|
|
|
|
|
* [TEST] https://arkenfox.github.io/TZP/tzp.html#misc
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1173199 ***/
|
|
|
|
|
// user_pref("mathml.disabled", true);
|
|
|
|
|
/* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+]
|
|
|
|
|
* [NOTE] In FF70+ and ESR68.1.0+ this no longer affects extensions (1564208)
|
|
|
|
|
* [WARNING] Expect breakage incl. youtube player controls. Best left for a "hardened" profile.
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1216893 ***/
|
|
|
|
|
// user_pref("svg.disabled", true);
|
|
|
|
|
@ -1205,8 +1173,7 @@ user_pref("network.IDN_show_punycode", true);
|
|
|
|
|
* CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare)
|
|
|
|
|
* [SETTING] General>Applications>Portable Document Format (PDF) ***/
|
|
|
|
|
user_pref("pdfjs.disabled", false); // [DEFAULT: false]
|
|
|
|
|
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS]
|
|
|
|
|
* [1] https://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ ***/
|
|
|
|
|
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/
|
|
|
|
|
user_pref("network.protocol-handler.external.ms-windows-store", false);
|
|
|
|
|
/* 2622: enforce no system colors; they can be fingerprinted
|
|
|
|
|
* [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/
|
|
|
|
|
@ -1217,6 +1184,10 @@ user_pref("browser.display.use_system_colors", false); // [DEFAULT: false]
|
|
|
|
|
* for these will show/use their correct 3rd party origin
|
|
|
|
|
* [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion */
|
|
|
|
|
user_pref("permissions.delegation.enabled", false);
|
|
|
|
|
/* 2624: enable "window.name" protection [FF82+]
|
|
|
|
|
* If a new page from another domain is loaded into a tab, then window.name is set to an empty string. The original
|
|
|
|
|
* string is restored if the tab reverts back to the original page. This change prevents some cross-site attacks ***/
|
|
|
|
|
user_pref("privacy.window.name.update.enabled", true);
|
|
|
|
|
|
|
|
|
|
/** DOWNLOADS ***/
|
|
|
|
|
/* 2650: discourage downloading to desktop
|
|
|
|
|
@ -1276,14 +1247,13 @@ user_pref("security.dialog_enable_delay", 700);
|
|
|
|
|
user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!");
|
|
|
|
|
/* 2701: disable 3rd-party cookies and site-data [SETUP-WEB]
|
|
|
|
|
* 0=Accept cookies and site data, 1=(Block) All third-party cookies, 2=(Block) All cookies,
|
|
|
|
|
* 3=(Block) Cookies from unvisited websites, 4=(Block) Cross-site and social media trackers (FF63+) (default FF69+)
|
|
|
|
|
* 3=(Block) Cookies from unvisited websites, 4=(Block) Cross-site and social media trackers (default)
|
|
|
|
|
* [NOTE] You can set exceptions under site permissions or use an extension
|
|
|
|
|
* [NOTE] Enforcing category to custom ensures ETP related prefs are always honored
|
|
|
|
|
* [SETTING] Privacy & Security>Enhanced Tracking Protection>Custom>Cookies ***/
|
|
|
|
|
user_pref("network.cookie.cookieBehavior", 1);
|
|
|
|
|
user_pref("browser.contentblocking.category", "custom");
|
|
|
|
|
/* 2702: set third-party cookies (i.e ALL) (if enabled, see 2701) to session-only
|
|
|
|
|
and (FF58+) set third-party non-secure (i.e HTTP) cookies to session-only
|
|
|
|
|
/* 2702: set third-party cookies (if enabled, see 2701) to session-only
|
|
|
|
|
[NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and
|
|
|
|
|
.nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones
|
|
|
|
|
* [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/
|
|
|
|
|
@ -1315,6 +1285,8 @@ user_pref("browser.cache.offline.enable", false);
|
|
|
|
|
/* 2755: disable Storage Access API [FF65+]
|
|
|
|
|
* [1] https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API ***/
|
|
|
|
|
// user_pref("dom.storage_access.enabled", false);
|
|
|
|
|
/* 2760: enable Local Storage Next Generation (LSNG) [FF65+] ***/
|
|
|
|
|
user_pref("dom.storage.next_gen", true);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 2800]: SHUTDOWN
|
|
|
|
|
You should set the values to what suits you best.
