|
|
|
|
@ -1,13 +1,13 @@
|
|
|
|
|
/******
|
|
|
|
|
* name: ghacks user.js
|
|
|
|
|
* date: 05 April 2020
|
|
|
|
|
* version 74-beta
|
|
|
|
|
* date: 13 Aug 2020
|
|
|
|
|
* version 79-beta
|
|
|
|
|
* authors: v52+ github | v51- www.ghacks.net
|
|
|
|
|
* url: https://github.com/ghacksuserjs/ghacks-user.js
|
|
|
|
|
* license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
|
|
|
|
|
|
|
|
|
|
* releases: These are end-of-stable-life-cycle legacy archives.
|
|
|
|
|
*Always* use the master branch user.js for a current up-to-date version.
|
|
|
|
|
*Always* use the master branch user.js for a current up-to-date version
|
|
|
|
|
url: https://github.com/ghacksuserjs/ghacks-user.js/releases
|
|
|
|
|
|
|
|
|
|
* README:
|
|
|
|
|
@ -125,6 +125,9 @@ user_pref("browser.newtabpage.activity-stream.showSponsored", false);
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false); // [FF66+]
|
|
|
|
|
/* 0105d: disable Activity Stream recent Highlights in the Library [FF57+] ***/
|
|
|
|
|
// user_pref("browser.library.activity-stream.enabled", false);
|
|
|
|
|
/* 0105e: clear default topsites
|
|
|
|
|
* [NOTE] This does not block you from adding your own ***/
|
|
|
|
|
user_pref("browser.newtabpage.activity-stream.default.sites", "");
|
|
|
|
|
/* 0110: start Firefox in PB (Private Browsing) mode
|
|
|
|
|
* [NOTE] In this mode *all* windows are "private windows" and the PB mode icon is not displayed
|
|
|
|
|
* [WARNING] The P in PB mode is misleading: it means no "persistent" disk storage such as history,
|
|
|
|
|
@ -158,31 +161,27 @@ user_pref("geo.provider.network.url", "https://location.services.mozilla.com/v1/
|
|
|
|
|
user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
|
|
|
|
|
user_pref("geo.provider.use_corelocation", false); // [MAC]
|
|
|
|
|
user_pref("geo.provider.use_gpsd", false); // [LINUX]
|
|
|
|
|
/* 0205: disable GeoIP-based search results
|
|
|
|
|
* [NOTE] May not be hidden if Firefox has changed your settings due to your locale
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/16254
|
|
|
|
|
* [2] https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine ***/
|
|
|
|
|
user_pref("browser.search.region", "US"); // [HIDDEN PREF]
|
|
|
|
|
user_pref("browser.search.geoip.url", "");
|
|
|
|
|
/* 0206: disable geographically specific results/search engines e.g. "browser.search.*.US"
|
|
|
|
|
* i.e. ignore all of Mozilla's various search engines in multiple locales ***/
|
|
|
|
|
user_pref("browser.search.geoSpecificDefaults", false);
|
|
|
|
|
user_pref("browser.search.geoSpecificDefaults.url", "");
|
|
|
|
|
/* 0207: disable region updates
|
|
|
|
|
* [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/
|
|
|
|
|
user_pref("browser.region.network.url", ""); // [FF78+]
|
|
|
|
|
user_pref("browser.region.update.enabled", false); // [[FF79+]
|
|
|
|
|
/* 0208: set search region
|
|
|
|
|
* [NOTE] May not be hidden if Firefox has changed your settings due to your region (see 0207) ***/
|
|
|
|
|
// user_pref("browser.search.region", "US"); // [HIDDEN PREF]
|
|
|
|
|
|
|
|
|
|
/** LANGUAGE / LOCALE ***/
|
|
|
|
|
/* 0210: set preferred language for displaying web pages
|
|
|
|
|
* [TEST] https://addons.mozilla.org/about ***/
|
|
|
|
|
user_pref("intl.accept_languages", "en-US, en");
|
|
|
|
|
/* 0211: enforce US English locale regardless of the system locale
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/867501 ***/
|
|
|
|
|
* [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages, see [2]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/867501
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1629630 ***/
|
|
|
|
|
user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF]
|
|
|
|
|
/* 0212: enforce fallback text encoding to match en-US
|
|
|
|
|
* When the content or server doesn't declare a charset the browser will
|
|
|
|
|
* fallback to the "Current locale" based on your application language
|
|
|
|
|
* [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content
|
|
|
|
|
* [TEST] https://hsivonen.com/test/moz/check-charset.htm
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/20025 ***/
|
|
|
|
|
user_pref("intl.charset.fallback.override", "windows-1252");
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 0300]: QUIET FOX
|
|
|
|
|
Starting in user.js v67, we only disable the auto-INSTALL of Firefox. You still get prompts
|
|
|
|
|
@ -209,7 +208,7 @@ user_pref("app.update.auto", false);
|
|
|
|
|
// user_pref("extensions.getAddons.cache.enabled", false);
|
|
|
|
|
/* 0308: disable search engine updates (e.g. OpenSearch)
|
|
|
|
|
* [NOTE] This does not affect Mozilla's built-in or Web Extension search engines
|
|
|
|
|
* [SETTING] General>Firefox Updates>Automatically update search engines ***/
|
|
|
|
|
* [SETTING] General>Firefox Updates>Automatically update search engines (FF72-) ***/
|
|
|
|
|
user_pref("browser.search.update", false);
|
|
|
|
|
/* 0309: disable sending Flash crash reports ***/
|
|
|
|
|
user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
|
|
|
|
|
@ -276,12 +275,10 @@ user_pref("network.connectivity-service.enabled", false);
|
|
|
|
|
/*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING (SB) ***/
|
|
|
|
|
user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!");
|
|
|
|
|
/** BLOCKLISTS ***/
|
|
|
|
|
/* 0401: enforce Firefox blocklist, but sanitize blocklist url
|
|
|
|
|
/* 0401: enforce Firefox blocklist
|
|
|
|
|
* [NOTE] It includes updates for "revoked certificates"
|
|
|
|
|
* [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
|
|
|
|
|
* [2] https://trac.torproject.org/projects/tor/ticket/16931 ***/
|
|
|
|
|
* [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/
|
|
|
|
|
user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true]
|
|
|
|
|
user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/");
|
|
|
|
|
|
|
|
|
|
/** SAFE BROWSING (SB)
|
|
|
|
|
Safe Browsing has taken many steps to preserve privacy. *IF* required, a full url is never
|
|
|
|
|
@ -396,7 +393,7 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost
|
|
|
|
|
/* 0701: disable IPv6
|
|
|
|
|
* IPv6 can be abused, especially regarding MAC addresses. They also do not play nice
|
|
|
|
|
* with VPNs. That's even assuming your ISP and/or router and/or website can handle it.
