2019-11-24 01:00:00 +01:00
/ * * * * * *
2020-10-31 22:22:23 +01:00
* name : thunderbird user . js
2022-05-24 22:13:39 +02:00
* date : 25 May 2022
* version : v91 . 1
2019-11-24 11:59:26 +01:00
* url : https : //github.com/HorlogeSkynet/thunderbird-user.js
* license : MIT ( https : //github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE)
* releases : https : //github.com/HorlogeSkynet/thunderbird-user.js/releases
2019-11-24 01:00:00 +01:00
* README :
2021-09-12 19:33:39 +02:00
1. Consider using Tor if it meets your needs or fits your threat model
* https : //www.torproject.org/about/torusers.html.en
2. Required reading : Overview , Backing Up , and Implementation entries
* https : //github.com/HorlogeSkynet/thunderbird-user.js/wiki
3. If you skipped step 2 , return to step 2
4. Make changes
* There are often trade - offs and conflicts between security vs privacy vs anti - fingerprinting
and these need to be balanced against functionality & convenience & breakage
* Some site breakage and unintended consequences will happen . Everyone ' s experience will differ
e . g . some user data is erased on close ( section 2800 ) , change this to suit your needs
* While not 100 % definitive , search for "[SETUP" tags
e . g . wanna re - enable account auto configuration ? check 9101 & 9102
* Take the wiki link in step 2 and read the Troubleshooting entry
5. Some tag info
2020-03-23 14:49:08 +01:00
[ SETUP - INSTALL ] if you experience any issue during Thunderbird setting up , read it
[ SETUP - FEATURE ] if you miss some ( expected ) Thunderbird features , read it
[ SETUP - SECURITY ] it ' s one item , read it
[ SETUP - WEB ] can cause some websites to break
2021-09-12 19:33:39 +02:00
[ SETUP - CHROME ] changes how Thunderbird itself behaves ( i . e . not directly website related )
2019-11-24 01:00:00 +01:00
* INDEX :
2021-09-12 19:33:39 +02:00
2019-11-24 18:51:29 +01:00
0100 : STARTUP
2020-11-01 19:08:14 +01:00
0200 : GEOLOCATION / LANGUAGE / LOCALE
2021-09-12 19:33:39 +02:00
0300 : QUIETER BIRD
0400 : SAFE BROWSING
2019-11-24 18:51:29 +01:00
0600 : BLOCK IMPLICIT OUTBOUND
2021-09-12 19:33:39 +02:00
0700 : DNS / DoH / PROXY / SOCKS / IPv6
0800 : LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS
0900 : PASSWORDS
1000 : DISK AVOIDANCE
1200 : HTTPS ( SSL / TLS / OCSP / CERTS / HPKP )
2019-11-24 18:51:29 +01:00
1400 : FONTS
1600 : HEADERS / REFERERS
2021-09-12 19:33:39 +02:00
1700 : CONTAINERS
2000 : PLUGINS / MEDIA / WEBRTC
2019-11-24 18:51:29 +01:00
2300 : WEB WORKERS
2021-09-12 19:33:39 +02:00
2400 : DOM ( DOCUMENT OBJECT MODEL )
2019-11-24 18:51:29 +01:00
2600 : MISCELLANEOUS
2700 : PERSISTENT STORAGE
2800 : SHUTDOWN
4000 : FPI ( FIRST PARTY ISOLATION )
4500 : RFP ( RESIST FINGERPRINTING )
2021-09-12 19:33:39 +02:00
5000 : OPTIONAL OPSEC
5500 : OPTIONAL HARDENING
6000 : DON ' T TOUCH
7000 : DON ' T BOTHER
8000 : DON ' T BOTHER : NON - RFP
9000 : PERSONAL
9100 : THUNDERBIRD ( AUTO CONFIG / UI / HEADERS / ADDRESS BOOK )
9200 : EMAIL COMPOSITION ( ENCODING / FORMAT / VIEW )
9300 : OTHER THUNDERBIRD COMPONENTS ( CHAT / CALENDAR / RSS )
2022-01-08 17:40:56 +01:00
9400 : THUNDERBIRD ENCRYPTION ( OPENGPG / GNUPG )
2019-11-24 18:51:29 +01:00
9999 : DEPRECATED / REMOVED / LEGACY / RENAMED
2019-11-24 01:00:00 +01:00
* * * * * * /
/ * S T A R T : i n t e r n a l c u s t o m p r e f t o t e s t f o r s y n t a x e r r o r s
2021-09-12 19:33:39 +02:00
* [ NOTE ] Not all syntax errors cause parsing to abort i . e . reaching the last debug pref
* no longer necessarily means that all prefs have been applied . Check the console right
2019-11-24 01:00:00 +01:00
* after startup for any warnings / error messages related to non - applied prefs
* [ 1 ] https : //blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/
user _pref ( "_user.js.parrot" , "START: Oh yes, the Norwegian Blue... what's wrong with it?" ) ;
2021-09-12 19:33:39 +02:00
/* 0000: disable about:config warning ***/
user _pref ( "browser.aboutConfig.showWarning" , false ) ;
2020-11-01 19:08:14 +01:00
2019-11-24 01:00:00 +01:00
/*** [SECTION 0100]: STARTUP ***/
user _pref ( "_user.js.parrot" , "0100 syntax error: the parrot's dead!" ) ;
/ * 0 1 0 1 : d i s a b l e d e f a u l t b r o w s e r c h e c k
2022-01-08 17:22:44 +01:00
* [ SETTING ] General > System Integration > Always check to see if Thunderbird is the default ... * * * /
2020-11-03 18:53:06 +01:00
user _pref ( "mail.shell.checkDefaultClient" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 0 1 0 2 : s e t S T A R T p a g e [ S E T U P - C H R O M E ]
2022-01-08 17:22:44 +01:00
* [ SETTING ] General > Thunderbird Start Page * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "mailnews.start_page.enabled" , false ) ;
2021-10-17 18:24:37 +02:00
/ * 0 1 0 4 : s e t N E W T A B p a g e
2022-01-08 17:22:44 +01:00
* true = Activity Stream ( default ) , false = blank page * * * /
2021-10-17 18:24:37 +02:00
user _pref ( "browser.newtabpage.enabled" , false ) ;
2019-11-24 01:00:00 +01:00
2020-11-01 19:08:14 +01:00
/*** [SECTION 0200]: GEOLOCATION / LANGUAGE / LOCALE ***/
2019-11-24 01:00:00 +01:00
user _pref ( "_user.js.parrot" , "0200 syntax error: the parrot's definitely deceased!" ) ;
2021-09-12 19:33:39 +02:00
/ * 0 2 0 1 : u s e M o z i l l a g e o l o c a t i o n s e r v i c e i n s t e a d o f G o o g l e i f p e r m i s s i o n i s g r a n t e d [ F F 7 4 + ]
2020-11-01 19:08:14 +01:00
* Optionally enable logging to the console ( defaults to false ) * * * /
user _pref ( "geo.provider.network.url" , "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%" ) ;
// user_pref("geo.provider.network.logging.enabled", true); // [HIDDEN PREF]
2021-09-12 19:33:39 +02:00
/* 0202: disable using the OS's geolocation service ***/
2020-11-01 19:08:14 +01:00
user _pref ( "geo.provider.ms-windows-location" , false ) ; // [WINDOWS]
user _pref ( "geo.provider.use_corelocation" , false ) ; // [MAC]
user _pref ( "geo.provider.use_gpsd" , false ) ; // [LINUX]
2021-09-12 19:33:39 +02:00
/ * 0 2 0 3 : d i s a b l e r e g i o n u p d a t e s
* [ 1 ] https : //firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/
user _pref ( "browser.region.network.url" , "" ) ; // [FF78+]
2021-10-30 11:33:39 +02:00
user _pref ( "browser.region.update.enabled" , false ) ; // [FF79+]
2021-09-12 19:33:39 +02:00
/ * 0 2 0 4 : s e t s e a r c h r e g i o n
* [ NOTE ] May not be hidden if Thunderbird has changed your settings due to your region ( 0203 ) * * * /
// user_pref("browser.search.region", "US"); // [HIDDEN PREF]
2021-10-30 11:33:39 +02:00
/ * 0 2 1 0 : s e t p r e f e r r e d l a n g u a g e f o r d i s p l a y i n g p a g e s
2022-01-08 17:22:44 +01:00
* [ SETTING ] General > Language & Appearance > Language > Choose the language used to display ...
2019-11-24 18:51:29 +01:00
* [ TEST ] https : //addons.mozilla.org/about ***/
2019-11-24 01:00:00 +01:00
user _pref ( "intl.accept_languages" , "en-US, en" ) ;
2020-11-01 19:08:14 +01:00
/* 0210b: Set dictionary to US ***/
2019-11-24 01:00:00 +01:00
user _pref ( "spellchecker.dictionary" , "en-US" ) ;
2021-09-12 19:33:39 +02:00
/ * 0 2 1 1 : u s e U S E n g l i s h l o c a l e r e g a r d l e s s o f t h e s y s t e m l o c a l e
* [ SETUP - WEB ] May break some input methods e . g xim / ibus for CJK languages [ 1 ]
* [ 1 ] https : //bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 ***/
2020-11-01 19:08:14 +01:00
user _pref ( "javascript.use_us_english_locale" , true ) ; // [HIDDEN PREF]
2019-11-24 01:00:00 +01:00
2019-11-24 18:51:29 +01:00
/ * * * [ S E C T I O N 0 3 0 0 ] : Q U I E T B I R D
Starting in user . js v68 , we only disable the auto - INSTALL of Thunderbird .
You still get prompts to update , in one click .
We have NEVER disabled auto - CHECKING , and highly discourage that .
There are many legitimate reasons to turn off auto - INSTALLS , including hijacked or monetized
extensions , time constraints , legacy issues , dev / testing , and fear of breakage / bugs . It is
still important to do updates for security reasons , please do so manually if you make changes .
* * * /
2019-11-24 01:00:00 +01:00
user _pref ( "_user.js.parrot" , "0300 syntax error: the parrot's not pinin' for the fjords!" ) ;
2021-09-12 19:33:39 +02:00
/** UPDATES ***/
/ * 0 3 0 1 : d i s a b l e a u t o - I N S T A L L I N G T h u n d e r b i r d u p d a t e s [ N O N - W I N D O W S ]
2022-01-08 17:22:44 +01:00
* [ NOTE ] You will still get prompts to update , and should do so in a timely manner * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "app.update.auto" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 0 3 0 2 : d i s a b l e a u t o - I N S T A L L I N G T h u n d e r b i r d u p d a t e s v i a a b a c k g r o u n d s e r v i c e [ F F 9 0 + ] [ W I N D O W S ]
2022-01-08 17:22:44 +01:00
* [ SETTING ] General > Thunderbird Updates > Automatically install updates > Use a background service to install updates
2021-09-12 19:33:39 +02:00
* [ 1 ] https : //support.mozilla.org/kb/enable-background-updates-firefox-windows ***/
user _pref ( "app.update.background.scheduling.enabled" , false ) ;
/* 0303: disable auto-CHECKING for extension and theme updates ***/
// user_pref("extensions.update.enabled", false);
/ * 0 3 0 4 : d i s a b l e a u t o - I N S T A L L I N G e x t e n s i o n a n d t h e m e u p d a t e s ( a f t e r t h e c h e c k i n 0 3 0 3 )
2022-01-08 17:22:44 +01:00
* [ SETTING ] about : addons > Extensions > [ cog - wheel - icon ] > Update Add - ons Automatically ( toggle ) * * * /
2019-11-24 18:51:29 +01:00
// user_pref("extensions.update.autoUpdateDefault", false);
2021-09-12 19:33:39 +02:00
/ * 0 3 0 5 : d i s a b l e e x t e n s i o n m e t a d a t a
2020-11-01 19:08:14 +01:00
* used when installing / updating an extension , and in daily background update checks :
2020-11-01 22:57:55 +01:00
* when false , extension detail tabs will have no description
* [ NOTE ] Unlike arkenfox / user . js , we explicitly disable it * * * /
user _pref ( "extensions.getAddons.cache.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 0 3 0 6 : d i s a b l e s e a r c h e n g i n e u p d a t e s ( e . g . O p e n S e a r c h )
* [ NOTE ] This does not affect Mozilla ' s built - in or Web Extension search engines * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "browser.search.update" , false ) ;
2021-09-12 19:33:39 +02:00
/** RECOMMENDATIONS ***/
/* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/
2019-11-24 01:00:00 +01:00
user _pref ( "extensions.getAddons.showPane" , false ) ; // [HIDDEN PREF]
2019-11-24 18:51:29 +01:00
/* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/
user _pref ( "extensions.htmlaboutaddons.recommendations.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/** TELEMETRY ***/
/ * 0 3 3 0 : d i s a b l e n e w d a t a s u b m i s s i o n [ F F 4 1 + ]
* If disabled , no policy is shown or upload takes place , ever
* [ 1 ] https : //bugzilla.mozilla.org/1195552 ***/
user _pref ( "datareporting.policy.dataSubmissionEnabled" , false ) ;
/ * 0 3 3 1 : d i s a b l e H e a l t h R e p o r t s
2022-01-08 17:22:44 +01:00
* [ SETTING ] Privacy & Security > Thunderbird Data Collection and Use > Allow Thunderbird to send technical ... * * * /
2021-09-12 19:33:39 +02:00
user _pref ( "datareporting.healthreport.uploadEnabled" , false ) ;
/ * 0 3 3 2 : d i s a b l e t e l e m e t r y
* The "unified" pref affects the behaviour of the "enabled" pref
* - If "unified" is false then "enabled" controls the telemetry module
* - If "unified" is true then "enabled" only controls whether to record extended data
* [ NOTE ] "toolkit.telemetry.enabled" is now LOCKED to reflect prerelease ( true ) or release builds ( false ) [ 2 ]
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html
* [ 2 ] https : //medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/
user _pref ( "toolkit.telemetry.unified" , false ) ;
2021-09-12 19:33:39 +02:00
user _pref ( "toolkit.telemetry.enabled" , false ) ; // see [NOTE]
2019-11-24 01:00:00 +01:00
user _pref ( "toolkit.telemetry.server" , "data:," ) ;
user _pref ( "toolkit.telemetry.archive.enabled" , false ) ;
user _pref ( "toolkit.telemetry.newProfilePing.enabled" , false ) ; // [FF55+]
user _pref ( "toolkit.telemetry.shutdownPingSender.enabled" , false ) ; // [FF55+]
user _pref ( "toolkit.telemetry.updatePing.enabled" , false ) ; // [FF56+]
user _pref ( "toolkit.telemetry.bhrPing.enabled" , false ) ; // [FF57+] Background Hang Reporter
user _pref ( "toolkit.telemetry.firstShutdownPing.enabled" , false ) ; // [FF57+]
2021-09-12 19:33:39 +02:00
/ * 0 3 3 3 : d i s a b l e T e l e m e t r y C o v e r a g e
* [ 1 ] https : //blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/
2021-10-31 09:42:26 +01:00
user _pref ( "toolkit.telemetry.coverage.opt-out" , true ) ; // [HIDDEN PREF]
user _pref ( "toolkit.coverage.opt-out" , true ) ; // [FF64+] [HIDDEN PREF]
user _pref ( "toolkit.coverage.endpoint.base" , "" ) ;
2021-09-12 19:33:39 +02:00
/ * 0 3 3 4 : d i s a b l e P i n g C e n t r e t e l e m e t r y ( u s e d i n s e v e r a l S y s t e m A d d - o n s ) [ F F 5 7 + ]
* Defense - in - depth : currently covered by 0331 * * * /
user _pref ( "browser.ping-centre.telemetry" , false ) ;
/** STUDIES ***/
/ * 0 3 4 0 : d i s a b l e S t u d i e s
2020-11-03 18:56:53 +01:00
* [ NOTE ] This option is missing from Thunderbird ' s preferences panel ( hidden ? ) * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "app.shield.optoutstudies.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 0 3 4 1 : d i s a b l e N o r m a n d y / S h i e l d [ F F 6 0 + ]
* Shield is a telemetry system that can push and test "recipes"
* [ 1 ] https : //mozilla.github.io/normandy/ ***/
user _pref ( "app.normandy.enabled" , false ) ;
user _pref ( "app.normandy.api_url" , "" ) ;
/** CRASH REPORTS ***/
2019-11-24 01:00:00 +01:00
/* 0350: disable Crash Reports ***/
user _pref ( "breakpad.reportURL" , "" ) ;
user _pref ( "browser.tabs.crashReporting.sendReport" , false ) ; // [FF44+]
2021-09-12 19:33:39 +02:00
// user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] [DEFAULT: false]
/ * 0 3 5 1 : e n f o r c e n o s u b m i s s i o n o f b a c k l o g g e d C r a s h R e p o r t s [ F F 5 8 + ]
2022-01-08 17:22:44 +01:00
* [ SETTING ] Privacy & Security > Thunderbird Data Collection and Use > Allow Thunderbird to send backlogged crash reports ... * * * /
2021-09-12 19:33:39 +02:00
user _pref ( "browser.crashReports.unsubmittedCheck.autoSubmit2" , false ) ; // [DEFAULT: false]
/** OTHER ***/
/ * 0 3 6 0 : d i s a b l e C a p t i v e P o r t a l d e t e c t i o n
* [ 1 ] https : //www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy ***/
user _pref ( "captivedetect.canonicalURL" , "" ) ;
user _pref ( "network.captive-portal-service.enabled" , false ) ; // [FF52+]
/ * 0 3 6 1 : d i s a b l e N e t w o r k C o n n e c t i v i t y c h e c k s [ F F 6 5 + ]
* [ 1 ] https : //bugzilla.mozilla.org/1460537 ***/
user _pref ( "network.connectivity-service.enabled" , false ) ;
/ * 0 3 6 2 : e n f o r c e d i s a b l i n g o f W e b C o m p a t i b i l i t y R e p o r t e r [ F F 5 6 + ]
* Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla * * * /
user _pref ( "extensions.webcompat-reporter.enabled" , false ) ; // [DEFAULT: false]
2020-11-03 18:56:53 +01:00
/* 0370: disable UI instrumentation ***/
2020-11-04 21:05:32 +01:00
user _pref ( "mail.instrumentation.postUrl" , "" ) ;
user _pref ( "mail.instrumentation.askUser" , false ) ;
user _pref ( "mail.instrumentation.userOptedIn" , false ) ;
2020-11-12 14:36:38 +01:00
/ * 0 3 7 1 : d i s a b l e a b o u t : r i g h t s n o t i f i c a t i o n o n f r e s h p r o f i l e s
* When a profile is loaded for the first time , a bottom notification appears with a button
* showing "Know your rights..." . If clicked , the _special _ page about : rights appears .