|
|
|
|
|
@ -1370,107 +1342,105 @@ user_pref("privacy.cpd.siteSettings", false); // Site Preferences
|
|
|
|
|
user_pref("privacy.sanitize.timeSpan", 0);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION)
|
|
|
|
|
** 1278037 - isolate indexedDB (FF51+)
|
|
|
|
|
** 1277803 - isolate favicons (FF52+)
|
|
|
|
|
** 1264562 - isolate OCSP cache (FF52+)
|
|
|
|
|
** 1268726 - isolate Shared Workers (FF52+)
|
|
|
|
|
** 1316283 - isolate SSL session cache (FF52+)
|
|
|
|
|
** 1317927 - isolate media cache (FF53+)
|
|
|
|
|
** 1323644 - isolate HSTS and HPKP (FF54+)
|
|
|
|
|
** 1334690 - isolate HTTP Alternative Services (FF54+)
|
|
|
|
|
** 1334693 - isolate SPDY/HTTP2 (FF55+)
|
|
|
|
|
** 1337893 - isolate DNS cache (FF55+)
|
|
|
|
|
** 1344170 - isolate blob: URI (FF55+)
|
|
|
|
|
** 1300671 - isolate data:, about: URLs (FF55+)
|
|
|
|
|
** 1473247 - isolate IP addresses (FF63+)
|
|
|
|
|
** 1492607 - isolate postMessage with targetOrigin "*" (requires 4002) (FF65+)
|
|
|
|
|
** 1542309 - isolate top-level domain URLs when host is in the public suffix list (FF68+)
|
|
|
|
|
** 1506693 - isolate pdfjs range-based requests (FF68+)
|
|
|
|
|
** 1330467 - isolate site permissions (FF69+)
|
|
|
|
|
** 1534339 - isolate IPv6 (FF73+)
|
|
|
|
|
1278037 - indexedDB (FF51+)
|
|
|
|
|
1277803 - favicons (FF52+)
|
|
|
|
|
1264562 - OCSP cache (FF52+)
|
|
|
|
|
1268726 - Shared Workers (FF52+)
|
|
|
|
|
1316283 - SSL session cache (FF52+)
|
|
|
|
|
1317927 - media cache (FF53+)
|
|
|
|
|
1323644 - HSTS and HPKP (FF54+)
|
|
|
|
|
1334690 - HTTP Alternative Services (FF54+)
|
|
|
|
|
1334693 - SPDY/HTTP2 (FF55+)
|
|
|
|
|
1337893 - DNS cache (FF55+)
|
|
|
|
|
1344170 - blob: URI (FF55+)
|
|
|
|
|
1300671 - data:, about: URLs (FF55+)
|
|
|
|
|
1473247 - IP addresses (FF63+)
|
|
|
|
|
1492607 - postMessage with targetOrigin "*" (requires 4002) (FF65+)
|
|
|
|
|
1542309 - top-level domain URLs when host is in the public suffix list (FF68+)
|
|
|
|
|
1506693 - pdfjs range-based requests (FF68+)
|
|
|
|
|
1330467 - site permissions (FF69+)
|
|
|
|
|
1534339 - IPv6 (FF73+)
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
|
|
|
|
|
/* 4001: enable First Party Isolation [FF51+]
|
|
|
|
|
* [SETUP-WEB] May break cross-domain logins and site functionality until perfected
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1260931 ***/
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1260931
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1299996 [META] ***/
|
|
|
|
|
user_pref("privacy.firstparty.isolate", true);
|
|
|
|
|
/* 4002: enforce FPI restriction for window.opener [FF54+]
|
|
|
|
|
* [NOTE] Setting this to false may reduce the breakage in 4001
|
|
|
|
|
* FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But
|
|
|
|
|
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
|
|
|
|
|
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute, see [2],[3]
|
|
|
|
|
* The 2nd pref removes that limitation and will only allow communication if FPDs also match.