|
|
|
|
|
* Firefox telemetry (April 2019) shows only 5% of all connections are IPv6.
|
|
|
|
|
* [STATS] Firefox telemetry (June 2020) shows only 5% of all connections are IPv6
|
|
|
|
|
* [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an
|
|
|
|
|
* OS/network level, and/or configured properly in VPN setups. If you are not masking your IP,
|
|
|
|
|
* then this won't make much difference. If you are masking your IP, then it can only help.
|
|
|
|
|
@ -436,13 +433,13 @@ user_pref("network.proxy.socks_remote_dns", true);
|
|
|
|
|
// user_pref("network.ftp.enabled", false);
|
|
|
|
|
/* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+]
|
|
|
|
|
* [SETUP-CHROME] Can break extensions for profiles on network shares
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/26424 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/
|
|
|
|
|
user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF]
|
|
|
|
|
/* 0710: disable GIO as a potential proxy bypass vector
|
|
|
|
|
* Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda,
|
|
|
|
|
* gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1433507
|
|
|
|
|
* [2] https://trac.torproject.org/23044
|
|
|
|
|
* [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/23044
|
|
|
|
|
* [3] https://en.wikipedia.org/wiki/GVfs
|
|
|
|
|
* [4] https://en.wikipedia.org/wiki/GIO_(software) ***/
|
|
|
|
|
user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF]
|
|
|
|
|
@ -459,9 +456,8 @@ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!");
|
|
|
|
|
/* 0801: disable location bar using search
|
|
|
|
|
* Don't leak URL typos to a search engine, give an error message instead.
|
|
|
|
|
* Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com"
|
|
|
|
|
* [NOTE] Search buttons in the dropdown work, but hitting 'enter' in the location bar will fail
|
|
|
|
|
* [TIP] You can add keywords to search engines in options (e.g. 'd' for DuckDuckGo) and
|
|
|
|
|
* the dropdown will now auto-select it and you can then hit 'enter' and it will work
|
|
|
|
|
* [NOTE] This does **not** affect explicit user action such as using search buttons in the
|
|
|
|
|
* dropdown, or using keyword search shortcuts you configure in options (e.g. 'd' for DuckDuckGo)
|
|
|
|
|
* [SETUP-CHROME] If you don't, or rarely, type URLs, or you use a default search
|
|
|
|
|
* engine that respects privacy, then you probably don't need this ***/
|
|
|
|
|
user_pref("keyword.enabled", false);
|
|
|
|
|
@ -489,18 +485,20 @@ user_pref("layout.css.visited_links_enabled", false);
|
|
|
|
|
* [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/
|
|
|
|
|
user_pref("browser.search.suggest.enabled", false);
|
|
|
|
|
user_pref("browser.urlbar.suggest.searches", false);
|
|
|
|
|
/* 0809: disable location bar suggesting "preloaded" top websites [FF54+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1211726 ***/
|
|
|
|
|
user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
|
|
|
|
|
/* 0810: disable location bar making speculative connections [FF56+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1348275 ***/
|
|
|
|
|
user_pref("browser.urlbar.speculativeConnect.enabled", false);
|
|
|
|
|
/* 0811: disable location bar leaking single words to a DNS provider **after searching** [FF78+]
|
|
|
|
|
* 0=never resolve single words, 1=heuristic (default), 2=always resolve
|
|
|
|
|
* [NOTE] For FF78 value 1 and 2 are the same and always resolve but that will change in future versions
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1642623 ***/
|
|
|
|
|
user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0);
|
|
|
|
|
/* 0850a: disable location bar suggestion types
|
|
|
|
|
* If all three suggestion types are false, search engine keywords are disabled
|
|
|
|
|
* [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest ***/
|
|
|
|
|
// user_pref("browser.urlbar.suggest.history", false);
|
|
|
|
|
// user_pref("browser.urlbar.suggest.bookmark", false);
|
|
|
|
|
// user_pref("browser.urlbar.suggest.openpage", false);
|
|
|
|
|
// user_pref("browser.urlbar.suggest.topsites", false); // [FF78+]
|
|
|
|
|
/* 0850c: disable location bar dropdown
|
|
|
|
|
* This value controls the total number of entries to appear in the location bar dropdown
|
|
|
|
|
* [NOTE] Items (bookmarks/history/openpages) with a high "frecency"/"bonus" will always
|
|
|
|
|
@ -512,9 +510,6 @@ user_pref("browser.urlbar.speculativeConnect.enabled", false);
|
|
|
|
|
/* 0850d: disable location bar autofill
|
|
|
|
|
* [1] https://support.mozilla.org/en-US/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/
|
|
|
|
|
// user_pref("browser.urlbar.autoFill", false);
|
|
|
|
|
/* 0850e: disable location bar one-off searches [FF51+]
|
|
|
|
|
* [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ ***/
|
|
|
|
|
// user_pref("browser.urlbar.oneOffSearches", false);
|
|
|
|
|
/* 0860: disable search and form history
|
|
|
|
|
* [SETUP-WEB] Be aware thet autocomplete form data can be read by third parties, see [1] [2]
|
|
|
|
|
* [NOTE] We also clear formdata on exit (see 2803)