* When ` mail.rights.override ` is unset ( default ) , Thunderbird falls - back on ` mail.rights.version `
* value . If it ' s unset ( default too ) or lower than the current version , notification is displayed .
* false = always show the notification
* true = never show the notification
* [ 1 ] https : //searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/specialTabs.js#1218 ***/
user _pref ( "mail.rights.override" , true ) ; // [DEFAULT: unset]
// user_pref("mail.rights.version", 1) // [DEFAULT: unset]
2021-10-17 17:42:22 +02:00
/ * 0 3 8 0 : d i s a b l e t h e u n r e a d m e s s a g e c o u n t b a d g e o n t a s k b a r i c o n
* [ 1 ] https : //www.thunderbird.net/en-US/thunderbird/91.0.2/releasenotes/#whatsnew */
// user_pref("mail.biff.show_badge", false); // [WINDOWS]
2019-11-24 01:00:00 +01:00
2021-09-12 19:33:39 +02:00
/ * * * [ S E C T I O N 0 4 0 0 ] : S A F E B R O W S I N G ( S B )
SB has taken many steps to preserve privacy . If required , a full url is never sent
to Google , only a part - hash of the prefix , hidden with noise of other real part - hashes .
Firefox takes measures such as stripping out identifying parameters and since SBv4 ( FF57 + )
doesn ' t even use cookies . ( # Turn on browser . safebrowsing . debug to monitor this activity )
FWIW , Google also swear it is anonymized and only used to flag malicious sites .
[ 1 ] https : //feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/
[ 2 ] https : //wiki.mozilla.org/Security/Safe_Browsing
[ 3 ] https : //support.mozilla.org/kb/how-does-phishing-and-malware-protection-work
2020-11-01 19:08:14 +01:00
* * * /
2021-09-12 19:33:39 +02:00
user _pref ( "_user.js.parrot" , "0400 syntax error: the parrot's passed on!" ) ;
/ * 0 4 0 1 : d i s a b l e S B ( S a f e B r o w s i n g )
2022-01-08 17:22:44 +01:00
* [ WARNING ] Do this at your own risk ! These are the master switches * * * /
2020-11-01 19:08:14 +01:00
// user_pref("browser.safebrowsing.malware.enabled", false);
// user_pref("browser.safebrowsing.phishing.enabled", false);
2021-09-12 19:33:39 +02:00
/ * 0 4 0 2 : d i s a b l e S B c h e c k s f o r d o w n l o a d s ( b o t h l o c a l l o o k u p s + r e m o t e )
2022-01-08 17:22:44 +01:00
* This is the master switch for the safebrowsing . downloads * prefs ( 0403 , 0404 ) * * * /
2020-11-01 19:08:14 +01:00
// user_pref("browser.safebrowsing.downloads.enabled", false);
2021-09-12 19:33:39 +02:00
/ * 0 4 0 3 : d i s a b l e S B c h e c k s f o r d o w n l o a d s ( r e m o t e )
* To verify the safety of certain executable files , Thunderbird may submit some information about the
2020-11-01 19:08:14 +01:00
* file , including the name , origin , size and a cryptographic hash of the contents , to the Google
2021-09-12 19:33:39 +02:00
* Safe Browsing service which helps Thunderbird determine whether or not the file should be blocked
2020-11-01 19:08:14 +01:00
* [ SETUP - SECURITY ] If you do not understand this , or you want this protection , then override it * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "browser.safebrowsing.downloads.remote.enabled" , false ) ;
2020-11-01 19:08:14 +01:00
user _pref ( "browser.safebrowsing.downloads.remote.url" , "" ) ;
2022-01-08 17:22:44 +01:00
/* 0404: disable SB checks for unwanted software ***/
2020-11-01 19:08:14 +01:00
// user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
// user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false);
2021-09-12 19:33:39 +02:00
/ * 0 4 0 5 : d i s a b l e " i g n o r e t h i s w a r n i n g " o n S B w a r n i n g s [ F F 4 5 + ]
2019-11-24 01:00:00 +01:00
* If clicked , it bypasses the block for that session . This is a means for admins to enforce SB
* [ TEST ] see github wiki APPENDIX A : Test Sites : Section 5
* [ 1 ] https : //bugzilla.mozilla.org/1226490 ***/
// user_pref("browser.safebrowsing.allowOverride", false);
/*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/
user _pref ( "_user.js.parrot" , "0600 syntax error: the parrot's no more!" ) ;
/ * 0 6 0 1 : d i s a b l e l i n k p r e f e t c h i n g
* [ 1 ] https : //developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
user _pref ( "network.prefetch-next" , false ) ;
/ * 0 6 0 2 : d i s a b l e D N S p r e f e t c h i n g
2021-09-12 19:33:39 +02:00
* [ 1 ] https : //developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
2019-11-24 01:00:00 +01:00
user _pref ( "network.dns.disablePrefetch" , true ) ;
2021-09-12 19:33:39 +02:00
// user_pref("network.dns.disablePrefetchFromHTTPS", true); // [DEFAULT: true]
2019-11-24 18:51:29 +01:00
/* 0603: disable predictor / prefetching ***/
2019-11-24 01:00:00 +01:00
user _pref ( "network.predictor.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
// user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false]
/ * 0 6 0 4 : d i s a b l e l i n k - m o u s e o v e r o p e n i n g c o n n e c t i o n t o l i n k e d s e r v e r
* [ 1 ] https : //news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/
2019-11-24 01:00:00 +01:00
user _pref ( "network.http.speculative-parallel-limit" , 0 ) ;
2021-09-12 19:33:39 +02:00
/ * 0 6 0 5 : e n f o r c e n o " H y p e r l i n k A u d i t i n g " ( c l i c k t r a c k i n g )
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/
2021-09-12 19:33:39 +02:00
// user_pref("browser.send_pings", false); // [DEFAULT: false]
2020-11-07 21:51:50 +01:00
/ * 0 6 1 0 : d o n ' t r e f r e s h n o r r e l o a d p a g e s w h e n t a b / w i n d o w i s n o t a c t i v e o r i n i d l e s t a t e
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=518805 ***/
user _pref ( "browser.meta_refresh_when_inactive.disabled" , true ) ;
2019-11-24 01:00:00 +01:00
2021-09-12 19:33:39 +02:00
/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS / IPv6 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "_user.js.parrot" , "0700 syntax error: the parrot's given up the ghost!" ) ;
/ * 0 7 0 1 : d i s a b l e I P v 6
2021-09-12 19:33:39 +02:00
* IPv6 can be abused , especially with MAC addresses , and can leak with VPNs : assuming
* your ISP and / or router and / or website is IPv6 capable . Most sites will fall back to IPv4
* [ STATS ] Firefox telemetry ( July 2021 ) shows ~ 10 % of all connections are IPv6
* [ NOTE ] This is an application level fallback . Disabling IPv6 is best done at an
2019-11-24 18:51:29 +01:00
* OS / network level , and / or configured properly in VPN setups . If you are not masking your IP ,
2020-11-01 19:08:14 +01:00
* then this won ' t make much difference . If you are masking your IP , then it can only help .
2021-09-12 19:33:39 +02:00
* [ NOTE ] PHP defaults to IPv6 with "localhost" . Use "php -S 127.0.0.1:PORT"
2020-11-01 19:08:14 +01:00
* [ TEST ] https : //ipleak.org/
2021-09-12 19:33:39 +02:00
* [ 1 ] https : //www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/
2019-11-24 01:00:00 +01:00
user _pref ( "network.dns.disableIPv6" , true ) ;
2020-11-03 18:56:53 +01:00
user _pref ( "network.notify.IPv6" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 0 7 0 2 : s e t t h e p r o x y s e r v e r t o d o a n y D N S l o o k u p s w h e n u s i n g S O C K S
2019-11-24 01:00:00 +01:00
* e . g . in Tor , this stops your local DNS server from knowing your Tor destination
* as a remote Tor node will handle the DNS request
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
2019-11-24 01:00:00 +01:00
user _pref ( "network.proxy.socks_remote_dns" , true ) ;
2021-09-12 19:33:39 +02:00
/ * 0 7 0 3 : d i s a b l e u s i n g U N C ( U n i f o r m N a m i n g C o n v e n t i o n ) p a t h s [ F F 6 1 + ]
2019-11-24 01:00:00 +01:00
* [ SETUP - CHROME ] Can break extensions for profiles on network shares
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "network.file.disable_unc_paths" , true ) ; // [HIDDEN PREF]
2021-10-30 11:33:39 +02:00
/ * 0 7 0 4 : d i s a b l e G I O a s a p o t e n t i a l p r o x y b y p a s s v e c t o r [ F F 6 0 + ]
2019-11-24 01:00:00 +01:00
* Gvfs / GIO has a set of supported protocols like obex , network , archive , computer , dav , cdda ,
* gphoto2 , trash , etc . By default only smb and sftp protocols are accepted so far ( as of FF64 )
* [ 1 ] https : //bugzilla.mozilla.org/1433507
2021-10-30 11:33:39 +02:00
* [ 2 ] https : //en.wikipedia.org/wiki/GVfs
* [ 3 ] https : //en.wikipedia.org/wiki/GIO_(software) ***/
2019-11-24 01:00:00 +01:00
user _pref ( "network.gio.supported-protocols" , "" ) ; // [HIDDEN PREF]
2021-09-12 19:33:39 +02:00
/ * 0 7 0 5 : d i s a b l e D N S - o v e r - H T T P S ( D o H ) r o l l o u t [ F F 6 0 + ]
* 0 = off by default , 2 = TRR ( Trusted Recursive Resolver ) first , 3 = TRR only , 5 = explicitly off
* see "doh-rollout.home-region" : USA Feb 2020 , Canada July 2021 [ 3 ]
* [ 1 ] https : //hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/
* [ 2 ] https : //wiki.mozilla.org/Security/DOH-resolver-policy
* [ 3 ] https : //blog.mozilla.org/mozilla/news/firefox-by-default-dns-over-https-rollout-in-canada/
* [ 4 ] https : //www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/
// user_pref("network.trr.mode", 5);
2021-10-30 11:33:39 +02:00
/ * 0 7 0 6 : d i s a b l e p r o x y d i r e c t f a i l o v e r f o r s y s t e m r e q u e s t s [ F F 9 1 + ]
* [ WARNING ] Default true is a security feature against malicious extensions [ 1 ]
* [ SETUP - CHROME ] If you use a proxy and you trust your extensions
* [ 1 ] https : //blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ ***/
// user_pref("network.proxy.failover_direct", false);
2021-09-12 19:33:39 +02:00
/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/
2019-11-24 01:00:00 +01:00
user _pref ( "_user.js.parrot" , "0800 syntax error: the parrot's ceased to be!" ) ;
2019-11-24 18:51:29 +01:00
/ * 0 8 0 1 : d i s a b l e l o c a t i o n b a r u s i n g s e a r c h
2021-09-12 19:33:39 +02:00
* Don ' t leak URL typos to a search engine , give an error message instead
2019-11-24 18:51:29 +01:00
* Examples : "secretplace,com" , "secretplace/com" , "secretplace com" , "secret place.com"
2021-09-12 19:33:39 +02:00
* [ NOTE ] This does not affect explicit user action such as using search buttons in the
* dropdown , or using keyword search shortcuts you configure in options ( e . g . "d" for DuckDuckGo )
2019-11-24 18:51:29 +01:00
* [ SETUP - CHROME ] If you don ' t , or rarely , type URLs , or you use a default search
* engine that respects privacy , then you probably don ' t need this * * * /
user _pref ( "keyword.enabled" , false ) ; // [DEFAULT: false]
/ * 0 8 0 2 : d i s a b l e l o c a t i o n b a r d o m a i n g u e s s i n g
* domain guessing intercepts DNS "hostname not found errors" and resends a
* request ( e . g . by adding www or . com ) . This is inconsistent use ( e . g . FQDNs ) , does not work
* via Proxy Servers ( different error ) , is a flawed use of DNS ( TLDs : why treat . com
* as the 411 for DNS errors ? ) , privacy issues ( why connect to sites you didn ' t
* intend to ) , can leak sensitive data ( e . g . query strings : e . g . Princeton attack ) ,
* and is a security risk ( e . g . common typos & malicious sites set up to exploit this ) * * * /
user _pref ( "browser.fixup.alternate.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 0 8 0 4 : d i s a b l e l i v e s e a r c h s u g g e s t i o n s
* [ NOTE ] Both must be true for the location bar to work
2022-01-08 17:22:44 +01:00
* [ SETUP - CHROME ] Change these if you trust and use a privacy respecting search engine * * * /
2019-11-24 18:51:29 +01:00
user _pref ( "browser.search.suggest.enabled" , false ) ;
2021-10-30 11:33:39 +02:00
/ * 0 8 1 0 : d i s a b l e s e a r c h a n d f o r m h i s t o r y
2021-09-12 19:33:39 +02:00
* [ SETUP - WEB ] Be aware that autocomplete form data can be read by third parties [ 1 ] [ 2 ]
* [ NOTE ] We also clear formdata on exit ( 2803 )
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //blog.mindedsecurity.com/2011/10/autocompleteagain.html
* [ 2 ] https : //bugzilla.mozilla.org/381681 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "browser.formfill.enable" , false ) ;
2021-10-30 11:33:39 +02:00
/ * 0 8 1 1 : d i s a b l e F o r m A u t o f i l l
2021-09-12 19:33:39 +02:00
* [ NOTE ] Stored data is NOT secure ( uses a JSON file )
* [ NOTE ] Heuristics controls Form Autofill on forms without @ autocomplete attributes
* [ 1 ] https : //wiki.mozilla.org/Firefox/Features/Form_Autofill ***/
user _pref ( "extensions.formautofill.addresses.enabled" , false ) ; // [FF55+]
user _pref ( "extensions.formautofill.available" , "off" ) ; // [FF56+]
user _pref ( "extensions.formautofill.creditCards.available" , false ) ; // [FF57+]
user _pref ( "extensions.formautofill.creditCards.enabled" , false ) ; // [FF56+]
user _pref ( "extensions.formautofill.heuristics.enabled" , false ) ; // [FF55+]
2021-10-30 11:33:39 +02:00
/ * 0 8 2 0 : d i s a b l e c o l o r i n g o f v i s i t e d l i n k s
2021-09-12 19:33:39 +02:00
* Bulk rapid history sniffing was mitigated in 2010 [ 1 ] [ 2 ] . Slower and more expensive
* redraw timing attacks were largely mitigated in FF77 + [ 3 ] . Using RFP ( 4501 ) further hampers timing
* attacks . Don ' t forget clearing history on close ( 2803 ) . However , social engineering [ 2 # limits ] [ 4 ] [ 5 ]
* and advanced targeted timing attacks could still produce usable results
* [ 1 ] https : //developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector
* [ 2 ] https : //dbaron.org/mozilla/visited-privacy
* [ 3 ] https : //bugzilla.mozilla.org/1632765
* [ 4 ] https : //earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use)
* [ 5 ] https : //lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/
user _pref ( "layout.css.visited_links_enabled" , false ) ;
2019-11-24 01:00:00 +01:00
2021-09-18 20:15:26 +02:00
/ * * * [ S E C T I O N 0 9 0 0 ] : P A S S W O R D S
[ 1 ] https : //support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas
2019-11-24 01:00:00 +01:00
* * * /
2021-09-18 20:15:26 +02:00
user _pref ( "_user.js.parrot" , "0900 syntax error: the parrot's expired!" ) ;
/ * 0 9 0 1 : s e t w h e n T h u n d e r b i r d s h o u l d p r o m p t f o r t h e p r i m a r y p a s s w o r d
* 0 = once per session ( default ) , 1 = every time it ' s needed , 2 = after n minutes ( 0902 ) * * * /
user _pref ( "security.ask_for_password" , 2 ) ;
/* 0902: set how long in minutes Thunderbird should remember the primary password (0901) ***/
// user_pref("security.password_lifetime", 30); // [DEFAULT: 30]
/ * 0 9 0 3 : d i s a b l e a u t o - f i l l i n g u s e r n a m e & p a s s w o r d f o r m f i e l d s
* can leak in cross - site forms * and * be spoofed
* [ NOTE ] Username & password is still available when you enter the field
* [ 1 ] https : //freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ ***/
user _pref ( "signon.autofillForms" , false ) ;
/* 0904: disable formless login capture for Password Manager [FF51+] ***/
user _pref ( "signon.formlessCapture.enabled" , false ) ;
/ * 0 9 0 5 : l i m i t ( o r d i s a b l e ) H T T P a u t h e n t i c a t i o n c r e d e n t i a l s d i a l o g s t r i g g e r e d b y s u b - r e s o u r c e s [ F F 4 1 + ]
* hardens against potential credentials phishing
* 0 = don ' t allow sub - resources to open HTTP authentication credentials dialogs
* 1 = don ' t allow cross - origin sub - resources to open HTTP authentication credentials dialogs
* 2 = allow sub - resources to open HTTP authentication credentials dialogs ( default ) * * * /
user _pref ( "network.auth.subresource-http-auth-allow" , 1 ) ;
/ * 0 9 0 6 : e n f o r c e n o a u t o m a t i c a u t h e n t i c a t i o n o n M i c r o s o f t s i t e s [ F F 9 1 + ] [ W I N D O W S 1 0 + ]
* [ 1 ] https : //support.mozilla.org/kb/windows-sso ***/
user _pref ( "network.http.windows-sso.enabled" , false ) ; // [DEFAULT: false]
/ * 0 9 1 0 : p r e v e n t a c c e s s t o e m a i l s u n t i l t h e m a s t e r p a s s w o r d i s e n t e r e d
* If a master password has been set , Thunderbird will prevent access to locally available emails
* until the secret is provided .
* This preference MAY mitigate risk due to intimate relationship threat in some cases ( see [ 2 ] ) ...
