diff --git a/user.js b/user.js index 0dcf02d..2a7d2af 100644 --- a/user.js +++ b/user.js @@ -231,15 +231,7 @@ user_pref("network.captive-portal-service.enabled", false); // [FF52+] * [1] https://bugzilla.mozilla.org/1460537 ***/ user_pref("network.connectivity-service.enabled", false); -/*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING (SB) ***/ -user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); -/** BLOCKLISTS ***/ -/* 0401: enforce Firefox blocklist - * [NOTE] It includes updates for "revoked certificates" - * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/ -user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] - -/** SAFE BROWSING (SB) +/*** [SECTION 0400]: SAFE BROWSING (SB) Safe Browsing has taken many steps to preserve privacy. If required, a full url is never sent to Google, only a PART-hash of the prefix, and this is hidden with noise of other real PART-hashes. Google also swear it is anonymized and only used to flag malicious sites. @@ -250,6 +242,7 @@ user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] [2] https://wiki.mozilla.org/Security/Safe_Browsing [3] https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work ***/ +user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); /* 0410: disable SB (Safe Browsing) * [WARNING] Do this at your own risk! These are the master switches * [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content ***/ @@ -661,9 +654,6 @@ user_pref("security.remote_settings.crlite_filters.enabled", true); user_pref("security.pki.crlite_mode", 2); /** MIXED CONTENT ***/ -/* 1240: enforce no insecure active content on https pages - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/ -user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true] /* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/ user_pref("security.mixed_content.block_display_content", true); /* 1244: enable HTTPS-Only mode in all windows [FF76+] @@ -725,13 +715,10 @@ user_pref("gfx.font_rendering.graphite.enabled", false); // user_pref("gfx.downloadable_fonts.fallback_delay", -1); /*** [SECTION 1600]: HEADERS / REFERERS - Only **cross domain** referers need controlling: leave 1601, 1602, 1605 and 1606 alone - Expect some breakage: Use an extension if you need precise control - --- + Expect some breakage e.g. banks: use an extension if you need precise control full URI: https://example.com:8888/foo/bar.html?id=1234 scheme+host+port+path: https://example.com:8888/foo/bar.html scheme+host+port: https://example.com:8888 - --- [1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ ***/ user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); @@ -741,17 +728,13 @@ user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); /* 1602: ALL: control the amount of information to send * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ // user_pref("network.http.referer.trimmingPolicy", 0); -/* 1603: CROSS ORIGIN: control when to send a referer +/* 1603: control when to send a cross origin referer * 0=always (default), 1=only if base domains match, 2=only if hosts match * [SETUP-WEB] Known to cause issues with older modems/routers and some sites e.g vimeo, icloud, instagram ***/ user_pref("network.http.referer.XOriginPolicy", 2); -/* 1604: CROSS ORIGIN: control the amount of information to send [FF52+] +/* 1604: control the amount of cross origin information to send [FF52+] * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); -/* 1605: ALL: enforce no spoofing of referer - * Spoofing effectively disables the anti-CSRF (Cross-Site Request Forgery) - * protections that some sites may rely on ***/ -user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] /* 1606: ALL: set the default Referrer Policy [FF59+] * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade * [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy @@ -1059,15 +1042,6 @@ user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ // user_pref("extensions.webextensions.restrictedDomains", ""); -/** SECURITY ***/ -/* 2680: enforce CSP (Content Security Policy) - * [NOTE] CSP is a very important and widespread security feature. Don't disable it! - * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/ -user_pref("security.csp.enable", true); // [DEFAULT: true] -/* 2684: enforce a security delay on some confirmation dialogs such as install, open/save - * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ -user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] - /*** [SECTION 2700]: PERSISTENT STORAGE Data SET by websites including cookies : profile\cookies.sqlite @@ -1327,6 +1301,27 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] * [1] https://bugzilla.mozilla.org/1448423 ***/ user_pref("browser.startup.blankWindow", false); +/*** [SECTION 5000]: OPTIONAL OPSEC ***/ +user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow"); + +/*** [SECTION 6000]: DON'T TOUCH ***/ +user_pref("_user.js.parrot", "6000 syntax error: the parrot's 'istory!"); +/* 6001: enforce Firefox blocklist + * [WHY] It includes updates for "revoked certificates" + * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/ +user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] +/* 6002: enforce no referer spoofing + * [WHY] Spoofing can affect CSRF (Cross-Site Request Forgery) protections ***/ +user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] +/* 6003: enforce CSP (Content Security Policy) + * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/ +user_pref("security.csp.enable", true); // [DEFAULT: true] +/* 6004: enforce a security delay on some confirmation dialogs such as install, open/save + * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ +user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] +/* 6005: enforce no insecure active content on https pages ***/ +user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true] + /*** [SECTION 7000]: DON'T BOTHER ***/ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); /* 7001: disable APIs