|
|
|
|
|
@ -589,13 +584,17 @@ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is m
|
|
|
|
|
* [NOTE] We also clear cache on exiting Firefox (see 2803) ***/
|
|
|
|
|
user_pref("browser.cache.disk.enable", false);
|
|
|
|
|
/* 1003: disable memory cache
|
|
|
|
|
/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes ***/
|
|
|
|
|
* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/
|
|
|
|
|
// user_pref("browser.cache.memory.enable", false);
|
|
|
|
|
// user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF ESR]
|
|
|
|
|
/* 1006: disable permissions manager from writing to disk [RESTART]
|
|
|
|
|
* [NOTE] This means any permission changes are session only
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/967812 ***/
|
|
|
|
|
// user_pref("permissions.memory_only", true); // [HIDDEN PREF]
|
|
|
|
|
/* 1007: disable media cache from writing to disk in Private Browsing
|
|
|
|
|
* [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/
|
|
|
|
|
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+]
|
|
|
|
|
user_pref("media.memory_cache_max_size", 65536);
|
|
|
|
|
|
|
|
|
|
/** SESSIONS & SESSION RESTORE ***/
|
|
|
|
|
/* 1020: exclude "Undo Closed Tabs" in Session Restore ***/
|
|
|
|
|
@ -637,6 +636,8 @@ user_pref("browser.shell.shortcutFavicons", false);
|
|
|
|
|
/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS)
|
|
|
|
|
Your cipher and other settings can be used in server side fingerprinting
|
|
|
|
|
[TEST] https://www.ssllabs.com/ssltest/viewMyClient.html
|
|
|
|
|
[TEST] https://browserleaks.com/ssl
|
|
|
|
|
[TEST] https://ja3er.com/
|
|
|
|
|
[1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
|
|
|
|
|
@ -653,10 +654,10 @@ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
|
|
|
|
|
user_pref("security.ssl.require_safe_negotiation", true);
|
|
|
|
|
/* 1202: control TLS versions with min and max
|
|
|
|
|
* 1=TLS 1.0, 2=TLS 1.1, 3=TLS 1.2, 4=TLS 1.3
|
|
|
|
|
* [STATS] Firefox telemetry (June 2020) shows only 0.16% of SSL handshakes use 1.0 or 1.1
|
|
|
|
|
* [WARNING] Leave these at default, otherwise you alter your TLS fingerprint.
|
|
|
|
|
* Firefox telemetry (April 2019) shows only 0.5% of TLS web traffic uses 1.0 or 1.1
|
|
|
|
|
* [1] https://www.ssllabs.com/ssl-pulse/ ***/
|
|
|
|
|
// user_pref("security.tls.version.min", 3);
|
|
|
|
|
// user_pref("security.tls.version.min", 3); // [DEFAULT: 3 FF78+]
|
|
|
|
|
// user_pref("security.tls.version.max", 4);
|
|
|
|
|
/* 1203: enforce TLS 1.0 and 1.1 downgrades as session only */
|
|
|
|
|
user_pref("security.tls.version.enable-deprecated", false);
|
|
|
|
|
@ -715,7 +716,7 @@ user_pref("security.pki.sha1_enforcement_level", 1);
|
|
|
|
|
* 0=disable detecting Family Safety mode and importing the root
|
|
|
|
|
* 1=only attempt to detect Family Safety mode (don't import the root)
|
|
|
|
|
* 2=detect Family Safety mode and import the root
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/21686 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/
|
|
|
|
|
user_pref("security.family_safety.mode", 0);
|
|
|
|
|
/* 1222: disable intermediate certificate caching (fingerprinting attack vector) [FF41+] [RESTART]
|
|
|
|
|
* [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
|
|
|
|
|
@ -726,41 +727,56 @@ user_pref("security.family_safety.mode", 0);
|
|
|
|
|
* PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict
|
|
|
|
|
* [SETUP-WEB] If you rely on an AV (antivirus) to protect your web browsing
|
|
|
|
|
* by inspecting ALL your web traffic, then leave at current default=1
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/
|
|
|
|
|
user_pref("security.cert_pinning.enforcement_level", 2);
|
|
|
|
|
|
|
|
|
|
/** MIXED CONTENT ***/
|
|
|
|
|
/* 1240: disable insecure active content on https pages
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/
|
|
|
|
|
user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true]
|
|
|
|
|
/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/
|
|
|
|
|
user_pref("security.mixed_content.block_display_content", true);
|
|
|
|
|
/* 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1190623 ***/
|
|
|
|
|
user_pref("security.mixed_content.block_object_subrequest", true);
|
|
|
|
|
/* 1244: enable https-only-mode [FF76+]
|
|
|
|
|
* [NOTE] This is experimental
|
|
|
|
|
* [SETTING] Privacy & Security>HTTPS-Only Mode (FF81+)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1613063 */
|
|
|
|
|
// user_pref("dom.security.https_only_mode", true); // [FF76+]
|
|
|
|
|
// user_pref("dom.security.https_only_mode.upgrade_local", true); // [FF77+]
|
|
|
|
|
|
|
|
|
|
/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro] ***/
|
|
|
|
|
/* 1261: disable 3DES (effective key size < 128)
|
|
|
|
|
/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro]
|
|
|
|
|
* These are all the ciphers still using SHA-1 and CBC which are weaker than the available alternatives. (see "Cipher Suites" in [1])
|
|
|
|
|
* Additionally some have other weaknesses like key sizes of 128 (or lower) [2] and/or no Perfect Forward Secrecy [3].