* [ WARNING ] This DOES NOT encrypt locally cached emails anyhow ( poor man ' s application security )
2021-10-17 18:54:35 +02:00
* [ WARNING ] This preference is very buggy , you might not manage to start Thunderbird when it ' s switched on
2021-09-18 20:15:26 +02:00
* [ 1 ] https : //support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-master-password
* [ 2 ] https : //www.schneier.com/wp-content/uploads/2020/06/Privacy_Threats_in_Intimate_Relationships-1.pdf ***/
2021-10-17 18:54:35 +02:00
// user_pref("mail.password_protect_local_cache", true); // [HIDDEN PREF]
2021-09-18 20:15:26 +02:00
/*** [SECTION 1000]: DISK AVOIDANCE ***/
2019-11-24 01:00:00 +01:00
user _pref ( "_user.js.parrot" , "1000 syntax error: the parrot's gone to meet 'is maker!" ) ;
2019-11-24 18:51:29 +01:00
/ * 1 0 0 1 : d i s a b l e d i s k c a c h e
2021-09-18 20:15:26 +02:00
* [ SETUP - CHROME ] If you think disk cache helps perf , then feel free to override this
* [ NOTE ] We also clear cache on exit ( 2803 ) * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "browser.cache.disk.enable" , false ) ;
2021-09-18 20:15:26 +02:00
/ * 1 0 0 2 : d i s a b l e m e d i a c a c h e f r o m w r i t i n g t o d i s k i n P r i v a t e B r o w s i n g
* [ NOTE ] MSE ( Media Source Extensions ) are already stored in - memory in PB
* [ SETUP - WEB ] ESR78 : playback might break on subsequent loading ( 1650281 ) * * * /
user _pref ( "browser.privatebrowsing.forceMediaMemoryCache" , true ) ; // [FF75+]
user _pref ( "media.memory_cache_max_size" , 65536 ) ;
/ * 1 0 0 3 : d i s a b l e s t o r i n g e x t r a s e s s i o n d a t a [ S E T U P - C H R O M E ]
* define on which sites to save extra session data such as form content , cookies and POST data
* 0 = everywhere , 1 = unencrypted sites , 2 = nowhere * * * /
user _pref ( "browser.sessionstore.privacy_level" , 2 ) ;
/ * 1 0 0 4 : s e t t h e m i n i m u m i n t e r v a l b e t w e e n s e s s i o n s a v e o p e r a t i o n s
* Increasing this can help on older machines and some websites , as well as reducing writes [ 1 ]
* [ 1 ] https : //bugzilla.mozilla.org/1304389 ***/
user _pref ( "browser.sessionstore.interval" , 30000 ) ; // [DEFAULT: 15000]
/ * 1 0 0 6 : d i s a b l e f a v i c o n s i n s h o r t c u t s
2019-11-24 01:00:00 +01:00
* URL shortcuts use a cached randomly named . ico file which is stored in your
2021-09-18 20:15:26 +02:00
* profile / shortcutCache directory . The . ico remains after the shortcut is deleted
2019-11-24 01:00:00 +01:00
* If set to false then the shortcuts use a generic Firefox icon * * * /
user _pref ( "browser.shell.shortcutFavicons" , false ) ;
2021-09-18 20:15:26 +02:00
/ * * * [ S E C T I O N 1 2 0 0 ] : H T T P S ( S S L / T L S / O C S P / C E R T S / H P K P )
2020-11-01 19:08:14 +01:00
Your cipher and other settings can be used in server side fingerprinting
[ TEST ] https : //www.ssllabs.com/ssltest/viewMyClient.html
[ TEST ] https : //browserleaks.com/ssl
[ TEST ] https : //ja3er.com/
2019-11-24 01:00:00 +01:00
[ 1 ] https : //www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
* * * /
user _pref ( "_user.js.parrot" , "1200 syntax error: the parrot's a stiff!" ) ;
/** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/
2020-11-01 19:08:14 +01:00
/ * 1 2 0 1 : r e q u i r e s a f e n e g o t i a t i o n
2021-09-18 20:15:26 +02:00
* Blocks connections ( SSL _ERROR _UNSAFE _NEGOTIATION ) to servers that don ' t support RFC 5746 [ 2 ]
* as they ' re potentially vulnerable to a MiTM attack [ 3 ] . A server without RFC 5746 can be
* safe from the attack if it disables renegotiations but the problem is that the browser can ' t
* know that . Setting this pref to true is the only way for the browser to ensure there will be
2020-11-01 19:08:14 +01:00
* no unsafe renegotiations on the channel between the browser and the server .
2021-09-18 20:15:26 +02:00
* [ STATS ] SSL Labs ( July 2021 ) reports over 99 % of sites have secure renegotiation [ 4 ]
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //wiki.mozilla.org/Security:Renegotiation
2020-11-01 19:08:14 +01:00
* [ 2 ] https : //tools.ietf.org/html/rfc5746
2021-09-18 20:15:26 +02:00
* [ 3 ] https : //cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
* [ 4 ] https : //www.ssllabs.com/ssl-pulse/ ***/
2019-11-24 01:00:00 +01:00
user _pref ( "security.ssl.require_safe_negotiation" , true ) ;
2021-09-18 20:15:26 +02:00
/* 1203: reset TLS 1.0 and 1.1 downgrades i.e. session only ***/
user _pref ( "security.tls.version.enable-deprecated" , false ) ; // [DEFAULT: false]
2020-11-01 19:08:14 +01:00
/ * 1 2 0 6 : d i s a b l e T L S 1 . 3 0 - R T T ( r o u n d - t r i p t i m e ) [ F F 5 1 + ]
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //github.com/tlswg/tls13-spec/issues/1001
* [ 2 ] https : //blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/
user _pref ( "security.tls.enable_0rtt_data" , false ) ;
/ * * O C S P ( O n l i n e C e r t i f i c a t e S t a t u s P r o t o c o l )
2021-09-18 20:15:26 +02:00
[ 1 ] https : //scotthelme.co.uk/revocation-is-broken/
[ 2 ] https : //blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
* * * /
2021-10-30 11:33:39 +02:00
/ * 1 2 1 1 : e n f o r c e O C S P f e t c h i n g t o c o n f i r m c u r r e n t v a l i d i t y o f c e r t i f i c a t e s
2019-11-24 01:00:00 +01:00
* 0 = disabled , 1 = enabled ( default ) , 2 = enabled for EV certificates only
* OCSP ( non - stapled ) leaks information about the sites you visit to the CA ( cert authority )
* It ' s a trade - off between security ( checking ) and privacy ( leaking info to the CA )
* [ NOTE ] This pref only controls OCSP fetching and does not affect OCSP stapling
2022-01-08 17:22:44 +01:00
* [ SETTING ] Privacy & Security > Security > Certificates > Query OCSP responder servers ...
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //en.wikipedia.org/wiki/Ocsp ***/
2021-10-30 11:33:39 +02:00
user _pref ( "security.OCSP.enabled" , 1 ) ; // [DEFAULT: 1]
2019-11-24 01:00:00 +01:00
/ * 1 2 1 2 : s e t O C S P f e t c h f a i l u r e s ( n o n - s t a p l e d , s e e 1 2 1 1 ) t o h a r d - f a i l [ S E T U P - W E B ]
* When a CA cannot be reached to validate a cert , Firefox just continues the connection ( = soft - fail )
* Setting this pref to true tells Firefox to instead terminate the connection ( = hard - fail )
* It is pointless to soft - fail when an OCSP fetch fails : you cannot confirm a cert is still valid ( it
* could have been revoked ) and / or you could be under attack ( e . g . malicious blocking of OCSP servers )
* [ 1 ] https : //blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
* [ 2 ] https : //www.imperialviolet.org/2014/04/19/revchecking.html ***/
user _pref ( "security.OCSP.require" , true ) ;
/** CERTS / HPKP (HTTP Public Key Pinning) ***/
/ * 1 2 2 0 : d i s a b l e o r l i m i t S H A - 1 c e r t i f i c a t e s
2021-09-18 20:15:26 +02:00
* 0 = allow all
* 1 = block all
* 3 = only allow locally - added roots ( e . g . anti - virus ) ( default )
* 4 = only allow locally - added roots or for certs in 2015 and earlier
* [ SETUP - CHROME ] If you have problems , update your software : SHA - 1 is obsolete
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ ***/
user _pref ( "security.pki.sha1_enforcement_level" , 1 ) ;
/ * 1 2 2 1 : d i s a b l e W i n d o w s 8 . 1 ' s M i c r o s o f t F a m i l y S a f e t y c e r t [ F F 5 0 + ] [ W I N D O W S ]
* 0 = disable detecting Family Safety mode and importing the root
* 1 = only attempt to detect Family Safety mode ( don ' t import the root )
* 2 = detect Family Safety mode and import the root
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "security.family_safety.mode" , 0 ) ;
2021-09-18 20:15:26 +02:00
/ * 1 2 2 3 : e n a b l e s t r i c t p i n n i n g
2021-10-30 11:33:39 +02:00
* PKP ( Public Key Pinning ) 0 = disabled , 1 = allow user MiTM ( such as your antivirus ) , 2 = strict
2021-09-18 20:15:26 +02:00
* [ SETUP - WEB ] If you rely on an AV ( antivirus ) to protect your web browsing
* by inspecting ALL your web traffic , then leave at current default = 1
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "security.cert_pinning.enforcement_level" , 2 ) ;
2021-09-18 20:15:26 +02:00
/ * 1 2 2 4 : e n a b l e C R L i t e [ F F 7 3 + ]
* In FF84 + it covers valid certs and in mode 2 doesn ' t fall back to OCSP
* [ 1 ] https : //bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985
* [ 2 ] https : //blog.mozilla.org/security/tag/crlite/ ***/
user _pref ( "security.remote_settings.crlite_filters.enabled" , true ) ;
user _pref ( "security.pki.crlite_mode" , 2 ) ;
2022-02-13 12:44:18 +01:00
/ * 1 2 2 5 : e n a b l e l o a d i n g o f c l i e n t c e r t i f i c a t e s s t o r e d i n O S c e r t i f i c a t e s t o r a g e
* Bug : this does * * NOT * * work for S / MIME [ 1 ]
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=1726442 ***/
// user_pref("security.osclientcerts.autoload", true);
2019-11-24 01:00:00 +01:00
/** MIXED CONTENT ***/
2019-11-24 18:51:29 +01:00
/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/
2019-11-24 01:00:00 +01:00
user _pref ( "security.mixed_content.block_display_content" , true ) ;
2021-09-18 20:15:26 +02:00
/ * 1 2 4 4 : e n a b l e H T T P S - O n l y m o d e i n a l l w i n d o w s [ F F 7 6 + ]
* When the top - level is HTTPS , insecure subresources are also upgraded ( silent fail )
* [ TEST ] http : //example.com [upgrade]
* [ TEST ] http : //neverssl.com/ [no upgrade] ***/
user _pref ( "dom.security.https_only_mode" , true ) ; // [FF76+]
user _pref ( "dom.security.https_only_mode_pbm" , true ) ; // [FF80+]
/* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/
user _pref ( "dom.security.https_only_mode.upgrade_local" , true ) ;
/ * 1 2 4 6 : d i s a b l e H T T P b a c k g r o u n d r e q u e s t s [ F F 8 2 + ]
* When attempting to upgrade , if the server doesn ' t respond within 3 seconds ,
* Firefox sends HTTP requests in order to check if the server supports HTTPS or not
* This is done to avoid waiting for a timeout which takes 90 seconds
* [ 1 ] https : //bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/
user _pref ( "dom.security.https_only_mode_send_http_background_request" , false ) ;
2019-11-24 01:00:00 +01:00
/** UI (User Interface) ***/
2020-11-01 19:08:14 +01:00
/ * 1 2 7 0 : d i s p l a y w a r n i n g o n t h e p a d l o c k f o r " b r o k e n s e c u r i t y " ( i f 1 2 0 1 i s f a l s e )
* Bug : warning padlock not indicated for subresources on a secure page ! [ 2 ]
* [ 1 ] https : //wiki.mozilla.org/Security:Renegotiation
2021-09-18 20:15:26 +02:00
* [ 2 ] https : //bugzilla.mozilla.org/1353705 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "security.ssl.treat_unsafe_negotiation_as_broken" , true ) ;
/ * 1 2 7 1 : c o n t r o l " A d d S e c u r i t y E x c e p t i o n " d i a l o g o n S S L w a r n i n g s
2021-10-30 11:33:39 +02:00
* 0 = do neither , 1 = pre - populate url , 2 = pre - populate url + pre - fetch cert ( default )
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //github.com/pyllyukko/user.js/issues/210 ***/
user _pref ( "browser.ssl_override_behavior" , 1 ) ;
/ * 1 2 7 2 : d i s p l a y a d v a n c e d i n f o r m a t i o n o n I n s e c u r e C o n n e c t i o n w a r n i n g p a g e s
* only works when it ' s possible to add an exception
* i . e . it doesn ' t work for HSTS discrepancies ( https : //subdomain.preloaded-hsts.badssl.com/)
* [ TEST ] https : //expired.badssl.com/ ***/
user _pref ( "browser.xul.error_pages.expert_bad_cert" , true ) ;
2021-09-18 20:15:26 +02:00
/* 1273: display "Not Secure" text on HTTP sites ***/
2019-11-24 01:00:00 +01:00
user _pref ( "security.insecure_connection_text.enabled" , true ) ; // [FF60+]
2019-11-30 22:34:58 +01:00
/* 1280: display warnings when insecure HTTP connections are made ***/
user _pref ( "security.warn_entering_weak" , true ) ;
user _pref ( "security.warn_leaving_secure" , true ) ;
user _pref ( "security.warn_viewing_mixed" , true ) ;
2019-11-24 01:00:00 +01:00
2019-11-24 18:51:29 +01:00
/*** [SECTION 1400]: FONTS ***/
user _pref ( "_user.js.parrot" , "1400 syntax error: the parrot's bereft of life!" ) ;
2021-09-18 20:15:26 +02:00
/* 1401: disable rendering of SVG OpenType fonts ***/
2019-11-24 18:51:29 +01:00
user _pref ( "gfx.font_rendering.opentype_svg.enabled" , false ) ;
2021-09-18 20:15:26 +02:00
/ * 1 4 0 2 : l i m i t f o n t v i s i b i l i t y ( W i n d o w s , M a c , s o m e L i n u x ) [ F F 7 9 + ]
* [ NOTE ] In FF80 + RFP ignores the pref and uses value 1
* Uses hardcoded lists with two parts : kBaseFonts + kLangPackFonts [ 1 ] , bundled fonts are auto - allowed
* 1 = only base system fonts , 2 = also fonts from optional language packs , 3 = also user - installed fonts
* [ 1 ] https : //searchfox.org/mozilla-central/search?path=StandardFonts*.inc ***/
user _pref ( "layout.css.font-visibility.level" , 1 ) ;
2019-11-24 01:00:00 +01:00
2019-11-24 18:51:29 +01:00
/*** [SECTION 1600]: HEADERS / REFERERS
2021-09-19 16:11:46 +02:00
Expect some breakage e . g . banks : use an extension if you need precise control
full URI : https : //example.com:8888/foo/bar.html?id=1234
scheme + host + port + path : https : //example.com:8888/foo/bar.html
scheme + host + port : https : //example.com:8888
[ 1 ] https : //feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/
2019-11-24 01:00:00 +01:00
* * * /
user _pref ( "_user.js.parrot" , "1600 syntax error: the parrot rests in peace!" ) ;
2021-09-19 16:11:46 +02:00
/ * 1 6 0 1 : c o n t r o l w h e n t o s e n d a c r o s s - o r i g i n r e f e r e r
2019-11-24 18:51:29 +01:00
* 0 = always ( default ) , 1 = only if base domains match , 2 = only if hosts match
2021-09-19 16:11:46 +02:00
* [ SETUP - WEB ] Known to cause issues with older modems / routers and some sites e . g vimeo , icloud , instagram * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "network.http.referer.XOriginPolicy" , 2 ) ;
2021-09-19 16:11:46 +02:00
/ * 1 6 0 2 : c o n t r o l t h e a m o u n t o f c r o s s - o r i g i n i n f o r m a t i o n t o s e n d [ F F 5 2 + ]
2019-11-24 01:00:00 +01:00
* 0 = send full URI ( default ) , 1 = scheme + host + port + path , 2 = scheme + host + port * * * /
2021-09-19 16:11:46 +02:00
user _pref ( "network.http.referer.XOriginTrimmingPolicy" , 2 ) ;
/ * 1 6 0 3 : e n a b l e t h e D N T ( D o N o t T r a c k ) H T T P h e a d e r
* [ NOTE ] DNT is enforced with Enhanced Tracking Protection ( 2710 )
2022-01-08 17:22:44 +01:00
* [ SETTING ] Privacy & Security > Privacy > Web Content > Send websites a "Do Not Track" signal ... * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "privacy.donottrackheader.enabled" , true ) ;
2021-09-19 16:11:46 +02:00
/ * * * [ S E C T I O N 1 7 0 0 ] : C O N T A I N E R S
Check out Temporary Containers [ 2 ] , read the article [ 3 ] , and visit the wiki / repo [ 4 ]
[ 1 ] https : //wiki.mozilla.org/Security/Contextual_Identity_Project/Containers
[ 2 ] https : //addons.mozilla.org/firefox/addon/temporary-containers/
[ 3 ] https : //medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
[ 4 ] https : //github.com/stoically/temporary-containers/wiki
* * * /
user _pref ( "_user.js.parrot" , "1700 syntax error: the parrot's bit the dust!" ) ;
2022-01-08 17:22:44 +01:00
/* 1701: enable Container Tabs and its UI setting [FF50+] ***/
2021-09-19 16:11:46 +02:00
user _pref ( "privacy.userContext.enabled" , true ) ;
user _pref ( "privacy.userContext.ui.enabled" , true ) ;
/ * 1 7 0 2 : s e t b e h a v i o u r o n " + T a b " b u t t o n t o d i s p l a y c o n t a i n e r m e n u o n l e f t c l i c k [ F F 7 4 + ]
2022-01-08 17:22:44 +01:00
* [ NOTE ] The menu is always shown on long press and right click * * * /
2021-09-19 16:11:46 +02:00
// user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true);
/*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/
2019-11-24 18:51:29 +01:00
user _pref ( "_user.js.parrot" , "2000 syntax error: the parrot's snuffed it!" ) ;
/ * 2 0 0 1 : d i s a b l e W e b R T C ( W e b R e a l - T i m e C o m m u n i c a t i o n )
* [ SETUP - WEB ] WebRTC can leak your IP address from behind your VPN , but if this is not
* in your threat model , and you want Real - Time Communication , this is the pref for you
* [ 1 ] https : //www.privacytools.io/#webrtc ***/
user _pref ( "media.peerconnection.enabled" , false ) ;
/ * 2 0 0 2 : l i m i t W e b R T C I P l e a k s i f u s i n g W e b R T C
2021-09-19 16:11:46 +02:00
* In FF70 + these settings match Mode 4 ( Mode 3 in older versions ) [ 3 ]
2019-11-24 18:51:29 +01:00
* [ TEST ] https : //browserleaks.com/webrtc
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713
* [ 2 ] https : //wiki.mozilla.org/Media/WebRTC/Privacy
* [ 3 ] https : //tools.ietf.org/html/draft-ietf-rtcweb-ip-handling-12#section-5.2 ***/
2019-11-24 18:51:29 +01:00
user _pref ( "media.peerconnection.ice.default_address_only" , true ) ;
user _pref ( "media.peerconnection.ice.no_host" , true ) ; // [FF51+]
2020-11-01 19:08:14 +01:00
user _pref ( "media.peerconnection.ice.proxy_only_if_behind_proxy" , true ) ; // [FF70+]
2021-09-19 16:11:46 +02:00
/ * 2 0 2 0 : d i s a b l e G M P ( G e c k o M e d i a P l u g i n s )
* [ 1 ] https : //wiki.mozilla.org/GeckoMediaPlugins ***/
user _pref ( "media.gmp-provider.enabled" , false ) ;
/ * 2 0 2 1 : d i s a b l e w i d e v i n e C D M ( C o n t e n t D e c r y p t i o n M o d u l e )
* [ NOTE ] This is covered by the EME master switch ( 2022 ) * * * /
user _pref ( "media.gmp-widevinecdm.enabled" , false ) ;
/ * 2 0 2 2 : d i s a b l e a l l D R M c o n t e n t ( E M E : E n c r y p t i o n M e d i a E x t e n s i o n )
* [ SETUP - WEB ] e . g . Netflix , Amazon Prime , Hulu , HBO , Disney + , Showtime , Starz , DirectTV
* [ TEST ] https : //bitmovin.com/demos/drm
* [ 1 ] https : //www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/
user _pref ( "media.eme.enabled" , false ) ;
2019-11-24 18:51:29 +01:00
/ * 2 0 3 0 : d i s a b l e a u t o p l a y o f H T M L 5 m e d i a [ F F 6 3 + ]
2021-09-19 16:11:46 +02:00
* 0 = Allow all , 1 = Block non - muted media ( default ) , 5 = Block all
2022-01-08 17:22:44 +01:00
* [ NOTE ] You can set exceptions under site permissions * * * /
2021-09-19 16:11:46 +02:00
user _pref ( "media.autoplay.default" , 5 ) ;
2020-11-01 19:08:14 +01:00
/ * 2 0 3 1 : d i s a b l e a u t o p l a y o f H T M L 5 m e d i a i f y o u i n t e r a c t e d w i t h t h e s i t e [ F F 7 8 + ]
* 0 = sticky ( default ) , 1 = transient , 2 = user
2021-09-19 16:11:46 +02:00
* Firefox ' s Autoplay Policy Documentation [ PDF ] is linked below via SUMO
* [ NOTE ] If you have trouble with some video sites , then add an exception ( 2030 )
* [ 1 ] https : //support.mozilla.org/questions/1293231 ***/
2020-11-01 19:08:14 +01:00
user _pref ( "media.autoplay.blocking_policy" , 2 ) ;
2019-11-24 18:51:29 +01:00
/ * * * [ S E C T I O N 2 3 0 0 ] : W E B W O R K E R S
2021-09-19 16:11:46 +02:00
A worker is a JS "background task" running in a global context , i . e . it is different from
the current window . Workers can spawn new workers ( must be the same origin & scheme ) ,
including service and shared workers . Shared workers can be utilized by multiple scripts and
communicate between browsing contexts ( windows / tabs / iframes ) and can even control your cache .
