8 Commits

3 changed files with 25 additions and 20 deletions

View File

@ -1,6 +1,8 @@
MIT License
Copyright (c) 2019 ghacksuserjs
Copyright (c) 2019-2020 HorlogeSkynet
Copyright (c) 2019 dngray
Copyright (c) 2019 ghacksuserjs
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal

View File

@ -10,7 +10,7 @@ For a more technical breakdown and explanation, you can read more on the [overvi
### :large_blue_diamond: thunderbird user.js
The Thunderbird `user.js` is a **template** which aims to provide as much privacy and enhanced security as possible.
It differs from the `ghacks user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client.
It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client.
- If you're using Thunderbird with Tor we suggest that you install the [TorBirdy](https://addons.thunderbird.net/addon/torbirdy) add-on. If you are using Tor, you should also consider using [Tails](https://tails.boum.org/) or [Whonix](https://www.whonix.org/).
- If you're a **Gmail** user see [this article about OAuth2](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/3.1-OAuth2-Users).
@ -20,7 +20,7 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o
### :large_blue_diamond: Acknowledgments
* [tya99](https://github.com/tya99) most of the ground work and initial port from the Firefox version of [ghacks user.js](https://github.com/ghacksuserjs/ghacks-user.js)
* [tya99](https://github.com/tya99) most of the ground work and initial port from the Firefox version of [arkenfox user.js](https://github.com/arkenfox/user.js)
* [dngray](https://github.com/dngray) continual maintenance and Wiki
* [HorlogeSkynet](https://github.com/HorlogeSkynet) continual maintenance

