diff --git a/4.1-Extensions.md b/4.1-Extensions.md index 7d6160c..ea6836d 100644 --- a/4.1-Extensions.md +++ b/4.1-Extensions.md @@ -2,39 +2,39 @@ This list covers privacy and security related extensions only. While we believe ### :small_orange_diamond: Relevant Links - * [#655](https://github.com/ghacksuserjs/ghacks-user.js/issues/655) Submissions | [#350](https://github.com/ghacksuserjs/ghacks-user.js/issues/350) Prefs & Extensions | [#664](https://github.com/ghacksuserjs/ghacks-user.js/issues/664) CSP issues + * [#655](https://github.com/arkenfox/user.js/issues/655) Submissions | [#350](https://github.com/arkenfox/user.js/issues/350) Prefs & Extensions | [#664](https://github.com/arkenfox/user.js/issues/664) CSP issues ### :small_orange_diamond: **CSP** - **FULLY** fixed in ESR78.1+ and FF78+ - [Developer Release Notes](https://wiki.developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/77#API_changes), [1462989](https://bugzilla.mozilla.org/show_bug.cgi?id=1462989), [1635781](https://bugzilla.mozilla.org/show_bug.cgi?id=1635781) -- :exclamation: **CSP**: When multiple extensions use CSP injection to modify headers, only one wins and predicting the winner is like [rolling a dice](https://github.com/ghacksuserjs/ghacks-user.js/issues/265#issuecomment-393935989). Some CSP items (this is not an exhaustive list) to be aware of are highlighted below. +- :exclamation: **CSP**: When multiple extensions use CSP injection to modify headers, only one wins and predicting the winner is like [rolling a dice](https://github.com/arkenfox/user.js/issues/265#issuecomment-393935989). Some CSP items (this is not an exhaustive list) to be aware of are highlighted below. --- ### :small_orange_diamond: Extensions (in no particular order...) -* [uBlock Origin](https://addons.mozilla.org/firefox/addon/ublock-origin/) ✔ [Privacy](https://github.com/gorhill/uBlock/wiki/Privacy-policy) | [GitHub](https://github.com/gorhill/uBlock) - * :exclamation: **CSP**: Uncheck `Dashboard > Settings > Block remote fonts`. Font rules use CSP, use Request Control instead. [Other CSP issues](https://github.com/ghacksuserjs/ghacks-user.js/issues/664#issuecomment-472596147) include filter lists that use `$csp=` (and there are lot of them) -* [uMatrix](https://addons.mozilla.org/firefox/addon/umatrix/) ✔ [Privacy](https://github.com/gorhill/uMatrix/wiki/Privacy-policy) | [GitHub](https://github.com/gorhill/uMatrix) +* [uBlock Origin](https://addons.mozilla.org/firefox/addon/ublock-origin/) ? [Privacy](https://github.com/gorhill/uBlock/wiki/Privacy-policy) | [GitHub](https://github.com/gorhill/uBlock) + * :exclamation: **CSP**: Uncheck `Dashboard > Settings > Block remote fonts`. Font rules use CSP, use Request Control instead. [Other CSP issues](https://github.com/arkenfox/user.js/issues/664#issuecomment-472596147) include filter lists that use `$csp=` (and there are lot of them) +* [uMatrix](https://addons.mozilla.org/firefox/addon/umatrix/) ? [Privacy](https://github.com/gorhill/uMatrix/wiki/Privacy-policy) | [GitHub](https://github.com/gorhill/uMatrix) * :exclamation: **CSP**: uMatrix uses CSP for `$inline` and for web workers (maybe others) -* [HTTPS Everywhere](https://addons.mozilla.org/firefox/addon/https-everywhere/) ✔ [Privacy](https://www.eff.org/code/privacy/policy) | [GitHub](https://github.com/EFForg/https-everywhere) +* [HTTPS Everywhere](https://addons.mozilla.org/firefox/addon/https-everywhere/) ? [Privacy](https://www.eff.org/code/privacy/policy) | [GitHub](https://github.com/EFForg/https-everywhere) * :exclamation: **CSP**: Uncheck `Toolbar Icon > Encrypt All Sites Eligible (EASE)` -* [CanvasBlocker](https://addons.mozilla.org/firefox/addon/canvasblocker/) ✔ [Privacy](https://addons.mozilla.org/firefox/addon/canvasblocker/privacy/) | [GitHub](https://github.com/kkapsner/CanvasBlocker) +* [CanvasBlocker](https://addons.mozilla.org/firefox/addon/canvasblocker/) ? [Privacy](https://addons.mozilla.org/firefox/addon/canvasblocker/privacy/) | [GitHub](https://github.com/kkapsner/CanvasBlocker) * :exclamation: **CSP**: Uncheck `Misc > Block data URL pages` -* [Decentraleyes](https://addons.mozilla.org/firefox/addon/decentraleyes/) ✔ [Privacy](https://addons.mozilla.org/firefox/addon/decentraleyes/privacy/) | [GitLab](https://git.synz.io/Synzvato/decentraleyes) | [GitHub Archive](https://github.com/Synzvato/decentraleyes) +* [Decentraleyes](https://addons.mozilla.org/firefox/addon/decentraleyes/) ? [Privacy](https://addons.mozilla.org/firefox/addon/decentraleyes/privacy/) | [GitLab](https://git.synz.io/Synzvato/decentraleyes) | [GitHub Archive](https://github.com/Synzvato/decentraleyes) * :sparkles: uBlock Origin users should add the [following `noop` rules](https://git.synz.io/Synzvato/decentraleyes/wikis/Frequently-Asked-Questions) if required -* [Temporary Containers](https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/) ✔ Privacy (stated on AMO) | [GitHub](https://github.com/stoically/temporary-containers) +* [Temporary Containers](https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/) ? Privacy (stated on AMO) | [GitHub](https://github.com/stoically/temporary-containers) * This can achieve *almost* everything First Party Isolation (FPI) does without breaking cross-domain logins. And (with or without FPI), in a hardened TC setup, this can even isolate repeat visits to the same domain, which FPI alone cannot. * Required reading: [1] [AMO description](https://addons.mozilla.org/firefox/addon/temporary-containers/) [2] [Article](https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21) [3] [TC's Wiki](https://github.com/stoically/temporary-containers/wiki) * [CSS Exfil Protection](https://addons.mozilla.org/firefox/addon/css-exfil-protection/) | [GitHub](https://github.com/mlgualtieri/CSS-Exfil-Protection) | [Homepage + Test](https://www.mike-gualtieri.com/css-exfil-vulnerability-tester) -* [Smart Referer](https://addons.mozilla.org/firefox/addon/smart-referer/) ✔ [Privacy](https://addons.mozilla.org/firefox/addon/smart-referer/privacy/) | [GitLab](https://gitlab.com/smart-referer/smart-referer) | [GitHub Archive](https://github.com/meh/smart-referer) +* [Smart Referer](https://addons.mozilla.org/firefox/addon/smart-referer/) ? [Privacy](https://addons.mozilla.org/firefox/addon/smart-referer/privacy/) | [GitLab](https://gitlab.com/smart-referer/smart-referer) | [GitHub Archive](https://github.com/meh/smart-referer) * [Header Editor](https://addons.mozilla.org/firefox/addon/header-editor/) | [GitHub](https://github.com/FirefoxBar/HeaderEditor) - * Allows you to run [Rules](https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor) to modify headers such as blocking ETags + * Allows you to run [Rules](https://github.com/arkenfox/user.js/wiki/4.2.4-Header-Editor) to modify headers such as blocking ETags * [ETag Stoppa](https://addons.mozilla.org/firefox/addon/etag-stoppa/) | [GitHub](https://github.com/claustromaniac/ETag-Stoppa) Use this if you don't want a full-on header extension -* [Neat URL](https://addons.mozilla.org/firefox/addon/neat-url/) ✔ [Privacy](https://addons.mozilla.org/firefox/addon/neat-url/privacy/) | [GitHub](https://github.com/Smile4ever/Neat-URL) +* [Neat URL](https://addons.mozilla.org/firefox/addon/neat-url/) ? [Privacy](https://addons.mozilla.org/firefox/addon/neat-url/privacy/) | [GitHub](https://github.com/Smile4ever/Neat-URL) * [Skip Redirect](https://addons.mozilla.org/firefox/addon/skip-redirect/) | [GitHub](https://github.com/sblask/webextension-skip-redirect) -* [ClearURLs](https://addons.mozilla.org/firefox/addon/clearurls/) ✔ Privacy (stated on AMO) | [GitLab](https://gitlab.com/KevinRoebert/ClearUrls) | [GitHub Archive](https://github.com/KevinRoebert/ClearUrls) +* [ClearURLs](https://addons.mozilla.org/firefox/addon/clearurls/) ? Privacy (stated on AMO) | [GitLab](https://gitlab.com/KevinRoebert/ClearUrls) | [GitHub Archive](https://github.com/KevinRoebert/ClearUrls) * [Request