[ 1 ] Web Workers : https : //developer.mozilla.org/docs/Web/API/Web_Workers_API
[ 2 ] Worker : https : //developer.mozilla.org/docs/Web/API/Worker
[ 3 ] Service Worker : https : //developer.mozilla.org/docs/Web/API/Service_Worker_API
[ 4 ] SharedWorker : https : //developer.mozilla.org/docs/Web/API/SharedWorker
[ 5 ] ChromeWorker : https : //developer.mozilla.org/docs/Web/API/ChromeWorker
[ 6 ] Notifications : https : //support.mozilla.org/questions/1165867#answer-981820
2019-11-24 18:51:29 +01:00
* * * /
user _pref ( "_user.js.parrot" , "2300 syntax error: the parrot's off the twig!" ) ;
/ * 2 3 0 2 : d i s a b l e s e r v i c e w o r k e r s [ F F 3 2 , F F 4 4 - c o m p a t ]
2020-11-01 19:08:14 +01:00
* Service workers essentially act as proxy servers that sit between web apps , and the
2021-09-19 16:11:46 +02:00
* browser and network , are event driven , and can control the web page / site they are associated
2020-11-01 19:08:14 +01:00
* with , intercepting and modifying navigation and resource requests , and caching resources .
2021-09-19 16:11:46 +02:00
* [ NOTE ] Service workers require HTTPS , have no DOM access , and are not supported in PB mode [ 1 ]
2020-11-01 19:08:14 +01:00
* [ SETUP - WEB ] Disabling service workers will break some sites . This pref is required true for
* service worker notifications ( 2304 ) , push notifications ( disabled , 2305 ) and service worker
2021-09-19 16:11:46 +02:00
* cache ( 2740 ) . If you enable this pref , then check those settings as well
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=1320796#c7 ***/
2020-11-01 19:08:14 +01:00
user _pref ( "dom.serviceWorkers.enabled" , false ) ;
2019-11-24 18:51:29 +01:00
/ * 2 3 0 4 : d i s a b l e W e b N o t i f i c a t i o n s
2021-09-19 16:11:46 +02:00
* [ NOTE ] Web Notifications can also use service workers ( 2302 ) and are behind a prompt ( 7002 )
2019-11-24 18:51:29 +01:00
* [ 1 ] https : //developer.mozilla.org/docs/Web/API/Notifications_API ***/
user _pref ( "dom.webnotifications.enabled" , false ) ; // [FF22+]
user _pref ( "dom.webnotifications.serviceworker.enabled" , false ) ; // [FF44+]
/ * 2 3 0 5 : d i s a b l e P u s h N o t i f i c a t i o n s [ F F 4 4 + ]
2020-11-01 19:08:14 +01:00
* Push is an API that allows websites to send you ( subscribed ) messages even when the site
2021-09-19 16:11:46 +02:00
* isn 't loaded, by pushing messages to your userAgentID through Mozilla' s Push Server
2020-11-01 19:08:14 +01:00
* [ NOTE ] Push requires service workers ( 2302 ) to subscribe to and display , and is behind
2021-09-19 16:11:46 +02:00
* a prompt ( 7002 ) . Disabling service workers alone doesn ' t stop Thunderbird polling the
* Mozilla Push Server . To remove all subscriptions , reset your userAgentID .
* [ 1 ] https : //support.mozilla.org/kb/push-notifications-firefox
* [ 2 ] https : //developer.mozilla.org/docs/Web/API/Push_API ***/
2020-11-01 19:08:14 +01:00
user _pref ( "dom.push.enabled" , false ) ;
2019-11-24 18:51:29 +01:00
// user_pref("dom.push.userAgentID", "");
2021-09-19 16:11:46 +02:00
/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/
2019-11-24 18:51:29 +01:00
user _pref ( "_user.js.parrot" , "2400 syntax error: the parrot's kicked the bucket!" ) ;
2021-09-19 16:11:46 +02:00
/ * 2 4 0 1 : d i s a b l e " C o n f i r m y o u w a n t t o l e a v e " d i a l o g o n p a g e c l o s e
* Does not prevent JS leaks of the page close event
* [ 1 ] https : //developer.mozilla.org/docs/Web/Events/beforeunload ***/
2019-11-24 18:51:29 +01:00
user _pref ( "dom.disable_beforeunload" , true ) ;
2021-09-19 16:11:46 +02:00
/* 2402: prevent scripts from moving and resizing open windows ***/
user _pref ( "dom.disable_window_move_resize" , true ) ;
2022-01-08 17:22:44 +01:00
/* 2403: block popup windows ***/
2021-09-19 16:11:46 +02:00
user _pref ( "dom.disable_open_during_load" , true ) ;
/* 2404: limit events that can cause a popup [SETUP-WEB] ***/
user _pref ( "dom.popup_allowed_events" , "click dblclick mousedown pointerdown" ) ;
2019-11-24 18:51:29 +01:00
2019-11-24 01:00:00 +01:00
/*** [SECTION 2600]: MISCELLANEOUS ***/
user _pref ( "_user.js.parrot" , "2600 syntax error: the parrot's run down the curtain!" ) ;
2021-09-19 16:11:46 +02:00
/ * 2 6 0 1 : p r e v e n t a c c e s s i b i l i t y s e r v i c e s f r o m a c c e s s i n g y o u r b r o w s e r [ R E S T A R T ]
2020-11-03 18:56:53 +01:00
* [ 1 ] https : //support.mozilla.org/kb/accessibility-services ***/
user _pref ( "accessibility.force_disabled" , 1 ) ;
2019-11-30 22:34:58 +01:00
/ * 2 6 0 2 : d i s a b l e s e n d i n g a d d i t i o n a l a n a l y t i c s t o w e b s e r v e r s
* [ 1 ] https : //developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/
user _pref ( "beacon.enabled" , false ) ;
2021-09-19 16:11:46 +02:00
/ * 2 6 0 3 : r e m o v e t e m p f i l e s o p e n e d w i t h a n e x t e r n a l a p p l i c a t i o n
* [ 1 ] https : //bugzilla.mozilla.org/302433 ***/
user _pref ( "browser.helperApps.deleteTempFileOnExit" , true ) ;
/* 2604: disable page thumbnail collection ***/
user _pref ( "browser.pagethumbnails.capturing_disabled" , true ) ; // [HIDDEN PREF]
/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
user _pref ( "browser.uitour.enabled" , false ) ;
user _pref ( "browser.uitour.url" , "" ) ;
2019-11-24 01:00:00 +01:00
/ * 2 6 0 7 : d i s a b l e v a r i o u s d e v e l o p e r t o o l s i n b r o w s e r c o n t e x t
* [ 1 ] https : //github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/
user _pref ( "devtools.chrome.enabled" , false ) ;
2021-09-19 16:11:46 +02:00
/ * 2 6 0 8 : r e s e t r e m o t e d e b u g g i n g t o d i s a b l e d
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
user _pref ( "devtools.debugger.remote-enabled" , false ) ; // [DEFAULT: false]
2019-11-24 01:00:00 +01:00
/ * 2 6 1 1 : d i s a b l e m i d d l e m o u s e c l i c k o p e n i n g l i n k s f r o m c l i p b o a r d
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "middlemouse.contentLoadURL" , false ) ;
2021-09-19 16:11:46 +02:00
/ * 2 6 1 6 : r e m o v e s p e c i a l p e r m i s s i o n s f o r c e r t a i n m o z i l l a d o m a i n s [ F F 3 5 + ]
* [ 1 ] resource : //app/defaults/permissions ***/
user _pref ( "permissions.manager.defaultsUrl" , "" ) ;
/* 2617: remove webchannel whitelist ***/
user _pref ( "webchannel.allowObject.urlWhitelist" , "" ) ;
/ * 2 6 1 9 : u s e P u n y c o d e i n I n t e r n a t i o n a l i z e d D o m a i n N a m e s t o e l i m i n a t e p o s s i b l e s p o o f i n g
2020-11-01 19:08:14 +01:00
* [ SETUP - WEB ] Might be undesirable for non - latin alphabet users since legitimate IDN ' s are also punycoded
2019-11-24 01:00:00 +01:00
* [ TEST ] https : //www.xn--80ak6aa92e.com/ (www.apple.com)
* [ 1 ] https : //wiki.mozilla.org/IDN_Display_Algorithm
* [ 2 ] https : //en.wikipedia.org/wiki/IDN_homograph_attack
2021-09-19 16:11:46 +02:00
* [ 3 ] https : //cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox
2019-11-24 01:00:00 +01:00
* [ 4 ] https : //www.xudongz.com/blog/2017/idn-phishing/ ***/
user _pref ( "network.IDN_show_punycode" , true ) ;
2021-09-19 16:11:46 +02:00
/ * 2 6 2 0 : e n f o r c e P D F J S , d i s a b l e P D F J S s c r i p t i n g [ S E T U P - C H R O M E ]
* This setting controls if the option "Display in Thunderbird" is available in the setting below
* and by effect controls whether PDFs are handled in - browser or externally ( "Ask" or "Open With" )
* PROS : pdfjs is lightweight , open source , and more secure / vetted than most
* Exploits are rare ( one serious case in seven years ) , treated seriously and patched quickly .
* It doesn ' t break "state separation" of browser content ( by not sharing with OS , independent apps ) .
* It maintains disk avoidance and application data isolation . It ' s convenient . You can still save to disk .
* CONS : You may prefer a different pdf reader for security reasons
2022-01-08 17:22:44 +01:00
* CAVEAT : JS can still force a pdf to open in - browser by bundling its own code * * * /
2021-09-19 16:11:46 +02:00
user _pref ( "pdfjs.disabled" , false ) ; // [DEFAULT: false]
user _pref ( "pdfjs.enableScripting" , false ) ; // [FF86+]
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/
user _pref ( "network.protocol-handler.external.ms-windows-store" , false ) ;
/ * 2 6 2 3 : d i s a b l e p e r m i s s i o n s d e l e g a t i o n [ F F 7 3 + ]
* Currently applies to cross - origin geolocation , camera , mic and screen - sharing
* permissions , and fullscreen requests . Disabling delegation means any prompts
* for these will show / use their correct 3 rd party origin
* [ 1 ] https : //groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion ***/
user _pref ( "permissions.delegation.enabled" , false ) ;
2019-11-24 01:00:00 +01:00
2021-10-17 18:24:37 +02:00
/** DOWNLOADS ***/
/ * 2 6 5 1 : e n a b l e u s e r i n t e r a c t i o n f o r s e c u r i t y b y a l w a y s a s k i n g w h e r e t o d o w n l o a d
2022-01-08 17:22:44 +01:00
* [ SETUP - CHROME ] On Android this blocks longtapping and saving images * * * /
2021-10-17 18:24:37 +02:00
user _pref ( "browser.download.useDownloadDir" , false ) ;
/* 2652: disable adding downloads to the system's "recent documents" list ***/
user _pref ( "browser.download.manager.addToRecentDocs" , false ) ;
/** EXTENSIONS ***/
/ * 2 6 6 0 : l o c k d o w n a l l o w e d e x t e n s i o n d i r e c t o r i e s
* [ SETUP - CHROME ] This will break extensions , language packs , themes and any other
* XPI files which are installed outside of profile and application directories
* [ 1 ] https : //mike.kaply.com/2012/02/21/understanding-add-on-scopes/
2021-10-30 11:33:39 +02:00
* [ 1 ] https : //archive.is/DYjAM (archived) ***/
2021-10-17 18:24:37 +02:00
user _pref ( "extensions.enabledScopes" , 5 ) ; // [HIDDEN PREF]
user _pref ( "extensions.autoDisableScopes" , 15 ) ; // [DEFAULT: 15]
/ * 2 6 6 2 : d i s a b l e w e b e x t e n s i o n r e s t r i c t i o n s o n c e r t a i n m o z i l l a d o m a i n s ( y o u a l s o n e e d 4 5 0 3 ) [ F F 6 0 + ]
* [ 1 ] https : //bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
// user_pref("extensions.webextensions.restrictedDomains", "");
2019-11-24 01:00:00 +01:00
/ * * * [ S E C T I O N 2 7 0 0 ] : P E R S I S T E N T S T O R A G E
2021-09-19 16:11:46 +02:00
Data SET by websites including
cookies : profile \ cookies . sqlite
localStorage : profile \ webappsstore . sqlite
indexedDB : profile \ storage \ default
serviceWorkers :
[ NOTE ] indexedDB and serviceWorkers are not available in Private Browsing Mode
[ NOTE ] Blocking cookies also blocks websites access to : localStorage ( incl . sessionStorage ) ,
indexedDB , sharedWorker , and serviceWorker ( and therefore service worker cache and notifications )
If you set a site exception for cookies ( either "Allow" or "Allow for Session" ) then they become
accessible to websites except shared / service workers where the cookie setting must be "Allow"
2019-11-24 01:00:00 +01:00
* * * /
user _pref ( "_user.js.parrot" , "2700 syntax error: the parrot's joined the bleedin' choir invisible!" ) ;
2021-09-19 16:11:46 +02:00
/ * 2 7 0 1 : d i s a b l e o r i s o l a t e 3 r d - p a r t y c o o k i e s a n d s i t e - d a t a [ S E T U P - W E B ]
* 0 = Accept cookies and site data
* 1 = ( Block ) All third - party cookies
* 2 = ( Block ) All cookies
* 3 = ( Block ) Cookies from unvisited websites
* 4 = ( Block ) Cross - site tracking cookies ( default )
* 5 = ( Isolate All ) Cross - site cookies ( TCP : Total Cookie Protection / dFPI : dynamic FPI ) [ 1 ] ( FF86 + )
* Option 5 with FPI enabled ( 4001 ) is ignored and not shown , and option 4 used instead
* [ NOTE ] You can set cookie exceptions under site permissions or use an extension
* [ NOTE ] Enforcing category to custom ensures ETP related prefs are always honored
2022-01-08 17:22:44 +01:00
* [ SETTING ] Privacy & Security > Privacy > Web Content > Accept cookies from sites
2021-09-19 16:11:46 +02:00
* [ 1 ] https : //blog.mozilla.org/security/2021/02/23/total-cookie-protection/ ***/
2019-11-24 01:00:00 +01:00
user _pref ( "network.cookie.cookieBehavior" , 2 ) ;
2021-09-19 16:11:46 +02:00
user _pref ( "browser.contentblocking.category" , "custom" ) ;
/ * 2 7 0 2 : s e t t h i r d - p a r t y c o o k i e s ( i f e n a b l e d , s e e 2 7 0 1 ) t o s e s s i o n - o n l y
* [ NOTE ] . sessionOnly overrides . nonsecureSessionOnly except when . sessionOnly = false and
* . nonsecureSessionOnly = true . This allows you to keep HTTPS cookies , but session - only HTTP ones
2020-11-01 19:08:14 +01:00
* [ 1 ] https : //feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/
user _pref ( "network.cookie.thirdparty.sessionOnly" , true ) ;
user _pref ( "network.cookie.thirdparty.nonsecureSessionOnly" , true ) ; // [FF58+]
/ * 2 7 0 3 : d e l e t e c o o k i e s a n d s i t e d a t a o n c l o s e
* 0 = keep until they expire ( default ) , 2 = keep until you close Thunderbird
* [ NOTE ] The setting below is disabled ( but not changed ) if you block all cookies ( 2701 = 2 )
2022-01-08 17:22:44 +01:00
* [ SETTING ] Privacy & Security > Privacy > Web Content > Keep until : "I close Thunderbird" * * * /
2020-11-01 19:08:14 +01:00
user _pref ( "network.cookie.lifetimePolicy" , 2 ) ;
2022-01-08 17:22:44 +01:00
/* 2710: enable Enhanced Tracking Protection (ETP) in all windows ***/
2021-09-19 16:11:46 +02:00
user _pref ( "privacy.trackingprotection.enabled" , true ) ;
/* 2711: enable various ETP lists ***/
user _pref ( "privacy.trackingprotection.socialtracking.enabled" , true ) ;
user _pref ( "privacy.trackingprotection.cryptomining.enabled" , true ) ; // [DEFAULT: true]
user _pref ( "privacy.trackingprotection.fingerprinting.enabled" , true ) ; // [DEFAULT: true]
2019-11-24 18:51:29 +01:00
/ * 2 7 4 0 : d i s a b l e s e r v i c e w o r k e r c a c h e a n d c a c h e s t o r a g e
2021-09-19 16:11:46 +02:00
* [ NOTE ] We clear service worker cache on exit ( 2803 )
2019-11-24 18:51:29 +01:00
* [ 1 ] https : //w3c.github.io/ServiceWorker/#privacy ***/
2020-11-08 22:50:22 +01:00
user _pref ( "dom.caches.enabled" , false ) ;
2019-11-24 18:51:29 +01:00
/ * 2 7 5 0 : d i s a b l e S t o r a g e A P I [ F F 5 1 + ]
* The API gives sites the ability to find out how much space they can use , how much
* they are already using , and even control whether or not they need to be alerted
* before the user agent disposes of site data in order to make room for other things .
