diff --git a/.github/ISSUE_TEMPLATE/troubleshooting-help.md b/.github/ISSUE_TEMPLATE/troubleshooting-help.md index 955c367..b8c876b 100644 --- a/.github/ISSUE_TEMPLATE/troubleshooting-help.md +++ b/.github/ISSUE_TEMPLATE/troubleshooting-help.md @@ -1,29 +1,31 @@ --- name: Troubleshooting help about: Ask for help to solve problems with user.js -title: '' +title: 'follow instructions or this will be closed as invalid' labels: '' assignees: '' --- -Before you proceed... - - Issues will be closed as invalid if you do not [troubleshoot](https://github.com/arkenfox/user.js/wiki/1.4-Troubleshooting), including - - confirming the problem is caused by the `user.js` - - searching the `[Setup` tags in the `user.js` - - Search the GitHub repository. The information you need is most likely here already. - - Note: We do not support forks + + + +šŸŸ„ https://github.com/arkenfox/user.js/wiki/5.2-Troubleshooting +- [ ] I have read the troubleshooting guide, done the checks and confirmed this is caused by arkenfox + - _unchecked issues ~~may~~ will be closed as invalid_ + +šŸŸŖ REQUIRED INFO + - Browser version & OS: + - Steps to Reproduce (STR): + - Expected result: + - Actual result: + - Console errors and warnings: + - Anything else you deem worth mentioning: + +--- diff --git a/README.md b/README.md index ec755c6..1a27d8a 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ ### šŸŸŖ user.js -A `user.js` is a configuration file that can control hundreds of Firefox settings. For a more technical breakdown and explanation, you can read more on the [overview](https://github.com/arkenfox/user.js/wiki/1.1-Overview) wiki page. +A `user.js` is a configuration file that can control Firefox settings - for a more technical breakdown and explanation, you can read more in the [wiki](https://github.com/arkenfox/user.js/wiki/2.1-User.js) ### šŸŸ© the arkenfox user.js @@ -7,21 +7,20 @@ A `user.js` is a configuration file that can control hundreds of Firefox setting The `arkenfox user.js` is a **template** which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen). -Everyone, experts included, should at least read the [implementation](https://github.com/arkenfox/user.js/wiki/1.3-Implementation) wiki page, as it contains important information regarding a few `user.js` settings. +Everyone, experts included, should at least read the [wiki](https://github.com/arkenfox/user.js/wiki), as it contains important information regarding a few `user.js` settings. There is also an [interactive current release](https://arkenfox.github.io/gui/), thanks to [icpantsparti2](https://github.com/icpantsparti2). -Note that we do *not* recommend connecting over Tor on Firefox. Use the [Tor Browser](https://www.torproject.org/projects/torbrowser.html.en) if your [threat model](https://www.torproject.org/about/torusers.html.en) calls for it, or for accessing hidden services. +Note that we do *not* recommend connecting over Tor on Firefox. Use the [Tor Browser](https://www.torproject.org/projects/torbrowser.html.en) if your [threat model](https://2019.www.torproject.org/about/torusers.html) calls for it, or for accessing hidden services. Also be aware that the `arkenfox user.js` is made specifically for desktop Firefox. Using it as-is in other Gecko-based browsers can be counterproductive, especially in the Tor Browser. ### šŸŸ§ sitemap - - [Releases](https://github.com/arkenfox/user.js/releases) + - [releases](https://github.com/arkenfox/user.js/releases) - [changelogs](https://github.com/arkenfox/user.js/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Achangelog) - - [Wiki](https://github.com/arkenfox/user.js/wiki) + - [wiki](https://github.com/arkenfox/user.js/wiki) - [stickies](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+is%3Aopen+label%3A%22sticky+topic%22) - [diffs](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+label%3Adiffs) + - [common questions and answers](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+label%3Aanswered) ### šŸŸ„ acknowledgments Literally thousands of sources, references and suggestions. Many thanks, and much appreciated. - - diff --git a/prefsCleaner.bat b/prefsCleaner.bat index 616ec28..62ca5f0 100644 --- a/prefsCleaner.bat +++ b/prefsCleaner.bat @@ -3,17 +3,19 @@ TITLE prefs.js cleaner REM ### prefs.js cleaner for Windows REM ## author: @claustromaniac -REM ## version: 2.4 +REM ## version: 2.8 CD /D "%~dp0" +IF /I "%~1"=="-unattended" (SET _ua=1) + :begin ECHO: ECHO: ECHO ######################################## ECHO #### prefs.js cleaner for Windows #### ECHO #### by claustromaniac #### -ECHO #### v2.4 #### +ECHO #### v2.8 #### ECHO ######################################## ECHO: CALL :message "This script should be run from your Firefox profile directory." @@ -22,17 +24,22 @@ CALL :message "This will allow inactive preferences to be reset to their default ECHO This Firefox profile shouldn't be in use during the process. CALL :message "" TIMEOUT 1 /nobreak >nul -CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" -CLS -IF ERRORLEVEL 3 (EXIT /B) -IF ERRORLEVEL 2 (GOTO :showhelp) + +IF NOT DEFINED _ua ( + CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" + CLS + IF ERRORLEVEL 3 (EXIT /B) + IF ERRORLEVEL 2 (GOTO :showhelp) +) IF NOT EXIST "user.js" (CALL :abort "user.js not found in the current directory." 30) IF NOT EXIST "prefs.js" (CALL :abort "prefs.js not found in the current directory." 30) CALL :strlenCheck CALL :FFcheck + CALL :message "Backing up prefs.js..." -SET "_time=%time: =0%" -COPY /B /V /Y prefs.js "prefs-backup-%date:/=-%_%_time::=.%.js" +FOR /F "delims=" %%# IN ('powershell -command get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# +COPY /B /V /Y prefs.js "prefs-backup-%ldt%.js" + CALL :message "Cleaning prefs.js..." CALL :cleanup CALL :message "All done!" diff --git a/prefsCleaner.sh b/prefsCleaner.sh old mode 100644 new mode 100755 index c9d92d9..b9739b2 --- a/prefsCleaner.sh +++ b/prefsCleaner.sh @@ -2,37 +2,83 @@ ## prefs.js cleaner for Linux/Mac ## author: @claustromaniac -## version: 1.3 +## version: 2.1 ## special thanks to @overdodactyl and @earthlng for a few snippets that I stol..*cough* borrowed from the updater.sh -currdir=$(pwd) +## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_prefsCleaner() ) + +readonly CURRDIR=$(pwd) ## get the full path of this script (readlink for Linux, greadlink for Mac with coreutils installed) -sfp=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null) +SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null) ## fallback for Macs without coreutils -if [ -z "$sfp" ]; then sfp=${BASH_SOURCE[0]}; fi +[ -z "$SCRIPT_FILE" ] && SCRIPT_FILE=${BASH_SOURCE[0]} -## change directory to the Firefox profile directory -cd "$(dirname "${sfp}")" + +AUTOUPDATE=true +QUICKSTART=false + +## download method priority: curl -> wget +DOWNLOAD_METHOD='' +if command -v curl >/dev/null; then + DOWNLOAD_METHOD='curl --max-redirs 3 -so' +elif command -v wget >/dev/null; then + DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O' +else + AUTOUPDATE=false + echo -e "No curl or wget detected.\nAutomatic self-update disabled!" +fi fQuit() { ## change directory back to the original working directory - cd "${currdir}" - echo -e "\n$2" + cd "${CURRDIR}" + [ "$1" -eq 0 ] && echo -e "\n$2" || echo -e "\n$2" >&2 exit $1 } +fUsage() { + echo -e "\nUsage: $0 [-ds]" + echo -e " +Optional Arguments: + -s Start immediately + -d Don't auto-update prefsCleaner.sh" +} + +download_file() { # expects URL as argument ($1) + declare -r tf=$(mktemp) + + $DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error +} + fFF_check() { # there are many ways to see if firefox is running or not, some more reliable than others # this isn't elegant and might not be future-proof but should at least be compatible with any environment while [ -e lock ]; do - echo -e "\nThis Firefox profile seems to be in use. Close Firefox and try again.\n" - read -p "Press any key to continue." + echo -e "\nThis Firefox profile seems to be in use. Close Firefox and try again.\n" >&2 + read -r -p "Press any key to continue." done } +## returns the version number of a prefsCleaner.sh file +get_prefsCleaner_version() { + echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")" +} + +## updates the prefsCleaner.sh file based on the latest public version +update_prefsCleaner() { + declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/prefsCleaner.sh')" + [ -z "$tmpfile" ] && echo -e "Error! Could not download prefsCleaner.sh" && return 1 # check if download failed + + [[ $(get_prefsCleaner_version "$SCRIPT_FILE") == $(get_prefsCleaner_version "$tmpfile") ]] && return 0 + + mv "$tmpfile" "$SCRIPT_FILE" + chmod u+x "$SCRIPT_FILE" + "$SCRIPT_FILE" "$@" -d + exit 0 +} + fClean() { # the magic happens here prefs="@@" @@ -41,7 +87,7 @@ fClean() { if [[ "$line" =~ $prefexp && $prefs != *"@@${BASH_REMATCH[1]}@@"* ]]; then prefs="${prefs}${BASH_REMATCH[1]}@@" fi - done <<< "`grep -E \"$prefexp\" user.js`" + done <<< "$(grep -E "$prefexp" user.js)" while IFS='' read -r line || [[ -n "$line" ]]; do if [[ "$line" =~ ^$prefexp ]]; then @@ -54,34 +100,72 @@ fClean() { done < "$1" > prefs.js } +fStart() { + if [ ! -e user.js ]; then + fQuit 1 "user.js not found in the current directory." + elif [ ! -e prefs.js ]; then + fQuit 1 "prefs.js not found in the current directory." + fi + + fFF_check + mkdir -p prefsjs_backups + bakfile="prefsjs_backups/prefs.js.backup.$(date +"%Y-%m-%d_%H%M")" + mv prefs.js "${bakfile}" || fQuit 1 "Operation aborted.\nReason: Could not create backup file $bakfile" + echo -e "\nprefs.js backed up: $bakfile" + echo "Cleaning prefs.js..." + fClean "$bakfile" + fQuit 0 "All done!" +} + + +while getopts "sd" opt; do + case $opt in + s) + QUICKSTART=true + ;; + d) + AUTOUPDATE=false + ;; + esac +done + +## change directory to the Firefox profile directory +cd "$(dirname "${SCRIPT_FILE}")" + +# Check if running as root and if any files have the owner as root/wheel. +if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then + fQuit 1 "You shouldn't run this with elevated privileges (such as with doas/sudo)." +elif [ -n "$(find ./ -user 0)" ]; then + printf 'It looks like this script was previously run with elevated privileges, +you will need to change ownership of the following files to your user:\n' + find . -user 0 + fQuit 1 +fi + +[ "$AUTOUPDATE" = true ] && update_prefsCleaner "$@" + echo -e "\n\n" echo " ā•”ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•—" echo " ā•‘ prefs.js cleaner ā•‘" echo " ā•‘ by claustromaniac ā•‘" -echo " ā•‘ v1.3 ā•‘" +echo " ā•‘ v2.1 ā•‘" echo " ā•šā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•ā•" echo -e "\nThis script should be run from your Firefox profile directory.\n" echo "It will remove any entries from prefs.js that also exist in user.js." echo "This will allow inactive preferences to be reset to their default values." echo -e "\nThis Firefox profile shouldn't be in use during the process.\n" + +[ "$QUICKSTART" = true ] && fStart + +echo -e "\nIn order to proceed, select a command below by entering its corresponding number.\n" + select option in Start Help Exit; do case $option in Start) - if [ ! -e user.js ]; then - fQuit 1 "user.js not found in the current directory." - elif [ ! -e prefs.js ]; then - fQuit 1 "prefs.js not found in the current directory." - fi - - fFF_check - bakfile="prefs.js.backup.$(date +"%Y-%m-%d_%H%M")" - mv prefs.js "${bakfile}" || fQuit 1 "Operation aborted.\nReason: Could not create backup file $bakfile" - echo -e "\nprefs.js backed up: $bakfile" - echo "Cleaning prefs.js..." - fClean "$bakfile" - fQuit 0 "All done!" + fStart ;; Help) + fUsage echo -e "\nThis script creates a backup of your prefs.js file before doing anything." echo -e "It should be safe, but you can follow these steps if something goes wrong:\n" echo "1. Make sure Firefox is closed." @@ -97,3 +181,5 @@ select option in Start Help Exit; do ;; esac done + +fQuit 0 diff --git a/scratchpad-scripts/arkenfox-cleanup.js b/scratchpad-scripts/arkenfox-cleanup.js new file mode 100644 index 0000000..3434fc7 --- /dev/null +++ b/scratchpad-scripts/arkenfox-cleanup.js @@ -0,0 +1,166 @@ +/*** + This will reset the preferences that since FF91 have been + - removed from the arkenfox user.js + - deprecated by Mozilla but listed in the arkenfox user.js in the past + + There is an archived version at https://github.com/arkenfox/user.js/issues/123 + if you want the full list since jesus + + Last updated: 21-April-2025 + + Instructions: + - [optional] close Firefox and backup your profile + - [optional] disable your network connection [1] + - start Firefox + - load about:config and press Ctrl+Shift+K to open the Web Console for about:config + - using about:config is important, so the script has the right permissions + - paste this script + - if you edited the list of prefs in the script, make sure the last pref does not have a trailing comma + - hit enter + - check the Info output to see which prefs were reset + - restart + - some prefs require a restart + - a restart will reapply your user.js + - [optional] re-enable your network connection + + [1] Blocking Firefox from the internet ensures it cannot act on your reset preferences in the + period before you restart it, such as app and extension auto-updating, or downloading unwanted + components (GMP etc). It depends on what you're resetting and how long before you restart. + +***/ + +(() => { + + if ('undefined' === typeof(Services)) return alert('about:config needs to be the active tab!'); + + const aPREFS = [ + /* DEPRECATED */ + /* 129-140 */ + 'media.ondevicechange.enabled', // 137 + 'webchannel.allowObject.urlWhitelist', // 132 + /* 116-128 */ + 'browser.contentanalysis.default_allow', // 127 + 'browser.messaging-system.whatsNewPanel.enabled', // 126 + 'browser.ping-centre.telemetry', // 123 + 'dom.webnotifications.serviceworker.enabled', // 117 + 'javascript.use_us_english_locale', // 119 + 'layout.css.font-visibility.private', // 118 + 'layout.css.font-visibility.resistFingerprinting', // 116 + 'layout.css.font-visibility.standard', // 118 + 'layout.css.font-visibility.trackingprotection', // 118 + 'network.dns.skipTRR-when-parental-control-enabled', // 119 + 'permissions.delegation.enabled', // 118 + 'security.family_safety.mode', // 117 + 'widget.non-native-theme.enabled', // 127 + /* 103-115 */ + 'browser.cache.offline.enable', // 115 + 'extensions.formautofill.heuristics.enabled', // 114 + 'network.cookie.lifetimePolicy', // 103 [technically removed in 104] + 'privacy.clearsitedata.cache.enabled', // 114 + 'privacy.resistFingerprinting.testGranularityMask', // 114 + 'security.pki.sha1_enforcement_level', // 103 + /* 92-102 */ + 'browser.urlbar.suggest.quicksuggest', // 95 + 'dom.securecontext.whitelist_onions', // 97 + 'dom.storage.next_gen', // 102 + 'network.http.spdy.enabled', // 100 + 'network.http.spdy.enabled.deps', + 'network.http.spdy.enabled.http2', + 'network.http.spdy.websockets', + 'layout.css.font-visibility.level', // 94 + 'security.ask_for_password', // 102 + 'security.csp.enable', // 99 + 'security.password_lifetime', // 102 + 'security.ssl3.rsa_des_ede3_sha', // 93 + + /* REMOVED */ + /* 129-140 */ + 'dom.securecontext.allowlist_onions', + 'network.http.referer.hideOnionSource', + 'privacy.clearOnShutdown.cache', + 'privacy.clearOnShutdown.cookies', + 'privacy.clearOnShutdown.downloads', + 'privacy.clearOnShutdown.formdata', + 'privacy.clearOnShutdown.history', + 'privacy.clearOnShutdown.offlineApps', + 'privacy.clearOnShutdown.sessions', + 'privacy.cpd.cache', + 'privacy.cpd.cookies', + 'privacy.cpd.formdata', + 'privacy.cpd.history', + 'privacy.cpd.offlineApps', + 'privacy.cpd.sessions', + /* 116-128 */ + 'browser.fixup.alternate.enabled', + 'browser.taskbar.previews.enable', + 'browser.urlbar.dnsResolveSingleWordsAfterSearch', + 'geo.provider.network.url', + 'geo.provider.network.logging.enabled', + 'geo.provider.use_gpsd', + 'media.gmp-widevinecdm.enabled', + 'network.protocol-handler.external.ms-windows-store', + 'privacy.partition.always_partition_third_party_non_cookie_storage', + 'privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage', + 'privacy.partition.serviceWorkers', + /* 103-115 */ + 'beacon.enabled', + 'browser.startup.blankWindow', + 'browser.newtab.preload', + 'browser.newtabpage.activity-stream.feeds.discoverystreamfeed', + 'browser.newtabpage.activity-stream.feeds.snippets', + 'browser.region.network.url', + 'browser.region.update.enabled', + 'browser.search.region', + 'browser.ssl_override_behavior', + 'browser.tabs.warnOnClose', + 'devtools.chrome.enabled', + 'dom.disable_beforeunload', + 'dom.disable_open_during_load', + 'dom.netinfo.enabled', + 'dom.vr.enabled', + 'extensions.formautofill.addresses.supported', + 'extensions.formautofill.available', + 'extensions.formautofill.creditCards.available', + 'extensions.formautofill.creditCards.supported', + 'middlemouse.contentLoadURL', + 'network.http.altsvc.oe', + /* 92-102 */ + 'browser.urlbar.trimURLs', + 'dom.caches.enabled', + 'dom.storageManager.enabled', + 'dom.storage_access.enabled', + 'dom.targetBlankNoOpener.enabled', + 'network.cookie.thirdparty.sessionOnly', + 'network.cookie.thirdparty.nonsecureSessionOnly', + 'privacy.firstparty.isolate.block_post_message', + 'privacy.firstparty.isolate.restrict_opener_access', + 'privacy.firstparty.isolate.use_site', + 'privacy.window.name.update.enabled', + 'security.insecure_connection_text.enabled', + + /* IMPORTANT: last active pref must not have a trailing comma */ + /* reset parrot: check your open about:config after running the script */ + '_user.js.parrot' + ]; + + console.clear(); + + let c = 0; + for (const sPname of aPREFS) { + if (Services.prefs.prefHasUserValue(sPname)) { + Services.prefs.clearUserPref(sPname); + if (!Services.prefs.prefHasUserValue(sPname)) { + console.info('reset', sPname); + c++; + } else console.warn('failed to reset', sPname); + } + } + + focus(); + + const d = (c==1) ? ' pref' : ' prefs'; + alert(c ? 