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1319773#c22
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1492607
|
|
|
|
|
* [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
|
|
|
|
|
// user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true]
|
|
|
|
|
// user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR]
|
|
|
|
|
// user_pref("privacy.firstparty.isolate.block_post_message", true);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING)
|
|
|
|
|
This master switch will be used for a wide range of items, many of which will
|
|
|
|
|
**override** existing prefs from FF55+, often providing a **better** solution
|
|
|
|
|
RFP covers a wide range of ongoing fingerprinting solutions.
|
|
|
|
|
It is an all-or-nothing buy in: you cannot pick and choose what parts you want
|
|
|
|
|
|
|
|
|
|
IMPORTANT: As existing prefs become redundant, and some of them WILL interfere
|
|
|
|
|
with how RFP works, they will be moved to section 4600 and made inactive
|
|
|
|
|
[WARNING] Do NOT use extensions to alter RFP protected metrics
|
|
|
|
|
[WARNING] Do NOT use prefs in section 4600 with RFP as they can interfere
|
|
|
|
|
|
|
|
|
|
** 418986 - limit window.screen & CSS media queries leaking identifiable info (FF41+)
|
|
|
|
|
[NOTE] Info only: To set a size, open a XUL (chrome) page (such as about:config) which is at
|
|
|
|
|
100% zoom, hit Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run.
|
|
|
|
|
Test your window size, do some math, resize to allow for all the non inner window elements
|
|
|
|
|
[TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
|
|
|
|
|
** 1281949 - spoof screen orientation (FF50+)
|
|
|
|
|
** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+)
|
|
|
|
|
FF53: Fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044)
|
|
|
|
|
** 1330890 - spoof timezone as UTC 0 (FF55+)
|
|
|
|
|
FF58: Date.toLocaleFormat deprecated (818634)
|
|
|
|
|
FF60: Date.toLocaleDateString and Intl.DateTimeFormat fixed (1409973)
|
|
|
|
|
** 1360039 - spoof navigator.hardwareConcurrency as 2 (see 4601) (FF55+)
|
|
|
|
|
This spoof *shouldn't* affect core chrome/Firefox performance
|
|
|
|
|
** 1217238 - reduce precision of time exposed by javascript (FF55+)
|
|
|
|
|
** 1369303 - spoof/disable performance API (see 2410-deprecated, 4602, 4603) (FF56+)
|
|
|
|
|
** 1333651 & 1383495 & 1396468 - spoof User Agent & Navigator API (see section 4700) (FF56+)
|
|
|
|
|
FF56: Version: rounded down to the nearest multiple of 10
|
|
|
|
|
FF57: Version: match current ESR (1393283, 1418672, 1418162, 1511763)
|
|
|
|
|
FF59: OS: Windows, OSX, Android, or Linux (to reduce breakage) (1404608)
|
|
|
|
|
FF66: OS: HTTP Headers reduced to Windows or Android (1509829)
|
|
|
|
|
FF68: OS: updated to Windows 10, OS 10.14, and Android 8.1 (1511434)
|
|
|
|
|
FF78: OS: updated to OS 10.15 and Android 9.0 (1635011)
|
|
|
|
|
** 1369319 - disable device sensor API (see 4604) (FF56+)
|
|
|
|
|
** 1369357 - disable site specific zoom (see 4605) (FF56+)
|
|
|
|
|
** 1337161 - hide gamepads from content (see 4606) (FF56+)
|
|
|
|
|
** 1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true (see 4607) (FF56+)
|
|
|
|
|
** 1333641 - reduce fingerprinting in WebSpeech API (see 4608) (FF56+)
|
|
|
|
|
** 1372069 & 1403813 & 1441295 - block geolocation requests (same as denying a site permission) (see 0201, 0202) (FF56-62)
|