* [ 1 ] https : //developer.mozilla.org/docs/Web/API/StorageManager
* [ 2 ] https : //developer.mozilla.org/docs/Web/API/Storage_API
* [ 3 ] https : //blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/
2020-03-23 14:44:08 +01:00
user _pref ( "dom.storageManager.enabled" , false ) ;
2019-11-24 18:51:29 +01:00
/ * 2 7 5 5 : d i s a b l e S t o r a g e A c c e s s A P I [ F F 6 5 + ]
2021-09-19 16:11:46 +02:00
* [ 1 ] https : //developer.mozilla.org/docs/Web/API/Storage_Access_API ***/
user _pref ( "dom.storage_access.enabled" , false ) ;
/* 2760: enable Local Storage Next Generation (LSNG) [FF65+] ***/
user _pref ( "dom.storage.next_gen" , true ) ; // [DEFAULT: true FF92+]
2019-11-24 18:51:29 +01:00
/ * * * [ S E C T I O N 2 8 0 0 ] : S H U T D O W N
2022-01-08 17:22:44 +01:00
* Sanitizing on shutdown is all or nothing ( no exception can be set )
2021-09-19 16:11:46 +02:00
* If you want to keep some sites ' cookies ( exception as "Allow" ) and optionally other site
data but clear all the rest on close , then you need to set the "cookie" and optionally the
"offlineApps" prefs below to false , and to set the cookie lifetime pref to 2 ( 2703 )
2019-11-24 01:00:00 +01:00
* * * /
user _pref ( "_user.js.parrot" , "2800 syntax error: the parrot's bleedin' demised!" ) ;
2021-12-14 10:51:48 +01:00
/* 2802: enable Thunderbird to clear items on shutdown (see 2803) ***/
2020-11-03 18:56:53 +01:00
user _pref ( "privacy.sanitize.sanitizeOnShutdown" , true ) ;
/ * 2 8 0 3 : s e t w h a t i t e m s t o c l e a r o n s h u t d o w n ( i f 2 8 0 2 i s t r u e ) [ S E T U P - C H R O M E ]
2021-09-19 16:11:46 +02:00
* [ NOTE ] If "history" is true , downloads will also be cleared
* [ NOTE ] Active Logins : does not refer to logins via cookies , but rather HTTP Basic Authentication [ 1 ]
* [ NOTE ] Offline Website Data : localStorage , service worker cache , QuotaManager ( IndexedDB , asm - cache )
* [ 1 ] https : //en.wikipedia.org/wiki/Basic_access_authentication ***/
2020-11-03 18:56:53 +01:00
user _pref ( "privacy.clearOnShutdown.cache" , true ) ;
user _pref ( "privacy.clearOnShutdown.cookies" , true ) ;
user _pref ( "privacy.clearOnShutdown.downloads" , true ) ; // see note above
user _pref ( "privacy.clearOnShutdown.formdata" , true ) ; // Form & Search History
user _pref ( "privacy.clearOnShutdown.history" , true ) ; // Browsing & Download History
user _pref ( "privacy.clearOnShutdown.offlineApps" , true ) ; // Offline Website Data
user _pref ( "privacy.clearOnShutdown.sessions" , true ) ; // Active Logins
user _pref ( "privacy.clearOnShutdown.siteSettings" , false ) ; // Site Preferences
2019-11-24 18:51:29 +01:00
/ * 2 8 0 4 : r e s e t d e f a u l t i t e m s t o c l e a r w i t h C t r l - S h i f t - D e l ( t o m a t c h 2 8 0 3 ) [ S E T U P - C H R O M E ]
2019-11-24 01:00:00 +01:00
* This dialog can also be accessed from the menu History > Clear Recent History
2021-09-19 16:11:46 +02:00
* Thunderbird remembers your last choices . This will reset them when you start Thunderbird
* [ NOTE ] Regardless of what you set "downloads" to , as soon as the dialog
* for "Clear Recent History" is opened , it is synced to the same as "history" * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "privacy.cpd.cache" , true ) ;
user _pref ( "privacy.cpd.cookies" , true ) ;
2021-09-19 16:11:46 +02:00
// user_pref("privacy.cpd.downloads", true); // not used, see note above
user _pref ( "privacy.cpd.formdata" , true ) ; // Form & Search History
2019-11-24 01:00:00 +01:00
user _pref ( "privacy.cpd.history" , true ) ; // Browsing & Download History
2021-09-19 16:11:46 +02:00
user _pref ( "privacy.cpd.offlineApps" , true ) ; // Offline Website Data
user _pref ( "privacy.cpd.passwords" , false ) ; // this is not listed
user _pref ( "privacy.cpd.sessions" , true ) ; // Active Logins
user _pref ( "privacy.cpd.siteSettings" , false ) ; // Site Preferences
/ * 2 8 0 5 : c l e a r S e s s i o n R e s t o r e d a t a w h e n s a n i t i z i n g o n s h u t d o w n o r m a n u a l l y [ F F 3 4 + ]
* [ NOTE ] Not needed if Session Restore is not used ( 0102 ) or is already cleared with history ( 2803 )
* [ NOTE ] privacy . clearOnShutdown . openWindows prevents resuming from crashes ( also see 5008 )
* [ NOTE ] privacy . cpd . openWindows has a bug that causes an additional window to open * * * /
// user_pref("privacy.clearOnShutdown.openWindows", true);
// user_pref("privacy.cpd.openWindows", true);
/ * 2 8 0 6 : r e s e t d e f a u l t " T i m e r a n g e t o c l e a r " f o r " C l e a r R e c e n t H i s t o r y " ( 2 8 0 4 )
* Thunderbird remembers your last choice . This will reset the value when you start Thunderbird
* 0 = everything , 1 = last hour , 2 = last two hours , 3 = last four hours , 4 = today
* [ NOTE ] Values 5 ( last 5 minutes ) and 6 ( last 24 hours ) are not listed in the dropdown ,
* which will display a blank value , and are not guaranteed to work * * * /
2019-11-24 01:00:00 +01:00
user _pref ( "privacy.sanitize.timeSpan" , 0 ) ;
/ * * * [ S E C T I O N 4 0 0 0 ] : F P I ( F I R S T P A R T Y I S O L A T I O N )
2021-09-19 20:03:16 +02:00
1278037 - indexedDB ( FF51 + )
1277803 - favicons ( FF52 + )
1264562 - OCSP cache ( FF52 + )
1268726 - Shared Workers ( FF52 + )
1316283 - SSL session cache ( FF52 + )
1317927 - media cache ( FF53 + )
1323644 - HSTS and HPKP ( FF54 + )
1334690 - HTTP Alternative Services ( FF54 + )
1334693 - SPDY / HTTP2 ( FF55 + )
1337893 - DNS cache ( FF55 + )
1344170 - blob : URI ( FF55 + )
1300671 - data : , about : URLs ( FF55 + )
1473247 - IP addresses ( FF63 + )
1542309 - top - level domain URLs when host is in the public suffix list ( FF68 + )
1506693 - pdfjs range - based requests ( FF68 + )
1330467 - site permissions ( FF69 + )
1534339 - IPv6 ( FF73 + )
1721858 - WebSocket ( FF92 + )
2019-11-24 01:00:00 +01:00
* * * /
user _pref ( "_user.js.parrot" , "4000 syntax error: the parrot's pegged out" ) ;
/ * 4 0 0 1 : e n a b l e F i r s t P a r t y I s o l a t i o n [ F F 5 1 + ]
2021-09-19 20:03:16 +02:00
* [ SETUP - WEB ] Breaks some cross - origin logins
* [ 1 ] https : //bugzilla.mozilla.org/buglist.cgi?bug_id=1260931,1299996 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "privacy.firstparty.isolate" , true ) ;
/ * 4 0 0 2 : e n f o r c e F P I r e s t r i c t i o n f o r w i n d o w . o p e n e r [ F F 5 4 + ]
* [ NOTE ] Setting this to false may reduce the breakage in 4001
* FF65 + blocks postMessage with targetOrigin "*" if originAttributes don ' t match . But
2021-09-19 20:03:16 +02:00
* to reduce breakage it ignores the 1 st - party domain ( FPD ) originAttribute [ 2 ] [ 3 ]
* The 2 nd pref removes that limitation and will only allow communication if FPDs also match
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //bugzilla.mozilla.org/1319773#c22
* [ 2 ] https : //bugzilla.mozilla.org/1492607
2021-09-19 20:03:16 +02:00
* [ 3 ] https : //developer.mozilla.org/docs/Web/API/Window/postMessage ***/
2020-11-08 22:50:22 +01:00
user _pref ( "privacy.firstparty.isolate.restrict_opener_access" , true ) ; // [DEFAULT: true]
2021-09-19 20:03:16 +02:00
user _pref ( "privacy.firstparty.isolate.block_post_message" , true ) ;
/ * 4 0 0 3 : e n a b l e s c h e m e w i t h F P I [ F F 7 8 + ]
* [ NOTE ] Experimental : existing data and site permissions are incompatible
* and some site exceptions may not work e . g . HTTPS - only mode ( 1244 ) * * * /
user _pref ( "privacy.firstparty.isolate.use_site" , true ) ;
2019-11-24 01:00:00 +01:00
/ * * * [ S E C T I O N 4 5 0 0 ] : R F P ( R E S I S T F I N G E R P R I N T I N G )
2021-09-19 20:03:16 +02:00
RFP covers a wide range of ongoing fingerprinting solutions .
It is an all - or - nothing buy in : you cannot pick and choose what parts you want
2019-11-24 01:00:00 +01:00
2021-09-19 20:03:16 +02:00
[ WARNING ] DO NOT USE extensions to alter RFP protected metrics
2019-11-24 01:00:00 +01:00
2021-09-19 20:03:16 +02:00
418986 - limit window . screen & CSS media queries ( FF41 )
2020-10-31 22:22:23 +01:00
[ TEST ] https : //arkenfox.github.io/TZP/tzp.html#screen
2021-09-19 20:03:16 +02:00
1281949 - spoof screen orientation ( FF50 )
1281963 - hide contents of navigator . plugins and navigator . mimeTypes ( FF50 - 88 )
1330890 - spoof timezone as UTC0 ( FF55 )
1360039 - spoof navigator . hardwareConcurrency as 2 ( FF55 )
1217238 - reduce precision of time exposed by javascript ( FF55 )
FF56
1369303 - spoof / disable performance API
1333651 - spoof User Agent & Navigator API
JS : FF91 + the version is spoofed as ESR , and the OS as Windows 10 , OS 10.15 , Android 10 , or Linux
HTTP Headers : spoofed as Windows or Android
1369319 - disable device sensor API
1369357 - disable site specific zoom
1337161 - hide gamepads from content
1372072 - spoof network information API as "unknown" when dom . netinfo . enabled = true
1333641 - reduce fingerprinting in WebSpeech API
FF57
1369309 - spoof media statistics
1382499 - reduce screen co - ordinate fingerprinting in Touch API
1217290 & 1409677 - enable some fingerprinting resistance for WebGL
1382545 - reduce fingerprinting in Animation API
1354633 - limit MediaError . message to a whitelist
1382533 & 1697680 - enable fingerprinting resistance for Presentation API ( FF57 - 87 )
Blocks exposure of local IP Addresses via mDNS ( Multicast DNS )
FF58 - 90
967895 - spoof canvas and enable site permission prompt ( FF58 )
1372073 - spoof / block fingerprinting in MediaDevices API ( FF59 )
Spoof : enumerate devices as one "Internal Camera" and one "Internal Microphone"
Block : suppresses the ondevicechange event
1039069 - warn when language prefs are not set to "en*" ( also see 0210 , 0211 ) ( FF59 )
1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events ( FF59 )
2019-11-24 01:00:00 +01:00
Spoofing mimics the content language of the document . Currently it only supports en - US .
Modifier events suppressed are SHIFT and both ALT keys . Chrome is not affected .
2021-09-19 20:03:16 +02:00
1337157 - disable WebGL debug renderer info ( FF60 )
1459089 - disable OS locale in HTTP Accept - Language headers ( ANDROID ) ( FF62 )
1479239 - return "no-preference" with prefers - reduced - motion ( FF63 )
1363508 - spoof / suppress Pointer Events ( FF64 )
1492766 - spoof pointerEvent . pointerid ( FF65 )
1485266 - disable exposure of system colors to CSS or canvas ( FF67 )
1494034 - return "light" with prefers - color - scheme ( FF67 )
1564422 - spoof audioContext outputLatency ( FF70 )
1595823 - return audioContext sampleRate as 44100 ( FF72 )
1607316 - spoof pointer as coarse and hover as none ( ANDROID ) ( FF74 )
1621433 - randomize canvas ( previously FF58 + returned an all - white canvas ) ( FF78 )
1653987 - limit font visibility to bundled and "Base Fonts" ( Windows , Mac , some Linux ) ( FF80 )
1461454 - spoof smooth = true and powerEfficient = false for supported media in MediaCapabilities ( FF82 )
FF91 +
531915 - use fdlibm ' s sin , cos and tan in jsmath ( FF93 , ESR91 . 1 )
2019-11-24 01:00:00 +01:00
* * * /
user _pref ( "_user.js.parrot" , "4500 syntax error: the parrot's popped 'is clogs" ) ;
/ * 4 5 0 1 : e n a b l e p r i v a c y . r e s i s t F i n g e r p r i n t i n g [ F F 4 1 + ]
2021-09-19 20:03:16 +02:00
* [ SETUP - WEB ] RFP can cause some website breakage : mainly canvas , use a site exception via the urlbar
* RFP also has a few side effects : mainly timezone is UTC0 , and websites will prefer light theme
* [ 1 ] https : //bugzilla.mozilla.org/418986 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "privacy.resistFingerprinting" , true ) ;
/ * 4 5 0 2 : s e t n e w w i n d o w s i z e s t o r o u n d t o h u n d r e d s [ F F 5 5 + ] [ S E T U P - C H R O M E ]
* Width will round down to multiples of 200 s and height to 100 s , to fit your screen .
2021-09-19 20:03:16 +02:00
* The max values are a starting point to round from if you want some control
* [ 1 ] https : //bugzilla.mozilla.org/1330882 ***/
2019-11-24 18:51:29 +01:00
// user_pref("privacy.window.maxInnerWidth", 1000);
// user_pref("privacy.window.maxInnerHeight", 1000);
2019-11-24 01:00:00 +01:00
/ * 4 5 0 3 : d i s a b l e m o z A d d o n M a n a g e r W e b A P I [ F F 5 7 + ]
2021-09-19 20:03:16 +02:00
* [ NOTE ] To allow extensions to work on AMO , you also need 2662
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
user _pref ( "privacy.resistFingerprinting.block_mozAddonManager" , true ) ; // [HIDDEN PREF]
2021-09-19 20:03:16 +02:00
/ * 4 5 0 4 : e n a b l e R F P l e t t e r b o x i n g [ F F 6 7 + ]
* Dynamically resizes the inner window by applying margins in stepped ranges [ 2 ]
* If you use the dimension pref , then it will only apply those resolutions .
* The format is "width1xheight1, width2xheight2, ..." ( e . g . "800x600, 1000x1000" )
* [ SETUP - WEB ] This is independent of RFP ( 4501 ) . If you ' re not using RFP , or you are but
* dislike the margins , then flip this pref , keeping in mind that it is effectively fingerprintable
* [ WARNING ] DO NOT USE : the dimension pref is only meant for testing
* [ 1 ] https : //bugzilla.mozilla.org/1407366
* [ 2 ] https : //hg.mozilla.org/mozilla-central/rev/6d2d7856e468#l2.32 ***/
user _pref ( "privacy.resistFingerprinting.letterboxing" , true ) ; // [HIDDEN PREF]
// user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF]
2021-10-17 18:24:37 +02:00
/ * 4 5 0 5 : e x p e r i m e n t a l R F P [ F F 9 1 + ]
* [ WARNING ] DO NOT USE unless testing , see [ 1 ] comment 12
* [ 1 ] https : //bugzilla.mozilla.org/1635603 ***/
// user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid");
// user_pref("privacy.resistFingerprinting.testGranularityMask", 0);
2021-10-30 11:33:39 +02:00
/ * 4 5 1 0 : e n f o r c e n o s y s t e m c o l o r s
2022-01-08 17:22:44 +01:00
* [ SETTING ] General > Language & Appearance > Colors ... > Use system colors * * * /
2021-10-30 11:33:39 +02:00
user _pref ( "browser.display.use_system_colors" , false ) ; // [DEFAULT: false]
/ * 4 5 1 1 : e n f o r c e n o n - n a t i v e w i d g e t t h e m e
* Security : removes / reduces system API calls , e . g . win32k API [ 1 ]
* Fingerprinting : provides a uniform look and feel across platforms [ 2 ]
* [ 1 ] https : //bugzilla.mozilla.org/1381938
* [ 2 ] https : //bugzilla.mozilla.org/1411425 ***/
user _pref ( "widget.non-native-theme.enabled" , true ) ; // [DEFAULT: true]
/ * 4 5 1 2 : e n f o r c e l i n k s t a r g e t i n g n e w w i n d o w s t o o p e n i n a n e w t a b i n s t e a d
* 1 = most recent window or tab , 2 = new window , 3 = new tab
* Stops malicious window sizes and some screen resolution leaks .