|
|
|
|
|
* [1] https://browserleaks.com/ssl
|
|
|
|
|
* [2] https://en.wikipedia.org/wiki/Key_size
|
|
|
|
|
* [3] https://en.wikipedia.org/wiki/Forward_secrecy
|
|
|
|
|
***/
|
|
|
|
|
/* 1261: disable 3DES (effective key size < 128 and no PFS)
|
|
|
|
|
* [1] https://en.wikipedia.org/wiki/3des#Security
|
|
|
|
|
* [2] https://en.wikipedia.org/wiki/Meet-in-the-middle_attack
|
|
|
|
|
* [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/
|
|
|
|
|
// user_pref("security.ssl3.rsa_des_ede3_sha", false);
|
|
|
|
|
/* 1262: disable 128 bits ***/
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
|
|
|
|
|
/* 1263: disable DHE (Diffie-Hellman Key Exchange)
|
|
|
|
|
* [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_256_sha", false);
|
|
|
|
|
/* 1264: disable the remaining non-modern cipher suites as of FF52 ***/
|
|
|
|
|
// user_pref("security.ssl3.rsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.rsa_aes_256_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); // [DEFAULT: false FF78+]
|
|
|
|
|
// user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); // [DEFAULT: false FF78+]
|
|
|
|
|
/* 1264: disable the remaining non-modern cipher suites as of FF78 (in order of preferred by FF) ***/
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
|
|
|
|
|
// user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS
|
|
|
|
|
// user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS
|
|
|
|
|
|
|
|
|
|
/** UI (User Interface) ***/
|
|
|
|
|
/* 1270: display warning on the padlock for "broken security" (if 1201 is false)
|
|
|
|
|
* Bug: warning padlock not indicated for subresources on a secure page! [2]
|
|
|
|
|
* [STATS] SSL Labs (June 2020) reports 98.8% of sites have secure renegotiation [3]
|
|
|
|
|
* [1] https://wiki.mozilla.org/Security:Renegotiation
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1353705 ***/
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1353705
|
|
|
|
|
* [3] https://www.ssllabs.com/ssl-pulse/ ***/
|
|
|
|
|
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
|
|
|
|
|
/* 1271: control "Add Security Exception" dialog on SSL warnings
|
|
|
|
|
* 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default)
|
|
|
|
|
@ -779,12 +795,12 @@ user_pref("security.insecure_connection_text.enabled", true); // [FF60+]
|
|
|
|
|
user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!");
|
|
|
|
|
/* 1401: disable websites choosing fonts (0=block, 1=allow)
|
|
|
|
|
* This can limit most (but not all) JS font enumeration which is a high entropy fingerprinting vector
|
|
|
|
|
* [SETUP-WEB] Disabling fonts can uglify the web a fair bit.
|
|
|
|
|
* [SETUP-WEB] Can break some PDFs (missing text). Limiting to default fonts can "uglify" the web
|
|
|
|
|
* [SETTING] General>Language and Appearance>Fonts & Colors>Advanced>Allow pages to choose... ***/
|
|
|
|
|
user_pref("browser.display.use_document_fonts", 0);
|
|
|
|
|
/* 1403: disable icon fonts (glyphs) and local fallback rendering
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/789788
|
|
|
|
|
* [2] https://trac.torproject.org/projects/tor/ticket/8455 ***/
|
|
|
|
|
* [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/
|
|
|
|
|
// user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+]
|
|
|
|
|
// user_pref("gfx.downloadable_fonts.fallback_delay", -1);
|
|
|
|
|
/* 1404: disable rendering of SVG OpenType fonts
|
|
|
|
|
@ -796,7 +812,8 @@ user_pref("gfx.font_rendering.opentype_svg.enabled", false);
|
|
|
|
|
* [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/
|
|
|
|
|
user_pref("gfx.font_rendering.graphite.enabled", false);
|
|
|
|
|
/* 1409: limit system font exposure to a whitelist [FF52+] [RESTART]
|
|
|
|
|
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
|
|
|
|
|
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed
|
|
|
|
|
* [NOTE] RFP in FF80+ restricts the whitelist to bundled and "Base Fonts" (see 4618)
|
|
|
|
|
* [WARNING] Creating your own probably highly-unique whitelist will raise your entropy.
|
|
|
|
|
* Eventually privacy.resistFingerprinting (see 4500) will cover this
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1121643 ***/
|
|
|
|
|
@ -903,7 +920,7 @@ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
|
|
|
|
|
* [1] https://www.privacytools.io/#webrtc ***/
|
|
|
|
|
user_pref("media.peerconnection.enabled", false);
|
|
|
|
|
/* 2002: limit WebRTC IP leaks if using WebRTC
|
|
|
|
|
* In FF70+ these settings match Mode 4 (Mode 3 in older versions) (see [3])
|
|
|
|
|
* In FF70+ these settings match Mode 4 (Mode 3 in older versions), see [3]
|
|
|
|
|
* [TEST] https://browserleaks.com/webrtc
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713
|
|
|
|
|
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy
|
|
|
|
|
@ -936,8 +953,11 @@ user_pref("media.getusermedia.audiocapture.enabled", false);
|
|
|
|
|
* [NOTE] You can set exceptions under site permissions
|
|
|
|
|
* [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/
|
|
|
|
|
// user_pref("media.autoplay.default", 5);
|
|
|
|
|
/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] ***/
|
|
|
|
|
user_pref("media.autoplay.enabled.user-gestures-needed", false);
|
|
|
|
|
/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+]
|
|
|
|
|
* 0=sticky (default), 1=transient, 2=user
|
|
|
|
|
* [NOTE] If you have trouble with some video sites, then add an exception (see 2030)
|
|
|
|
|
* [1] https://html.spec.whatwg.org/multipage/interaction.html#sticky-activation ***/
|
|
|
|
|
user_pref("media.autoplay.blocking_policy", 2);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!");
|
|
|
|
|
@ -957,7 +977,7 @@ user_pref("dom.disable_window_move_resize", true);
|
|
|
|
|
* This stops malicious window sizes and some screen resolution leaks.