Control](https://addons.mozilla.org/firefox/addon/requestcontrol/) | [GitHub](https://github.com/tumpio/requestcontrol) | [Manual](https://github.com/tumpio/requestcontrol/blob/master/_locales/en/manual.md) | [Testing links](https://github.com/tumpio/requestcontrol/wiki/Testing-links) -* [Redirector](https://addons.mozilla.org/firefox/addon/redirector/) ✔ [Privacy](https://github.com/einaregilsson/Redirector/blob/master/privacy.md) | [GitHub](https://github.com/einaregilsson/Redirector) +* [Redirector](https://addons.mozilla.org/firefox/addon/redirector/) ? [Privacy](https://github.com/einaregilsson/Redirector/blob/master/privacy.md) | [GitHub](https://github.com/einaregilsson/Redirector) --- @@ -45,7 +45,7 @@ These extensions will not mask or alter any data sent or received, but may be us * [uBO-Scope](https://addons.mozilla.org/firefox/addon/ubo-scope/) | [GitHub](https://github.com/gorhill/uBO-Scope) * [Behave](https://addons.mozilla.org/firefox/addon/behave/) | [GitHub](https://github.com/mindedsecurity/behave) * monitors and warns if a web page; performs DNS Rebinding attacks to Private IPs, accesses Private IPs, does Port Scans -* [True Sight](https://addons.mozilla.org/firefox/addon/detect-cloudflare-plus/) ✔ [Privacy](https://addons.mozilla.org/firefox/addon/detect-cloudflare-plus/privacy/) | [GitHub](https://github.com/claustromaniac/detect-cloudflare-plus) +* [True Sight](https://addons.mozilla.org/firefox/addon/detect-cloudflare-plus/) ? [Privacy](https://addons.mozilla.org/firefox/addon/detect-cloudflare-plus/privacy/) | [GitHub](https://github.com/claustromaniac/detect-cloudflare-plus) * Why would you want to detect CDNs? Read [this](https://github.com/claustromaniac/detect-cloudflare-PA/blob/master/README.md#motivation). * [mozlz4-edit](https://addons.mozilla.org/firefox/addon/mozlz4-edit/) | [Github](https://github.com/serj-kzv/mozlz4-edit) * inspect and/or edit `*.lz4`, `*.mozlz4`, `*.jsonlz4`, `*.baklz4` and `*.json` files within FF @@ -59,13 +59,13 @@ These extensions will not mask or alter any data sent or received, but may be us ### :small_orange_diamond: Don't Bother... * Cookie extensions - * ❗️ Functionality for extensions may be missing for clearing IndexedDB, Service Workers cache, or cache **by host**. Clearing cookies & localStorage on their own, and leaving orphaned persistent data is a false sense of privacy + * ?? Functionality for extensions may be missing for clearing IndexedDB, Service Workers cache, or cache **by host**. Clearing cookies & localStorage on their own, and leaving orphaned persistent data is a false sense of privacy * see [1340511](https://bugzilla.mozilla.org/1340511) for progress on this * FF77+ [1551301](https://bugzilla.mozilla.org/1551301) IDB [1632990](https://bugzilla.mozilla.org/1632990) Service Workers cache * FF78+ [1636784](https://bugzilla.mozilla.org/1636784) cache * Use FPI (First Party Isolation) and/or Temporary Containers * NoScript - * ❗️ **CSP**: "NoScript uses some trickery to ensure its CSP headers are injected" [gorhill](https://bugzilla.mozilla.org/show_bug.cgi?id=1462989#c20) + * ?? **CSP**: "NoScript uses some trickery to ensure its CSP headers are injected" [gorhill](https://bugzilla.mozilla.org/show_bug.cgi?id=1462989#c20) * Privacy Badger * Is easily [detected](https://adtechmadness.wordpress.com/2020/03/27/detecting-privacy-badgers-canvas-fp-detection/) and additional blocking via [hueristics](https://www.eff.org/privacybadger/faq#How-does-Privacy-Badger-work) is redundant or negligible when using uBlock Origin (depending on your configuration) * Ghostery, Disconnect @@ -73,7 +73,7 @@ These extensions will not mask or alter any data sent or received, but may be us --- -### :small_orange_diamond: ⚠️ Anti-Fingerprinting Extensions... F&%K NO! +### :small_orange_diamond: ?? Anti-Fingerprinting Extensions... F&%K NO! * **DON'T BOTHER** to **USE** extension features to **CHANGE** any RFP protections * Exception: where you can whitelist a site for functionality and you know the risks