|
|
|
|
** 1369309 - spoof media statistics (see 4610) (FF57+)
|
|
|
|
|
** 1382499 - reduce screen co-ordinate fingerprinting in Touch API (see 4611) (FF57+)
|
|
|
|
|
** 1217290 & 1409677 - enable fingerprinting resistance for WebGL (see 2010-12) (FF57+)
|
|
|
|
|
** 1382545 - reduce fingerprinting in Animation API (FF57+)
|
|
|
|
|
** 1354633 - limit MediaError.message to a whitelist (FF57+)
|
|
|
|
|
** 1382533 - enable fingerprinting resistance for Presentation API (FF57+)
|
|
|
|
|
FF41+
|
|
|
|
|
418986 - limit window.screen & CSS media queries leaking identifiable info
|
|
|
|
|
[TEST] https://arkenfox.github.io/TZP/tzp.html#screen
|
|
|
|
|
FF50+
|
|
|
|
|
1281949 - spoof screen orientation
|
|
|
|
|
1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+)
|
|
|
|
|
FF55+
|
|
|
|
|
1330890 - spoof timezone as UTC 0
|
|
|
|
|
1360039 - spoof navigator.hardwareConcurrency as 2 (see 4601)
|
|
|
|
|
1217238 - reduce precision of time exposed by javascript
|
|
|
|
|
FF56+
|
|
|
|
|
1369303 - spoof/disable performance API (see 4602, 4603)
|
|
|
|
|
1333651 - spoof User Agent & Navigator API (see section 4700)
|
|
|
|
|
JS: FF78+ the version is spoofed as 78, and the OS as Windows 10, OS 10.15, Android 9, or Linux
|
|
|
|
|
HTTP Headers: spoofed as Windows or Android
|
|
|
|
|
1369319 - disable device sensor API (see 4604)
|
|
|
|
|
1369357 - disable site specific zoom (see 4605)
|
|
|
|
|
1337161 - hide gamepads from content (see 4606)
|
|
|
|
|
1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true (see 4607)
|
|
|
|
|
1333641 - reduce fingerprinting in WebSpeech API (see 4608)
|
|
|
|
|
FF57+
|
|
|
|
|
1369309 - spoof media statistics (see 4610)
|
|
|
|
|
1382499 - reduce screen co-ordinate fingerprinting in Touch API (see 4611)
|
|
|
|
|
1217290 & 1409677 - enable fingerprinting resistance for WebGL (see 2010-12)
|
|
|
|
|
1382545 - reduce fingerprinting in Animation API
|
|
|
|
|
1354633 - limit MediaError.message to a whitelist
|
|
|
|
|
1382533 - enable fingerprinting resistance for Presentation API
|
|
|
|
|
This blocks exposure of local IP Addresses via mDNS (Multicast DNS)
|
|
|
|
|
** 967895 - spoof canvas and enable site permission prompt before allowing canvas data extraction (FF58+)
|
|
|
|
|
FF59: Added to site permissions panel (1413780) Only prompt when triggered by user input (1376865)
|
|
|
|
|
** 1372073 - spoof/block fingerprinting in MediaDevices API (FF59+)
|
|
|
|
|
FF58+
|
|
|
|
|
967895 - spoof canvas and enable site permission prompt before allowing canvas data extraction
|
|
|
|
|
FF59+
|
|
|
|
|
1372073 - spoof/block fingerprinting in MediaDevices API
|
|
|
|
|
Spoof: enumerate devices reports one "Internal Camera" and one "Internal Microphone" if
|
|
|
|
|
media.navigator.enabled is true (see 2505 which we chose to keep disabled)
|
|
|
|
|
Block: suppresses the ondevicechange event (see 4612)
|
|
|
|
|
** 1039069 - warn when language prefs are set to non en-US (see 0210, 0211) (FF59+)
|
|
|
|
|
** 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59+)
|
|
|
|
|
1039069 - warn when language prefs are set to non en-US (see 0210, 0211)
|
|
|
|
|
1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events
|
|
|
|
|
Spoofing mimics the content language of the document. Currently it only supports en-US.
|
|
|
|
|
Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected.