'successfully reset ' + c + d + "\n\nfor details check the console" : 'nothing to reset'); + + return 'all done'; + +})(); diff --git a/scratchpad-scripts/arkenfox-clear-RFP-alternatives.js b/scratchpad-scripts/arkenfox-clear-RFP-alternatives.js deleted file mode 100644 index 4be4b81..0000000 --- a/scratchpad-scripts/arkenfox-clear-RFP-alternatives.js +++ /dev/null @@ -1,65 +0,0 @@ -/*** - Version: up to and including FF/ESR78 - - This will reset the preferences that are under sections 4600 & 4700 in the - arkenfox user.js. These are the prefs that are no longer necessary, or they - conflict with, privacy.resistFingerprinting if you have that enabled. - - For instructions see: - https://github.com/arkenfox/user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] -***/ - -(function() { - let ops = [ - /* section 4600 */ - 'dom.maxHardwareConcurrency', - 'dom.enable_resource_timing', - 'dom.enable_performance', - 'device.sensors.enabled', - 'browser.zoom.siteSpecific', - 'dom.gamepad.enabled', - 'dom.netinfo.enabled', - 'media.webspeech.synth.enabled', - 'media.video_stats.enabled', - 'dom.w3c_touch_events.enabled', - 'media.ondevicechange.enabled', - 'webgl.enable-debug-renderer-info', - 'dom.w3c_pointer_events.enabled', - 'ui.use_standins_for_native_colors', - 'ui.systemUsesDarkTheme', - 'ui.prefersReducedMotion', - /* section 4700 */ - 'general.useragent.override', - 'general.buildID.override', - 'general.appname.override', - 'general.appversion.override', - 'general.platform.override', - 'general.oscpu.override', - /* reset parrot: check your open about:config after running the script */ - '_user.js.parrot' - ] - - if("undefined" === typeof(Services)) { - alert("about:config needs to be the active tab!"); - return; - } - - let c = 0; - for (let i = 0, len = ops.length; i < len; i++) { - if (Services.prefs.prefHasUserValue(ops[i])) { - Services.prefs.clearUserPref(ops[i]); - if (!Services.prefs.prefHasUserValue(ops[i])) { - console.log("reset", ops[i]); - c++; - } else { console.log("failed to reset", ops[i]); } - } - } - - focus(); - - let d = (c==1) ? " pref" : " prefs"; - if (c > 0) { - alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); - } else { alert("nothing to reset"); } - -})(); diff --git a/scratchpad-scripts/arkenfox-clear-deprecated.js b/scratchpad-scripts/arkenfox-clear-deprecated.js deleted file mode 100644 index 766dd33..0000000 --- a/scratchpad-scripts/arkenfox-clear-deprecated.js +++ /dev/null @@ -1,248 +0,0 @@ -/*** - Version: up to and including FF/ESR78 - - This will reset the preferences that have been deprecated by Mozilla - and used in the arkenfox user.js - - It is in reverse order, so feel free to remove sections that do not apply - - For instructions see: - https://github.com/arkenfox/user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] -***/ - -(function() { - let ops = [ - /* deprecated */ - - /* 78 */ - 'media.autoplay.enabled.user-gestures-needed', - 'toolkit.cosmeticAnimations.enabled', - /* 77 */ - 'browser.urlbar.oneOffSearches', - 'browser.tabs.remote.allowLinkedWebInFileUriProcess', - /* 76 */ - 'extensions.blocklist.url', - /* 74 */ - 'geo.wifi.uri', - 'geo.wifi.logging.enabled', - 'privacy.userContext.longPressBehavior', - 'webgl.disable-extensions', - /* 72 */ - 'browser.newtabpage.activity-stream.telemetry.ping.endpoint', - 'toolkit.telemetry.hybridContent.enabled', - 'dom.indexedDB.enabled', - /* 71 */ - 'devtools.webide.enabled', - 'devtools.webide.autoinstallADBExtension', - 'offline-apps.allow_by_default', - /* 69 */ - 'gfx.downloadable_fonts.woff2.enabled', - 'plugins.click_to_play', - 'media.autoplay.allow-muted', - /* 68 */ - 'browser.newtabpage.activity-stream.disableSnippets', - 'browser.aboutHomeSnippets.updateUrl', - 'lightweightThemes.update.enabled', - 'security.csp.experimentalEnabled', - /* F67 */ - 'dom.event.highrestimestamp.enabled', - 'browser.newtabpage.activity-stream.asrouter.userprefs.cfr', - /* 66 */ - 'browser.chrome.errorReporter.enabled', - 'browser.chrome.errorReporter.submitUrl', - 'network.allow-experiments', - /* 65 */ - 'browser.urlbar.autocomplete.enabled', - 'browser.fixup.hide_user_pass', - /* 64 */ - 'browser.onboarding.enabled', - 'devtools.webide.autoinstallADBHelper', - 'devtools.webide.adbAddonURL', - 'security.csp.enable_violation_events', - /* 63 */ - 'browser.search.countryCode', - 'app.update.enabled', - 'shield.savant.enabled', - 'browser.chrome.favicons', - 'media.autoplay.enabled', - 'network.cookie.lifetime.days', - 'browser.ctrlTab.previews', - /* 62 */ - 'plugin.state.java', - /* 61 */ - 'experiments.enabled', - 'experiments.manifest.uri', - 'experiments.supported', - 'experiments.activeExperiment', - 'network.jar.block-remote-files', - 'network.jar.open-unsafe-types', - /* 60 */ - 'browser.newtabpage.directory.source', - 'browser.newtabpage.enhanced', - 'browser.newtabpage.introShown', - 'extensions.shield-recipe-client.enabled', - 'extensions.shield-recipe-client.api_url', - 'browser.newtabpage.activity-stream.enabled', - 'dom.workers.enabled', - /* 59 */ - 'intl.locale.matchOS', - 'general.useragent.locale', - 'datareporting.healthreport.about.reportUrl', - 'dom.flyweb.enabled', - 'security.mixed_content.use_hsts', - 'security.mixed_content.send_hsts_priming', - 'network.http.referer.userControlPolicy', - 'security.xpconnect.plugin.unrestricted', - 'media.getusermedia.screensharing.allowed_domains', - 'camera.control.face_detection.enabled', - 'dom.disable_window_status_change', - 'dom.idle-observers-api.enabled', - /* 58 */ - 'browser.crashReports.unsubmittedCheck.autoSubmit', - /* 57 */ - 'social.whitelist', - 'social.toast-notifications.enabled', - 'social.shareDirectory', - 'social.remote-install.enabled', - 'social.directories', - 'social.share.activationPanelEnabled', - 'social.enabled', - 'media.eme.chromium-api.enabled', - 'devtools.webide.autoinstallFxdtAdapters', - 'browser.casting.enabled', - 'browser.bookmarks.showRecentlyBookmarked', - /* 56 */ - 'extensions.screenshots.system-disabled', - 'extensions.formautofill.experimental', - /* 55 */ - 'geo.security.allowinsecure', - 'browser.selfsupport.enabled', - 'browser.selfsupport.url', - 'browser.newtabpage.directory.ping', - 'browser.formfill.saveHttpsForms', - 'browser.formautofill.enabled', - 'dom.enable_user_timing', - 'dom.keyboardevent.code.enabled', - 'browser.tabs.animate', - 'browser.fullscreen.animate', - /* 54 */ - 'browser.safebrowsing.reportMalwareMistakeURL', - 'browser.safebrowsing.reportPhishMistakeURL', - 'media.eme.apiVisible', - 'dom.archivereader.enabled', - /* 53 */ - 'security.tls.unrestricted_rc4_fallback', - 'plugin.scan.Acrobat', - 'plugin.scan.Quicktime', - 'plugin.scan.WindowsMediaPlayer', - 'media.getusermedia.screensharing.allow_on_old_platforms', - 'dom.beforeAfterKeyboardEvent.enabled', - /* 52 */ - 'network.http.sendSecureXSiteReferrer', - 'media.gmp-eme-adobe.enabled', - 'media.gmp-eme-adobe.visible', - 'media.gmp-eme-adobe.autoupdate', - 'dom.telephony.enabled', - 'dom.battery.enabled', - /* 51 */ - 'media.block-play-until-visible', - 'dom.vr.oculus050.enabled', - 'network.http.spdy.enabled.v3-1', - /* 50 */ - 'browser.usedOnWindows10.introURL', - 'plugins.update.notifyUser', - 'browser.safebrowsing.enabled', - 'security.ssl3.ecdhe_ecdsa_rc4_128_sha', - 'security.ssl3.ecdhe_rsa_rc4_128_sha', - 'security.ssl3.rsa_rc4_128_md5', - 'security.ssl3.rsa_rc4_128_sha', - 'plugins.update.url', - /* 49 */ - 'loop.enabled', - 'loop.server', - 'loop.feedback.formURL', - 'loop.feedback.manualFormURL', - 'loop.facebook.appId', - 'loop.facebook.enabled', - 'loop.facebook.fallbackUrl', - 'loop.facebook.shareUrl', - 'loop.logDomains', - 'dom.disable_window_open_feature.scrollbars', - 'dom.push.udp.wakeupEnabled', - /* 48 */ - 'browser.urlbar.unifiedcomplete', - /* 47 */ - 'toolkit.telemetry.unifiedIsOptIn', - 'datareporting.healthreport.about.reportUrlUnified', - 'browser.history.allowPopState', - 'browser.history.allowPushState', - 'browser.history.allowReplaceState', - /* 46 */ - 'datareporting.healthreport.service.enabled', - 'datareporting.healthreport.documentServerURI', - 'datareporting.policy.dataSubmissionEnabled.v2', - 'browser.safebrowsing.appRepURL', - 'browser.polaris.enabled', - 'browser.pocket.enabled', - 'browser.pocket.api', - 'browser.pocket.site', - 'browser.pocket.oAuthConsumerKey', - /* 45 */ - 'browser.sessionstore.privacy_level_deferred', - /* 44 */ - 'browser.safebrowsing.provider.google.appRepURL', - 'security.tls.insecure_fallback_hosts.use_static_list', - 'dom.workers.sharedWorkers.enabled', - 'dom.disable_image_src_set', - /* 43 */ - 'browser.safebrowsing.gethashURL', - 'browser.safebrowsing.updateURL', - 'browser.safebrowsing.malware.reportURL', - 'browser.trackingprotection.gethashURL', - 'browser.trackingprotection.updateURL', - 'pfs.datasource.url', - 'browser.search.showOneOffButtons', - /* 42 and earlier */ - 'privacy.clearOnShutdown.passwords', // 42 - 'full-screen-api.approval-required', // 42 - 'browser.safebrowsing.reportErrorURL', // 41 - 'browser.safebrowsing.reportGenericURL', // 41 - 'browser.safebrowsing.reportMalwareErrorURL', // 41 - 'browser.safebrowsing.reportMalwareURL', // 41 - 'browser.safebrowsing.reportURL', // 41 - 'plugins.enumerable_names', // 41 - 'network.http.spdy.enabled.http2draft', // 41 - 'camera.control.autofocus_moving_callback.enabled', // 37 - 'privacy.donottrackheader.value', // 36 - 'network.websocket.enabled', // 35 - 'dom.network.enabled', // 31 - 'pageThumbs.enabled', // 25 - - /* reset parrot: check your open about:config after running the script */ - '_user.js.parrot' - ] - - if("undefined" === typeof(Services)) { - alert("about:config needs to be the active tab!"); - return; - } - - let c = 0; - for (let i = 0, len = ops.length; i < len; i++) { - if (Services.prefs.prefHasUserValue(ops[i])) { - Services.prefs.clearUserPref(ops[i]); - if (!Services.prefs.prefHasUserValue(ops[i])) { - console.log("reset", ops[i]); - c++; - } else { console.log("failed to reset", ops[i]); } - } - } - - focus(); - - let d = (c==1) ? " pref" : " prefs"; - if (c > 0) { - alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); - } else { alert("nothing to reset"); } - -})(); diff --git a/scratchpad-scripts/arkenfox-clear-removed.js b/scratchpad-scripts/arkenfox-clear-removed.js deleted file mode 100644 index 74cd070..0000000 --- a/scratchpad-scripts/arkenfox-clear-removed.js +++ /dev/null @@ -1,268 +0,0 @@ -/*** - This will reset the preferences that have been removed completely from the arkenfox user.js. - - Last updated: 07-Apr-2021 - - For instructions see: - https://github.com/arkenfox/user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] -***/ - -(function() { - let ops = [ - /* removed in arkenfox user.js */ - /* 52-alpha */ - 'browser.search.reset.enabled', - 'browser.search.reset.whitelist', - /* 54-alpha */ - 'browser.migrate.automigrate.enabled', - 'services.sync.enabled', - 'webextensions.storage.sync.enabled', - 'webextensions.storage.sync.serverURL', - /* 55-alpha */ - 'dom.keyboardevent.dispatch_during_composition', // default is false anyway - 'dom.vr.oculus.enabled', // covered by dom.vr.enabled - 'dom.vr.openvr.enabled', // ditto - 'dom.vr.osvr.enabled', // ditto - 'extensions.pocket.api', // covered by extensions.pocket.enabled - 'extensions.pocket.oAuthConsumerKey', // ditto - 'extensions.pocket.site', // ditto - /* 57-alpha */ - 'geo.wifi.xhr.timeout', // covered by geo.enabled - 'browser.search.geoip.timeout', // ditto - 'media.webspeech.recognition.enable', // default is false anyway - 'gfx.layerscope.enabled', // default is false anyway - /* 58-alpha */ - // excluding these e10 settings - // 'browser.tabs.remote.autostart', - // 'browser.tabs.remote.autostart.2', - // 'browser.tabs.remote.force-enable', - // 'browser.tabs.remote.separateFileUriProcess', - // 'extensions.e10sBlocksEnabling', - // 'extensions.webextensions.remote', - // 'dom.ipc.processCount', - // 'dom.ipc.shims.enabledWarnings', - // 'dom.ipc.processCount.extension', - // 'dom.ipc.processCount.file', - // 'security.sandbox.content.level', - // 'dom.ipc.plugins.sandbox-level.default', - // 'dom.ipc.plugins.sandbox-level.flash', - // 'security.sandbox.logging.enabled', - 'dom.presentation.controller.enabled', - 'dom.presentation.discoverable', - 'dom.presentation.discovery.enabled', - 'dom.presentation.enabled', - 'dom.presentation.receiver.enabled', - 'dom.presentation.session_transport.data_channel.enable', - /* 59-alpha */ - 'browser.stopReloadAnimation.enabled', - 'browser.tabs.insertRelatedAfterCurrent', - 'browser.tabs.loadDivertedInBackground', - 'browser.tabs.loadInBackground', - 'browser.tabs.selectOwnerOnClose', - 'browser.urlbar.clickSelectsAll', - 'browser.urlbar.doubleClickSelectsAll', - 'media.flac.enabled', - 'media.mediasource.enabled', - 'media.mediasource.mp4.enabled', - 'media.mediasource.webm.audio.enabled', - 'media.mediasource.webm.enabled', - 'media.mp4.enabled', - 'media.ogg.enabled', - 'media.ogg.flac.enabled', - 'media.opus.enabled', - 'media.raw.enabled', - 'media.wave.enabled', - 'media.webm.enabled', - 'media.wmf.amd.vp9.enabled', - 'media.wmf.enabled', - 'media.wmf.vp9.enabled', - 'ui.submenuDelay', - /* 60-beta - these were all at default anyway */ - 'device.storage.enabled', - 'general.useragent.compatMode.firefox', - 'network.dns.blockDotOnion', - 'network.stricttransportsecurity.preloadlist', - 'security.block_script_with_wrong_mime', - 'security.fileuri.strict_origin_policy', - 'security.sri.enable', - /* 61-beta */ - 'browser.laterrun.enabled', - 'browser.offline-apps.notify', - 'browser.rights.3.shown', - 'browser.slowStartup.maxSamples', - 'browser.slowStartup.notificationDisabled', - 'browser.slowStartup.samples', - 'browser.storageManager.enabled', - 'dom.allow_scripts_to_close_windows', - 'dom.disable_window_flip', - 'network.http.fast-fallback-to-IPv4', - 'offline-apps.quota.warn', - 'services.blocklist.signing.enforced', - /* 62-beta */ - 'browser.urlbar.autoFill.typed', - 'security.tls.version.fallback-limit', - /* 63-beta */ - 'extensions.webextensions.keepStorageOnUninstall', - 'extensions.webextensions.keepUuidOnUninstall', - 'privacy.trackingprotection.ui.enabled', - /* 64-beta */ - 'browser.eme.ui.enabled', - 'browser.sessionstore.max_windows_undo', - 'network.auth.subresource-img-cross-origin-http-auth-allow', - 'media.peerconnection.ice.tcp', - 'media.peerconnection.identity.enabled', - 'media.peerconnection.identity.timeout', - 'media.peerconnection.turn.disable', - 'media.peerconnection.use_document_iceservers', - 'media.peerconnection.video.enabled', - 'media.navigator.video.enabled', - /* 65-beta */ - 'browser.contentblocking.enabled', - 'browser.urlbar.maxHistoricalSearchSuggestions', - /* 67-beta */ - 'app.update.service.enabled', - 'app.update.silent', - 'app.update.staging.enabled', - 'browser.cache.disk.capacity', - 'browser.cache.disk.smart_size.enabled', - 'browser.cache.disk.smart_size.first_run', - 'browser.cache.offline.insecure.enable', - 'browser.safebrowsing.downloads.remote.url', - 'browser.safebrowsing.provider.google.reportMalwareMistakeURL', - 'browser.safebrowsing.provider.google.reportPhishMistakeURL', - 'browser.safebrowsing.provider.google.reportURL', - 'browser.safebrowsing.provider.google4.dataSharing.enabled', - 'browser.safebrowsing.provider.google4.dataSharingURL', - 'browser.safebrowsing.provider.google4.reportMalwareMistakeURL', - 'browser.safebrowsing.provider.google4.reportPhishMistakeURL', - 'browser.safebrowsing.provider.google4.reportURL', - 'browser.safebrowsing.reportPhishURL', - 'browser.sessionhistory.max_total_viewers', - 'browser.urlbar.filter.javascript', - 'canvas.capturestream.enabled', - 'dom.imagecapture.enabled', - 'dom.popup_maximum', - 'gfx.offscreencanvas.enabled', - 'javascript.options.shared_memory', - 'media.gmp-gmpopenh264.autoupdate', - 'media.gmp-gmpopenh264.enabled', - 'media.gmp-manager.updateEnabled', - 'media.gmp-manager.url', - 'media.gmp-manager.url.override', - 'media.gmp.trial-create.enabled', - 'media.gmp-widevinecdm.autoupdate', - 'network.cookie.leave-secure-alone', - 'network.cookie.same-site.enabled', - 'network.dnsCacheEntries', - 'network.dnsCacheExpiration', - 'network.proxy.autoconfig_url.include_path', - 'pdfjs.enableWebGL', - 'plugin.default.state', - 'plugin.defaultXpi.state', - 'plugin.scan.plid.all', - 'security.data_uri.block_toplevel_data_uri_navigations', - 'security.insecure_field_warning.contextual.enabled', - 'security.insecure_password.ui.enabled', - 'signon.autofillForms.http', - 'signon.storeWhenAutocompleteOff', - 'xpinstall.whitelist.required', - /* 67-beta: Blocklist, SB & TP cleanup: these were all inactive */ - 'browser.safebrowsing.downloads.remote.block_dangerous', - 'browser.safebrowsing.downloads.remote.block_dangerous_host', - 'browser.safebrowsing.blockedURIs.enabled', - 'browser.safebrowsing.provider.google.gethashURL', - 'browser.safebrowsing.provider.google.updateURL', - 'browser.safebrowsing.provider.google4.gethashURL', - 'browser.safebrowsing.provider.google4.updateURL', - 'browser.safebrowsing.provider.mozilla.gethashURL', - 'browser.safebrowsing.provider.mozilla.updateURL', - 'browser.urlbar.userMadeSearchSuggestionsChoice', - 'privacy.trackingprotection.annotate_channels', - 'privacy.trackingprotection.enabled', - 'privacy.trackingprotection.lower_network_priority', - 'privacy.trackingprotection.pbmode.enabled', - 'services.blocklist.addons.collection', - 'services.blocklist.gfx.collection', - 'services.blocklist.onecrl.collection', - 'services.blocklist.plugins.collection', - 'services.blocklist.update_enabled', - 'urlclassifier.trackingTable', - /* 