|
|
|
|
|
* You can still right-click a link and open in a new window.
|
|
|
|
|
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
|
|
|
|
|
user_pref("browser.link.open_newwindow", 3);
|
|
|
|
|
user_pref("browser.link.open_newwindow.restriction", 0);
|
|
|
|
|
/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
|
|
|
|
|
@ -1027,14 +1047,14 @@ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!
|
|
|
|
|
/* 2401: disable website control over browser right-click context menu
|
|
|
|
|
* [NOTE] Shift-Right-Click will always bring up the browser right-click context menu ***/
|
|
|
|
|
// user_pref("dom.event.contextmenu.enabled", false);
|
|
|
|
|
/* 2402: disable website access to clipboard events/content
|
|
|
|
|
* [SETUP-WEB] This will break some sites functionality such as pasting into facebook, wordpress
|
|
|
|
|
/* 2402: disable website access to clipboard events/content [SETUP-HARDEN]
|
|
|
|
|
* [NOTE] This will break some sites' functionality e.g. Outlook, Twitter, Facebook, Wordpress
|
|
|
|
|
* This applies to onCut/onCopy/onPaste events - i.e. it requires interaction with the website
|
|
|
|
|
* [WARNING] If both 'middlemouse.paste' and 'general.autoScroll' are true (at least one
|
|
|
|
|
* is default false) then enabling this pref can leak clipboard content, see [2]
|
|
|
|
|
* [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1528289 */
|
|
|
|
|
user_pref("dom.event.clipboardevents.enabled", false);
|
|
|
|
|
// user_pref("dom.event.clipboardevents.enabled", false);
|
|
|
|
|
/* 2404: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+]
|
|
|
|
|
* this disables document.execCommand("cut"/"copy") to protect your clipboard
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1170911 ***/
|
|
|
|
|
@ -1054,11 +1074,14 @@ user_pref("dom.vibrator.enabled", false);
|
|
|
|
|
* [5] https://www.mozilla.org/security/advisories/mfsa2017-05/#CVE-2017-5400
|
|
|
|
|
* [6] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/
|
|
|
|
|
user_pref("javascript.options.asmjs", false);
|
|
|
|
|
/* 2421: disable Ion and baseline JIT to help harden JS against exploits
|
|
|
|
|
/* 2421: disable Ion and baseline JIT to harden against JS exploits [SETUP-HARDEN]
|
|
|
|
|
* [NOTE] In FF75+, when **both** Ion and JIT are disabled, **and** the new
|
|
|
|
|
* hidden pref is enabled, then Ion can still be used by extensions (1599226)
|
|
|
|
|
* [WARNING] Disabling Ion/JIT can cause some site issues and performance loss
|
|
|
|
|
* [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 ***/
|
|
|
|
|
// user_pref("javascript.options.ion", false);
|
|
|
|
|
// user_pref("javascript.options.baselinejit", false);
|
|
|
|
|
// user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF]
|
|
|
|
|
/* 2422: disable WebAssembly [FF52+] [SETUP-PERF]
|
|
|
|
|
* [NOTE] In FF71+ this no longer affects extensions (1576254)
|
|
|
|
|
* [1] https://developer.mozilla.org/docs/WebAssembly ***/
|
|
|
|
|
@ -1070,7 +1093,7 @@ user_pref("javascript.options.wasm", false);
|
|
|
|
|
// user_pref("dom.IntersectionObserver.enabled", false);
|
|
|
|
|
/* 2429: enable (limited but sufficient) window.opener protection [FF65+]
|
|
|
|
|
* Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/
|
|
|
|
|
user_pref("dom.targetBlankNoOpener.enabled", true);
|
|
|
|
|
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/
|
|
|
|
|
user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!");
|
|
|
|
|
@ -1078,7 +1101,7 @@ user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is m
|
|
|
|
|
* Initially a Linux issue (high precision readout) that was fixed.
|
|
|
|
|
* However, it is still another metric for fingerprinting, used to raise entropy.
|
|
|
|
|
* e.g. do you have a battery or not, current charging status, charge level, times remaining etc
|
|
|
|
|
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1]
|
|
|
|
|
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code, see [1]
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1313580 ***/
|
|
|
|
|
// user_pref("dom.battery.enabled", false);
|
|
|
|
|
/* 2505: disable media device enumeration [FF29+]
|
|
|
|
|
@ -1126,10 +1149,6 @@ user_pref("browser.helperApps.deleteTempFileOnExit", true);
|
|
|
|
|
/* 2604: disable page thumbnail collection
|
|
|
|
|
* look in profile/thumbnails directory - you may want to clean that out ***/
|
|
|
|
|
user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF]
|
|
|
|
|
/* 2605: block web content in file processes [FF55+]
|
|
|
|
|
* [SETUP-WEB] You may want to disable this for corporate or developer environments
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1343184 ***/
|
|
|
|
|
user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
|
|
|
|
|
/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
|
|
|
|
|
user_pref("browser.uitour.enabled", false);
|
|
|
|
|
user_pref("browser.uitour.url", "");
|
|
|
|
|
@ -1138,8 +1157,8 @@ user_pref("browser.uitour.url", "");
|
|
|
|
|
* [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/
|
|
|
|
|
user_pref("devtools.chrome.enabled", false);
|
|
|
|
|
/* 2608: disable remote debugging
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/16222 ***/
|
|
|
|
|
user_pref("devtools.debugger.remote-enabled", false);
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
|
|
|
|
|
user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
|
|
|
|
|
/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN]
|
|
|
|
|
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1173199 ***/
|
|
|
|
|
@ -1150,7 +1169,7 @@ user_pref("devtools.debugger.remote-enabled", false);