|
|
|
|
|
FF60: Fix keydown/keyup events (1438795)
|
|
|
|
|
** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
|
|
|
|
|
** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+)
|
|
|
|
|
** 1479239 - return "no-preference" with prefers-reduced-motion (see 4617) (FF63+)
|
|
|
|
|
** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+)
|
|
|
|
|
FF60-67
|
|
|
|
|
1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
|
|
|
|
|
1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+)
|
|
|
|
|
1479239 - return "no-preference" with prefers-reduced-motion (see 4614) (FF63+)
|
|
|
|
|
1363508 - spoof/suppress Pointer Events (see 4615) (FF64+)
|
|
|
|
|
FF65: pointerEvent.pointerid (1492766)
|
|
|
|
|
** 1485266 - disable exposure of system colors to CSS or canvas (see 4615) (FF67+)
|
|
|
|
|
** 1407366 - enable inner window letterboxing (see 4504) (FF67+)
|
|
|
|
|
** 1494034 - return "light" with prefers-color-scheme (see 4616) (FF67+)
|
|
|
|
|
[1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme
|
|
|
|
|
** 1564422 - spoof audioContext outputLatency (FF70+)
|
|
|
|
|
** 1595823 - spoof audioContext sampleRate (FF72+)
|
|
|
|
|
** 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+)
|
|
|
|
|
** 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+)
|
|
|
|
|
1485266 - disable exposure of system colors to CSS or canvas (see 4616) (FF67+)
|
|
|
|
|
1407366 - enable inner window letterboxing (see 4504) (FF67+)
|
|
|
|
|
1494034 - return "light" with prefers-color-scheme (see 4617) (FF67+)
|
|
|
|
|
FF68-77
|
|
|
|
|
1564422 - spoof audioContext outputLatency (FF70+)
|
|
|
|
|
1595823 - spoof audioContext sampleRate (FF72+)
|
|
|
|
|
1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+)
|
|
|
|
|
FF78+
|
|
|
|
|
1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+)
|
|
|
|
|
1653987 - limit font visibility to bundled and "Base Fonts" (see 4618) (non-ANDROID) (FF80+)
|
|
|
|
|
1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82+)
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
|
|
|
|
|
/* 4501: enable privacy.resistFingerprinting [FF41+]
|
|
|
|
|
@ -1487,22 +1457,22 @@ user_pref("privacy.resistFingerprinting", true);
|
|
|
|
|
// user_pref("privacy.window.maxInnerWidth", 1000);
|
|
|
|
|
// user_pref("privacy.window.maxInnerHeight", 1000);
|
|
|
|
|
/* 4503: disable mozAddonManager Web API [FF57+]
|
|
|
|
|
* [NOTE] As a side-effect in FF57-59 this allowed extensions to work on AMO. In FF60+ you also need
|
|
|
|
|
* to sanitize or clear extensions.webextensions.restrictedDomains (see 2662) to keep that side-effect
|
|
|
|
|
* [NOTE] To allow extensions to work on AMO, you also need 2662
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
|
|
|
|
|
user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF]
|
|
|
|
|
/* 4504: enable RFP letterboxing [FF67+]
|
|
|
|
|
* Dynamically resizes the inner window (FF67; 200w x100h: FF68+; stepped ranges) by applying letterboxing,
|
|
|
|
|
* using dimensions which waste the least content area, If you use the dimension pref, then it will only apply
|
|
|
|
|
* those resolutions. The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000, 1600x900")
|
|
|
|
|
* [SETUP-WEB] This does NOT require RFP (see 4501) **for now**, so if you're not using 4501, or you are but you're
|
|
|
|
|
* not taking anti-fingerprinting seriously and a little visual change upsets you, then feel free to flip this pref
|
|
|
|
|
* Dynamically resizes the inner window by applying margins in stepped ranges, see [2]
|
|
|
|
|
* If you use the dimension pref, then it will only apply those resolutions. The format is
|
|
|
|
|
* "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000, 1600x900")
|
|
|
|
|
* [SETUP-WEB] This does NOT require RFP (see 4501) **for now**, so if you're not using 4501, or you are but
|
|
|
|
|
* dislike margins being applied, then flip this pref, keeping in mind that it is effectively fingerprintable
|
|
|
|
|
* [WARNING] The dimension pref is only meant for testing, and we recommend you DO NOT USE it
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1407366 ***/
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1407366
|
|
|
|
|
* [2] https://hg.mozilla.org/mozilla-central/rev/6d2d7856e468#l2.32 ***/
|
|
|
|
|
user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF]
|
|
|
|
|
// user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF]
|
|
|
|
|
/* 4510: disable showing about:blank as soon as possible during startup [FF60+]
|
|
|
|
|
* When default true (FF62+) this no longer masks the RFP chrome resizing activity
|
|
|
|
|
* When default true this no longer masks the RFP chrome resizing activity
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1448423 ***/
|
|
|
|
|
user_pref("browser.startup.blankWindow", false);
|
|
|
|
|
/* 4520: disable chrome animations [FF77+] [RESTART]
|
|
|
|
|
@ -1510,15 +1480,7 @@ user_pref("browser.startup.blankWindow", false);
|
|
|
|
|
user_pref("ui.prefersReducedMotion", 1); // [HIDDEN PREF]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4600]: RFP ALTERNATIVES
|
|
|
|
|
* non-RFP users:
|
|
|
|
|
Enable the whole section (see the SETUP tag below)
|
|
|
|
|
* RFP users:
|
|
|
|
|
Make sure these are reset in about:config. They are redundant. In fact, some
|
|
|
|
|
even cause RFP to not behave as you would expect and alter your fingerprint
|
|
|
|
|
* ESR RFP users:
|
|
|
|
|
Reset those *up to and including* your version. Add those *after* your version
|
|
|
|
|
as active prefs in your overrides. This is assuming that the patch wasn't also
|
|
|
|
|
backported to Firefox ESR. Backporting RFP patches to ESR is rare.