37
user.js
View File

@ -1,7 +1,7 @@
/******
* name: ghacks thunderbird user.js
* date: 24 November 2019
* version v68.0-beta: "Knock on Pants"
* name: thunderbird user.js
* date: 31 October 2020
* version v68.0: "Knock on Pants"
* authors: v52+ github | v51- www.ghacks.net
* url: https://github.com/HorlogeSkynet/thunderbird-user.js
* license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE)
@ -151,16 +151,18 @@ user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);
user_pref("extensions.webservice.discoverURL", "");
/* 0330: disable telemetry
* the pref (.unified) affects the behaviour of the pref (.enabled)
* the pref (.unified) affects the behavior of the pref (.enabled)
* IF unified=false then .enabled controls the telemetry module
* IF unified=true then .enabled ONLY controls whether to record extended data
* so make sure to have both set as false
* so make sure to have both set as false.
* Restoring prompted=0 would make TB ask you on fresh install.
* [NOTE] FF58+ `toolkit.telemetry.enabled` is now LOCKED to reflect prerelease
* or release builds (true and false respectively), see [2]
* or release builds (true and false respectively), see [2].
* [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html
* [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/
user_pref("toolkit.telemetry.unified", false);
user_pref("toolkit.telemetry.enabled", false); // see [NOTE] above FF58+
user_pref("toolkit.telemetry.prompted", 2);
user_pref("toolkit.telemetry.server", "data:,");
user_pref("toolkit.telemetry.archive.enabled", false);
user_pref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+]
@ -297,7 +299,7 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost
* OS/network level, and/or configured properly in VPN setups. If you are not masking your IP,
* then this won't make much difference. If you are maksing your IP, then it can only help.
* [TEST] http://ipv6leak.com/
* [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/437#issuecomment-403740626
* [1] https://github.com/arkenfox/user.js/issues/437#issuecomment-403740626
* [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/
user_pref("network.dns.disableIPv6", true);
/* 0702: disable HTTP2
@ -408,7 +410,7 @@ user_pref("places.history.enabled", false);
[1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
[2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/
[3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache
[4] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
[4] https://github.com/arkenfox/user.js/wiki/4.2.4-Header-Editor
[5] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
***/
user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
@ -534,7 +536,8 @@ user_pref("security.family_safety.mode", 0);
/* 1223: enforce strict pinning
* PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict
* [SETUP-INSTALL] If you rely on an AV (anti-virus) to protect your web browsing
* by inspecting ALL your web traffic, then leave at current default=1
* by inspecting ALL your web traffic, then leave at current 1 (default).
* [NOTE] It needs to be set to 1 when connecting to the ProtonMail's Bridge for the first time.
* [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/
user_pref("security.cert_pinning.enforcement_level", 2);
@ -722,14 +725,14 @@ user_pref("dom.disable_window_move_resize", true);
/* 2203: open links targeting new windows in a new tab instead
* This stops malicious window sizes and some screen resolution leaks.
* You can still right-click a link and open in a new window.
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
* [TEST] https://arkenfox.github.io/TZP/tzp.html#screen
* [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/
// user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3]
// user_pref("browser.link.open_newwindow.restriction", 0); // [DEFAULT: 0]
/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
* [NOTE] You can still manually toggle the browser's fullscreen state (F11),
* but this pref will disable embedded video/game fullscreen controls, e.g. youtube
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen ***/
* [TEST] https://arkenfox.github.io/TZP/tzp.html#screen ***/
// user_pref("full-screen-api.enabled", false); // [DEFAULT: false]
/* 2210: block popup windows
* [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/
@ -766,7 +769,7 @@ user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!");
// user_pref("dom.serviceWorkers.enabled", false); // [DEFAULT: false]
/* 2304: disable Web Notifications
* [NOTE] Web Notifications require service workers (2302) and are behind a prompt (2306)
* [NOTE] Unlike ghacks-user.js, we explicitly disable them as they are enabled by default.
* [NOTE] Unlike arkenfox/user.js, we explicitly disable them as they are enabled by default.
* [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/
user_pref("dom.webnotifications.enabled", false); // [FF22+]
user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+]
@ -879,7 +882,7 @@ user_pref("devtools.chrome.enabled", false);
user_pref("devtools.debugger.remote-enabled", false);
user_pref("devtools.webide.enabled", false);
/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN]
* [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc
* [TEST] https://arkenfox.github.io/TZP/tzp.html#misc
* [1] https://bugzilla.mozilla.org/1173199 ***/
// user_pref("mathml.disabled", true);
/* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+]
@ -1070,7 +1073,7 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAUL
[NOTE] Info only: To set a size, open a XUL (chrome) page (such as about:config) which is at
100% zoom, hit Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run.
Test your window size, do some math, resize to allow for all the non inner window elements
[TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
[TEST] https://arkenfox.github.io/TZP/tzp.html#screen
** 1281949 - spoof screen orientation (FF50+)
** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+)
FF53: Fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044)
@ -1229,7 +1232,7 @@ user_pref("ui.use_standins_for_native_colors", true);
// FF41+
// 4620: mitigate fingerprinting via canvas
// [NOTE] This setting has been removed from gHacks v67 (see [1]) but is still enabled by default.
// [1] https://github.com/ghacksuserjs/ghacks-user.js/commit/8b07fd57d0f8a31dab25661d51235fe1b0c6360c
// [1] https://github.com/arkenfox/user.js/commit/8b07fd57d0f8a31dab25661d51235fe1b0c6360c
user_pref("canvas.capturestream.enabled", false);
// * * * /
// ***/
@ -1364,7 +1367,7 @@ user_pref("mailnews.display.date_senders_timezone", false);
* to make Thunderbird show the time when the message arrived on your mail server, based on the
* "Received" header. Set the following preference. New messages will show the time the message
* was received, rather than when it was sent. ***/
user_pref("mailnews.use_received_date", "true");
// user_pref("mailnews.use_received_date", true);
/** ADDRESS BOOK ***/
/* 6007: Address book collection
@ -1589,7 +1592,7 @@ user_pref("mail.server.default.acPreferEncrypt", 0);
/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED
Documentation denoted as [-]. Items deprecated prior to FF61 have been archived at [1], which
also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets
[1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
[1] https://github.com/arkenfox/user.js/issues/123
***/
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
/* ESR60.x still uses all the following prefs