68-beta */ - 'dom.forms.datetime', - 'font.blacklist.underline_offset', - 'font.name.monospace.x-unicode', - 'font.name.monospace.x-western', - 'font.name.sans-serif.x-unicode', - 'font.name.sans-serif.x-western', - 'font.name.serif.x-unicode', - 'font.name.serif.x-western', - 'layout.css.font-loading-api.enabled', - 'toolkit.telemetry.cachedClientID', - /* 69-beta */ - 'plugin.sessionPermissionNow.intervalInMinutes', - /* 70-beta */ - 'browser.cache.disk_cache_ssl', - 'browser.sessionhistory.max_entries', - 'dom.push.connection.enabled', - 'dom.push.serverURL', - 'extensions.getAddons.discovery.api_url', - 'extensions.htmlaboutaddons.discover.enabled', - 'extensions.webservice.discoverURL', - 'intl.locale.requested', - 'intl.regional_prefs.use_os_locales', - 'privacy.usercontext.about_newtab_segregation.enabled', - 'security.insecure_connection_icon.pbmode.enabled', - 'security.insecure_connection_text.pbmode.enabled', - 'webgl.dxgl.enabled', - /* 71-beta */ - 'media.block-autoplay-until-in-foreground', - 'middlemouse.paste', - /* 75-beta */ - 'browser.search.geoip.url', - 'browser.search.region', - /* 79-beta */ - 'browser.urlbar.usepreloadedtopurls.enabled', - /* 82-beta */ - 'dom.IntersectionObserver.enabled', - 'extensions.screenshots.upload-disabled', - 'privacy.partition.network_state', - 'security.ssl3.dhe_rsa_aes_128_sha', - 'security.ssl3.dhe_rsa_aes_256_sha', - /* 84-beta */ - 'browser.newtabpage.activity-stream.asrouter.providers.snippets', - /* 85-beta */ - 'network.http.redirection-limit', - /* 86-beta */ - 'media.gmp-widevinecdm.visible', - /* 87-beta */ - 'browser.send_pings.require_same_host', - /* 88-beta */ - 'webgl.min_capability_mode', - /* reset parrot: check your open about:config after running the script */ - '_user.js.parrot' - ] - - if("undefined" === typeof(Services)) { - alert("about:config needs to be the active tab!"); - return; - } - - let c = 0; - for (let i = 0, len = ops.length; i < len; i++) { - if (Services.prefs.prefHasUserValue(ops[i])) { - Services.prefs.clearUserPref(ops[i]); - if (!Services.prefs.prefHasUserValue(ops[i])) { - console.log("reset", ops[i]); - c++; - } else { console.log("failed to reset", ops[i]); } - } - } - - focus(); - - let d = (c==1) ? " pref" : " prefs"; - if (c > 0) { - alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); - } else { alert("nothing to reset"); } - -})(); diff --git a/scratchpad-scripts/troubleshooter.js b/scratchpad-scripts/troubleshooter.js index be64708..bd86786 100644 --- a/scratchpad-scripts/troubleshooter.js +++ b/scratchpad-scripts/troubleshooter.js @@ -1,4 +1,3 @@ - /*** arkenfox user.js troubleshooter.js v1.6.3 ***/ (function() { @@ -194,7 +193,7 @@ const aBAK = getMyList(aPREFS); //console.log(aBAK.length, "user-set prefs from our list detected and their values stored."); - + const sMsg = "all detected prefs reset.\n\n" + "!! KEEP THIS PROMPT OPEN AND TEST THE SITE IN ANOTHER TAB !!\n\n" + "IF the problem still exists, this script can't help you - click Cancel to re-apply your values and exit.\n\n" + diff --git a/updater.bat b/updater.bat index a806ca6..bc1078a 100644 --- a/updater.bat +++ b/updater.bat @@ -3,10 +3,10 @@ TITLE arkenfox user.js updater REM ## arkenfox user.js updater for Windows REM ## author: @claustromaniac -REM ## version: 4.14 -REM ## instructions: https://github.com/arkenfox/user.js/wiki/3.3-Updater-Scripts +REM ## version: 4.20 +REM ## instructions: https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-windows -SET v=4.14 +SET v=4.19 VERIFY ON CD /D "%~dp0" @@ -23,7 +23,6 @@ IF /I "%~1"=="-merge" (SET _merge=1) IF /I "%~1"=="-updatebatch" (SET _updateb=1) IF /I "%~1"=="-singlebackup" (SET _singlebackup=1) IF /I "%~1"=="-esr" (SET _esr=1) -IF /I "%~1"=="-rfpalts" (SET _rfpalts=1) SHIFT GOTO parse :endparse @@ -141,10 +140,6 @@ IF EXIST user.js.new (DEL /F "user.js.new") CALL :message "Retrieving latest user.js file from github repository..." CALL :psdownload https://raw.githubusercontent.com/arkenfox/user.js/master/user.js "user.js.new" IF EXIST user.js.new ( - IF DEFINED _rfpalts ( - CALL :message "Activating RFP Alternatives section..." - CALL :activate user.js.new "[SETUP-non-RFP]" - ) IF DEFINED _esr ( CALL :message "Activating ESR section..." CALL :activate user.js.new ".x still uses all the following prefs" @@ -182,8 +177,8 @@ IF EXIST user.js.new ( IF DEFINED _singlebackup ( MOVE /Y user.js user.js.bak >nul ) ELSE ( - SET "_time=!time: =0!" - MOVE /Y user.js "user-backup-!date:/=-!_!_time::=.!.js" >nul + FOR /F "delims=" %%# IN ('powershell -command get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# + MOVE /Y user.js "user-backup-!ldt!.js" >nul ) REN user.js.new user.js CALL :message "Update complete." @@ -320,8 +315,6 @@ ECHO: Run without user input. CALL :message " -singleBackup" ECHO: Use a single backup file and overwrite it on new updates, instead of ECHO: cumulative backups. This was the default behaviour before v4.3. -CALL :message " -rfpAlts" -ECHO: Activate RFP Alternatives section CALL :message " -updateBatch" ECHO: Update the script itself on execution, before the normal routine. CALL :message "" diff --git a/updater.sh b/updater.sh index e265445..72c77fc 100755 --- a/updater.sh +++ b/updater.sh @@ -2,12 +2,18 @@ ## arkenfox user.js updater for macOS and Linux -## version: 3.0 +## version: 4.0 ## Author: Pat Johnson (@overdodactyl) -## Additional contributors: @earthlng, @ema-pe, @claustromaniac +## Additional contributors: @earthlng, @ema-pe, @claustromaniac, @infinitewarp ## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_updater() ) +# Check if running as root +if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then + printf "You shouldn't run this with elevated privileges (such as with doas/sudo).\n" + exit 1 +fi + readonly CURRDIR=$(pwd) SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null) @@ -41,9 +47,9 @@ ESR=false # Download method priority: curl -> wget DOWNLOAD_METHOD='' -if [[ $(command -v 'curl') ]]; then +if command -v curl >/dev/null; then DOWNLOAD_METHOD='curl --max-redirs 3 -so' -elif [[ $(command -v 'wget') ]]; then +elif command -v wget >/dev/null; then DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O' else echo -e "${RED}This script requires curl or wget.\nProcess aborted${NC}" @@ -51,7 +57,7 @@ else fi -show_banner () { +show_banner() { echo -e "${BBLUE} ############################################################################ #### #### @@ -62,7 +68,7 @@ show_banner () { #### #### ############################################################################" echo -e "${NC}\n" - echo -e "Documentation for this script is available here: ${CYAN}https://github.com/arkenfox/user.js/wiki/3.3-Updater-Scripts${NC}\n" + echo -e "Documentation for this script is available here: ${CYAN}https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-maclinux${NC}\n" } ######################### @@ -103,13 +109,13 @@ Optional Arguments: # File Handling # ######################### -download_file () { # expects URL as argument ($1) +download_file() { # expects URL as argument ($1) declare -r tf=$(mktemp) - $DOWNLOAD_METHOD "${tf}" "$1" && echo "$tf" || echo '' # return the temp-filename or empty string on error + $DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error } -open_file () { # expects one argument: file_path +open_file() { # expects one argument: file_path if [ "$(uname)" == 'Darwin' ]; then open "$1" elif [ "$(uname -s | cut -c -5)" == "Linux" ]; then @@ -119,11 +125,11 @@ open_file () { # expects one argument: file_path fi } -readIniFile () { # expects one argument: absolute path of profiles.ini +readIniFile() { # expects one argument: absolute path of profiles.ini declare -r inifile="$1" # tempIni will contain: [ProfileX], Name=, IsRelative= and Path= (and Default= if present) of the only (if) or the selected (else) profile - if [ $(grep -c '^\[Profile' "${inifile}") -eq "1" ]; then ### only 1 profile found + if [ "$(grep -c '^\[Profile' "${inifile}")" -eq "1" ]; then ### only 1 profile found tempIni="$(grep '^\[Profile' -A 4 "${inifile}")" else echo -e "Profiles found:\nā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“ā€“" @@ -150,7 +156,7 @@ readIniFile () { # expects one argument: absolute path of profiles.ini [[ ${pathisrel} == "1" ]] && PROFILE_PATH="$(dirname "${inifile}")/${PROFILE_PATH}" } -getProfilePath () { +getProfilePath() { declare -r f1=~/Library/Application\ Support/Firefox/profiles.ini declare -r f2=~/.mozilla/firefox/profiles.ini @@ -175,8 +181,8 @@ getProfilePath () { ######################### # Returns the version number of a updater.sh file -get_updater_version () { - echo $(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1") +get_updater_version() { + echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")" } # Update updater.sh @@ -184,21 +190,21 @@ get_updater_version () { # Args: # -d: New version will not be looked for and update will not occur # -u: Check for update, if available, execute without asking -update_updater () { - [ $UPDATE = 'no' ] && return 0 # User signified not to check for updates +update_updater() { + [ "$UPDATE" = 'no' ] && return 0 # User signified not to check for updates declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/updater.sh')" [ -z "${tmpfile}" ] && echo -e "${RED}Error! Could not download updater.sh${NC}" && return 1 # check if download failed if [[ $(get_updater_version "$SCRIPT_FILE") < $(get_updater_version "${tmpfile}") ]]; then - if [ $UPDATE = 'check' ]; then + if [ "$UPDATE" = 'check' ]; then echo -e "There is a newer version of updater.sh available. ${RED}Update and execute Y/N?${NC}" read -p "" -n 1 -r echo -e "\n\n" - [[ $REPLY =~ ^[Nn]$ ]] && return 0 # Update available, but user chooses not to update + [[ $REPLY =~ ^[Yy]$ ]] || return 0 # Update available, but user chooses not to update fi else - return 0 # No update available + return 0 # No update available fi mv "${tmpfile}" "$SCRIPT_FILE" chmod u+x "$SCRIPT_FILE" @@ -211,11 +217,11 @@ update_updater () { ######################### # Returns version number of a user.js file -get_userjs_version () { - [ -e $1 ] && echo "$(sed -n '4p' "$1")" || echo "Not detected." +get_userjs_version() { + [ -e "$1" ] && echo "$(sed -n '4p' "$1")" || echo "Not detected." } -add_override () { +add_override() { input=$1 if [ -f "$input" ]; then echo "" >> user.js @@ -235,27 +241,27 @@ add_override () { fi } -remove_comments () { # expects 2 arguments: from-file and to-file - sed -e 's/^[[:space:]]*\/\/.*$//' -e '/^\/\*/,/\*\//d' -e '/^[[:space:]]*$/d' -e 's/);[[:space:]]*\/\/.*/);/' "$1" > "$2" +remove_comments() { # expects 2 arguments: from-file and to-file + sed -e '/^\/\*.*\*\/[[:space:]]*$/d' -e '/^\/\*/,/\*\//d' -e 's|^[[:space:]]*//.*$||' -e '/^[[:space:]]*$/d' -e 's|);[[:space:]]*//.*|);|' "$1" > "$2" } # Applies latest version of user.js and any custom overrides -update_userjs () { +update_userjs() { declare -r newfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/user.js')" [ -z "${newfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && return 1 # check if download failed echo -e "Please observe the following information: Firefox profile: ${ORANGE}$(pwd)${NC} - Available online: ${ORANGE}$(get_userjs_version $newfile)${NC} + Available online: ${ORANGE}$(get_userjs_version "$newfile")${NC} Currently using: ${ORANGE}$(get_userjs_version user.js)${NC}\n\n" - if [ $CONFIRM = 'yes' ]; then + if [ "$CONFIRM" = 'yes' ]; then echo -e "This script will update to the latest user.js file and append any custom configurations from user-overrides.js. ${RED}Continue Y/N? ${NC}" read -p "" -n 1 -r echo -e "\n" - if [[ $REPLY =~ ^[Nn]$ ]]; then + if ! [[ $REPLY =~ ^[Yy]$ ]]; then echo -e "${RED}Process aborted${NC}" - rm $newfile + rm "$newfile" return 1 fi fi @@ -269,7 +275,7 @@ update_userjs () { # backup user.js mkdir -p userjs_backups local bakname="userjs_backups/user.js.backup.$(date +"%Y-%m-%d_%H%M")" - [ $BACKUP = 'single' ] && bakname='userjs_backups/user.js.backup' + [ "$BACKUP" = 'single' ] && bakname='userjs_backups/user.js.backup' cp user.js "$bakname" &>/dev/null mv "${newfile}" user.js @@ -295,19 +301,19 @@ update_userjs () { past_nocomments='userjs_diffs/past_userjs.txt' current_nocomments='userjs_diffs/current_userjs.txt' - remove_comments $pastuserjs $past_nocomments - remove_comments user.js $current_nocomments + remove_comments "$pastuserjs" "$past_nocomments" + remove_comments user.js "$current_nocomments" diffname="userjs_diffs/diff_$(date +"%Y-%m-%d_%H%M").txt" - diff=$(diff -w -B -U 0 $past_nocomments $current_nocomments) - if [ ! -z "$diff" ]; then + diff=$(diff -w -B -U 0 "$past_nocomments" "$current_nocomments") + if [ -n "$diff" ]; then echo "$diff" > "$diffname" echo -e "Status: ${GREEN}A diff file was created:${NC} ${PWD}/${diffname}" else echo -e "Warning: ${ORANGE}Your new user.js file appears to be identical. No diff file was created.${NC}" - [ $BACKUP = 'multiple' ] && rm $bakname &>/dev/null + [ "$BACKUP" = 'multiple' ] && rm "$bakname" &>/dev/null fi - rm $past_nocomments $current_nocomments $pastuserjs &>/dev/null + rm "$past_nocomments" "$current_nocomments" "$pastuserjs" &>/dev/null fi [ "$VIEW" = true ] && open_file "${PWD}/user.js" @@ -319,7 +325,7 @@ update_userjs () { if [ $# != 0 ]; then # Display usage if first argument is -help or --help - if [ $1 = '--help' ] || [ $1 = '-help' ]; then + if [ "$1" = '--help' ] || [ "$1" = '-help' ]; then usage else while getopts ":hp:ludsno:bcvre" opt; do @@ -363,7 +369,7 @@ if [ $# != 0 ]; then r) tfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/user.js')" [ -z "${tfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && exit 1 # check if download failed - mv $tfile "${tfile}.js" + mv "$tfile" "${tfile}.js" echo -e "${ORANGE}Warning: user.js was saved to temporary file ${tfile}.js${NC}" open_file "${tfile}.js" exit 0 @@ -382,9 +388,20 @@ if [ $# != 0 ]; then fi show_banner -update_updater $@ +update_updater "$@" getProfilePath # updates PROFILE_PATH or exits on error -cd "$PROFILE_PATH" && update_userjs +cd "$PROFILE_PATH" || exit 1 + +# Check if any files have the owner as root/wheel. +if [ -n "$(find ./ -user 0)" ]; then + printf 'It looks like this script was previously run with elevated privileges, +you will need to change ownership of the following files to your user:\n' + find . -user 0 + cd "$CURRDIR" + exit 1 +fi + +update_userjs cd "$CURRDIR" diff --git a/user.js b/user.js index c029dd5..08c51ca 100644 --- a/user.js +++ b/user.js @@ -1,220 +1,1212 @@ /****** -* name: arkenfox user.js -* date: 23 April 2021 -* version 88 -* url: https://github.com/arkenfox/user.js +* name: arkenfox user.js +* date: 6 March 2025 +* version: 135 +* urls: https://github.com/arkenfox/user.js [repo] +* : https://arkenfox.github.io/gui/ [interactive] * license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt * README: - 1. Consider using Tor Browser if it meets your needs or fits your threat model better - * https://www.torproject.org/about/torusers.html.en - 2. Required reading: Overview, Backing Up, Implementing, and Maintenance entries + 1. Consider using Tor Browser if it meets your needs or fits your threat model + * https://2019.www.torproject.org/about/torusers.html + 2. Read the entire wiki * https://github.com/arkenfox/user.js/wiki 3. If you skipped step 2, return to step 2 - 4. Make changes - * There are often trade-offs and conflicts between security vs privacy vs anti-fingerprinting + 4. Make changes in a user-overrides.js + * There are often trade-offs and conflicts between security vs privacy vs anti-tracking and these need to be balanced against functionality & convenience & breakage * Some site breakage and unintended consequences will happen. Everyone's experience will differ - e.g. some user data is erased on close (section 2800), change this to suit your needs + e.g. some user data is erased on exit (section 2800), change this to suit your needs * While not 100% definitive, search for "[SETUP" tags - e.g. third party images/videos not loading on some sites? check 1603 - * Take the wiki link in step 2 and read the Troubleshooting entry 5. Some tag info [SETUP-SECURITY] it's one item, read it [SETUP-WEB] can cause some websites to break [SETUP-CHROME] changes how Firefox itself behaves (i.e. not directly website related) - [SETUP-PERF] may impact performance - [WARNING] used sparingly, heed them 6. Override Recipes: https://github.com/arkenfox/user.js/issues/1080 * RELEASES: https://github.com/arkenfox/user.js/releases - * It is best to use the arkenfox release that is optimized for and matches your Firefox version - * EVERYONE: each release - - run prefsCleaner or reset deprecated prefs (9999s) and prefs made redundant by RPF (4600s) - - re-enable section 4600 if you don't use RFP - ESR78 - - If you are not using arkenfox v78... (not a definitive list) - - 1244: HTTPS-Only mode is enabled - - 1401: document fonts is inactive as it is now covered by RFP in FF80+ - - 4600: some prefs may apply even if you use RFP - - 9999: switch the appropriate deprecated section(s) back on + * Use the arkenfox release that matches your Firefox version + - DON'T wait for arkenfox to update Firefox, nothing major changes these days + * Each release + - run prefsCleaner to reset prefs made inactive, including deprecated (9999) + * ESR + - It is recommended to not use the updater, or you will get a later version which may cause issues. + So you should manually append your overrides (and keep a copy), and manually update when you + change ESR releases (arkenfox is already past that release) + - If you decide to keep updating, then the onus is on you - also see section 9999 * INDEX: 0100: STARTUP - 0200: GEOLOCATION / LANGUAGE / LOCALE - 0300: QUIET FOX - 0400: BLOCKLISTS / SAFE BROWSING - 0500: SYSTEM ADD-ONS / EXPERIMENTS + 0200: GEOLOCATION + 0300: QUIETER FOX + 0400: SAFE BROWSING 0600: BLOCK IMPLICIT OUTBOUND - 0700: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc + 0700: DNS / DoH / PROXY / SOCKS 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS 0900: PASSWORDS - 1000: CACHE / SESSION (RE)STORE / FAVICONS - 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS) - 1400: FONTS - 1600: HEADERS / REFERERS + 1000: DISK AVOIDANCE + 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) + 1600: REFERERS 1700: CONTAINERS - 1800: PLUGINS - 2000: MEDIA / CAMERA / MIC - 2200: WINDOW MEDDLING & LEAKS / POPUPS - 2300: WEB WORKERS - 2400: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT - 2500: HARDWARE FINGERPRINTING + 2000: PLUGINS / MEDIA / WEBRTC + 2400: DOM (DOCUMENT OBJECT MODEL) 2600: MISCELLANEOUS - 2700: PERSISTENT STORAGE - 2800: SHUTDOWN - 4000: FPI (FIRST PARTY ISOLATION) - 4500: RFP (RESIST FINGERPRINTING) - 4600: RFP ALTERNATIVES - 4700: RFP ALTERNATIVES (USER AGENT SPOOFING) - 5000: PERSONAL - 9999: DEPRECATED / REMOVED / LEGACY / RENAMED + 2700: ETP (ENHANCED TRACKING PROTECTION) + 2800: SHUTDOWN & SANITIZING + 4000: FPP (fingerprintingProtection) + 4500: OPTIONAL RFP (resistFingerprinting) + 5000: OPTIONAL OPSEC + 5500: OPTIONAL HARDENING + 6000: DON'T TOUCH + 7000: DON'T BOTHER + 8000: DON'T BOTHER: FINGERPRINTING + 8500: TELEMETRY + 9000: NON-PROJECT RELATED + 9999: DEPRECATED / RENAMED ******/ /* START: internal custom pref to test for syntax errors - * [NOTE] In FF60+, not all syntax errors cause parsing to abort i.e. reaching the last debug - * pref no longer necessarily means that all prefs have been applied. Check the console right + * [NOTE] Not all syntax errors cause parsing to abort i.e. reaching the last debug pref + * no longer necessarily means that all prefs have been applied. Check the console right * after startup for any warnings/error messages related to non-applied prefs * [1] https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/ user_pref("_user.js.parrot", "START: Oh yes, the Norwegian Blue... what's wrong with it?"); -/* 0000: disable about:config warning - * FF73-86: chrome://global/content/config.xhtml ***/ -user_pref("general.warnOnAboutConfig", false); // XHTML version -user_pref("browser.aboutConfig.showWarning", false); // HTML version [FF71+] +/* 0000: disable about:config warning ***/ +user_pref("browser.aboutConfig.showWarning", false); /*** [SECTION 0100]: STARTUP ***/ user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); -/* 0101: disable default browser check - * [SETTING] General>Startup>Always check if Firefox is your default browser ***/ -user_pref("browser.shell.checkDefaultBrowser", false); /* 0102: set startup page [SETUP-CHROME] * 0=blank, 1=home, 2=last visited page, 3=resume previous session - * [NOTE] Session Restore is not used in PB mode (0110) and is cleared with history (2803, 2804) + * [NOTE] Session Restore is cleared with history (2811+), and not used in Private Browsing mode * [SETTING] General>Startup>Restore previous session ***/ user_pref("browser.startup.page", 0); /* 0103: set HOME+NEWWINDOW page - * about:home=Activity Stream (default, see 0105), custom URL, about:blank + * about:home=Firefox Home (default, see 0105), custom URL, about:blank * [SETTING] Home>New Windows and Tabs>Homepage and new windows ***/ user_pref("browser.startup.homepage", "about:blank"); /* 0104: set NEWTAB page - * true=Activity Stream (default, see 0105), false=blank page + * true=Firefox Home (default, see 0105), false=blank page * [SETTING] Home>New Windows and Tabs>New tabs ***/ user_pref("browser.newtabpage.enabled", false); -user_pref("browser.newtab.preload", false); -/* 0105: disable Activity Stream stuff (AS) - * AS is the default homepage/newtab in FF57+, based on metadata and browsing behavior. - * **NOT LISTING ALL OF THESE: USE THE PREFERENCES UI** - * [SETTING] Home>Firefox Home Content>... to show/hide what you want ***/ -/* 0105a: disable Activity Stream telemetry ***/ -user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false); -user_pref("browser.newtabpage.activity-stream.telemetry", false); -/* 0105b: disable Activity Stream Snippets - * Runs code received from a server (aka Remote Code Execution) and sends information back to a metrics server - * [1] https://abouthome-snippets-service.readthedocs.io/ ***/ -user_pref("browser.newtabpage.activity-stream.feeds.snippets", false); -/* 0105c: disable Activity Stream Top Stories, Pocket-based and/or sponsored content ***/ -user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false); -user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false); -user_pref("browser.newtabpage.activity-stream.showSponsored", false); -user_pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false); // [FF66+] -/* 0105e: clear default topsites +/* 0105: disable sponsored content on Firefox Home (Activity Stream) + * [SETTING] Home>Firefox Home Content ***/ +user_pref("browser.newtabpage.activity-stream.showSponsored", false); // [FF58+] +user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false); // [FF83+] Shortcuts>Sponsored shortcuts +/* 0106: clear default topsites * [NOTE] This does not block you from adding your own ***/ user_pref("browser.newtabpage.activity-stream.default.sites", ""); -/* 0110: start Firefox in PB (Private Browsing) mode - * [NOTE] In this mode *all* windows are "private windows" and the PB mode icon is not displayed - * [WARNING] The P in PB mode is misleading: it means no "persistent" disk storage such as history, - * caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode). - * In fact, PB mode limits or removes the ability to control some of these, and you need to quit - * Firefox to clear them. PB is best used as a one off window (File>New Private Window) to provide - * a temporary self-contained new session. Close all Private Windows to clear the PB mode session. - * [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode - * [1] https://wiki.mozilla.org/Private_Browsing - * [2] https://spreadprivacy.com/is-private-browsing-really-private/ ***/ - // user_pref("browser.privatebrowsing.autostart", true); -/*** [SECTION 0200]: GEOLOCATION / LANGUAGE / LOCALE ***/ +/*** [SECTION 0200]: GEOLOCATION ***/ user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!"); -/** GEOLOCATION ***/ -/* 0201: disable Location-Aware Browsing - * [NOTE] Best left at default "true", fingerprintable, already behind a prompt (see 0202) - * [1] https://www.mozilla.org/firefox/geolocation/ ***/ - // user_pref("geo.enabled", false); -/* 0202: set a default permission for Location (see 0201) [FF58+] - * 0=always ask (default), 1=allow, 2=block - * [NOTE] Best left at default "always ask", fingerprintable via Permissions API - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Access Your Location - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Location>Settings ***/ - // user_pref("permissions.default.geo", 2); -/* 0203: use Mozilla geolocation service instead of Google when geolocation is enabled [FF74+] - * Optionally enable logging to the console (defaults to false) ***/ -user_pref("geo.provider.network.url", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"); - // user_pref("geo.provider.network.logging.enabled", true); // [HIDDEN PREF] -/* 0204: disable using the OS's geolocation service ***/ +/* 0202: disable using the OS's geolocation service ***/ user_pref("geo.provider.ms-windows-location", false); // [WINDOWS] user_pref("geo.provider.use_corelocation", false); // [MAC] -user_pref("geo.provider.use_gpsd", false); // [LINUX] -/* 0207: disable region updates - * [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/ -user_pref("browser.region.network.url", ""); // [FF78+] -user_pref("browser.region.update.enabled", false); // [[FF79+] -/* 0208: set search region - * [NOTE] May not be hidden if Firefox has changed your settings due to your region (see 0207) ***/ - // user_pref("browser.search.region", "US"); // [HIDDEN PREF] +user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX] -/** LANGUAGE / LOCALE ***/ -/* 0210: set preferred language for displaying web pages - * [TEST] https://addons.mozilla.org/about ***/ -user_pref("intl.accept_languages", "en-US, en"); -/* 0211: enforce US English locale regardless of the system locale - * [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages [1] - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 ***/ -user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] - -/*** [SECTION 0300]: QUIET FOX - We only disable the auto-INSTALL of Firefox (app) updates. You still get prompts to update, - and it only takes one click. We highly discourage disabling auto-CHECKING for updates. - - Legitimate reasons to disable auto-INSTALLS include hijacked/monetized extensions, time - constraints, legacy issues, dev/testing, and fear of breakage/bugs. It is still important - to do updates for security reasons, please do so manually if you make changes. -***/ +/*** [SECTION 0300]: QUIETER FOX ***/ user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!"); -/* 0301b: disable auto-CHECKING for extension and theme updates ***/ - // user_pref("extensions.update.enabled", false); -/* 0302a: disable auto-INSTALLING Firefox updates [NON-WINDOWS FF65+] - * [NOTE] In FF65+ on Windows this SETTING (below) is now stored in a file and the pref was removed - * [SETTING] General>Firefox Updates>Check for updates but let you choose to install them ***/ -user_pref("app.update.auto", false); -/* 0302b: disable auto-INSTALLING extension and theme updates (after the check in 0301b) - * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/ - // user_pref("extensions.update.autoUpdateDefault", false); -/* 0306: disable extension metadata - * used when installing/updating an extension, and in daily background update checks: - * when false, extension detail tabs will have no description ***/ - // user_pref("extensions.getAddons.cache.enabled", false); -/* 0308: disable search engine updates (e.g. OpenSearch) - * [NOTE] This does not affect Mozilla's built-in or Web Extension search engines ***/ -user_pref("browser.search.update", false); -/* 0309: disable sending Flash crash reports ***/ -user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false); -/* 0310: disable sending the URL of the website where a plugin crashed ***/ -user_pref("dom.ipc.plugins.reportCrashURL", false); -/* 0320: disable about:addons' Recommendations pane (uses Google Analytics) ***/ +/** RECOMMENDATIONS ***/ +/* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/ user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF] /* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/ user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); -/* 0330: disable telemetry - * the pref (.unified) affects the behaviour of the pref (.enabled) - * IF unified=false then .enabled controls the telemetry module - * IF unified=true then .enabled ONLY controls whether to record extended data - * so make sure to have both set as false - * [NOTE] FF58+ 'toolkit.telemetry.enabled' is now LOCKED to reflect prerelease - * or release builds (true and false respectively) [2] +/* 0322: disable personalized Extension Recommendations in about:addons and AMO [FF65+] + * [NOTE] This pref has no effect when Health Reports (8501) are disabled + * [SETTING] Privacy & Security>Firefox Data Collection and Use>Allow personalized extension recommendations + * [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/ +user_pref("browser.discovery.enabled", false); +/* 0323: disable shopping experience [FF116+] + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1840156#c0 ***/ +user_pref("browser.shopping.experience2023.enabled", false); // [DEFAULT: false] + +/** TELEMETRY ***/ +/* 0335: disable Firefox Home (Activity Stream) telemetry ***/ +user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false); +user_pref("browser.newtabpage.activity-stream.telemetry", false); + +/** STUDIES ***/ +/* 0340: disable Studies + * [SETTING] Privacy & Security>Firefox Data Collection and Use>Install and run studies ***/ +user_pref("app.shield.optoutstudies.enabled", false); +/* 0341: disable Normandy/Shield [FF60+] + * Shield is a telemetry system that can push and test "recipes" + * [1] https://mozilla.github.io/normandy/ ***/ +user_pref("app.normandy.enabled", false); +user_pref("app.normandy.api_url", ""); + +/** CRASH REPORTS ***/ +/* 0350: disable Crash Reports ***/ +user_pref("breakpad.reportURL", ""); +user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+] + // user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] [DEFAULT: false] +/* 0351: enforce no submission of backlogged Crash Reports [FF58+] + * [SETTING] Privacy & Security>Firefox Data Collection and Use>Send backlogged crash reports ***/ +user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [DEFAULT: false] + +/** OTHER ***/ +/* 0360: disable Captive Portal detection + * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy ***/ +user_pref("captivedetect.canonicalURL", ""); +user_pref("network.captive-portal-service.enabled", false); // [FF52+] +/* 0361: disable Network Connectivity checks [FF65+] + * [1] https://bugzilla.mozilla.org/1460537 ***/ +user_pref("network.connectivity-service.enabled", false); + +/*** [SECTION 0400]: SAFE BROWSING (SB) + SB has taken many steps to preserve privacy. If required, a full url is never sent + to Google, only a part-hash of the prefix, hidden with noise of other real part-hashes. + Firefox takes measures such as stripping out identifying parameters and since SBv4 (FF57+) + doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity) + + [1] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ + [2] https://wiki.mozilla.org/Security/Safe_Browsing + [3] https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work + [4] https://educatedguesswork.org/posts/safe-browsing-privacy/ +***/ +user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); +/* 0401: disable SB (Safe Browsing) + * [WARNING] Do this at your own risk! These are the master switches + * [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content ***/ + // user_pref("browser.safebrowsing.malware.enabled", false); + // user_pref("browser.safebrowsing.phishing.enabled", false); +/* 0402: disable SB checks for downloads (both local lookups + remote) + * This is the master switch for the safebrowsing.downloads* prefs (0403, 0404) + * [SETTING] Privacy & Security>Security>... "Block dangerous downloads" ***/ + // user_pref("browser.safebrowsing.downloads.enabled", false); +/* 0403: disable SB checks for downloads (remote) + * To verify the safety of certain executable files, Firefox may submit some information about the + * file, including the name, origin, size and a cryptographic hash of the contents, to the Google + * Safe Browsing service which helps Firefox determine whether or not the file should be blocked + * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override this ***/ +user_pref("browser.safebrowsing.downloads.remote.enabled", false); + // user_pref("browser.safebrowsing.downloads.remote.url", ""); // Defense-in-depth +/* 0404: disable SB checks for unwanted software + * [SETTING] Privacy & Security>Security>... "Warn you about unwanted and uncommon software" ***/ + // user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); + // user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); +/* 0405: disable "ignore this warning" on SB warnings [FF45+] + * If clicked, it bypasses the block for that session. This is a means for admins to enforce SB + * [TEST] see https://github.com/arkenfox/user.js/wiki/Appendix-A-Test-Sites#-mozilla + * [1] https://bugzilla.mozilla.org/1226490 ***/ + // user_pref("browser.safebrowsing.allowOverride", false); + +/*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/ +user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!"); +/* 0601: disable link prefetching + * [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/ +user_pref("network.prefetch-next", false); +/* 0602: disable DNS prefetching + * [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/ +user_pref("network.dns.disablePrefetch", true); +user_pref("network.dns.disablePrefetchFromHTTPS", true); +/* 0603: disable predictor / prefetching ***/ +user_pref("network.predictor.enabled", false); +user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false] +/* 0604: disable link-mouseover opening connection to linked server + * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/ +user_pref("network.http.speculative-parallel-limit", 0); +/* 0605: disable mousedown speculative connections on bookmarks and history [FF98+] ***/ +user_pref("browser.places.speculativeConnect.enabled", false); +/* 0610: enforce no "Hyperlink Auditing" (click tracking) + * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/ + // user_pref("browser.send_pings", false); // [DEFAULT: false] + +/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS ***/ +user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!"); +/* 0702: set the proxy server to do any DNS lookups when using SOCKS + * e.g. in Tor, this stops your local DNS server from knowing your Tor destination + * as a remote Tor node will handle the DNS request + * [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/ +user_pref("network.proxy.socks_remote_dns", true); +/* 0703: disable using UNC (Uniform Naming Convention) paths [FF61+] + * [SETUP-CHROME] Can break extensions for profiles on network shares + * [1] https://bugzilla.mozilla.org/1413868 ***/ +user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] +/* 0704: disable GIO as a potential proxy bypass vector + * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, + * dav, cdda, gphoto2, trash, etc. From FF87-117, by default