|
|
|
|
|
[WARNING] Do NOT use prefs in this section with RFP as they can interfere
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan");
|
|
|
|
|
/* [SETUP-non-RFP] Non-RFP users replace the * with a slash on this line to enable these
|
|
|
|
|
@ -1589,52 +1551,50 @@ user_pref("media.ondevicechange.enabled", false);
|
|
|
|
|
// [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info
|
|
|
|
|
user_pref("webgl.enable-debug-renderer-info", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF65+
|
|
|
|
|
// 4614: [2516] disable PointerEvents
|
|
|
|
|
// FF63+
|
|
|
|
|
// 4614: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART]
|
|
|
|
|
// 0=no-preference, 1=reduce
|
|
|
|
|
user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF]
|
|
|
|
|
// FF64+
|
|
|
|
|
// 4615: [2516] disable PointerEvents
|
|
|
|
|
// [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent
|
|
|
|
|
user_pref("dom.w3c_pointer_events.enabled", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF67+
|
|
|
|
|
// 4615: [2618] disable exposure of system colors to CSS or canvas [FF44+]
|
|
|
|
|
// 4616: [2618] disable exposure of system colors to CSS or canvas [FF44+]
|
|
|
|
|
// [NOTE] See second listed bug: may cause black on black for elements with undefined colors
|
|
|
|
|
// [SETUP-CHROME] Might affect CSS in themes and extensions
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876
|
|
|
|
|
user_pref("ui.use_standins_for_native_colors", true);
|
|
|
|
|
// 4616: enforce prefers-color-scheme as light [FF67+]
|
|
|
|
|
// 4617: enforce prefers-color-scheme as light [FF67+]
|
|
|
|
|
// 0=light, 1=dark : This overrides your OS value
|
|
|
|
|
user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF]
|
|
|
|
|
// 4617: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART]
|
|
|
|
|
// 0=no-preference, 1=reduce
|
|
|
|
|
user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF]
|
|
|
|
|
// FF80+
|
|
|
|
|
// 4618: limit font visbility (non-ANDROID) [FF79+]
|
|
|
|
|
// Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts, see [1]
|
|
|
|
|
// 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts
|
|
|
|
|
// [NOTE] Bundled fonts are auto-allowed
|
|
|
|
|
// [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc
|
|
|
|
|
user_pref("layout.css.font-visibility.level", 1);
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4700]: RFP ALTERNATIVES (NAVIGATOR / USER AGENT (UA) SPOOFING)
|
|
|
|
|
This is FYI ONLY. These prefs are INSUFFICIENT(a) on their own, you need
|
|
|
|
|
to use RFP (4500) or an extension, in which case they become POINTLESS.
|
|
|
|
|
(a) Many of the components that make up your UA can be derived by other means.
|
|
|
|
|
And when those values differ, you provide more bits and raise entropy.
|
|
|
|
|
Examples of leaks include workers, navigator objects, date locale/formats,
|
|
|
|
|
iframes, headers, tcp/ip attributes, feature detection, and **many** more.