* You can still right - click a link and open in a new window
* [ TEST ] https : //arkenfox.github.io/TZP/tzp.html#screen
* [ 1 ] https : //gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
user _pref ( "browser.link.open_newwindow" , 3 ) ; // [DEFAULT: 3]
/ * 4 5 1 3 : s e t a l l o p e n w i n d o w m e t h o d s t o a b i d e b y " b r o w s e r . l i n k . o p e n _ n e w w i n d o w " ( 4 5 1 2 )
* [ 1 ] https : //searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js ***/
user _pref ( "browser.link.open_newwindow.restriction" , 0 ) ; // [DEFAULT: 0]
/ * 4 5 2 0 : d i s a b l e W e b G L ( W e b G r a p h i c s L i b r a r y )
* [ SETUP - WEB ] If you need it then enable it . RFP still randomizes canvas for naive scripts * * * /
user _pref ( "webgl.disabled" , true ) ;
2019-11-24 01:00:00 +01:00
2021-09-19 20:03:16 +02:00
/ * * * [ S E C T I O N 5 0 0 0 ] : O P T I O N A L O P S E C
Disk avoidance , application data isolation , eyeballs ...
2019-11-24 18:51:29 +01:00
* * * /
2021-09-19 20:03:16 +02:00
user _pref ( "_user.js.parrot" , "5000 syntax error: the parrot's taken 'is last bow" ) ;
/ * 5 0 0 1 : s t a r t T h u n d e r b i r d i n P B ( P r i v a t e B r o w s i n g ) m o d e
* [ NOTE ] In this mode all windows are "private windows" and the PB mode icon is not displayed
* [ NOTE ] The P in PB mode can be misleading : it means no "persistent" disk state such as history ,
* caches , searches , cookies , localStorage , IndexedDB etc ( which you can achieve in normal mode ) .
* In fact , PB mode limits or removes the ability to control some of these , and you need to quit
* Thunderbird to clear them . PB is best used as a one off window ( Menu > New Private Window ) to provide
* a temporary self - contained new session . Close all Private Windows to clear the PB mode session .
* [ 1 ] https : //wiki.mozilla.org/Private_Browsing
* [ 2 ] https : //support.mozilla.org/kb/common-myths-about-private-browsing ***/
// user_pref("browser.privatebrowsing.autostart", true);
/ * 5 0 0 2 : d i s a b l e m e m o r y c a c h e
* capacity : - 1 = determine dynamically ( default ) , 0 = none , n = memory capacity in kibibytes * * * /
user _pref ( "browser.cache.memory.enable" , false ) ;
user _pref ( "browser.cache.memory.capacity" , 0 ) ;
/ * 5 0 0 3 : d i s a b l e s a v i n g p a s s w o r d s
2022-01-08 17:22:44 +01:00
* [ NOTE ] This does not clear any passwords already saved * * * /
2021-09-19 20:03:16 +02:00
user _pref ( "signon.rememberSignons" , false ) ;
2022-07-18 19:56:56 +02:00
/ * 5 0 0 4 : d i s a b l e p e r m i s s i o n s m a n a g e r f r o m r e a d i n g o r w r i t i n g t o d i s k [ F F 4 1 + ] [ R E S T A R T ]
* [ SETUP - CHROME ] This means any permission changes ( cookie or mail remote content ) are session only
2021-09-19 20:03:16 +02:00
* [ 1 ] https : //bugzilla.mozilla.org/967812 ***/
user _pref ( "permissions.memory_only" , true ) ; // [HIDDEN PREF]
/ * 5 0 0 5 : d i s a b l e i n t e r m e d i a t e c e r t i f i c a t e c a c h i n g [ F F 4 1 + ] [ R E S T A R T ]
* [ NOTE ] This affects login / cert / key dbs . The effect is all credentials are session - only .
* Saved logins and passwords are not available . Reset the pref and restart to return them * * * /
// user_pref("security.nocertdb", true); // [HIDDEN PREF]
/ * 5 0 0 6 : d i s a b l e f a v i c o n s i n h i s t o r y a n d b o o k m a r k s
* [ NOTE ] Stored as data blobs in favicons . sqlite , these don ' t reveal anything that your
* actual history ( and bookmarks ) already do . Your history is more detailed , so
* control that instead ; e . g . disable history , clear history on close , use PB mode
* [ NOTE ] favicons . sqlite is sanitized on Thunderbird close * * * /
user _pref ( "browser.chrome.site_icons" , false ) ;
/* 5007: exclude "Undo Closed Tabs" in Session Restore ***/
user _pref ( "browser.sessionstore.max_tabs_undo" , 0 ) ;
/* 5008: disable resuming session from crash ***/
user _pref ( "browser.sessionstore.resume_from_crash" , false ) ;
/ * 5 0 0 9 : d i s a b l e " o p e n w i t h " i n d o w n l o a d d i a l o g [ F F 5 0 + ]
* Application data isolation [ 1 ]
* [ 1 ] https : //bugzilla.mozilla.org/1281959 ***/
// user_pref("browser.download.forbid_open_with", true);
/ * 5 0 1 3 : d i s a b l e b r o w s i n g a n d d o w n l o a d h i s t o r y
2022-01-08 17:22:44 +01:00
* [ NOTE ] We also clear history and downloads on exit ( 2803 ) * * * /
2021-09-19 20:03:16 +02:00
user _pref ( "places.history.enabled" , false ) ;
/ * 5 0 1 6 : d i s c o u r a g e d o w n l o a d i n g t o d e s k t o p
2022-01-08 17:22:44 +01:00
* 0 = desktop , 1 = downloads ( default ) , 2 = last used * * * /
2021-09-19 20:03:16 +02:00
// user_pref("browser.download.folderList", 2);
/ * * * [ S E C T I O N 5 5 0 0 ] : O P T I O N A L H A R D E N I N G
Whereas not recommended by upstream arkenfox , we disable each one of those Web features
as we focus on keeping Thunderbird an email client and not a browser
* * * /
user _pref ( "_user.js.parrot" , "5500 syntax error: this is an ex-parrot!" ) ;
/ * 5 5 0 1 : d i s a b l e M a t h M L ( M a t h e m a t i c a l M a r k u p L a n g u a g e ) [ F F 5 1 + ]
* [ 1 ] https : //cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mathml ***/
user _pref ( "mathml.disabled" , true ) ; // 1173199
/ * 5 5 0 2 : d i s a b l e i n - c o n t e n t S V G ( S c a l a b l e V e c t o r G r a p h i c s ) [ F F 5 3 + ]
* [ 1 ] https : //cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+svg ***/
user _pref ( "svg.disabled" , true ) ; // 1216893
/ * 5 5 0 3 : d i s a b l e g r a p h i t e
* [ 1 ] https : //cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+graphite
* [ 2 ] https : //en.wikipedia.org/wiki/Graphite_(SIL) ***/
user _pref ( "gfx.font_rendering.graphite.enabled" , false ) ;
/ * 5 5 0 4 : d i s a b l e a s m . j s [ F F 2 2 + ]
* [ 1 ] http : //asmjs.org/
* [ 2 ] https : //cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js
* [ 3 ] https : //rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/
user _pref ( "javascript.options.asmjs" , false ) ;
/ * 5 5 0 5 : d i s a b l e I o n a n d b a s e l i n e J I T t o h a r d e n a g a i n s t J S e x p l o i t s
* [ NOTE ] In FF75 + , when * * both * * Ion and JIT are disabled , * * and * * the new
* hidden pref is enabled , then Ion can still be used by extensions ( 1599226 )
* [ 1 ] https : //cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit ***/
user _pref ( "javascript.options.ion" , false ) ;
user _pref ( "javascript.options.baselinejit" , false ) ;
user _pref ( "javascript.options.jit_trustedprincipals" , true ) ; // [FF75+] [HIDDEN PREF]
/ * 5 5 0 6 : d i s a b l e W e b A s s e m b l y [ F F 5 2 + ]
* Vulnerabilities [ 1 ] have increasingly been found , including those known and fixed
* in native programs years ago [ 2 ] . WASM has powerful low - level access , making
* certain attacks ( brute - force ) and vulnerabilities more possible
2021-10-17 17:05:45 +02:00
* [ STATS ] ~ 0.2 % of websites , about half of which are for crytomining / malvertising [ 2 ] [ 3 ]
2021-09-19 20:03:16 +02:00
* [ 1 ] https : //cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm
* [ 2 ] https : //spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly
* [ 3 ] https : //www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/
user _pref ( "javascript.options.wasm" , false ) ;
2022-02-13 12:50:38 +01:00
/* 5590: show a prompt when opening a link in external applications ***/
user _pref ( "security.external_protocol_requires_permission" , true ) ;
2021-09-19 20:03:16 +02:00
/*** [SECTION 6000]: DON'T TOUCH ***/
user _pref ( "_user.js.parrot" , "6000 syntax error: the parrot's 'istory!" ) ;
/ * 6 0 0 1 : e n f o r c e M o z i l l a ' s b l o c k l i s t
* [ WHY ] It includes updates for "revoked certificates"
* [ 1 ] https : //blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/
user _pref ( "extensions.blocklist.enabled" , true ) ; // [DEFAULT: true]
/ * 6 0 0 2 : e n f o r c e n o r e f e r e r s p o o f i n g
* [ WHY ] Spoofing can affect CSRF ( Cross - Site Request Forgery ) protections * * * /
user _pref ( "network.http.referer.spoofSource" , false ) ; // [DEFAULT: false]
/ * 6 0 0 3 : e n f o r c e C S P ( C o n t e n t S e c u r i t y P o l i c y )
* [ 1 ] https : //developer.mozilla.org/docs/Web/HTTP/CSP ***/
user _pref ( "security.csp.enable" , true ) ; // [DEFAULT: true]
/ * 6 0 0 4 : e n f o r c e a s e c u r i t y d e l a y o n s o m e c o n f i r m a t i o n d i a l o g s s u c h a s i n s t a l l , o p e n / s a v e
* [ 1 ] https : //www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
user _pref ( "security.dialog_enable_delay" , 1000 ) ; // [DEFAULT: 1000]
/ * 6 0 0 5 : e n f o r c e w i n d o w . o p e n e r p r o t e c t i o n [ F F 6 5 + ]
* Makes rel = noopener implicit for target = _blank in anchor and area elements when no rel attribute is set * * * /
user _pref ( "dom.targetBlankNoOpener.enabled" , true ) ; // [DEFAULT: true FF79+]
/ * 6 0 0 6 : e n f o r c e " w i n d o w . n a m e " p r o t e c t i o n [ F F 8 2 + ]
* If a new page from another domain is loaded into a tab , then window . name is set to an empty string . The original
* string is restored if the tab reverts back to the original page . This change prevents some cross - site attacks
* [ TEST ] https : //arkenfox.github.io/TZP/tests/windownamea.html ***/
user _pref ( "privacy.window.name.update.enabled" , true ) ; // [DEFAULT: true FF86+]
/* 6050: prefsCleaner: reset previously active items removed from arkenfox in 79-91 ***/
// user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "");
// user_pref("browser.send_pings.require_same_host", "");
// user_pref("dom.allow_cut_copy", "");
// user_pref("dom.vibrator.enabled", "");
// user_pref("media.getusermedia.audiocapture.enabled", "");
// user_pref("media.getusermedia.browser.enabled", "");
// user_pref("media.getusermedia.screensharing.enabled", "");
// user_pref("media.gmp-widevinecdm.visible", "");
// user_pref("network.http.redirection-limit", "");
// user_pref("privacy.partition.network_state", "");
// user_pref("security.insecure_connection_icon.enabled", ""); // [DEFAULT: true FF70+]
// user_pref("security.mixed_content.block_active_content", ""); // [DEFAULT: true since at least FF60]
// user_pref("security.ssl.enable_ocsp_stapling", ""); // [DEFAULT: true FF26+]
// user_pref("webgl.disable-fail-if-major-performance-caveat", ""); // [DEFAULT: true FF86+]
// user_pref("webgl.enable-webgl2", "");
// user_pref("webgl.min_capability_mode", "");
2021-10-17 17:33:16 +02:00
/ * * * [ S E C T I O N 7 0 0 0 ] : D O N ' T B O T H E R
Thunderbird - User . JS maintainer here :
Actually we do , TB is an e - mail client , not a ( bloated ) browser .
Thus some of below preferences have been set , despite upstream ( Arkenfox ) warnings .
* * * /
2021-09-19 20:03:16 +02:00
user _pref ( "_user.js.parrot" , "7000 syntax error: the parrot's pushing up daisies!" ) ;
/ * 7 0 0 1 : d i s a b l e A P I s
* Location - Aware Browsing , Full Screen , offline cache ( appCache ) , Virtual Reality
* [ WHY ] The API state is easily fingerprintable . Geo and VR are behind prompts ( 7002 ) .