only sftp was accepted + * [1] https://bugzilla.mozilla.org/1433507 + * [2] https://en.wikipedia.org/wiki/GVfs + * [3] https://en.wikipedia.org/wiki/GIO_(software) ***/ +user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] [DEFAULT: ""] +/* 0705: disable proxy direct failover for system requests [FF91+] + * [WARNING] Default true is a security feature against malicious extensions [1] + * [SETUP-CHROME] If you use a proxy and you trust your extensions + * [1] https://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ ***/ + // user_pref("network.proxy.failover_direct", false); +/* 0706: disable proxy bypass for system request failures [FF95+] + * RemoteSettings, UpdateService, Telemetry [1] + * [WARNING] If false, this will break the fallback for some security features + * [SETUP-CHROME] If you use a proxy and you understand the security impact + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 ***/ + // user_pref("network.proxy.allow_bypass", false); +/* 0710: enable DNS-over-HTTPS (DoH) [FF60+] + * 0=default, 2=increased (TRR (Trusted Recursive Resolver) first), 3=max (TRR only), 5=off (no rollout) + * see "doh-rollout.home-region": USA 2019, Canada 2021, Russia/Ukraine 2022 [3] + * [SETTING] Privacy & Security>DNS over HTTPS + * [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ + * [2] https://wiki.mozilla.org/Security/DOH-resolver-policy + * [3] https://support.mozilla.org/kb/firefox-dns-over-https + * [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/ + // user_pref("network.trr.mode", 3); +/* 0712: set DoH provider + * The custom uri is the value shown when you "Choose provider>Custom>" + * [NOTE] If you USE custom then "network.trr.uri" should be set the same + * [SETTING] Privacy & Security>DNS over HTTPS>Increased/Max>Choose provider ***/ + // user_pref("network.trr.uri", "https://example.dns"); + // user_pref("network.trr.custom_uri", "https://example.dns"); + +/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/ +user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); +/* 0801: disable location bar making speculative connections [FF56+] + * [1] https://bugzilla.mozilla.org/1348275 ***/ +user_pref("browser.urlbar.speculativeConnect.enabled", false); +/* 0802: disable location bar contextual suggestions + * [NOTE] The UI is controlled by the .enabled pref + * [SETTING] Search>Address Bar>Suggestions from... + * [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/ +user_pref("browser.urlbar.quicksuggest.enabled", false); // [FF92+] +user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+] +user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false); // [FF92+] +/* 0803: disable live search suggestions + * [NOTE] Both must be true for live search to work in the location bar + * [SETUP-CHROME] Override these if you trust and use a privacy respecting search engine + * [SETTING] Search>Show search suggestions | Show search suggestions in address bar results ***/ +user_pref("browser.search.suggest.enabled", false); +user_pref("browser.urlbar.suggest.searches", false); +/* 0805: disable urlbar trending search suggestions [FF118+] + * [SETTING] Search>Search Suggestions>Show trending search suggestions (FF119) ***/ +user_pref("browser.urlbar.trending.featureGate", false); +/* 0806: disable urlbar suggestions ***/ +user_pref("browser.urlbar.addons.featureGate", false); // [FF115+] +user_pref("browser.urlbar.fakespot.featureGate", false); // [FF130+] [DEFAULT: false] +user_pref("browser.urlbar.mdn.featureGate", false); // [FF117+] [HIDDEN PREF] +user_pref("browser.urlbar.pocket.featureGate", false); // [FF116+] [DEFAULT: false] +user_pref("browser.urlbar.weather.featureGate", false); // [FF108+] [DEFAULT: false] +user_pref("browser.urlbar.yelp.featureGate", false); // [FF124+] +/* 0807: disable urlbar clipboard suggestions [FF118+] ***/ + // user_pref("browser.urlbar.clipboard.featureGate", false); +/* 0808: disable recent searches [FF120+] + * [NOTE] Recent searches are cleared with history (2811+) + * [1] https://support.mozilla.org/kb/search-suggestions-firefox ***/ + // user_pref("browser.urlbar.recentsearches.featureGate", false); +/* 0810: disable search and form history + * [NOTE] We also clear formdata on exit (2811+) + * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] + * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history + * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html + * [2] https://bugzilla.mozilla.org/381681 ***/ +user_pref("browser.formfill.enable", false); +/* 0815: disable tab-to-search [FF85+] + * Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search + * [SETTING] Search>Address Bar>When using the address bar, suggest>Search engines ***/ + // user_pref("browser.urlbar.suggest.engines", false); +/* 0820: disable coloring of visited links + * [SETUP-HARDEN] Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive + * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing + * attacks. Don't forget clearing history on exit (2811+). However, social engineering [2#limits][4][5] + * and advanced targeted timing attacks could still produce usable results + * [1] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector + * [2] https://dbaron.org/mozilla/visited-privacy + * [3] https://bugzilla.mozilla.org/1632765 + * [4] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use) + * [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/ + // user_pref("layout.css.visited_links_enabled", false); +/* 0830: enable separate default search engine in Private Windows and its UI setting + * [SETTING] Search>Default Search Engine>Choose a different default search engine for Private Windows only ***/ +user_pref("browser.search.separatePrivateDefault", true); // [FF70+] +user_pref("browser.search.separatePrivateDefault.ui.enabled", true); // [FF71+] + +/*** [SECTION 0900]: PASSWORDS + [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas +***/ +user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!"); +/* 0903: disable auto-filling username & password form fields + * can leak in cross-site forms *and* be spoofed + * [NOTE] Username & password is still available when you enter the field + * [SETTING] Privacy & Security>Logins and Passwords>Autofill logins and passwords + * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ + * [2] https://homes.esat.kuleuven.be/~asenol/leaky-forms/ ***/ +user_pref("signon.autofillForms", false); +/* 0904: disable formless login capture for Password Manager [FF51+] ***/ +user_pref("signon.formlessCapture.enabled", false); +/* 0905: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+] + * hardens against potential credentials phishing + * 0 = don't allow sub-resources to open HTTP authentication credentials dialogs + * 1 = don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs + * 2 = allow sub-resources to open HTTP authentication credentials dialogs (default) ***/ +user_pref("network.auth.subresource-http-auth-allow", 1); +/* 0906: enforce no automatic authentication on Microsoft sites [FF91+] [WINDOWS 10+] + * [SETTING] Privacy & Security>Logins and Passwords>Allow Windows single sign-on for... + * [1] https://support.mozilla.org/kb/windows-sso ***/ + // user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false] +/* 0907: enforce no automatic authentication on Microsoft sites [FF131+] [MAC] + * On macOS, SSO only works on corporate devices ***/ + // user_pref("network.http.microsoft-entra-sso.enabled", false); // [DEFAULT: false] + +/*** [SECTION 1000]: DISK AVOIDANCE ***/ +user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); +/* 1001: disable disk cache + * [NOTE] We also clear cache on exit (2811+) + * [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this ***/ +user_pref("browser.cache.disk.enable", false); +/* 1002: set media cache in Private Browsing to in-memory and increase its maximum size + * [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/ +user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+] +user_pref("media.memory_cache_max_size", 65536); +/* 1003: disable storing extra session data [SETUP-CHROME] + * define on which sites to save extra session data such as form content, cookies and POST data + * 0=everywhere, 1=unencrypted sites, 2=nowhere ***/ +user_pref("browser.sessionstore.privacy_level", 2); +/* 1005: disable automatic Firefox start and session restore after reboot [FF62+] [WINDOWS] + * [1] https://bugzilla.mozilla.org/603903 ***/ +user_pref("toolkit.winRegisterApplicationRestart", false); +/* 1006: disable favicons in shortcuts [WINDOWS] + * URL shortcuts use a cached randomly named .ico file which is stored in your + * profile/shortcutCache directory. The .ico remains after the shortcut is deleted + * If set to false then the shortcuts use a generic Firefox icon ***/ +user_pref("browser.shell.shortcutFavicons", false); + +/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) + Your cipher and other settings can be used in server side fingerprinting + [TEST] https://www.ssllabs.com/ssltest/viewMyClient.html + [TEST] https://browserleaks.com/ssl + [TEST] https://ja3er.com/ + [1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/ +***/ +user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); +/** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/ +/* 1201: require safe negotiation + * Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a + * MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations + * but the problem is that the browser can't know that. Setting this pref to true is the only way for the + * browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server + * [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site? + * [STATS] SSL Labs (May 2024) reports over 99.7% of top sites have secure renegotiation [4] + * [1] https://wiki.mozilla.org/Security:Renegotiation + * [2] https://datatracker.ietf.org/doc/html/rfc5746 + * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 + * [4] https://www.ssllabs.com/ssl-pulse/ ***/ +user_pref("security.ssl.require_safe_negotiation", true); +/* 1206: disable TLS1.3 0-RTT (round-trip time) [FF51+] + * This data is not forward secret, as it is encrypted solely under keys derived using + * the offered PSK. There are no guarantees of non-replay between connections + * [1] https://github.com/tlswg/tls13-spec/issues/1001 + * [2] https://www.rfc-editor.org/rfc/rfc9001.html#name-replay-attacks-with-0-rtt + * [3] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/ +user_pref("security.tls.enable_0rtt_data", false); + +/** OCSP (Online Certificate Status Protocol) + [1] https://scotthelme.co.uk/revocation-is-broken/ + [2] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ +***/ +/* 1211: enforce OCSP fetching to confirm current validity of certificates + * 0=disabled, 1=enabled (default), 2=enabled for EV certificates only + * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority) + * It's a trade-off between security (checking) and privacy (leaking info to the CA) + * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling + * [SETTING] Privacy & Security>Security>Certificates>Query OCSP responder servers... + * [1] https://en.wikipedia.org/wiki/Ocsp ***/ +user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] +/* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail + * [SETUP-WEB] SEC_ERROR_OCSP_SERVER_ERROR | SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST + * When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail) + * Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail) + * It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it + * could have been revoked) and/or you could be under attack (e.g. malicious blocking of OCSP servers) + * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ + * [2] https://www.imperialviolet.org/2014/04/19/revchecking.html + * [3] https://letsencrypt.org/2024/12/05/ending-ocsp/ ***/ +user_pref("security.OCSP.require", true); + +/** CERTS / HPKP (HTTP Public Key Pinning) ***/ +/* 1223: enable strict PKP (Public Key Pinning) + * 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict + * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE ***/ +user_pref("security.cert_pinning.enforcement_level", 2); +/* 1224: enable CRLite [FF73+] + * 0 = disabled + * 1 = consult CRLite but only collect telemetry + * 2 = consult CRLite and enforce both "Revoked" and "Not Revoked" results + * 3 = consult CRLite and enforce "Not Revoked" results, but defer to OCSP for "Revoked" (default) + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985,1753071 + * [2] https://blog.mozilla.org/security/tag/crlite/ ***/ +user_pref("security.remote_settings.crlite_filters.enabled", true); // [DEFAULT: true FF137+] +user_pref("security.pki.crlite_mode", 2); + +/** MIXED CONTENT ***/ +/* 1241: disable insecure passive content (such as images) on https pages ***/ + // user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244) +/* 1244: enable HTTPS-Only mode in all windows + * When the top-level is HTTPS, insecure subresources are also upgraded (silent fail) + * [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (after "Continue to HTTP Site") + * [SETTING] Privacy & Security>HTTPS-Only Mode (and manage exceptions) + * [TEST] http://example.com [upgrade] + * [TEST] http://httpforever.com/ | http://http.rip [no upgrade] ***/ +user_pref("dom.security.https_only_mode", true); // [FF76+] + // user_pref("dom.security.https_only_mode_pbm", true); // [FF80+] +/* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/ + // user_pref("dom.security.https_only_mode.upgrade_local", true); +/* 1246: disable HTTP background requests [FF82+] + * When attempting to upgrade, if the server doesn't respond within 3 seconds, Firefox sends + * a top-level HTTP request without path in order to check if the server supports HTTPS or not + * This is done to avoid waiting for a timeout which takes 90 seconds + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/ +user_pref("dom.security.https_only_mode_send_http_background_request", false); + +/** UI (User Interface) ***/ +/* 1270: display warning on the padlock for "broken security" (if 1201 is false) + * Bug: warning padlock not indicated for subresources on a secure page! [2] + * [1] https://wiki.mozilla.org/Security:Renegotiation + * [2] https://bugzilla.mozilla.org/1353705 ***/ +user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); +/* 1272: display advanced information on Insecure Connection warning pages + * only works when it's possible to add an exception + * i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/) + * [TEST] https://expired.badssl.com/ ***/ +user_pref("browser.xul.error_pages.expert_bad_cert", true); + +/*** [SECTION 1600]: REFERERS + full URI: https://example.com:8888/foo/bar.html?id=1234 + scheme+host+port+path: https://example.com:8888/foo/bar.html + scheme+host+port: https://example.com:8888 + [1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ +***/ +user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); +/* 1602: control the amount of cross-origin information to send [FF52+] + * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ +user_pref("network.http.referer.XOriginTrimmingPolicy", 2); + +/*** [SECTION 1700]: CONTAINERS ***/ +user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); +/* 1701: enable Container Tabs and its UI setting [FF50+] + * [SETTING] General>Tabs>Enable Container Tabs + * https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/ +user_pref("privacy.userContext.enabled", true); +user_pref("privacy.userContext.ui.enabled", true); +/* 1702: set behavior on "+ Tab" button to display container menu on left click [FF74+] + * [NOTE] The menu is always shown on long press and right click + * [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/ + // user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true); +/* 1703: set external links to open in site-specific containers [FF123+] + * [SETUP-WEB] Depending on your container extension(s) and their settings + * true=Firefox will not choose a container (so your extension can) + * false=Firefox will choose the container/no-container (default) + * [1] https://bugzilla.mozilla.org/1874599 ***/ + // user_pref("browser.link.force_default_user_context_id_for_external_opens", true); + +/*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/ +user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); +/* 2002: force WebRTC inside the proxy [FF70+] ***/ +user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); +/* 2003: force a single network interface for ICE candidates generation [FF42+] + * When using a system-wide proxy, it uses the proxy interface + * [1] https://developer.mozilla.org/docs/Web/API/RTCIceCandidate + * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/ +user_pref("media.peerconnection.ice.default_address_only", true); +/* 2004: force exclusion of private IPs from ICE candidates [FF51+] + * [SETUP-HARDEN] This will protect your private IP even in TRUSTED scenarios after you + * grant device access, but often results in breakage on video-conferencing platforms ***/ + // user_pref("media.peerconnection.ice.no_host", true); +/* 2020: disable GMP (Gecko Media Plugins) + * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ + // user_pref("media.gmp-provider.enabled", false); + +/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/ +user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); +/* 2402: prevent scripts from moving and resizing open windows ***/ +user_pref("dom.disable_window_move_resize", true); + +/*** [SECTION 2600]: MISCELLANEOUS ***/ +user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); +/* 2603: remove temp files opened from non-PB windows with an external application + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=302433,1738574 ***/ +user_pref("browser.download.start_downloads_in_tmp_dir", true); // [FF102+] +user_pref("browser.helperApps.deleteTempFileOnExit", true); +/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/ +user_pref("browser.uitour.enabled", false); + // user_pref("browser.uitour.url", ""); // Defense-in-depth +/* 2608: reset remote debugging to disabled + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/ +user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] +/* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+] + * 0 (default) or 1=allow, 2=block + * [SETTING] to add site exceptions: Ctrl+I>Permissions>Override Keyboard Shortcuts ***/ + // user_pref("permissions.default.shortcuts", 2); +/* 2616: remove special permissions for certain mozilla domains [FF35+] + * [1] resource://app/defaults/permissions ***/ +user_pref("permissions.manager.defaultsUrl", ""); +/* 2619: use Punycode in Internationalized Domain Names to eliminate possible spoofing + * [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded + * [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com) + * [1] https://wiki.mozilla.org/IDN_Display_Algorithm + * [2] https://en.wikipedia.org/wiki/IDN_homograph_attack + * [3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox + * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/ +user_pref("network.IDN_show_punycode", true); +/* 2620: enforce PDFJS, disable PDFJS scripting + * This setting controls if the option "Display in Firefox" is available in the setting below + * and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With") + * [WHY] pdfjs is lightweight, open source, and secure: the last exploit was June 2015 [1] + * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). + * It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. + * [NOTE] JS can still force a pdf to open in-browser by bundling its own code + * [SETUP-CHROME] You may prefer a different pdf reader for security/workflow reasons + * [SETTING] General>Applications>Portable Document Format (PDF) + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/ +user_pref("pdfjs.disabled", false); // [DEFAULT: false] +user_pref("pdfjs.enableScripting", false); // [FF86+] +/* 2624: disable middle click on new tab button opening URLs or searches using clipboard [FF115+] */ +user_pref("browser.tabs.searchclipboardfor.middleclick", false); // [DEFAULT: false NON-LINUX] +/* 2630: disable content analysis by DLP (Data Loss Prevention) agents + * DLP agents are background processes on managed computers that allow enterprises to monitor locally running + * applications for data exfiltration events, which they can allow/block based on customer defined DLP policies. + * 0=Block all requests, 1=Warn on all requests (which lets the user decide), 2=Allow all requests + * [1] https://github.com/chromium/content_analysis_sdk */ +user_pref("browser.contentanalysis.enabled", false); // [FF121+] [DEFAULT: false] +user_pref("browser.contentanalysis.default_result", 0); // [FF127+] [DEFAULT: 0] + +/** DOWNLOADS ***/ +/* 2651: enable user interaction for security by always asking where to download + * [SETUP-CHROME] On Android this blocks longtapping and saving images + * [SETTING] General>Downloads>Always ask you where to save files ***/ +user_pref("browser.download.useDownloadDir", false); +/* 2652: disable downloads panel opening on every download [FF96+] ***/ +user_pref("browser.download.alwaysOpenPanel", false); +/* 2653: disable adding downloads to the system's "recent documents" list ***/ +user_pref("browser.download.manager.addToRecentDocs", false); +/* 2654: enable user interaction for security by always asking how to handle new mimetypes [FF101+] + * [SETTING] General>Files and Applications>What should Firefox do with other files ***/ +user_pref("browser.download.always_ask_before_handling_new_types", true); + +/** EXTENSIONS ***/ +/* 2660: limit allowed extension directories + * 1=profile, 2=user, 4=application, 8=system, 16=temporary, 31=all + * The pref value represents the sum: e.g. 5 would be profile and application directories + * [SETUP-CHROME] Breaks usage of files which are installed outside allowed directories + * [1] https://archive.is/DYjAM ***/ +user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] + // user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] +/* 2661: disable bypassing 3rd party extension install prompts [FF82+] + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1659530,1681331 ***/ +user_pref("extensions.postDownloadThirdPartyPrompt", false); +/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ + // user_pref("extensions.webextensions.restrictedDomains", ""); + +/*** [SECTION 2700]: ETP (ENHANCED TRACKING PROTECTION) ***/ +user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); +/* 2701: enable ETP Strict Mode [FF86+] + * ETP Strict Mode enables Total Cookie Protection (TCP) + * [NOTE] Adding site exceptions disables all ETP protections for that site and increases the risk of + * cross-site state tracking e.g. exceptions for SiteA and SiteB means PartyC on both sites is shared + * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ + * [SETTING] to add site exceptions: Urlbar>ETP Shield + * [SETTING] to manage site exceptions: Options>Privacy & Security>Enhanced Tracking Protection>Manage Exceptions ***/ +user_pref("browser.contentblocking.category", "strict"); // [HIDDEN PREF] +/* 2702: disable ETP web compat features [FF93+] + * [SETUP-HARDEN] Includes skip lists, heuristics (SmartBlock) and automatic grants + * Opener and redirect heuristics are granted for 30 days, see [3] + * [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/ + * [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12 + * [3] https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ + // user_pref("privacy.antitracking.enableWebcompat", false); + +/*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ +user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); +/* 2810: enable Firefox to clear items on shutdown + * [NOTE] In FF129+ clearing "siteSettings" on shutdown (2811+), or manually via site data (2820+) and + * via history (2830), will no longer remove sanitize on shutdown "cookie and site data" site exceptions (2815) + * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes | Settings ***/ +user_pref("privacy.sanitize.sanitizeOnShutdown", true); + +/** SANITIZE ON SHUTDOWN: IGNORES "ALLOW" SITE EXCEPTIONS ***/ +/* 2811: set/enforce clearOnShutdown items (if 2810 is true) [SETUP-CHROME] [FF128+] ***/ +user_pref("privacy.clearOnShutdown_v2.cache", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown_v2.historyFormDataAndDownloads", true); // [DEFAULT: true] + // user_pref("privacy.clearOnShutdown_v2.siteSettings", false); // [DEFAULT: false] +/* 2812: set/enforce clearOnShutdown items [FF136+] ***/ +user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown_v2.downloads", true); +user_pref("privacy.clearOnShutdown_v2.formdata", true); +/* 2813: set Session Restore to clear on shutdown (if 2810 is true) [FF34+] + * [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811+) + * [NOTE] If true, this prevents resuming from crashes (also see 5008) ***/ + // user_pref("privacy.clearOnShutdown.openWindows", true); + +/** SANITIZE ON SHUTDOWN: RESPECTS "ALLOW" SITE EXCEPTIONS ***/ +/* 2815: set "Cookies" and "Site Data" to clear on shutdown (if 2810 is true) [SETUP-CHROME] [FF128+] + * [NOTE] Exceptions: For cross-domain logins, add exceptions for both sites + * e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on) + * [WARNING] Be selective with what sites you "Allow", as they also disable partitioning (1767271) + * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow (when on the website in question) + * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ +user_pref("privacy.clearOnShutdown_v2.cookiesAndStorage", true); + +/** SANITIZE SITE DATA: IGNORES "ALLOW" SITE EXCEPTIONS ***/ +/* 2820: set manual "Clear Data" items [SETUP-CHROME] [FF128+] + * Firefox remembers your last choices. This will reset them when you start Firefox + * [SETTING] Privacy & Security>Browser Privacy>Cookies and Site Data>Clear Data ***/ +user_pref("privacy.clearSiteData.cache", true); +user_pref("privacy.clearSiteData.cookiesAndStorage", false); // keep false until it respects "allow" site exceptions +user_pref("privacy.clearSiteData.historyFormDataAndDownloads", true); + // user_pref("privacy.clearSiteData.siteSettings", false); +/* 2821: set manual "Clear Data" items [FF136+] ***/ +user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", true); +user_pref("privacy.clearSiteData.formdata", true); + +/** SANITIZE HISTORY: IGNORES "ALLOW" SITE EXCEPTIONS ***/ +/* 2830: set manual "Clear History" items, also via Ctrl-Shift-Del [SETUP-CHROME] [FF128+] + * Firefox remembers your last choices. This will reset them when you start Firefox + * [SETTING] Privacy & Security>History>Custom Settings>Clear History ***/ +user_pref("privacy.clearHistory.cache", true); // [DEFAULT: true] +user_pref("privacy.clearHistory.cookiesAndStorage", false); +user_pref("privacy.clearHistory.historyFormDataAndDownloads", true); // [DEFAULT: true] + // user_pref("privacy.clearHistory.siteSettings", false); // [DEFAULT: false] +/* 2831: set manual "Clear History" items [FF136+] ***/ +user_pref("privacy.clearHistory.browsingHistoryAndDownloads", true); // [DEFAULT: true] +user_pref("privacy.clearHistory.formdata", true); + +/** SANITIZE MANUAL: TIMERANGE ***/ +/* 2840: set "Time range to clear" for "Clear Data" (2820+) and "Clear History" (2830+) + * Firefox remembers your last choice. This will reset the value when you start Firefox + * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today + * [NOTE] Values 5 (last 5 minutes) and 6 (last 24 hours) are not listed in the dropdown, + * which will display a blank value, and are not guaranteed to work ***/ +user_pref("privacy.sanitize.timeSpan", 0); + +/*** [SECTION 4000]: FPP (fingerprintingProtection) + RFP (4501) overrides FPP + + In FF118+ FPP is on by default in private windows (4001) and in FF119+ is controlled + by ETP (2701). FPP will also use Remote Services in future to relax FPP protections + on a per site basis for compatibility (4004). + + https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargetsDefault.inc + + [NOTE] RFPTargets + granular overrides are somewhat experimental and may produce unexpected results + - e.g. FrameRate can only be controlled per process, not per origin + + 1826408 - restrict fonts to system (kBaseFonts + kLangPackFonts) (Windows, Mac, some Linux) + https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc + 1858181 - subtly randomize canvas per eTLD+1, per session and per window-mode (FF120+) +***/ +user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!"); +/* 4001: enable FPP in PB mode [FF114+] + * [NOTE] In FF119+, FPP for all modes (7016) is enabled with ETP Strict (2701) ***/ + // user_pref("privacy.fingerprintingProtection.pbmode", true); // [DEFAULT: true] +/* 4002: set global FPP overrides [FF114+] + * uses "RFPTargets" [1] which despite the name these are not used by RFP + * e.g. "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC" = all targets but allow prefers-color-scheme and do not change timezone + * e.g. "-AllTargets,+CanvasRandomization,+JSDateTimeUTC" = no targets but do use FPP canvas and change timezone + * [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults + * [1] https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargets.inc ***/ + // user_pref("privacy.fingerprintingProtection.overrides", ""); +/* 4003: set granular FPP overrides + * JSON format: e.g."[{\"firstPartyDomain\": \"netflix.com\", \"overrides\": \"-CanvasRandomization,-FrameRate,\"}]" + * [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults ***/ + // user_pref("privacy.fingerprintingProtection.granularOverrides", ""); +/* 4004: disable remote FPP overrides [FF127+] ***/ + // user_pref("privacy.fingerprintingProtection.remoteOverrides.enabled", false); + +/*** [SECTION 4500]: OPTIONAL RFP (resistFingerprinting) + RFP overrides FPP (4000) + + FF128+ Arkenfox by default uses FPP (automatically enabled with ETP Strict). For most people + this is all you need. To use RFP instead, add RFP (4501) to your overrides, and optionally + add letterboxing (4504), spoof_english (4506), and webgl (4520). + + RFP is an all-or-nothing buy in: you cannot pick and choose what parts you want + + [WARNING] DO NOT USE extensions to alter RFP protected metrics + + 418986 - limit window.screen & CSS media queries (FF41) + 1360039 - spoof navigator.hardwareConcurrency as 2 (FF55) + FF56 + 1333651 - spoof User Agent & Navigator API + JS: spoofed as Windows 10, OS 10.15, Android 10, or Linux + HTTP Header: spoofed as Windows 10 or Android 10.15 until FF136 then matches JS spoof + 1369319 - disable device sensor API + 1369357 - disable site specific zoom + 1337161 - hide gamepads from content + 1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true + 1333641 - reduce fingerprinting in WebSpeech API + FF57 + 1369309 - spoof media statistics + 1382499 - reduce screen co-ordinate fingerprinting in Touch API + 1217290 & 1409677 - enable some fingerprinting resistance for WebGL + 1354633 - limit MediaError.message to a whitelist + FF58+ + 1372073 - spoof/block fingerprinting in MediaDevices API (FF59) + Spoof: enumerate devices as one "Internal Camera" and one "Internal Microphone" + Block: suppresses the ondevicechange event + 1039069 - warn when language prefs are not set to "en*" (FF59) + 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59) + Spoofing mimics the content language of the document. Currently it only supports en-US. + Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected. + 1337157 - disable WebGL debug renderer info (FF60) + 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62) + 1479239 - return "no-preference" with prefers-reduced-motion (FF63) + 1363508 & 1826051 - spoof/suppress Pointer Events (FF64, FF132) + 1492766 - spoof pointerEvent.pointerid (FF65) + 1485266 - disable exposure of system colors to CSS or canvas (FF67) + 1494034 - return "light" with prefers-color-scheme (FF67) + 1564422 - spoof audioContext outputLatency (FF70) + 1595823 - return audioContext sampleRate as 44100 (FF72) + 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74) + 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78) + 1506364 - return "no-preference" with prefers-contrast (FF80) + 1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80) + 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82) + 531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1) + 1756280 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF100-115) + 1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms) (FF102) + 1422237 - return "srgb" with color-gamut (FF110) + 1794628 - return "none" with inverted-colors (FF114) + 1787790 - normalize system fonts (FF128) + 1835987 - spoof timezone as Atlantic/Reykjavik (previously FF55+ was UTC) (FF128) + 1834307 - always use smooth scrolling (FF132) + 1918202 - spoof screen orientation based on spoofed screen size and platform (FF132) + previously it always returned landscape-primary and an angle of 0 (FF50+) + 1390465 - load all subtitles in WebVTT (Video Text Tracks) (FF133) + 1873382 - make spoofed devicePixelRatio and CSS media queries match (FF133) + previously FF41+ devicePixelRatio was hardcoded as 1 and FF127+ as 2 + previously FF41+ CSS media queries were spoofed as zoom level at a devicePixelRatio of 1 +***/ +user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); +/* 4501: enable RFP + * [NOTE] pbmode applies if true and the original pref is false + * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a canvas site exception via the urlbar. + * RFP also has a few side effects: mainly that timezone is GMT, and websites will prefer light theme ***/ + // user_pref("privacy.resistFingerprinting", true); // [FF41+] + // user_pref("privacy.resistFingerprinting.pbmode", true); // [FF114+] +/* 4502: set RFP new window size max rounded values [FF55+] + * [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen + * [1] https://bugzilla.mozilla.org/1330882 ***/ +user_pref("privacy.window.maxInnerWidth", 1600); +user_pref("privacy.window.maxInnerHeight", 900); +/* 4503: disable mozAddonManager Web API [FF57+] + * [NOTE] To allow extensions to work on AMO, you also need 2662 + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ +user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); +/* 4504: enable letterboxing [FF67+] + * Dynamically resizes the inner window by applying margins in stepped ranges [2] + * If you use the dimension pref, then it will only apply those resolutions. + * The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000") + * [SETUP-WEB] This is independent of RFP (4501). If you're not using RFP, or you are but + * dislike the margins, then flip this pref, keeping in mind that it is effectively fingerprintable + * [WARNING] DO NOT USE: the dimension pref is only meant for testing + * [1] https://bugzilla.mozilla.org/1407366 + * [2] https://hg.mozilla.org/mozilla-central/rev/7211cb4f58ff#l5.13 ***/ + // user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] + // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF] +/* 4505: disable RFP by domain [FF91+] + * [NOTE] Working examples: "arkenfox.github.io", "*github.io" + * Non-working examples: "https://arkenfox.github.io", "github.io", "*arkenfox.github.io" ***/ + // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); +/* 4506: disable RFP spoof english prompt [FF59+] + * 0=prompt, 1=disabled, 2=enabled + * [NOTE] When changing from value 2, preferred languages ('intl.accept_languages') is not reset. + * [SETUP-WEB] when enabled, sets 'en-US, en' for