mirror of
https://github.com/HorlogeSkynet/thunderbird-user.js.git
synced 2025-09-01 17:38:31 +02:00
Compare commits
8 Commits
Author | SHA1 | Date | |
---|---|---|---|
ce8dfe3329 | |||
30848dd7e7 | |||
b90bbe45b2 | |||
5ede0acaaa | |||
eb8cade42e | |||
c57ead1b76 | |||
3ce96df737 | |||
49921ed98c |
4
LICENSE
4
LICENSE
@ -1,6 +1,8 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2019 ghacksuserjs
|
||||
Copyright (c) 2019-2020 HorlogeSkynet
|
||||
Copyright (c) 2019 dngray
|
||||
Copyright (c) 2019 ghacksuserjs
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
|
@ -10,7 +10,7 @@ For a more technical breakdown and explanation, you can read more on the [overvi
|
||||
### :large_blue_diamond: thunderbird user.js
|
||||
|
||||
The Thunderbird `user.js` is a **template** which aims to provide as much privacy and enhanced security as possible.
|
||||
It differs from the `ghacks user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client.
|
||||
It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client.
|
||||
|
||||
- If you're using Thunderbird with Tor we suggest that you install the [TorBirdy](https://addons.thunderbird.net/addon/torbirdy) add-on. If you are using Tor, you should also consider using [Tails](https://tails.boum.org/) or [Whonix](https://www.whonix.org/).
|
||||
- If you're a **Gmail** user see [this article about OAuth2](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/3.1-OAuth2-Users).
|
||||
@ -20,7 +20,7 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o
|
||||
|
||||
### :large_blue_diamond: Acknowledgments
|
||||
|
||||
* [tya99](https://github.com/tya99) most of the ground work and initial port from the Firefox version of [ghacks user.js](https://github.com/ghacksuserjs/ghacks-user.js)
|
||||
* [tya99](https://github.com/tya99) most of the ground work and initial port from the Firefox version of [arkenfox user.js](https://github.com/arkenfox/user.js)
|
||||
* [dngray](https://github.com/dngray) continual maintenance and Wiki
|
||||
* [HorlogeSkynet](https://github.com/HorlogeSkynet) continual maintenance
|
||||
|
||||
|
37
user.js
37
user.js
@ -1,7 +1,7 @@
|
||||
/******
|
||||
* name: ghacks thunderbird user.js
|
||||
* date: 24 November 2019
|
||||
* version v68.0-beta: "Knock on Pants"
|
||||
* name: thunderbird user.js
|
||||
* date: 31 October 2020
|
||||
* version v68.0: "Knock on Pants"
|
||||
* authors: v52+ github | v51- www.ghacks.net
|
||||
* url: https://github.com/HorlogeSkynet/thunderbird-user.js
|
||||
* license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE)
|
||||
@ -151,16 +151,18 @@ user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
|
||||
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);
|
||||
user_pref("extensions.webservice.discoverURL", "");
|
||||
/* 0330: disable telemetry
|
||||
* the pref (.unified) affects the behaviour of the pref (.enabled)
|
||||
* the pref (.unified) affects the behavior of the pref (.enabled)
|
||||
* IF unified=false then .enabled controls the telemetry module
|
||||
* IF unified=true then .enabled ONLY controls whether to record extended data
|
||||
* so make sure to have both set as false
|
||||
* so make sure to have both set as false.
|
||||
* Restoring prompted=0 would make TB ask you on fresh install.
|
||||
* [NOTE] FF58+ `toolkit.telemetry.enabled` is now LOCKED to reflect prerelease
|
||||
* or release builds (true and false respectively), see [2]
|
||||
* or release builds (true and false respectively), see [2].
|
||||
* [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html
|
||||
* [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/
|
||||
user_pref("toolkit.telemetry.unified", false);
|
||||
user_pref("toolkit.telemetry.enabled", false); // see [NOTE] above FF58+
|
||||
user_pref("toolkit.telemetry.prompted", 2);
|
||||
user_pref("toolkit.telemetry.server", "data:,");
|
||||
user_pref("toolkit.telemetry.archive.enabled", false);
|
||||
user_pref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+]
|
||||
@ -297,7 +299,7 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost
|
||||
* OS/network level, and/or configured properly in VPN setups. If you are not masking your IP,
|
||||
* then this won't make much difference. If you are maksing your IP, then it can only help.
|
||||
* [TEST] http://ipv6leak.com/
|
||||
* [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/437#issuecomment-403740626
|
||||
* [1] https://github.com/arkenfox/user.js/issues/437#issuecomment-403740626
|
||||
* [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/
|
||||
user_pref("network.dns.disableIPv6", true);
|
||||
/* 0702: disable HTTP2
|
||||
@ -408,7 +410,7 @@ user_pref("places.history.enabled", false);
|
||||
[1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
|
||||
[2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/
|
||||
[3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache
|
||||
[4] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
|
||||
[4] https://github.com/arkenfox/user.js/wiki/4.2.4-Header-Editor
|
||||
[5] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
|
||||
***/
|
||||
user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
|
||||
@ -534,7 +536,8 @@ user_pref("security.family_safety.mode", 0);
|
||||
/* 1223: enforce strict pinning
|
||||
* PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict
|
||||
* [SETUP-INSTALL] If you rely on an AV (anti-virus) to protect your web browsing
|
||||
* by inspecting ALL your web traffic, then leave at current default=1
|
||||
* by inspecting ALL your web traffic, then leave at current 1 (default).