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1216893 ***/
|
|
|
|
|
// user_pref("svg.disabled", true);
|
|
|
|
|
/* 2611: disable middle mouse click opening links from clipboard
|
|
|
|
|
* [1] https://trac.torproject.org/projects/tor/ticket/10089 ***/
|
|
|
|
|
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/
|
|
|
|
|
user_pref("middlemouse.contentLoadURL", false);
|
|
|
|
|
/* 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS)
|
|
|
|
|
* [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins)
|
|
|
|
|
@ -1350,6 +1369,7 @@ user_pref("privacy.cpd.siteSettings", false); // Site Preferences
|
|
|
|
|
user_pref("privacy.sanitize.timeSpan", 0);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION)
|
|
|
|
|
4001: FPI
|
|
|
|
|
** 1278037 - isolate indexedDB (FF51+)
|
|
|
|
|
** 1277803 - isolate favicons (FF52+)
|
|
|
|
|
** 1264562 - isolate OCSP cache (FF52+)
|
|
|
|
|
@ -1368,22 +1388,29 @@ user_pref("privacy.sanitize.timeSpan", 0);
|
|
|
|
|
** 1506693 - isolate pdfjs range-based requests (FF68+)
|
|
|
|
|
** 1330467 - isolate site permissions (FF69+)
|
|
|
|
|
** 1534339 - isolate IPv6 (FF73+)
|
|
|
|
|
4003: NETWORK PARTITON
|
|
|
|
|
** 1647732 - isolate font cache (FF80+)
|
|
|
|
|
** 1649673 - isolate speculative connections (FF80+)
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
|
|
|
|
|
/* 4001: enable First Party Isolation [FF51+]
|
|
|
|
|
* [SETUP-WEB] May break cross-domain logins and site functionality until perfected
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1260931 ***/
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1260931
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1299996 [META] ***/
|
|
|
|
|
user_pref("privacy.firstparty.isolate", true);
|
|
|
|
|
/* 4002: enforce FPI restriction for window.opener [FF54+]
|
|
|
|
|
* [NOTE] Setting this to false may reduce the breakage in 4001
|
|
|
|
|
* FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But
|
|
|
|
|
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
|
|
|
|
|
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute, see [2],[3]
|
|
|
|
|
* The 2nd pref removes that limitation and will only allow communication if FPDs also match.
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1319773#c22
|
|
|
|
|
* [2] https://bugzilla.mozilla.org/1492607
|
|
|
|
|
* [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
|
|
|
|
|
// user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true]
|
|
|
|
|
// user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR]
|
|
|
|
|
/* 4003: enable site partitioning (FF78+)
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1590107 [META] */
|
|
|
|
|
user_pref("privacy.partition.network_state", true);
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING)
|
|
|
|
|
This master switch will be used for a wide range of items, many of which will
|
|
|
|
|
@ -1407,12 +1434,13 @@ user_pref("privacy.firstparty.isolate", true);
|
|
|
|
|
This spoof *shouldn't* affect core chrome/Firefox performance
|
|
|
|
|
** 1217238 - reduce precision of time exposed by javascript (FF55+)
|
|
|
|
|
** 1369303 - spoof/disable performance API (see 2410-deprecated, 4602, 4603) (FF56+)
|
|
|
|
|
** 1333651 & 1383495 & 1396468 - spoof Navigator API (see section 4700) (FF56+)
|
|
|
|
|
FF56: The version number will be rounded down to the nearest multiple of 10
|
|
|
|
|
FF57: The version number will match current ESR (1393283, 1418672, 1418162, 1511763)
|
|
|
|
|
FF59: The OS will be reported as Windows, OSX, Android, or Linux (to reduce breakage) (1404608)
|
|
|
|
|
FF66: The OS in HTTP Headers will be reduced to Windows or Android (1509829)
|
|
|
|
|
FF68: Reported OS versions updated to Windows 10, OS 10.14, and Adnroid 8.1 (1511434)
|
|
|
|
|
** 1333651 & 1383495 & 1396468 - spoof User Agent & Navigator API (see section 4700) (FF56+)
|
|
|
|
|
FF56: Version: rounded down to the nearest multiple of 10
|
|
|
|
|
FF57: Version: match current ESR (1393283, 1418672, 1418162, 1511763)
|
|
|
|
|
FF59: OS: Windows, OSX, Android, or Linux (to reduce breakage) (1404608)
|
|
|
|
|
FF66: OS: HTTP Headers reduced to Windows or Android (1509829)
|
|
|
|
|
FF68: OS: updated to Windows 10, OS 10.14, and Android 8.1 (1511434)
|
|
|
|
|
FF78: OS: updated to OS 10.15 and Android 9.0 (1635011)
|
|
|
|
|
** 1369319 - disable device sensor API (see 4604) (FF56+)
|
|
|
|
|
** 1369357 - disable site specific zoom (see 4605) (FF56+)
|
|
|
|
|
** 1337161 - hide gamepads from content (see 4606) (FF56+)
|
|
|
|
|
@ -1426,7 +1454,7 @@ user_pref("privacy.firstparty.isolate", true);
|
|
|
|
|
** 1354633 - limit MediaError.message to a whitelist (FF57+)
|
|
|
|
|
** 1382533 - enable fingerprinting resistance for Presentation API (FF57+)
|
|
|
|
|
This blocks exposure of local IP Addresses via mDNS (Multicast DNS)
|
|
|
|
|
** 967895 - enable site permission prompt before allowing canvas data extraction (FF58+)
|
|
|
|
|
** 967895 - spoof canvas and enable site permission prompt before allowing canvas data extraction (FF58+)
|
|
|
|
|
FF59: Added to site permissions panel (1413780) Only prompt when triggered by user input (1376865)
|
|
|
|
|
** 1372073 - spoof/block fingerprinting in MediaDevices API (FF59+)
|
|
|
|
|
Spoof: enumerate devices reports one "Internal Camera" and one "Internal Microphone" if
|
|
|
|
|
@ -1439,16 +1467,18 @@ user_pref("privacy.firstparty.isolate", true);
|
|
|
|
|
FF60: Fix keydown/keyup events (1438795)
|
|
|
|
|
** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
|
|
|
|
|
** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+)
|
|
|
|
|
** 1479239 - return "no-preference" with prefers-reduced-motion (FF63+)
|
|
|
|
|
** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+)
|
|
|
|
|
** 1479239 - return "no-preference" with prefers-reduced-motion (see 4614) (FF63+)
|
|
|
|
|
** 1363508 - spoof/suppress Pointer Events (see 4615) (FF64+)
|
|
|
|
|
FF65: pointerEvent.pointerid (1492766)
|
|
|
|
|
** 1485266 - disable exposure of system colors to CSS or canvas (see 4615) (FF67+)
|
|
|
|
|
** 1485266 - disable exposure of system colors to CSS or canvas (see 4616) (FF67+)
|
|
|
|
|
** 1407366 - enable inner window letterboxing (see 4504) (FF67+)
|
|
|
|
|
** 1494034 - return "light" with prefers-color-scheme (see 4616) (FF67+)
|
|
|
|
|
** 1494034 - return "light" with prefers-color-scheme (see 4617) (FF67+)
|
|
|
|
|
[1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme
|
|
|
|
|
** 1564422 - spoof audioContext outputLatency (FF70+)
|
|
|
|
|
** 1595823 - spoof audioContext sampleRate (FF72+)
|
|
|
|
|
** 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+)
|
|
|
|
|
** 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+)
|
|
|
|
|
** 1653987 - limit font visibility to bundled and "Base Fonts" (see 4618) (non-ANDROID) (FF80+)
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
|
|
|
|
|
/* 4501: enable privacy.resistFingerprinting [FF41+]
|
|
|
|
|
@ -1483,6 +1513,9 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF]
|
|
|
|
|
* When default true (FF62+) this no longer masks the RFP chrome resizing activity
|
|
|
|
|
* [1] https://bugzilla.mozilla.org/1448423 ***/
|
|
|
|
|
user_pref("browser.startup.blankWindow", false);
|
|
|
|
|
/* 4520: disable chrome animations [FF77+] [RESTART]
|
|
|
|
|
* [NOTE] pref added in FF63, but applied to chrome in FF77. RFP spoofs this for web content ***/
|
|
|
|
|
user_pref("ui.prefersReducedMotion", 1); // [HIDDEN PREF]
|
|
|
|
|
|
|
|
|
|
/*** [SECTION 4600]: RFP ALTERNATIVES
|
|
|
|
|
* non-RFP users:
|
|
|
|
|
@ -1501,8 +1534,8 @@ user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan
|
|
|
|
|
// 4601: [2514] spoof (or limit?) number of CPU cores [FF48+]
|
|
|
|
|
// [NOTE] *may* affect core chrome/Firefox performance, will affect content.
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/1008453
|
|
|
|
|
// [2] https://trac.torproject.org/projects/tor/ticket/21675
|
|
|
|
|
// [3] https://trac.torproject.org/projects/tor/ticket/22127
|
|
|
|
|
// [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21675
|
|
|
|
|
// [3] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22127
|
|
|
|
|
// [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency
|
|
|
|
|
// user_pref("dom.maxHardwareConcurrency", 2);
|
|
|
|
|
// * * * /
|
|
|
|
|
@ -1514,7 +1547,7 @@ user_pref("dom.enable_resource_timing", false);
|
|
|
|
|
user_pref("dom.enable_performance", false);
|
|
|
|
|
// 4604: [2512] disable device sensor API
|
|
|
|
|
// Optional protection depending on your device
|
|
|
|
|
// [1] https://trac.torproject.org/projects/tor/ticket/15758
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15758
|
|
|
|
|
// [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/
|
|
|
|
|
// [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751
|
|
|
|
|
// user_pref("device.sensors.enabled", false);
|
|
|
|
|
@ -1525,7 +1558,7 @@ user_pref("dom.enable_performance", false);
|
|
|
|
|
user_pref("browser.zoom.siteSpecific", false);
|
|
|
|
|
// 4606: [2501] disable gamepad API - USB device ID enumeration
|
|
|
|
|
// Optional protection depending on your connected devices
|
|
|
|
|
// [1] https://trac.torproject.org/projects/tor/ticket/13023
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/13023
|
|
|
|
|
// user_pref("dom.gamepad.enabled", false);
|
|
|
|
|
// 4607: [2503] disable giving away network info [FF31+]
|
|
|
|
|
// e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none
|
|
|
|
|
@ -1541,7 +1574,7 @@ user_pref("media.webspeech.synth.enabled", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF57+
|
|
|
|
|
// 4610: [2506] disable video statistics - JS performance fingerprinting [FF25+]
|
|
|
|
|
// [1] https://trac.torproject.org/projects/tor/ticket/15757
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15757
|
|
|
|
|
// [2] https://bugzilla.mozilla.org/654550
|
|
|
|
|
user_pref("media.video_stats.enabled", false);
|
|
|
|
|
// 4611: [2509] disable touch events
|
|
|
|
|
@ -1549,7 +1582,7 @@ user_pref("media.video_stats.enabled", false);
|
|
|
|
|
// 0=disabled, 1=enabled, 2=autodetect
|
|
|
|
|
// Optional protection depending on your device
|
|
|
|
|
// [1] https://developer.mozilla.org/docs/Web/API/Touch_events
|
|
|
|
|
// [2] https://trac.torproject.org/projects/tor/ticket/10286
|
|
|
|
|
// [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10286
|
|
|
|
|
// user_pref("dom.w3c_touch_events.enabled", 0);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF59+
|
|
|
|
|
@ -1564,20 +1597,31 @@ user_pref("media.ondevicechange.enabled", false);
|
|
|
|
|
// [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info
|
|
|
|
|
user_pref("webgl.enable-debug-renderer-info", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF65+
|
|
|
|
|
// 4614: [2516] disable PointerEvents
|
|
|
|
|
// FF63+
|
|
|
|
|
// 4614: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART]
|
|
|
|
|
// 0=no-preference, 1=reduce
|
|
|
|
|
user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF]
|
|
|
|
|
// FF64+
|
|
|
|
|
// 4615: [2516] disable PointerEvents
|
|
|
|
|