displaying pages and 'en-US' as locale. + * [SETTING] General>Language>Choose your preferred language for displaying pages>Choose>Request English... ***/ +user_pref("privacy.spoof_english", 1); +/* 4510: disable using system colors + * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ +user_pref("browser.display.use_system_colors", false); // [DEFAULT: false NON-WINDOWS] +/* 4511: disable using system accent colors ***/ +user_pref("widget.non-native-theme.use-theme-accent", false); // [DEFAULT: false WINDOWS] +/* 4512: enforce links targeting new windows to open in a new tab instead + * 1=most recent window or tab, 2=new window, 3=new tab + * Stops malicious window sizes and some screen resolution leaks. + * You can still right-click a link and open in a new window + * [SETTING] General>Tabs>Open links in tabs instead of new windows + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ +user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3] +/* 4513: set all open window methods to abide by "browser.link.open_newwindow" (4512) + * [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js ***/ +user_pref("browser.link.open_newwindow.restriction", 0); +/* 4520: disable WebGL (Web Graphics Library) ***/ + // user_pref("webgl.disabled", true); + +/*** [SECTION 5000]: OPTIONAL OPSEC + Disk avoidance, application data isolation, eyeballs... +***/ +user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow"); +/* 5001: start Firefox in PB (Private Browsing) mode + * [NOTE] In this mode all windows are "private windows" and the PB mode icon is not displayed + * [NOTE] The P in PB mode can be misleading: it means no "persistent" disk state such as history, + * caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode). + * In fact, PB mode limits or removes the ability to control some of these, and you need to quit + * Firefox to clear them. PB is best used as a one off window (Menu>New Private Window) to provide + * a temporary self-contained new session. Close all private windows to clear the PB session. + * [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode + * [1] https://wiki.mozilla.org/Private_Browsing + * [2] https://support.mozilla.org/kb/common-myths-about-private-browsing ***/ + // user_pref("browser.privatebrowsing.autostart", true); +/* 5002: disable memory cache + * capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/ + // user_pref("browser.cache.memory.enable", false); + // user_pref("browser.cache.memory.capacity", 0); +/* 5003: disable saving passwords + * [NOTE] This does not clear any passwords already saved + * [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/ + // user_pref("signon.rememberSignons", false); +/* 5004: disable permissions manager from writing to disk [FF41+] [RESTART] + * [NOTE] This means any permission changes are session only + * [1] https://bugzilla.mozilla.org/967812 ***/ + // user_pref("permissions.memory_only", true); // [HIDDEN PREF] +/* 5005: disable intermediate certificate caching [FF41+] [RESTART] + * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. + * Saved logins and passwords are not available. Reset the pref and restart to return them ***/ + // user_pref("security.nocertdb", true); +/* 5006: disable favicons in history and bookmarks + * [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your + * actual history (and bookmarks) already do. Your history is more detailed, so + * control that instead; e.g. disable history, clear history on exit, use PB mode + * [NOTE] favicons.sqlite is sanitized on Firefox close ***/ + // user_pref("browser.chrome.site_icons", false); +/* 5007: exclude "Undo Closed Tabs" in Session Restore ***/ + // user_pref("browser.sessionstore.max_tabs_undo", 0); +/* 5008: disable resuming session from crash + * [TEST] about:crashparent ***/ + // user_pref("browser.sessionstore.resume_from_crash", false); +/* 5009: disable "open with" in download dialog [FF50+] + * Application data isolation [1] + * [1] https://bugzilla.mozilla.org/1281959 ***/ + // user_pref("browser.download.forbid_open_with", true); +/* 5010: disable location bar suggestion types + * [SETTING] Search>Address Bar>When using the address bar, suggest ***/ + // user_pref("browser.urlbar.suggest.history", false); + // user_pref("browser.urlbar.suggest.bookmark", false); + // user_pref("browser.urlbar.suggest.openpage", false); + // user_pref("browser.urlbar.suggest.topsites", false); // [FF78+] +/* 5011: disable location bar dropdown + * This value controls the total number of entries to appear in the location bar dropdown ***/ + // user_pref("browser.urlbar.maxRichResults", 0); +/* 5012: disable location bar autofill + * [1] https://support.mozilla.org/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/ + // user_pref("browser.urlbar.autoFill", false); +/* 5013: disable browsing and download history + * [NOTE] We also clear history and downloads on exit (2811+) + * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/ + // user_pref("places.history.enabled", false); +/* 5014: disable Windows jumplist [WINDOWS] ***/ + // user_pref("browser.taskbar.lists.enabled", false); + // user_pref("browser.taskbar.lists.frequent.enabled", false); + // user_pref("browser.taskbar.lists.recent.enabled", false); + // user_pref("browser.taskbar.lists.tasks.enabled", false); +/* 5016: discourage downloading to desktop + * 0=desktop, 1=downloads (default), 2=custom + * [SETTING] To set your custom default "downloads": General>Downloads>Save files to ***/ + // user_pref("browser.download.folderList", 2); +/* 5017: disable Form Autofill + * If .supportedCountries includes your region (browser.search.region) and .supported + * is "detect" (default), then the UI will show. Stored data is not secure, uses JSON + * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses + * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ + // user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] + // user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] +/* 5018: limit events that can cause a pop-up ***/ + // user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); +/* 5019: disable page thumbnail collection ***/ + // user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] +/* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/ + // user_pref("alerts.useSystemBackend.windows.notificationserver.enabled", false); +/* 5021: disable location bar using search + * Don't leak URL typos to a search engine, give an error message instead + * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com" + * [NOTE] This does not affect explicit user action such as using search buttons in the + * dropdown, or using keyword search shortcuts you configure in options (e.g. "d" for DuckDuckGo) ***/ + // user_pref("keyword.enabled", false); + +/*** [SECTION 5500]: OPTIONAL HARDENING + Not recommended. Overriding these can cause breakage and performance issues, + they are mostly fingerprintable, and the threat model is practically nonexistent +***/ +user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!"); +/* 5501: disable MathML (Mathematical Markup Language) [FF51+] + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mathml ***/ + // user_pref("mathml.disabled", true); // 1173199 +/* 5502: disable in-content SVG (Scalable Vector Graphics) [FF53+] + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+svg ***/ + // user_pref("svg.disabled", true); // 1216893 +/* 5503: disable graphite + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+graphite + * [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/ + // user_pref("gfx.font_rendering.graphite.enabled", false); +/* 5504: disable asm.js [FF22+] + * [1] http://asmjs.org/ + * [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js + * [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ + // user_pref("javascript.options.asmjs", false); +/* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART] + * [NOTE] When both Ion and JIT are disabled, and trustedprincipals + * is enabled, then Ion can still be used by extensions (1599226) + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit + * [2] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ ***/ + // user_pref("javascript.options.ion", false); + // user_pref("javascript.options.baselinejit", false); + // user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF] +/* 5506: disable WebAssembly [FF52+] + * Vulnerabilities [1] have increasingly been found, including those known and fixed + * in native programs years ago [2]. WASM has powerful low-level access, making + * certain attacks (brute-force) and vulnerabilities more possible + * [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3] + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm + * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly + * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ + // user_pref("javascript.options.wasm", false); +/* 5507: disable rendering of SVG OpenType fonts ***/ + // user_pref("gfx.font_rendering.opentype_svg.enabled", false); +/* 5508: disable all DRM content (EME: Encryption Media Extension) + * Optionally hide the UI setting which also disables the DRM prompt + * [SETTING] General>DRM Content>Play DRM-controlled content + * [TEST] https://bitmovin.com/demos/drm + * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ + // user_pref("media.eme.enabled", false); + // user_pref("browser.eme.ui.enabled", false); +/* 5509: disable IPv6 if using a VPN + * This is an application level fallback. Disabling IPv6 is best done at an OS/network + * level, and/or configured properly in system wide VPN setups. + * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" + * [SETUP-WEB] PR_CONNECT_RESET_ERROR + * [TEST] https://ipleak.org/ + * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/ + // user_pref("network.dns.disableIPv6", true); +/* 5510: control when to send a cross-origin referer + * 0=always (default), 1=only if base domains match, 2=only if hosts match + * [NOTE] Will cause breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram ***/ + // user_pref("network.http.referer.XOriginPolicy", 2); +/* 5511: set DoH bootstrap address [FF89+] + * Firefox uses the system DNS to initially resolve the IP address of your DoH server. + * When set to a valid, working value that matches your "network.trr.uri" (0712) Firefox + * won't use the system DNS. If the IP doesn't match then DoH won't work ***/ + // user_pref("network.trr.bootstrapAddr", "10.0.0.1"); // [HIDDEN PREF] + +/*** [SECTION 6000]: DON'T TOUCH ***/ +user_pref("_user.js.parrot", "6000 syntax error: the parrot's 'istory!"); +/* 6001: enforce Firefox blocklist + * [WHY] It includes updates for "revoked certificates" + * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/ +user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] +/* 6002: enforce no referer spoofing + * [WHY] Spoofing can affect CSRF (Cross-Site Request Forgery) protections ***/ +user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] +/* 6004: enforce a security delay on some confirmation dialogs such as install, open/save + * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ +user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] +/* 6008: enforce no First Party Isolation [FF51+] + * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), and enabling FPI + * disables those. FPI is no longer maintained except at Tor Project for Tor Browser's config ***/ +user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false] +/* 6009: enforce SmartBlock shims (about:compat) [FF81+] + * [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/ +user_pref("extensions.webcompat.enable_shims", true); // [HIDDEN PREF] [DEFAULT: true] +/* 6010: enforce no TLS 1.0/1.1 downgrades + * [TEST] https://tls-v1-1.badssl.com:1010/ ***/ +user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false] +/* 6011: enforce disabling of Web Compatibility Reporter [FF56+] + * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla + * [WHY] To prevent wasting Mozilla's time with a custom setup ***/ +user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] +/* 6012: enforce Quarantined Domains [FF115+] + * [WHY] https://support.mozilla.org/kb/quarantined-domains */ +user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true] +/* 6050: prefsCleaner: reset previously active items removed from arkenfox FF128+ ***/ + // user_pref("privacy.clearOnShutdown.cache", ""); + // user_pref("privacy.clearOnShutdown.cookies", ""); + // user_pref("privacy.clearOnShutdown.downloads", ""); + // user_pref("privacy.clearOnShutdown.formdata", ""); + // user_pref("privacy.clearOnShutdown.history", ""); + // user_pref("privacy.clearOnShutdown.offlineApps", ""); + // user_pref("privacy.clearOnShutdown.sessions", ""); + // user_pref("privacy.cpd.cache", ""); + // user_pref("privacy.cpd.cookies", ""); + // user_pref("privacy.cpd.formdata", ""); + // user_pref("privacy.cpd.history", ""); + // user_pref("privacy.cpd.offlineApps", ""); + // user_pref("privacy.cpd.sessions", ""); + +/*** [SECTION 7000]: DON'T BOTHER ***/ +user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); +/* 7001: disable APIs + * Location-Aware Browsing, Full Screen + * [WHY] The API state is easily fingerprintable. + * Geo is behind a prompt (7002). Full screen requires user interaction ***/ + // user_pref("geo.enabled", false); + // user_pref("full-screen-api.enabled", false); +/* 7002: set default permissions + * Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+] + * 0=always ask (default), 1=allow, 2=block + * [WHY] These are fingerprintable via Permissions API, except VR. Just add site + * exceptions as allow/block for frequently visited/annoying sites: i.e. not global + * [SETTING] to add site exceptions: Ctrl+I>Permissions> + * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ + // user_pref("permissions.default.geo", 0); + // user_pref("permissions.default.camera", 0); + // user_pref("permissions.default.microphone", 0); + // user_pref("permissions.default.desktop-notification", 0); + // user_pref("permissions.default.xr", 0); // Virtual Reality +/* 7003: disable non-modern cipher suites [1] + * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks + * [1] https://browserleaks.com/ssl ***/ + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); + // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); + // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS + // user_pref("security.ssl3.rsa_aes_256_gcm_sha384", false); // no PFS + // user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS + // user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS +/* 7004: control TLS versions + * [WHY] Passive fingerprinting and security ***/ + // user_pref("security.tls.version.min", 3); // [DEFAULT: 3] + // user_pref("security.tls.version.max", 4); +/* 7005: disable SSL session IDs [FF36+] + * [WHY] Passive fingerprinting and perf costs. These are session-only + * and isolated with network partitioning (FF85+) and/or containers ***/ + // user_pref("security.ssl.disable_session_identifiers", true); +/* 7007: referers + * [WHY] Only cross-origin referers (1602, 5510) matter ***/ + // user_pref("network.http.sendRefererHeader", 2); + // user_pref("network.http.referer.trimmingPolicy", 0); +/* 7008: set the default Referrer Policy [FF59+] + * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade + * [WHY] Defaults are fine. They can be overridden by a site-controlled Referrer Policy ***/ + // user_pref("network.http.referer.defaultPolicy", 2); // [DEFAULT: 2] + // user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2] +/* 7010: disable HTTP Alternative Services [FF37+] + * [WHY] Already isolated with network partitioning (FF85+) ***/ + // user_pref("network.http.altsvc.enabled", false); +/* 7011: disable website control over browser right-click context menu + * [WHY] Just use Shift-Right-Click ***/ + // user_pref("dom.event.contextmenu.enabled", false); +/* 7012: disable icon fonts (glyphs) and local fallback rendering + * [WHY] Breakage, font fallback is equivalency, also RFP + * [1] https://bugzilla.mozilla.org/789788 + * [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/ + // user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+] + // user_pref("gfx.downloadable_fonts.fallback_delay", -1); +/* 7013: disable Clipboard API + * [WHY] Fingerprintable. Breakage. Cut/copy/paste require user + * interaction, and paste is limited to focused editable fields ***/ + // user_pref("dom.event.clipboardevents.enabled", false); +/* 7014: disable System Add-on updates + * [WHY] It can compromise security. System addons ship with prefs, use those ***/ + // user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] + // user_pref("extensions.systemAddon.update.url", ""); // [FF44+] +/* 7015: enable the DNT (Do Not Track) HTTP header + * [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/ + // user_pref("privacy.donottrackheader.enabled", true); +/* 7016: customize ETP settings + * [NOTE] FPP (fingerprintingProtection) is ignored when RFP (4501) is enabled + * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ + // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5] + // user_pref("network.cookie.cookieBehavior.optInPartitioning", true); // [ETP FF132+] + // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); + // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] + // user_pref("privacy.bounceTrackingProtection.mode", 1); // [FF131+] [ETP FF133+] + // user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+] + // user_pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT: true] + // user_pref("privacy.query_stripping.enabled", true); // [FF101+] + // user_pref("privacy.trackingprotection.enabled", true); + // user_pref("privacy.trackingprotection.socialtracking.enabled", true); + // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] + // user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] +/* 