|
|
|
|
|
ALL values below intentionally left blank - use RFP, or get a vetted, tested
|
|
|
|
|
extension and mimic RFP values to *lower* entropy, or randomize to *raise* it
|
|
|
|
|
/*** [SECTION 4700]: RFP ALTERNATIVES (USER AGENT SPOOFING)
|
|
|
|
|
These prefs are insufficient and leak. Use RFP and **nothing else**
|
|
|
|
|
- Many of the user agent components can be derived by other means. When those
|
|
|
|
|
values differ, you provide more bits and raise entropy. Examples include
|
|
|
|
|
workers, iframes, headers, tcp/ip attributes, feature detection, and many more
|
|
|
|
|
- Web extensions also lack APIs to fully protect spoofing
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow");
|
|
|
|
|
/* 4701: navigator.userAgent ***/
|
|
|
|
|
// user_pref("general.useragent.override", ""); // [HIDDEN PREF]
|
|
|
|
|
/* 4702: navigator.buildID
|
|
|
|
|
* Revealed build time down to the second. In FF64+ it now returns a fixed timestamp
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/583181
|
|
|
|
|
* [2] https://www.fxsitecompat.com/en-CA/docs/2018/navigator-buildid-now-returns-a-fixed-timestamp/ ***/
|
|
|
|
|
// user_pref("general.buildID.override", ""); // [HIDDEN PREF]
|
|
|
|
|
/* 4703: navigator.appName ***/
|
|
|
|
|
/* 4701: navigator DOM object overrides
|
|
|
|
|
* [WARNING] DO NOT USE ***/
|
|
|
|
|
// user_pref("general.appname.override", ""); // [HIDDEN PREF]
|
|
|
|
|
/* 4704: navigator.appVersion ***/
|
|
|
|
|
// user_pref("general.appversion.override", ""); // [HIDDEN PREF]
|
|
|
|
|
/* 4705: navigator.platform ***/
|
|
|
|
|
// user_pref("general.platform.override", ""); // [HIDDEN PREF]
|
|
|
|
|
/* 4706: navigator.oscpu ***/
|
|
|
|
|
// user_pref("general.buildID.override", ""); // [HIDDEN PREF]
|
|
|
|
|
// user_pref("general.oscpu.override", ""); // [HIDDEN PREF]
|
|
|
|
|
// user_pref("general.platform.override", ""); // [HIDDEN PREF]
|
|
|
|
|
// user_pref("general.useragent.override", ""); // [HIDDEN PREF]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 5000]: PERSONAL
|
|
|
|
|
Non-project related but useful. If any of these interest you, add them to your overrides ***/
|
|
|
|
|
@ -1680,92 +1640,28 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
|
|
|
|
|
// user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR)
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED
|
|
|
|
|
Documentation denoted as [-]. Items deprecated in FF68 or earlier have been archived at [1],
|
|
|
|
|
Documentation denoted as [-]. Items deprecated in FF78 or earlier have been archived at [1],
|
|
|
|
|
which also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets
|
|
|
|
|
[1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
|
|
|
|
|
[1] https://github.com/arkenfox/user.js/issues/123
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
|
|
|
|
|
/* ESR68.x still uses all the following prefs
|
|
|
|
|
/* ESR78.x still uses all the following prefs
|
|
|
|
|
// [NOTE] replace the * with a slash in the line above to re-enable them
|
|
|
|
|
// FF69
|
|
|
|
|
// 1405: disable WOFF2 (Web Open Font Format) [FF35+]
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1556991
|
|
|
|
|
// user_pref("gfx.downloadable_fonts.woff2.enabled", false);
|
|
|
|
|
// 1802: enforce click-to-play for plugins
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1519434
|
|
|
|
|
user_pref("plugins.click_to_play", true); // [DEFAULT: true FF25+]
|
|
|
|
|
// 2033: disable autoplay for muted videos [FF63+] - replaced by 'media.autoplay.default' options (2030)
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1562331
|
|
|
|
|
// user_pref("media.autoplay.allow-muted", false);
|
|
|
|
|
// FF79
|
|
|
|
|
// 0212: enforce fallback text encoding to match en-US
|
|
|
|
|
// When the content or server doesn't declare a charset the browser will
|
|
|
|
|
// fallback to the "Current locale" based on your application language
|
|
|
|
|
// [TEST] https://hsivonen.com/test/moz/check-charset.htm
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1603712
|
|
|
|
|
user_pref("intl.charset.fallback.override", "windows-1252");
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF71
|
|
|
|
|
// 2608: disable WebIDE and ADB extension download
|
|
|
|
|
// [1] https://trac.torproject.org/projects/tor/ticket/16222
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1539462