|
||||
* [NOTE] It needs to be set to 1 when connecting to the ProtonMail's Bridge for the first time.
|
||||
* [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/
|
||||
user_pref("security.cert_pinning.enforcement_level", 2);
|
||||
|
||||
@ -722,14 +725,14 @@ user_pref("dom.disable_window_move_resize", true);
|
||||
/* 2203: open links targeting new windows in a new tab instead
|
||||
* This stops malicious window sizes and some screen resolution leaks.
|
||||
* You can still right-click a link and open in a new window.
|
||||
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
|
||||
* [TEST] https://arkenfox.github.io/TZP/tzp.html#screen
|
||||
* [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/
|
||||
// user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3]
|
||||
// user_pref("browser.link.open_newwindow.restriction", 0); // [DEFAULT: 0]
|
||||
/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
|
||||
* [NOTE] You can still manually toggle the browser's fullscreen state (F11),
|
||||
* but this pref will disable embedded video/game fullscreen controls, e.g. youtube
|
||||
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen ***/
|
||||
* [TEST] https://arkenfox.github.io/TZP/tzp.html#screen ***/
|
||||
// user_pref("full-screen-api.enabled", false); // [DEFAULT: false]
|
||||
/* 2210: block popup windows
|
||||
* [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/
|
||||
@ -766,7 +769,7 @@ user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!");
|
||||
// user_pref("dom.serviceWorkers.enabled", false); // [DEFAULT: false]
|
||||
/* 2304: disable Web Notifications
|
||||
* [NOTE] Web Notifications require service workers (2302) and are behind a prompt (2306)
|
||||
* [NOTE] Unlike ghacks-user.js, we explicitly disable them as they are enabled by default.
|
||||
* [NOTE] Unlike arkenfox/user.js, we explicitly disable them as they are enabled by default.
|
||||
* [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/
|
||||
user_pref("dom.webnotifications.enabled", false); // [FF22+]
|
||||
user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+]
|
||||
@ -879,7 +882,7 @@ user_pref("devtools.chrome.enabled", false);
|
||||
user_pref("devtools.debugger.remote-enabled", false);
|
||||
user_pref("devtools.webide.enabled", false);
|
||||
/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN]
|
||||
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc
|
||||
* [TEST] https://arkenfox.github.io/TZP/tzp.html#misc
|
||||
* [1] https://bugzilla.mozilla.org/1173199 ***/
|
||||
// user_pref("mathml.disabled", true);
|
||||
/* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+]
|
||||
@ -1070,7 +1073,7 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAUL
|
||||
[NOTE] Info only: To set a size, open a XUL (chrome) page (such as about:config) which is at
|
||||
100% zoom, hit Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run.
|
||||
Test your window size, do some math, resize to allow for all the non inner window elements
|
||||
[TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
|
||||
[TEST] https://arkenfox.github.io/TZP/tzp.html#screen
|
||||
** 1281949 - spoof screen orientation (FF50+)
|
||||
** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+)
|
||||
FF53: Fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044)
|
||||
@ -1229,7 +1232,7 @@ user_pref("ui.use_standins_for_native_colors", true);
|
||||
// FF41+
|
||||
// 4620: mitigate fingerprinting via canvas
|
||||
// [NOTE] This setting has been removed from gHacks v67 (see [1]) but is still enabled by default.
|
||||
// [1] https://github.com/ghacksuserjs/ghacks-user.js/commit/8b07fd57d0f8a31dab25661d51235fe1b0c6360c
|
||||
// [1] https://github.com/arkenfox/user.js/commit/8b07fd57d0f8a31dab25661d51235fe1b0c6360c
|
||||
user_pref("canvas.capturestream.enabled", false);
|
||||
// * * * /
|
||||
// ***/
|
||||
@ -1364,7 +1367,7 @@ user_pref("mailnews.display.date_senders_timezone", false);
|
||||
* to make Thunderbird show the time when the message arrived on your mail server, based on the
|
||||
* "Received" header. Set the following preference. New messages will show the time the message
|
||||
* was received, rather than when it was sent. ***/
|
||||
user_pref("mailnews.use_received_date", "true");
|
||||
// user_pref("mailnews.use_received_date", true);
|
||||
|
||||
/** ADDRESS BOOK ***/
|
||||
/* 6007: Address book collection
|
||||
@ -1589,7 +1592,7 @@ user_pref("mail.server.default.acPreferEncrypt", 0);
|
||||
/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED
|
||||
Documentation denoted as [-]. Items deprecated prior to FF61 have been archived at [1], which
|
||||
also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets
|
||||
[1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
|
||||
[1] https://github.com/arkenfox/user.js/issues/123
|
||||
***/
|
||||
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
|
||||
/* ESR60.x still uses all the following prefs
|
||||
|
Reference in New Issue
Block a user