* appCache storage capability was removed in FF90 . Full screen requires user interaction * * * /
2021-10-17 17:33:16 +02:00
user _pref ( "geo.enabled" , false ) ;
user _pref ( "full-screen-api.enabled" , false ) ;
user _pref ( "browser.cache.offline.enable" , false ) ;
user _pref ( "dom.vr.enabled" , false ) ;
2021-09-19 20:03:16 +02:00
/ * 7 0 0 3 : d i s a b l e n o n - m o d e r n c i p h e r s u i t e s [ 1 ]
* [ WHY ] Passive fingerprinting . Minimal / non - existent threat of downgrade attacks
* [ 1 ] https : //browserleaks.com/ssl ***/
// user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
// user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS
// user_pref("security.ssl3.rsa_aes_256_gcm_sha384", false); // no PFS
// user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS
// user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS
// user_pref("security.ssl3.rsa_des_ede3_sha", false); // 3DES
/ * 7 0 0 4 : c o n t r o l T L S v e r s i o n s
* [ WHY ] Passive fingerprinting . Downgrades are still possible : behind user interaction * * * /
// user_pref("security.tls.version.min", 3); // [DEFAULT: 3]
// user_pref("security.tls.version.max", 4);
/ * 7 0 0 5 : d i s a b l e S S L s e s s i o n I D s [ F F 3 6 + ]
* [ WHY ] Passive fingerprinting and perf costs . These are session - only and isolated
* with network partitioning ( FF85 + ) or when using FPI and / or containers * * * /
// user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF]
/ * 7 0 0 6 : o n i o n s
* [ WHY ] Firefox doesn ' t support hidden services . Use Tor Browser * * * /
// user_pref("dom.securecontext.whitelist_onions", true); // 1382359
// user_pref("network.http.referer.hideOnionSource", true); // 1305144
/ * 7 0 0 7 : r e f e r e r s
* [ WHY ] Only cross - origin referers ( 1600 s ) need control * * * /
2021-10-17 17:33:16 +02:00
user _pref ( "network.http.sendRefererHeader" , 0 ) ;
user _pref ( "network.http.referer.trimmingPolicy" , 0 ) ;
2021-09-19 20:03:16 +02:00
/ * 7 0 0 8 : s e t t h e d e f a u l t R e f e r r e r P o l i c y [ F F 5 9 + ]
* 0 = no - referer , 1 = same - origin , 2 = strict - origin - when - cross - origin , 3 = no - referrer - when - downgrade
* [ WHY ] Defaults are fine . They can be overridden by a site - controlled Referrer Policy * * * /
2021-10-17 17:33:16 +02:00
user _pref ( "network.http.referer.defaultPolicy" , 0 ) ; // [DEFAULT: 2 FF87+]
user _pref ( "network.http.referer.defaultPolicy.pbmode" , 0 ) ; // [DEFAULT: 2]
2021-09-19 20:03:16 +02:00
/ * 7 0 0 9 : d i s a b l e H T T P 2
* [ WHY ] Passive fingerprinting . ~ 50 % of sites use HTTP2 [ 1 ]
* [ 1 ] https : //w3techs.com/technologies/details/ce-http2/all/all ***/
// user_pref("network.http.spdy.enabled", false);
// user_pref("network.http.spdy.enabled.deps", false);
// user_pref("network.http.spdy.enabled.http2", false);
// user_pref("network.http.spdy.websockets", false); // [FF65+]
/ * 7 0 1 0 : d i s a b l e H T T P A l t e r n a t i v e S e r v i c e s [ F F 3 7 + ]
* [ WHY ] Already isolated by network partitioning ( FF85 + ) or FPI * * * /
2021-10-17 17:33:16 +02:00
user _pref ( "network.http.altsvc.enabled" , false ) ;
user _pref ( "network.http.altsvc.oe" , false ) ;
2021-09-19 20:03:16 +02:00
/ * 7 0 1 1 : d i s a b l e w e b s i t e c o n t r o l o v e r b r o w s e r r i g h t - c l i c k c o n t e x t m e n u
* [ WHY ] Just use Shift - Right - Click * * * /
2021-10-17 17:33:16 +02:00
user _pref ( "dom.event.contextmenu.enabled" , false ) ;
2021-09-19 20:03:16 +02:00
/ * 7 0 1 2 : d i s a b l e i c o n f o n t s ( g l y p h s ) a n d l o c a l f a l l b a c k r e n d e r i n g
* [ WHY ] Breakage , font fallback is equivalency , also RFP
* [ 1 ] https : //bugzilla.mozilla.org/789788
* [ 2 ] https : //gitlab.torproject.org/legacy/trac/-/issues/8455 ***/
2021-10-17 17:33:16 +02:00
user _pref ( "gfx.downloadable_fonts.enabled" , false ) ; // [FF41+]
user _pref ( "gfx.downloadable_fonts.fallback_delay" , - 1 ) ;
2021-09-19 20:03:16 +02:00
/ * 7 0 1 3 : d i s a b l e C l i p b o a r d A P I
* [ WHY ] Fingerprintable . Breakage . Cut / copy / paste require user
* interaction , and paste is limited to focused editable fields * * * /
2021-10-17 17:33:16 +02:00
user _pref ( "dom.event.clipboardevents.enabled" , false ) ;
2021-10-30 11:33:39 +02:00
/ * 7 0 1 4 : d i s a b l e S y s t e m A d d - o n u p d a t e s
* [ WHY ] It can compromise security . System addons ship with prefs , use those * * * /
// user_pref("extensions.systemAddon.update.enabled", false); // [FF62+]
// user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
2021-09-19 20:03:16 +02:00
/ * * * [ S E C T I O N 8 0 0 0 ] : D O N ' T B O T H E R : N O N - R F P
[ WHY ] They are insufficient to help anti - fingerprinting and do more harm than good
[ WARNING ] DO NOT USE with RFP . RFP already covers these and they can interfere
2022-05-23 17:05:15 +02:00
[ NOTE ] An empty User - Agent may break Microsoft Exchange OAuth2 login
2021-09-19 20:03:16 +02:00
* * * /
user _pref ( "_user.js.parrot" , "8000 syntax error: the parrot's crossed the Jordan" ) ;
/* 8001: disable APIs ***/
2019-11-24 18:51:29 +01:00
// user_pref("device.sensors.enabled", false);
2021-09-19 20:03:16 +02:00
// user_pref("dom.enable_performance", false);
// user_pref("dom.enable_resource_timing", false);
2019-11-24 18:51:29 +01:00
// user_pref("dom.gamepad.enabled", false);
2021-09-19 20:03:16 +02:00
// user_pref("dom.netinfo.enabled", false);
// user_pref("dom.webaudio.enabled", false);
/* 8002: disable other ***/
// user_pref("browser.display.use_document_fonts", 0);
2019-11-24 18:51:29 +01:00
// user_pref("dom.w3c_touch_events.enabled", 0);
2021-09-19 20:03:16 +02:00
// user_pref("media.navigator.enabled", false);
// user_pref("media.ondevicechange.enabled", false);
// user_pref("media.video_stats.enabled", false);
// user_pref("media.webspeech.synth.enabled", false);
// user_pref("webgl.enable-debug-renderer-info", false);
/* 8003: spoof ***/
// user_pref("dom.maxHardwareConcurrency", 2);
// user_pref("font.system.whitelist", ""); // [HIDDEN PREF]
2019-11-24 18:51:29 +01:00
// user_pref("general.appname.override", ""); // [HIDDEN PREF]
// user_pref("general.appversion.override", ""); // [HIDDEN PREF]
2021-09-19 20:03:16 +02:00
// user_pref("general.buildID.override", ""); // [HIDDEN PREF]
2019-11-24 18:51:29 +01:00
// user_pref("general.oscpu.override", ""); // [HIDDEN PREF]
2021-09-19 20:03:16 +02:00
// user_pref("general.platform.override", ""); // [HIDDEN PREF]
// user_pref("general.useragent.override", ""); // [HIDDEN PREF]
// user_pref("ui.use_standins_for_native_colors", true);
2019-11-24 18:51:29 +01:00
2021-09-12 19:33:39 +02:00
/ * * * [ S E C T I O N 9 0 0 0 ] : P E R S O N A L
2021-10-17 17:05:45 +02:00
Non - project related but useful . If any interest you , add them to your overrides
* * * /
user _pref ( "_user.js.parrot" , "9000 syntax error: the parrot's cashed in 'is chips!" ) ;
/* WELCOME & WHAT'S NEW NOTICES ***/
user _pref ( "mailnews.start_page_override.mstone" , "ignore" ) ; // master switch
2019-11-24 01:00:00 +01:00
/* WARNINGS ***/
// user_pref("full-screen-api.warning.delay", 0);
// user_pref("full-screen-api.warning.timeout", 0);
/* APPEARANCE ***/
2021-10-17 17:05:45 +02:00
// user_pref("ui.systemUsesDarkTheme", 1); // [FF67+] [HIDDEN PREF]
// 0=light, 1=dark: with RFP this only affects chrome
2019-11-24 18:51:29 +01:00
// user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent
2021-10-17 17:05:45 +02:00
// user_pref("ui.prefersReducedMotion", 1); // disable chrome animations [FF77+] [RESTART] [HIDDEN PREF]
// 0=no-preference, 1=reduce: with RFP this only affects chrome
2019-11-24 01:00:00 +01:00
/* CONTENT BEHAVIOR ***/
// user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type"
// user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX]
/* UX BEHAVIOR ***/
2020-11-01 19:08:14 +01:00
// user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux]
2019-11-24 01:00:00 +01:00
// user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART]
2021-10-17 18:24:37 +02:00
/* UX FEATURES ***/
// user_pref("reader.parse-on-load.enabled", false); // Reader View
/* OTHER ***/
// user_pref("browser.bookmarks.max_backups", 2);
// user_pref("network.manage-offline-status", false); // see bugzilla 620472
// user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR)
2021-10-17 17:05:45 +02:00
/* RETURN RECEIPT BEHAVIOR ***/
// user_pref("mail.mdn.report.enabled", false); // disable return receipt sending unconditionally
/* CUSTOM HEADERS ***/
2022-05-25 09:05:41 +02:00
// user_pref("mail.compose.other.header", "X-Custom-Header,X-Another-Custom-Header"); // corresponding values can be set in compose window ("double-arrow" drop-down)
2019-11-24 01:00:00 +01:00
// user_pref("mail.identity.id1.headers", "References, InReplyTo");
// user_pref("mail.identity.id1.header.References", "References: <2ad46d80-c8ce-49a3-9896-16171788ac28@example.tld>\n <31ff00c2-b7cb-4063-beeb-a0bdd424c3a7@example1.tld>");
// user_pref("mail.identity.id1.header.InReplyTo", "In-Reply-To: <31ff00c2-b7cb-4063-beeb-a0bdd424c3a7@example1.tld>");
2019-11-24 18:51:29 +01:00
user _pref ( "mail.identity.id1.headers" , "" ) ;
user _pref ( "mail.identity.id1.header.References" , "" ) ;
user _pref ( "mail.identity.id1.header.InReplyTo" , "" ) ;
2019-11-24 01:00:00 +01:00
2021-09-12 19:33:39 +02:00
/*** [SECTION 9100]: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK )
2019-11-24 01:00:00 +01:00
Options general to Thunderbird ' s mail configuration and user interface
2021-09-12 19:33:39 +02:00
[ 1 ] https : //searchfox.org/comm-esr91/source/
2019-11-24 01:00:00 +01:00
[ 2 ] http : //kb.mozillazine.org/Mail_and_news_settings
* * * /
2021-09-12 19:33:39 +02:00
user _pref ( "_user.js.parrot" , "9100 syntax error: this parrot is blind!" ) ;
2019-11-24 01:00:00 +01:00
/** AUTO CONFIG ***/
2021-09-12 19:33:39 +02:00
/ * 9 1 0 1 : D i s a b l e a u t o - c o n f i g u r a t i o n [ S E T U P - I N S T A L L ]
2020-11-01 22:57:55 +01:00
* These options disable auto - configuration of mail servers in Thunderbird .
2019-11-24 01:00:00 +01:00
* Such settings require a query to Mozilla which could have privacy implications
2019-12-26 16:20:47 +01:00
* if the user wishes to keep the existence of the mail provider private .
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration ***/
user _pref ( "mailnews.auto_config.guess.enabled" , false ) ;
user _pref ( "mailnews.auto_config.fetchFromISP.enabled" , false ) ;
user _pref ( "mailnews.auto_config.fetchFromISP.sendEmailAddress" , false ) ;
user _pref ( "mailnews.auto_config.fetchFromExchange.enabled" , false ) ;
user _pref ( "mailnews.auto_config_url" , "" ) ;
user _pref ( "mailnews.auto_config.addons_url" , "" ) ;
2021-09-12 19:33:39 +02:00
/ * 9 1 0 2 : D i s a b l e a c c o u n t p r o v i s i o n i n g [ S E T U P - I N S T A L L ]
2020-11-01 22:57:55 +01:00
* This option allows users to create a new email account through partner providers .
* [ 1 ] https : //developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Account_Provisioner ***/
user _pref ( "mail.provider.enabled" , false ) ;
2019-11-24 01:00:00 +01:00
/** UI (User Interface) ***/
2021-09-12 19:33:39 +02:00
/ * 9 1 1 0 : H i d e t a b b a r
2019-11-24 01:00:00 +01:00
* false = Hides the tab bar if there is only one tab . ( default ) * * * /
user _pref ( "mail.tabs.autoHide" , true ) ;
2021-09-12 19:33:39 +02:00
/ * 9 1 1 1 : S h o w f u l l e m a i l i n s t e a d o f j u s t n a m e f r o m a d d r e s s b o o k
2019-11-24 01:00:00 +01:00
* true = Show just the display name for people in the address book ( default )
* false = Show both the email address and display name . * * * /
user _pref ( "mail.showCondensedAddresses" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 1 1 2 : D i s a b l e " F i l e l i n k f o r L a r g e A t t a c h m e n t s " f e a t u r e
2019-11-30 22:34:58 +01:00
* [ 1 ] https : //support.thunderbird.net/kb/filelink-large-attachments ***/
user _pref ( "mail.cloud_files.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/* 9113: Don't hide cookies and passwords related (advanced?) buttons ***/
2019-11-30 22:34:58 +01:00
user _pref ( "pref.privacy.disable_button.view_cookies" , false ) ;
user _pref ( "pref.privacy.disable_button.cookie_exceptions" , false ) ;
user _pref ( "pref.privacy.disable_button.view_passwords" , false ) ;
2019-11-24 01:00:00 +01:00
/** HEADERS ***/
2021-09-12 19:33:39 +02:00
/ * 9 1 2 0 :
2019-11-24 01:00:00 +01:00
* true = Show Sender header in message pane .
* false = Does nothing . ( default ) * * * /
user _pref ( "mailnews.headers.showSender" , true ) ;
2021-09-12 19:33:39 +02:00
/ * 9 1 2 1 :
2019-11-24 01:00:00 +01:00
* true = Show User Agent header in message pane
* false = Does nothing . ( default ) * * * /
user _pref ( "mailnews.headers.showUserAgent" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 1 2 2 : H e l l o a r g u m e n t
2019-11-24 01:00:00 +01:00
* Lets you replace your IP address with the specified string in Received : headers when your
* IP address is not a "fully qualified domain name" ( FQDN ) . Typically you only need to do this
* when you have a NAT box to prevent it from using the NAT boxes IP address .
* If you don 't set it to something in your SMTP server' s domain it may increase your spam
* score . * * * /
user _pref ( "mail.smtpserver.default.hello_argument" , "[127.0.0.1]" ) ;
2021-09-12 19:33:39 +02:00
/ * 9 1 2 3 : D i s p l a y e d d a t e s a n d t i m e s
2020-03-23 11:41:07 +01:00
* [ SETUP - INSTALL ] When your e - mail program displays the e - mail ' s date and time , it normally
* converts them to your time zone . If your computer ' s time zone settings are wrong , then you will
* see the wrong time ( and possibly the wrong date ) .
* To turn this conversion off , you can use a preference setting .
2019-11-24 01:00:00 +01:00
* It affects the headers that you see in e - mails that you open or preview , but it does not affect
* the Date column in folders .
* [ 1 ] http : //kb.mozillazine.org/Time_and_time_zone_settings
* [ 2 ] http : //wiki.cacert.org/ThunderBirdAdvancedConfig
* * * * /
user _pref ( "mailnews.display.original_date" , false ) ;
2021-09-12 19:33:39 +02:00
/* 9124: Display the sender's Timezone when set to true ***/
2019-11-24 01:00:00 +01:00
user _pref ( "mailnews.display.date_senders_timezone" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 1 2 5 : D i s p l a y T i m e D a t e b a s e d o n R e c e i v e d H e a d e r
2019-11-24 01:00:00 +01:00
* Thunderbird shows the time when the message was sent , according to the sender . It is possible
* to make Thunderbird show the time when the message arrived on your mail server , based on the
* "Received" header . Set the following preference . New messages will show the time the message
* was received , rather than when it was sent . * * * /
2020-05-01 08:49:08 +02:00
// user_pref("mailnews.use_received_date", true);
2019-11-24 01:00:00 +01:00
/** ADDRESS BOOK ***/
2021-09-12 19:33:39 +02:00
/ * 9 1 3 0 : A d d r e s s b o o k c o l l e c t i o n [ S E T U P - F E A T U R E ]
2020-11-07 19:05:58 +01:00
* Disable Thunderbird internal address book email collection
* Consider using CardBook extension instead ( https : //addons.thunderbird.net/addon/cardbook/)
2022-01-08 17:22:44 +01:00
* [ SETTING ] Preferences > Composition > Addressing > Automatically add outgoing e - mail addresses ...
* [ SETTING ] [ CARDBOOK ] CardBook > Preferences > Email > Collect Outgoing Email * * * /
2021-12-14 14:24:05 +01:00
// user_pref("mail.collect_addressbook", "jsaddrbook://history.sqlite");
2019-11-24 01:00:00 +01:00
user _pref ( "mail.collect_email_address_outgoing" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 1 3 1 : O n l y u s e e m a i l a d d r e s s e s , w i t h o u t t h e i r D i s p l a y N a m e s [ C A R D B O O K ] [ S E T U P - F E A T U R E ]
2020-11-07 19:00:33 +01:00
* By default , CardBook extension incorporates contacts display names in addresses fields .
* This could leak sensitive information to all recipients .
2022-01-08 17:22:44 +01:00
* [ SETTING ] [ CARDBOOK ] CardBook > Preferences > Email > Sending Emails > Only use email addresses ... * * * /
2020-11-07 19:00:33 +01:00
user _pref ( "extensions.cardbook.useOnlyEmail" , true ) ;
2019-11-24 01:00:00 +01:00
2021-09-12 19:33:39 +02:00
/*** [SECTION 9200]: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW )
2019-11-24 01:00:00 +01:00
Options that relate to composition , formatting and viewing email
* * * /
2021-09-12 19:33:39 +02:00
user _pref ( "_user.js.parrot" , "9200 syntax error: this parrot has got no mail!" ) ;
2019-11-24 01:00:00 +01:00
/** ENCODING ***/
2021-09-12 19:33:39 +02:00
/ * 9 2 0 1 : P r e v e n t f a l l b a c k e n c o d i n g t o w i n d o w s - 1 2 5 2 , p r e f e r 7 b i t o r 8 b i t U T F - 8
2019-11-24 01:00:00 +01:00
* [ 1 ] http : //forums.mozillazine.org/viewtopic.php?f=28&t=267341
* [ 2 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=214729
* [ 3 ] https : //stackoverflow.com/a/28531705 ***/
user _pref ( "intl.fallbackCharsetList.ISO-8859-1" , "UTF-8" ) ;
2022-01-08 17:22:44 +01:00
/* 9202: Set encoding of incoming mail ***/
2019-11-24 01:00:00 +01:00
user _pref ( "mailnews.view_default_charset" , "UTF-8" ) ;
2022-01-08 17:22:44 +01:00
/* 9203: Set encoding of outgoing mail ***/
2019-11-24 01:00:00 +01:00
user _pref ( "mailnews.send_default_charset" , "UTF-8" ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 0 4 : F o r c e s e n c o d i n g i n r e p l y t o b e t h e d e f a u l t c h a r s e t
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=234958#c2 ***/
user _pref ( "mailnews.reply_in_default_charset" , true ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 0 5 : A v o i d i n f o r m a t i o n l e a k a g e i n r e p l y h e a d e r
2020-11-04 10:43:38 +01:00
* Reply header may contain sensitive information about system locale ( date and / or language )
* 0 = no header
* 1 = "<author> wrote:" ( see ` reply_header_authorwrotesingle ` below )
* 2 = "On <date> <author> wrote:" ( see ` reply_header_ondateauthorwrote ` below [ DEFAULT ] )
* 3 = "<author> wrote On <date>:" ( see ` reply_header_authorwroteondate ` below ` )
* 4 = user specified ( you may use below tokens to forge your own format [ DISCOURAGED ] ) * * * /
user _pref ( "mailnews.reply_header_type" , 1 ) ;
user _pref ( "mailnews.reply_header_authorwrotesingle" , "#1 wrote:" ) ;
// user_pref("mailnews.reply_header_ondateauthorwrote", "On #2 #3, #1 wrote:");
// user_pref("mailnews.reply_header_authorwroteondate", "#1 wrote on #2 #3:");
2022-05-23 18:49:57 +02:00
/ * 9 2 0 6 : P r e v e n t s p e l l c h e c k i n g d i c t i o n a r y l e a k a g e t h r o u g h C o n t e n t - L a n g u a g e h e a d e r
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=1370217 ***/
user _pref ( "mail.suppress_content_language" , true ) ;
/ * 9 2 0 7 : S a n i t i z e D a t e h e a d e r t o c o n v e r t d a t e t o U T C a n d r o u n d t o c l o s e s t m i n u t e
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=1603359 ***/
user _pref ( "mail.sanitize_date_header" , true ) ;
2019-11-24 01:00:00 +01:00
/** COMPOSITION ***/
2021-09-12 19:33:39 +02:00
/ * 9 2 1 0 : C h e c k s p e l l i n g b e f o r e s e n d i n g [ S E T U P - F E A T U R E ]
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=667133 ***/
user _pref ( "mail.SpellCheckBeforeSend" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 1 1 : B e h a v i o r w h e n s e n d i n g H T M L m e s s a g e [ S E T U P - F E A T U R E ]
2020-11-01 22:58:48 +01:00
* ( 0 = Ask , 1 = Send as plain text , 2 = Send as HTML anyway ,
* 3 = Include both plain text and HTML message bodies in message )
2019-11-24 01:00:00 +01:00
* Email that is HTML should also have plaintext multipart for plain text users .
* [ 1 ] https : //drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html
2022-01-08 17:22:44 +01:00
* [ SETTING ] Account Settings > Composition & Addressing > Composition > Compose messages in HTML format * * * /
2020-11-01 22:58:48 +01:00
user _pref ( "mail.default_html_action" , 1 ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 1 2 : S e n d e m a i l i n p l a i n t e x t u n l e s s e x p r e s s l y o v e r r i d d e n .