|
|
|
|
|
user_pref("devtools.webide.enabled", false); // [DEFAULT: false FF70+]
|
|
|
|
|
user_pref("devtools.webide.autoinstallADBExtension", false); // [FF64+]
|
|
|
|
|
// 2731: enforce websites to ask to store data for offline use
|
|
|
|
|
// [1] https://support.mozilla.org/questions/1098540
|
|
|
|
|
// [2] https://bugzilla.mozilla.org/959985
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1574480
|
|
|
|
|
user_pref("offline-apps.allow_by_default", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF72
|
|
|
|
|
// 0105a: disable Activity Stream telemetry
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1597697
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "");
|
|
|
|
|
// 0330: disable Hybdrid Content telemetry
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1520491
|
|
|
|
|
user_pref("toolkit.telemetry.hybridContent.enabled", false); // [FF59+]
|
|
|
|
|
// 2720: enforce IndexedDB (IDB) as enabled
|
|
|
|
|
// IDB is required for extensions and Firefox internals (even before FF63 in [1])
|
|
|
|
|
// To control *website* IDB data, control allowing cookies and service workers, or use
|
|
|
|
|
// Temporary Containers. To mitigate *website* IDB, FPI helps (4001), and/or sanitize
|
|
|
|
|
// on close (Offline Website Data, see 2800) or on-demand (Ctrl-Shift-Del), or automatically
|
|
|
|
|
// via an extension. Note that IDB currently cannot be sanitized by host.
|
|
|
|
|
// [1] https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1488583
|
|
|
|
|
user_pref("dom.indexedDB.enabled", true); // [DEFAULT: true]
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF74
|
|
|
|
|
// 0203: use Mozilla geolocation service instead of Google when geolocation is enabled
|
|
|
|
|
// Optionally enable logging to the console (defaults to false)
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1613627
|
|
|
|
|
user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");
|
|
|
|
|
// user_pref("geo.wifi.logging.enabled", true); // [HIDDEN PREF]
|
|
|
|
|
// 1704: set behaviour on "+ Tab" button to display container menu [FF53+] [SETUP-CHROME]
|
|
|
|
|
// 0=no menu (default), 1=show when clicked, 2=show on long press
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/1328756
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1606265
|
|
|
|
|
user_pref("privacy.userContext.longPressBehavior", 2);
|
|
|
|
|
// 2012: limit WebGL
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1477756
|
|
|
|
|
user_pref("webgl.disable-extensions", true);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF76
|
|
|
|
|
// 0401: sanitize blocklist url
|
|
|
|
|
// [2] https://trac.torproject.org/projects/tor/ticket/16931
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1618188
|
|
|
|
|
user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/");
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF77
|
|
|
|
|
// 0850e: disable location bar one-off searches [FF51+]
|
|
|
|
|
// [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1628926
|
|
|
|
|
// user_pref("browser.urlbar.oneOffSearches", false);
|
|
|
|
|
// 2605: block web content in file processes [FF55+]
|
|
|
|
|
// [SETUP-WEB] You may want to disable this for corporate or developer environments
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/1343184
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1603007
|
|
|
|
|
user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF78
|
|
|
|
|
// 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] - replaced by 'media.autoplay.blocking_policy'
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1509933
|
|
|
|
|
user_pref("media.autoplay.enabled.user-gestures-needed", false);
|
|
|
|
|
// 5000's: disable chrome animations - replaced FF77+ by 'ui.prefersReducedMotion' (4520)
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1640501
|
|
|
|
|
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
|
|
|
|
|
// FF82
|
|
|
|
|
// 0206: disable geographically specific results/search engines e.g. "browser.search.*.US"
|
|
|
|
|
// i.e. ignore all of Mozilla's various search engines in multiple locales
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1619926
|
|
|
|
|
user_pref("browser.search.geoSpecificDefaults", false);
|
|
|
|
|
user_pref("browser.search.geoSpecificDefaults.url", "");
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
|
