Git/firefox-user.js
1
0
Fork 0
mirror of https://github.com/arkenfox/user.js.git synced 2024-11-22 02:21:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

Updated 4.1 Extensions (markdown)

Thorin-Oakenpants 2022-07-31 23:43:46 +00:00
parent bf7647014b
commit 7eb1a370c3
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
4.1-Extensions.md

@ -75,7 +75,7 @@ These extensions will not mask or alter any data sent or received, but may be us
* NoScript
- Redundant with uBlock Origin
* Ghostery, Disconnect, Privacy Badger, etc
- Redundant with [Total Cookie Protection](https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/) (dFPI) or FPI
- Redundant with [Total Cookie Protection](https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/) (dFPI)
- Note: Privacy Badger [no longer](https://www.eff.org/deeplinks/2020/10/privacy-badger-changing-protect-you-better) uses [heuristics](https://www.eff.org/privacybadger/faq#How-does-Privacy-Badger-work) by default, and enabling it makes you easily [detected](https://adtechmadness.wordpress.com/2020/03/27/detecting-privacy-badgers-canvas-fp-detection/)
* Neat URL, ClearURLs
- Redundant with uBlock Origin's [`removeparam`](https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#removeparam) and added lists. Any potential extra coverage provided by additional extensions is going to be minimal
@ -84,11 +84,11 @@ These extensions will not mask or alter any data sent or received, but may be us
* CSS Exfil Protection
- Practically zero threat and if the platform's CSS was compromised, you'd have bigger problems to worry about
* LocalCDN, Decentraleyes
- Third parties are already isolated if you use [Total Cookie Protection](https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/) (dFPI) or FPI
- Third parties are already partitioned if you use [Total Cookie Protection](https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/) (dFPI)
- Replacing _some version specific_ scripts on CDNs with local versions is not a comprehensive solution and is a form of [enumerating badness](https://www.ranum.com/security/computer_security/editorials/dumb/). While it may work with some scripts that are included it doesn’t help with most other third party connections
- CDN extensions don't really improve privacy as far as sharing your IP address is concerned and their usage is fingerprintable as this Tor Project developer [points out](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22089#note_2639603). They are the [wrong tool](https://en.wikipedia.org/wiki/XY_problem) for the job and are not a substitute for a good VPN or Tor Browser. Its worth noting the [resources](https://git.synz.io/Synzvato/decentraleyes/-/tree/master/resources) for Decentraleyes are over three years out of date and would not likely be used anyway
* Temporary Containers, Cookie extensions
- Redundant with [Total Cookie Protection](https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/) (dFPI) or FPI
- Third parties are already partitioned with [Total Cookie Protection](https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/) (dFPI)
- ❗️Sanitizing in-session is a false sense of privacy. They do nothing for IP tracking. Even Tor Browser does not sanitize in-session e.g. when you request a new circuit. A new ID requires _both_ full sanitizing _and_ a new IP. The same applies to Firefox
- ❗️Cookie extensions can lack APIs or implementation of them to properly sanitize
- e.g. at the time of writing: [Cookie Auto Delete](https://addons.mozilla.org/firefox/addon/cookie-autodelete/)