// [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent
|
|
|
|
|
user_pref("dom.w3c_pointer_events.enabled", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF67+
|
|
|
|
|
// 4615: [2618] disable exposure of system colors to CSS or canvas [FF44+]
|
|
|
|
|
// 4616: [2618] disable exposure of system colors to CSS or canvas [FF44+]
|
|
|
|
|
// [NOTE] See second listed bug: may cause black on black for elements with undefined colors
|
|
|
|
|
// [SETUP-CHROME] Might affect CSS in themes and extensions
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876
|
|
|
|
|
user_pref("ui.use_standins_for_native_colors", true);
|
|
|
|
|
// 4616: enforce prefers-color-scheme as light [FF67+]
|
|
|
|
|
// 4617: enforce prefers-color-scheme as light [FF67+]
|
|
|
|
|
// 0=light, 1=dark : This overrides your OS value
|
|
|
|
|
user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF]
|
|
|
|
|
// FF80+
|
|
|
|
|
// 4618: limit font visbility (non-ANDROID) [FF79+]
|
|
|
|
|
// Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts, see [1]
|
|
|
|
|
// 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts
|
|
|
|
|
// [NOTE] Bundled fonts are auto-allowed
|
|
|
|
|
// [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc
|
|
|
|
|
user_pref("layout.css.font-visibility.level", 1);
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
@ -1586,8 +1630,8 @@ user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF]
|
|
|
|
|
to use RFP (4500) or an extension, in which case they become POINTLESS.
|
|
|
|
|
(a) Many of the components that make up your UA can be derived by other means.
|
|
|
|
|
And when those values differ, you provide more bits and raise entropy.
|
|
|
|
|
Examples of leaks include navigator objects, date locale/formats, iframes,
|
|
|
|
|
headers, tcp/ip attributes, feature detection, and **many** more.
|
|
|
|
|
Examples of leaks include workers, navigator objects, date locale/formats,
|
|
|
|
|
iframes, headers, tcp/ip attributes, feature detection, and **many** more.
|
|
|
|
|
ALL values below intentionally left blank - use RFP, or get a vetted, tested
|
|
|
|
|
extension and mimic RFP values to *lower* entropy, or randomize to *raise* it
|
|
|
|
|
***/
|
|
|
|
|
@ -1624,7 +1668,6 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
|
|
|
|
|
// user_pref("full-screen-api.warning.timeout", 0);
|
|
|
|
|
/* APPEARANCE ***/
|
|
|
|
|
// user_pref("browser.download.autohideButton", false); // [FF57+]
|
|
|
|
|
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
|
|
|
|
|
// user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent
|
|
|
|
|
/* CONTENT BEHAVIOR ***/
|
|
|
|
|
// user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type"
|
|
|
|
|
@ -1658,6 +1701,20 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
|
|
|
|
|
[1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
|
|
|
|
|
***/
|
|
|
|
|
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
|
|
|
|
|
/* ESR78.x still uses all the following prefs
|
|
|
|
|
// [NOTE] replace the * with a slash in the line above to re-enable them
|
|
|
|
|
// FF79
|
|
|
|
|
// 0212: enforce fallback text encoding to match en-US
|
|
|
|
|
// When the content or server doesn't declare a charset the browser will
|
|
|
|
|
// fallback to the "Current locale" based on your application language
|
|
|
|
|
// [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content (FF72-)
|
|
|
|
|
// [TEST] https://hsivonen.com/test/moz/check-charset.htm
|
|
|
|
|
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1603712
|
|
|
|
|
user_pref("intl.charset.fallback.override", "windows-1252");
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
/* ESR68.x still uses all the following prefs
|
|
|
|
|
// [NOTE] replace the * with a slash in the line above to re-enable them
|
|
|
|
|
// FF69
|
|
|
|
|
@ -1715,6 +1772,31 @@ user_pref("privacy.userContext.longPressBehavior", 2);
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1477756
|
|
|
|
|
user_pref("webgl.disable-extensions", true);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF76
|
|
|
|
|
// 0401: sanitize blocklist url
|
|
|
|
|
// [2] https://trac.torproject.org/projects/tor/ticket/16931
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1618188
|
|
|
|
|
user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/");
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF77
|
|
|
|
|
// 0850e: disable location bar one-off searches [FF51+]
|
|
|
|
|
// [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1628926
|
|
|
|
|
// user_pref("browser.urlbar.oneOffSearches", false);
|
|
|
|
|
// 2605: block web content in file processes [FF55+]
|
|
|
|
|
// [SETUP-WEB] You may want to disable this for corporate or developer environments
|
|
|
|
|
// [1] https://bugzilla.mozilla.org/1343184
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1603007
|
|
|
|
|
user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
|
|
|
|
|
// * * * /
|
|
|
|
|
// FF78
|
|
|
|
|
// 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] - replaced by 'media.autoplay.blocking_policy'
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1509933
|
|
|
|
|
user_pref("media.autoplay.enabled.user-gestures-needed", false);
|
|
|
|
|
// 5000's: disable chrome animations - replaced FF77+ by 'ui.prefersReducedMotion' (4520)
|
|
|
|
|
// [-] https://bugzilla.mozilla.org/1640501
|
|
|
|
|
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
|
|
|
|
|
// * * * /
|
|
|
|
|
// ***/
|
|
|
|
|
|
|
|
|
|
/* END: internal custom pref to test for syntax errors ***/
|
|
|
|
|
|