2020-03-23 11:41:07 +01:00
* [ SETUP - FEATURE ] Sometimes HTML is useful especially when used with Markdown Here
2019-11-24 01:00:00 +01:00
* [ NOTE ] Holding down shift when you click on "Write" will bypass
* [ 1 ] http : //kb.mozillazine.org/Plain_text_e-mail_%28Thunderbird%29
* [ 2 ] https : //support.mozilla.org/en-US/questions/1004181
* [ 3 ] https : //markdown-here.com ***/
user _pref ( "mail.html_compose" , false ) ;
user _pref ( "mail.identity.default.compose_html" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 1 3 : D o w n g r a d e e m a i l t o p l a i n t e x t b y d e f a u l t
2020-03-23 11:41:07 +01:00
* [ SETUP - FEATURE ] Only use HTML email if you need it , see above
2022-01-08 17:22:44 +01:00
* [ SETTING ] Composition > Composition > HTML Style > Configure text format behavior > Send options ... > Send messages as plain text if possible * * * /
2022-01-08 17:23:51 +01:00
user _pref ( "mailnews.sendformat.auto_downgrade" , true ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 1 4 : W h a t c l a s s e s c a n p r o c e s s i n c o m i n g d a t a .
2019-11-24 01:00:00 +01:00
* ( 0 = All classes ( default ) , 1 = Don 't display HTML, 2=Don' t display HTML and inline images ,
* 3 = Don ' t display HTML , inline images and some other uncommon types , 100 = Use a hard coded list )
* In the past this has mitigated a vulnerability CVE - 2008 - 0304 ( rare )
* [ 1 ] https : //www.mozilla.org/en-US/security/advisories/mfsa2008-12/
* [ 2 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=677905 ***/
2020-11-01 22:57:55 +01:00
user _pref ( "mailnews.display.disallow_mime_handlers" , 3 ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 1 5 : H o w t o d i s p l a y H T M L p a r t s o f a m e s s a g e b o d y
2019-11-24 01:00:00 +01:00
* ( 0 = Display the HTML normally ( default ) , 1 = Convert it to text and then back again
* 2 = Display the HTML source , 3 = Sanitize the HTML , 4 = Display all body parts )
* ( in trunk builds later than 2011 - 07 - 23 )
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=602718
* [ 2 ] https : //hg.mozilla.org/comm-central/rev/c1ef44a22eb2
* [ 3 ] https : //www.bucksch.org/1/projects/mozilla/108153/ ***/
user _pref ( "mailnews.display.html_as" , 3 ) ;
2022-06-11 12:20:49 +02:00
/ * 9 2 1 6 : P r e f e r t o v i e w a s p l a i n t e x t o r H T M L [ S E T U P - F E A T U R E ]
2019-11-24 01:00:00 +01:00
* true = Display a message as plain text when there is both a HTML and a plain
* text version of a message body
* false = Display a message as HTML when there is both a HTML and a plain text
* version of a message body . ( default ) * * * /
user _pref ( "mailnews.display.prefer_plaintext" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 1 7 : I n l i n e a t t a c h m e n t s [ S E T U P - F E A T U R E ]
2019-11-24 01:00:00 +01:00
* true = Show inlinable attachments ( text , images , messages ) after the message .
* false = Do not display any attachments with the message * * * /
user _pref ( "mail.inline_attachments" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 1 8 : B i g a t t a c h m e n t w a r n i n g
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //support.mozilla.org/en-US/questions/1081046
* [ 2 ] http : //forums.mozillazine.org/viewtopic.php?f=39&t=2949521 */
user _pref ( "mail.compose.big_attachments.notify" , true ) ; // [DEFAULT: true]
2021-09-12 19:33:39 +02:00
/* 9219: Set big attachment size to warn at */
2022-02-13 12:54:05 +01:00
user _pref ( "mail.compose.big_attachments.threshold_kb" , 9220 ) ; // [DEFAULT: 5120]
2020-11-08 16:18:57 +01:00
// user_pref("mailnews.message_warning_size", 20971520); // [DEFAULT: 20971520]
2019-11-24 01:00:00 +01:00
/** VIEW ***/
2021-09-12 19:33:39 +02:00
/ * 9 2 3 0 : D i s a b l e J a v a S c r i p t
2019-11-24 01:00:00 +01:00
* [ NOTE ] JavaScript is already disabled in message content .
* [ 1 ] https : //developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Releases/3
* [ 2 ] https : //stackoverflow.com/questions/3054315/is-javascript-supported-in-an-email-message
* * * * /
user _pref ( "javascript.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 3 1 : D i s a b l e m e d i a s o u r c e e x t e n s i o n s
2019-11-24 01:00:00 +01:00
* [ 1 ] https : //www.ghacks.net/2014/05/10/enable-media-source-extensions-firefox ***/
user _pref ( "media.mediasource.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/* 9232: Disable hardware decoding support ***/
2019-11-24 01:00:00 +01:00
user _pref ( "media.hardware-video-decoding.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 2 3 3 : D e f a u l t i m a g e p e r m i s s i o n s
2019-11-24 01:00:00 +01:00
* 1 = Allow all images to load , regardless of origin . ( Default ) ,
* 2 = Block all images from loading .
* 3 = Prevent third - party images from loading
* [ 1 ] http : //kb.mozillazine.org/Permissions.default.image ***/
user _pref ( "permissions.default.image" , 2 ) ;
2022-01-08 17:55:30 +01:00
/ * 9 2 4 0 : B u i l t i n p h i s h i n g / s c a m m i n g d e t e c t i o n
* [ NOTE ] These preferences are enabled by default and should not usually be touched .
* [ 1 ] https : //searchfox.org/comm-central/source/mail/modules/PhishingDetector.jsm ***/
user _pref ( "mail.phishing.detection.enabled" , true ) ;
user _pref ( "mail.phishing.detection.disallow_form_actions" , true ) ;
user _pref ( "mail.phishing.detection.ipaddresses" , true ) ;
user _pref ( "mail.phishing.detection.mismatched_hosts" , true ) ;
2019-11-24 01:00:00 +01:00
2021-09-12 19:33:39 +02:00
/*** [SECTION 9300]: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS )
2020-11-03 18:56:53 +01:00
Options that relate to other Thunderbird components such as the chat client , calendar and RSS )
2019-11-24 01:00:00 +01:00
* * * /
2021-09-12 19:33:39 +02:00
user _pref ( "_user.js.parrot" , "9300 syntax error: this parrot is not tweeting!" ) ;
2019-11-24 01:00:00 +01:00
/** CHAT ***/
2021-09-12 19:33:39 +02:00
/* 9301: Disable chat functionality [SETUP-FEATURE] ***/
2019-11-24 01:00:00 +01:00
user _pref ( "mail.chat.enabled" , false ) ;
2021-09-12 19:33:39 +02:00
/* 9302: Disable logging of group chats ***/
2019-11-24 01:00:00 +01:00
user _pref ( "purple.logging.log_chats" , false ) ;
2021-09-12 19:33:39 +02:00
/* 9303: Disable logging of 1 to 1 conversations ***/
2019-11-24 01:00:00 +01:00
user _pref ( "purple.logging.log_ims" , false ) ;
2021-09-12 19:33:39 +02:00
/* 9304: Disable logging of system messages ***/
2019-11-24 01:00:00 +01:00
user _pref ( "purple.logging.log_system" , false ) ;
2021-09-12 19:33:39 +02:00
/* 9305: Disable typing notifications ***/
2019-11-24 01:00:00 +01:00
user _pref ( "purple.conversations.im.send_typing" , false ) ;
2021-09-12 19:33:39 +02:00
/ * 9 3 0 6 : W h e n c h a t i s e n a b l e d , d o n o t c o n n e c t t o a c c o u n t s a u t o m a t i c a l l y
2019-11-30 22:34:58 +01:00
* 0 = Do not connect / show the account manager ,
* 1 = Connect automatically . ( Default ) * * * /
// user_pref("messenger.startup.action", 0);
2021-09-12 19:33:39 +02:00
/* 9307: When chat is enabled, do not report idle status ***/
2020-11-08 22:50:22 +01:00
// user_pref("messenger.status.reportIdle", false);
2022-02-13 13:00:15 +01:00
/* 9308: Disable chat desktop notifications ***/
// user_pref("mail.chat.show_desktop_notifications", false);
/ * 9 3 0 9 : D e c i d e h o w m u c h i n f o r m a t i o n w i l l b e s h o w n i n c h a t n o t i f i c a t i o n s
* 0 = Show all info ( sender , chat message message preview ) ,
* 1 = Show sender ' s info only ( not message preview ) ,
* 2 = No info ( fill dummy values ) . * * * /
user _pref ( "mail.chat.notification_info" , 2 ) ;
2019-11-24 01:00:00 +01:00
/** CALENDAR ***/
2021-09-12 19:33:39 +02:00
/ * 9 3 1 0 : D i s a b l e c a l e n d a r i n t e g r a t i o n
2020-11-03 18:56:53 +01:00
* [ SETUP - FEATURE ] Lightning calendar add - on is integrated in Thunderbird 38 and later .
* Keeping this preference false allows us to properly show the opt - in / o p t - o u t d i a l o g
* on new profiles fresh start , see [ 3 ] .
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=401779
* [ 2 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=1130854
* [ 3 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=1130852 ***/
2019-11-24 01:00:00 +01:00
user _pref ( "mail.calendar-integration.opt-out" , false ) ;
2021-09-12 19:33:39 +02:00
/* 9311: Set user agent for calendar ***/
2019-11-24 01:00:00 +01:00
user _pref ( "calendar.useragent.extra" , "" ) ;
2021-09-12 19:33:39 +02:00
/ * 9 3 1 2 : S e t c a l e n d a r t i m e z o n e t o a v o i d s y s t e m d e t e c t i o n [ S E T U P - I N S T A L L ]
2020-11-03 18:56:53 +01:00
* By default , extensive system detection would be performed to find user ' s current timezone .
* Setting this preference to "UTC" should disable it .
2020-11-07 19:19:32 +01:00
* You may also directly set it to your timezone , i . e . "Pacific/Fakaofo"
2022-01-08 17:22:44 +01:00
* [ SETTING ] Calendar > Calendar > Timezone * * * /
2020-11-03 18:56:53 +01:00
user _pref ( "calendar.timezone.local" , "UTC" ) ; // [DEFAULT: ""]
2019-11-24 01:00:00 +01:00
/** RSS ***/
2020-11-12 14:42:14 +01:00
/ * * T h e s e f e a t u r e s d o n ' t a c t u a l l y d o a n y t h i n g a s t h e y a r e n ' t i m p l e m e n t e d
* [ 1 ] https : //searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/mailWindowOverlay.js#925
* [ 2 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=458606#c9
2021-09-12 19:33:39 +02:00
/ * 9 3 2 0 : W h a t c l a s s e s c a n p r o c e s s i n c o m i n g d a t a .
2019-11-24 01:00:00 +01:00
* ( 0 = All classes ( default ) , 1 = Don 't display HTML, 2=Don' t display HTML and inline images ,
* 3 = Don ' t display HTML , inline images and some other uncommon types , 100 = Use a hard coded list )
2020-11-12 14:42:14 +01:00
* [ 1 ] https : //www.privacy-handbuch.de/handbuch_31j.htm
2019-11-24 01:00:00 +01:00
user _pref ( "rss.display.disallow_mime_handlers" , 3 ) ;
2021-09-12 19:33:39 +02:00
/ * 9 3 2 1 : H o w t o d i s p l a y H T M L p a r t s o f a m e s s a g e b o d y
2019-11-24 01:00:00 +01:00
* ( 0 = Display the HTML normally ( default ) , 1 = Convert it to text and then back again
* 2 = Display the HTML source , 3 = Sanitize the HTML , 4 = Display all body parts )
* ( in trunk builds later than 2011 - 07 - 23 )
* [ 1 ] https : //bugzilla.mozilla.org/show_bug.cgi?id=602718
* [ 2 ] https : //hg.mozilla.org/comm-central/rev/c1ef44a22eb2
2020-11-12 14:42:14 +01:00
* [ 3 ] https : //www.bucksch.org/1/projects/mozilla/108153/
2019-11-24 01:00:00 +01:00
user _pref ( "rss.display.html_as" , 1 ) ;
2022-06-11 12:20:49 +02:00
/ * 9 3 2 2 : P r e f e r t o v i e w a s p l a i n t e x t o r H T M L
2019-11-24 01:00:00 +01:00
* true = Display a message as plain text when there is both a HTML and a plain
* text version of a message body
* false = Display a message as HTML when there is both a HTML and a plain text
2020-11-12 14:42:14 +01:00
* version of a message body . ( default )
2019-11-24 01:00:00 +01:00
user _pref ( "rss.display.prefer_plaintext" , true ) ;
2020-11-12 14:42:14 +01:00
* * /
2021-09-12 19:33:39 +02:00
/ * 9 3 2 3 : F e e d m e s s a g e d i s p l a y ( s u m m a r y o r w e b p a g e ) , o n o p e n .
2019-11-24 01:00:00 +01:00
* Action on double click or enter in threadpane for a feed message .
* 0 = open content - base url in new window , 1 = open summary in new window ,
* 2 = toggle load summary and content - base url in message pane ,
* 3 = load content - base url in browser
* [ 1 ] http : //forums.mozillazine.org/viewtopic.php?f=39&t=2502335 ***/
user _pref ( "rss.show.content-base" , 3 ) ;
2021-09-12 19:33:39 +02:00
/ * 9 3 2 4 : F e e d m e s s a g e d i s p l a y ( s u m m a r y o r w e b p a g e ) , o n s e l e c t .
2019-11-24 01:00:00 +01:00
* 0 = global override , load web page , 1 = global override , load summary ,
* 2 = use default feed folder setting from Subscribe dialog ; if no setting default to 1 * * * /
user _pref ( "rss.show.summary" , 1 ) ;
2021-09-12 19:33:39 +02:00
/ * 9 3 2 5 : F e e d m e s s a g e a d d i t i o n a l w e b p a g e d i s p l a y .
2019-11-24 01:00:00 +01:00
* 0 = no action , 1 = load web page in default browser , on select * * * /
user _pref ( "rss.message.loadWebPageOnSelect" , 0 ) ;
2022-01-08 17:40:56 +01:00
/*** [SECTION 9400]: THUNDERBIRD ENCRYPTION (OPENGPG / GNUPG )
Options that relate to e - mail encryption in Thunderbird .
[ 1 ] https : //wiki.mozilla.org/Thunderbird:OpenPGP
[ 2 ] https : //support.mozilla.org/kb/openpgp-thunderbird-howto-and-faq
2019-11-24 01:00:00 +01:00
* * * /
2021-09-12 19:33:39 +02:00
user _pref ( "_user.js.parrot" , "9400 syntax error: this parrot is talking in codes!" ) ;
2019-11-24 01:00:00 +01:00
2020-11-01 22:57:55 +01:00
/** GNUPG ***/
2021-09-12 19:33:39 +02:00
/ * 9 4 0 9 : A l l o w t h e u s e o f e x t e r n a l G n u P G
2020-11-01 22:57:55 +01:00
* Whenever RNP fails to decrypt a message , Thunderbird will tray against system GnuPG
* [ 1 ] https : //wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards#Allow_the_use_of_external_GnuPG ***/
user _pref ( "mail.openpgp.allow_external_gnupg" , true ) ; // [HIDDEN PREF]
2019-11-24 01:00:00 +01:00
/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED
2021-10-17 17:05:45 +02:00
Documentation denoted as [ - ] . Items deprecated in FF78 or earlier have been archived at [ 1 ]
[ 1 ] https : //github.com/arkenfox/user.js/issues/123
2019-11-24 01:00:00 +01:00
* * * /
2021-10-31 09:42:26 +01:00
user _pref ( "_user.js.parrot" , "9999 syntax error: the parrot's shuffled off 'is mortal coil!" ) ;
2021-10-17 17:05:45 +02:00
/ * E S R 7 8 . x s t i l l u s e s a l l t h e f o l l o w i n g p r e f s
2019-11-24 01:00:00 +01:00
// [NOTE] replace the * with a slash in the line above to re-enable them
2021-10-17 17:05:45 +02:00
// FF79
// 0212: enforce fallback text encoding to match en-US
// When the content or server doesn't declare a charset the browser will
// fallback to the "Current locale" based on your application language
// [TEST] https://hsivonen.com/test/moz/check-charset.htm
// [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025
// [-] https://bugzilla.mozilla.org/1603712
user _pref ( "intl.charset.fallback.override" , "windows-1252" ) ;
// FF82
// 0206: disable geographically specific results/search engines e.g. "browser.search.*.US"
// i.e. ignore all of Mozilla's various search engines in multiple locales
// [-] https://bugzilla.mozilla.org/1619926
user _pref ( "browser.search.geoSpecificDefaults" , false ) ;
user _pref ( "browser.search.geoSpecificDefaults.url" , "" ) ;
// FF86
// 1205: disable SSL Error Reporting
// [1] https://firefox-source-docs.mozilla.org/main/65.0/browser/base/sslerrorreport/preferences.html
// [-] https://bugzilla.mozilla.org/1681839
user _pref ( "security.ssl.errorReporting.automatic" , false ) ;
user _pref ( "security.ssl.errorReporting.enabled" , false ) ;
user _pref ( "security.ssl.errorReporting.url" , "" ) ;
// 2653: disable hiding mime types (Options>General>Applications) not associated with a plugin
// [-] https://bugzilla.mozilla.org/1581678
user _pref ( "browser.download.hide_plugins_without_extensions" , false ) ;
// FF89
// 0309: disable sending Flash crash reports
// [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed]
user _pref ( "dom.ipc.plugins.flash.subprocess.crashreporter.enabled" , false ) ;
// 0310: disable sending the URL of the website where a plugin crashed
// [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed]
user _pref ( "dom.ipc.plugins.reportCrashURL" , false ) ;
// 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+]
// [1] https://bugzilla.mozilla.org/1190623
// [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed]
user _pref ( "security.mixed_content.block_object_subrequest" , true ) ;
// 1803: disable Flash plugin
// 0=deactivated, 1=ask, 2=enabled
// ESR52.x is the last branch to fully support NPAPI, FF52+ stable only supports Flash
// [NOTE] You can still override individual sites via site permissions
// [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed]
user _pref ( "plugin.state.flash" , 0 ) ; // [DEFAULT: 1]
// FF90
// 0708: disable FTP [FF60+]
// [-] https://bugzilla.mozilla.org/1574475
// user_pref("network.ftp.enabled", false); // [DEFAULT: false FF88+]
2019-11-24 01:00:00 +01:00
// ***/
/* END: internal custom pref to test for syntax errors ***/
user _pref ( "_user.js.parrot" , "SUCCESS: No no he's not dead, he's, he's restin'!" ) ;