7017: disable service workers + * [WHY] Already isolated with TCP (2701) behind a pref (2710) ***/ + // user_pref("dom.serviceWorkers.enabled", false); +/* 7018: disable Web Notifications [FF22+] + * [WHY] Web Notifications are behind a prompt (7002) + * [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ ***/ + // user_pref("dom.webnotifications.enabled", false); +/* 7019: disable Push Notifications [FF44+] + * [WHY] Website "push" requires subscription, and the API is required for CRLite (1224) + * [NOTE] To remove all subscriptions, reset "dom.push.userAgentID" + * [1] https://support.mozilla.org/kb/push-notifications-firefox ***/ + // user_pref("dom.push.enabled", false); +/* 7020: disable WebRTC (Web Real-Time Communication) + * [WHY] Firefox desktop uses mDNS hostname obfuscation and the private IP is never exposed until + * required in TRUSTED scenarios; i.e. after you grant device (microphone or camera) access + * [TEST] https://browserleaks.com/webrtc + * [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ + * [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 ***/ + // user_pref("media.peerconnection.enabled", false); +/* 7021: enable GPC (Global Privacy Control) in non-PB windows + * [WHY] Passive and active fingerprinting. Mostly redundant with Tracking Protection + * in ETP Strict (2701) and sanitizing on close (2800s) ***/ + // user_pref("privacy.globalprivacycontrol.enabled", true); + +/*** [SECTION 8000]: DON'T BOTHER: FINGERPRINTING + [WHY] They are insufficient to help anti-fingerprinting and do more harm than good + [WARNING] DO NOT USE with RFP. RFP already covers these and they can interfere +***/ +user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan"); +/* 8001: prefsCleaner: reset items useless for anti-fingerprinting ***/ + // user_pref("browser.display.use_document_fonts", ""); + // user_pref("browser.zoom.siteSpecific", ""); + // user_pref("device.sensors.enabled", ""); + // user_pref("dom.enable_performance", ""); + // user_pref("dom.enable_resource_timing", ""); + // user_pref("dom.gamepad.enabled", ""); + // user_pref("dom.maxHardwareConcurrency", ""); + // user_pref("dom.w3c_touch_events.enabled", ""); + // user_pref("dom.webaudio.enabled", ""); + // user_pref("font.system.whitelist", ""); + // user_pref("general.appname.override", ""); + // user_pref("general.appversion.override", ""); + // user_pref("general.buildID.override", ""); + // user_pref("general.oscpu.override", ""); + // user_pref("general.platform.override", ""); + // user_pref("general.useragent.override", ""); + // user_pref("media.navigator.enabled", ""); + // user_pref("media.ondevicechange.enabled", ""); + // user_pref("media.video_stats.enabled", ""); + // user_pref("media.webspeech.synth.enabled", ""); + // user_pref("ui.use_standins_for_native_colors", ""); + // user_pref("webgl.enable-debug-renderer-info", ""); + +/*** [SECTION 8500]: TELEMETRY + Arkenfox does not consider Firefox telemetry to be a privacy or security concern - comments below. + But since most arkenfox users prefer it disabled, we'll do that rather than cause overrides. + + Opt-out + - Telemetry is essential: a browser engine is a _very_ large complex beast costing billions to maintain + - Opt-in telemetry _does not_ work and results in data that is unrepresentative and may be misleading + Choice + - Every new profile on first use provides data collection/use policy and the abillty to opt-out + - It can be disabled at any time (Settings>Privacy & Security>Data Collection and Use) + Data + - no PII (Personally Identifiable Information) + - can be viewed in about:telemetry + - uses Prio [1][2][3], Glean [4], Oblivious HTTP [5][6] + + [1] https://crypto.stanford.edu/prio/ + [2] https://hacks.mozilla.org/2018/10/testing-privacy-preserving-telemetry-with-prio/ + [3] https://blog.mozilla.org/security/2019/06/06/next-steps-in-privacy-preserving-telemetry-with-prio/ + [4] https://firefox-source-docs.mozilla.org/toolkit/components/glean/index.html + [5] https://firefox-source-docs.mozilla.org/toolkit/components/glean/user/ohttp.html + [6] https://blog.mozilla.org/en/tag/oblivious-http/ +***/ +user_pref("_user.js.parrot", "8500 syntax error: the parrot's off the twig!"); +/* 8500: disable new data submission [FF41+] + * If disabled, no policy is shown or upload takes place, ever + * [1] https://bugzilla.mozilla.org/1195552 ***/ +user_pref("datareporting.policy.dataSubmissionEnabled", false); +/* 8501: disable Health Reports + * [SETTING] Privacy & Security>Firefox Data Collection and Use>Send technical... data ***/ +user_pref("datareporting.healthreport.uploadEnabled", false); +/* 0802: disable telemetry + * The "unified" pref affects the behavior of the "enabled" pref + * - If "unified" is false then "enabled" controls the telemetry module + * - If "unified" is true then "enabled" only controls whether to record extended data + * [NOTE] "toolkit.telemetry.enabled" is now LOCKED to reflect prerelease (true) or release builds (false) [2] * [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html * [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/ user_pref("toolkit.telemetry.unified", false); @@ -226,1481 +1218,31 @@ user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+] user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+] user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+] -/* 0331: disable Telemetry Coverage +/* 8503: disable Telemetry Coverage * [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/ user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF] user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF] user_pref("toolkit.coverage.endpoint.base", ""); -/* 0340: disable Health Reports - * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send technical... data ***/ -user_pref("datareporting.healthreport.uploadEnabled", false); -/* 0341: disable new data submission, master kill switch [FF41+] - * If disabled, no policy is shown or upload takes place, ever - * [1] https://bugzilla.mozilla.org/1195552 ***/ -user_pref("datareporting.policy.dataSubmissionEnabled", false); -/* 0342: disable Studies (see 0503) - * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to install and run studies ***/ -user_pref("app.shield.optoutstudies.enabled", false); -/* 0343: disable personalized Extension Recommendations in about:addons and AMO [FF65+] - * [NOTE] This pref has no effect when Health Reports (0340) are disabled - * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to make personalized extension recommendations - * [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/ -user_pref("browser.discovery.enabled", false); -/* 0350: disable Crash Reports ***/ -user_pref("breakpad.reportURL", ""); -user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+] - // user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] [DEFAULT: false] -/* 0351: enforce no submission of backlogged Crash Reports [FF58+] - * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send backlogged crash reports ***/ -user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [DEFAULT: false] -/* 0390: disable Captive Portal detection - * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy - * [2] https://wiki.mozilla.org/Necko/CaptivePortal ***/ -user_pref("captivedetect.canonicalURL", ""); -user_pref("network.captive-portal-service.enabled", false); // [FF52+] -/* 0391: disable Network Connectivity checks [FF65+] - * [1] https://bugzilla.mozilla.org/1460537 ***/ -user_pref("network.connectivity-service.enabled", false); -/*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING (SB) ***/ -user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); -/** BLOCKLISTS ***/ -/* 0401: enforce Firefox blocklist - * [NOTE] It includes updates for "revoked certificates" - * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/ -user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] +/*** [SECTION 9000]: NON-PROJECT RELATED ***/ +user_pref("_user.js.parrot", "9000 syntax error: the parrot's cashed in 'is chips!"); +/* 9001: disable welcome notices ***/ +user_pref("browser.startup.homepage_override.mstone", "ignore"); // [HIDDEN PREF] +/* 9002: disable General>Browsing>Recommend extensions/features as you browse [FF67+] ***/ +user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false); +user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false); +/* 9004: disable search terms [FF110+] + * [SETTING] Search>Search Bar>Use the address bar for search and navigation>Show search terms instead of URL... ***/ +user_pref("browser.urlbar.showSearchTerms.enabled", false); -/** SAFE BROWSING (SB) - Safe Browsing has taken many steps to preserve privacy. *IF* required, a full url is never - sent to Google, only a PART-hash of the prefix, and this is hidden with noise of other real - PART-hashes. Google also swear it is anonymized and only used to flag malicious sites. - Firefox also takes measures such as striping out identifying parameters and since SBv4 (FF57+) - doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity) - - #Required reading [#] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ - [1] https://wiki.mozilla.org/Security/Safe_Browsing - [2] https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work -***/ -/* 0410: disable SB (Safe Browsing) - * [WARNING] Do this at your own risk! These are the master switches. - * [SETTING] Privacy & Security>Security>... "Block dangerous and deceptive content" ***/ - // user_pref("browser.safebrowsing.malware.enabled", false); - // user_pref("browser.safebrowsing.phishing.enabled", false); -/* 0411: disable SB checks for downloads (both local lookups + remote) - * This is the master switch for the safebrowsing.downloads* prefs (0412, 0413) - * [SETTING] Privacy & Security>Security>... "Block dangerous downloads" ***/ - // user_pref("browser.safebrowsing.downloads.enabled", false); -/* 0412: disable SB checks for downloads (remote) - * To verify the safety of certain executable files, Firefox may submit some information about the - * file, including the name, origin, size and a cryptographic hash of the contents, to the Google - * Safe Browsing service which helps Firefox determine whether or not the file should be blocked - * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override it ***/ -user_pref("browser.safebrowsing.downloads.remote.enabled", false); -user_pref("browser.safebrowsing.downloads.remote.url", ""); -/* 0413: disable SB checks for unwanted software - * [SETTING] Privacy & Security>Security>... "Warn you about unwanted and uncommon software" ***/ - // user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); - // user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); -/* 0419: disable 'ignore this warning' on SB warnings [FF45+] - * If clicked, it bypasses the block for that session. This is a means for admins to enforce SB - * [TEST] see github wiki APPENDIX A: Test Sites: Section 5 - * [1] https://bugzilla.mozilla.org/1226490 ***/ - // user_pref("browser.safebrowsing.allowOverride", false); - -/*** [SECTION 0500]: SYSTEM ADD-ONS / EXPERIMENTS - System Add-ons are a method for shipping extensions, considered to be - built-in features to Firefox, that are hidden from the about:addons UI. - To view your System Add-ons go to about:support, they are listed under "Firefox Features" - - Some System Add-ons have no on-off prefs. Instead you can manually remove them. Note that app - updates will restore them. They may also be updated and possibly restored automatically (see 0505) - * Portable: "...\App\Firefox64\browser\features\" (or "App\Firefox\etc" for 32bit) - * Windows: "...\Program Files\Mozilla\browser\features" (or "Program Files (X86)\etc" for 32bit) - * Mac: "...\Applications\Firefox\Contents\Resources\browser\features\" - [NOTE] On Mac you can right-click on the application and select "Show Package Contents" - * Linux: "/usr/lib/firefox/browser/features" (or similar) - - [1] https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html - [2] https://dxr.mozilla.org/mozilla-central/source/browser/extensions -***/ -user_pref("_user.js.parrot", "0500 syntax error: the parrot's cashed in 'is chips!"); -/* 0503: disable Normandy/Shield [FF60+] - * Shield is an telemetry system (including Heartbeat) that can also push and test "recipes" - * [1] https://wiki.mozilla.org/Firefox/Shield - * [2] https://github.com/mozilla/normandy ***/ -user_pref("app.normandy.enabled", false); -user_pref("app.normandy.api_url", ""); -/* 0505: disable System Add-on updates ***/ -user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] -user_pref("extensions.systemAddon.update.url", ""); // [FF44+] -/* 0506: disable PingCentre telemetry (used in several System Add-ons) [FF57+] - * Currently blocked by 'datareporting.healthreport.uploadEnabled' (see 0340) ***/ -user_pref("browser.ping-centre.telemetry", false); -/* 0515: disable Screenshots ***/ - // user_pref("extensions.screenshots.disabled", true); // [FF55+] -/* 0517: disable Form Autofill - * [NOTE] Stored data is NOT secure (uses a JSON file) - * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes - * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses - * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ -user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] -user_pref("extensions.formautofill.available", "off"); // [FF56+] -user_pref("extensions.formautofill.creditCards.available", false); // [FF57+] -user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] -user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] -/* 0518: enforce disabling of Web Compatibility Reporter [FF56+] - * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla ***/ -user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] - -/*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/ -user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!"); -/* 0601: disable link prefetching - * [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/ -user_pref("network.prefetch-next", false); -/* 0602: disable DNS prefetching - * [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/ -user_pref("network.dns.disablePrefetch", true); - // user_pref("network.dns.disablePrefetchFromHTTPS", true); // [DEFAULT: true] -/* 0603: disable predictor / prefetching ***/ -user_pref("network.predictor.enabled", false); - // user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false] -/* 0605: disable link-mouseover opening connection to linked server - * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/ -user_pref("network.http.speculative-parallel-limit", 0); -/* 0606: enforce no "Hyperlink Auditing" (click tracking) - * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/ - // user_pref("browser.send_pings", false); // [DEFAULT: false] - -/*** [SECTION 0700]: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc ***/ -user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!"); -/* 0701: disable IPv6 - * IPv6 can be abused, especially with MAC addresses, and can leak with VPNs. That's even - * assuming your ISP and/or router and/or website can handle it. Sites will fall back to IPv4 - * [STATS] Firefox telemetry (Dec 2020) shows ~8% of all connections are IPv6 - * [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an - * OS/network level, and/or configured properly in VPN setups. If you are not masking your IP, - * then this won't make much difference. If you are masking your IP, then it can only help. - * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" - * [TEST] https://ipleak.org/ - * [1] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/ -user_pref("network.dns.disableIPv6", true); -/* 0702: disable HTTP2 - * HTTP2 raises concerns with "multiplexing" and "server push", does nothing to - * enhance privacy, and opens up a number of server-side fingerprinting opportunities. - * [WARNING] Don't disable HTTP2. Don't be that one person using HTTP1.1 on HTTP2 sites - * [STATS] Over 50% of sites (April 2021) and growing [5] - * [1] https://http2.github.io/faq/ - * [2] https://blog.scottlogic.com/2014/11/07/http-2-a-quick-look.html - * [3] https://http2.github.io/http2-spec/#rfc.section.10.8 - * [4] https://queue.acm.org/detail.cfm?id=2716278 - * [5] https://w3techs.com/technologies/details/ce-http2/all/all ***/ - // user_pref("network.http.spdy.enabled", false); - // user_pref("network.http.spdy.enabled.deps", false); - // user_pref("network.http.spdy.enabled.http2", false); - // user_pref("network.http.spdy.websockets", false); // [FF65+] -/* 0703: disable HTTP Alternative Services [FF37+] - * [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the - * consequences. FPI isolates these, but it was designed with the Tor protocol in mind, - * and the Tor Browser has extra protection, including enhanced sanitizing per Identity. - * [1] https://tools.ietf.org/html/rfc7838#section-9 - * [2] https://www.mnot.net/blog/2016/03/09/alt-svc ***/ -user_pref("network.http.altsvc.enabled", false); -user_pref("network.http.altsvc.oe", false); -/* 0704: enforce the proxy server to do any DNS lookups when using SOCKS - * e.g. in Tor, this stops your local DNS server from knowing your Tor destination - * as a remote Tor node will handle the DNS request - * [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/ -user_pref("network.proxy.socks_remote_dns", true); -/* 0708: disable FTP [FF60+] ***/ - // user_pref("network.ftp.enabled", false); // [DEFAULT: false FF88+] -/* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+] - * [SETUP-CHROME] Can break extensions for profiles on network shares - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/ -user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] -/* 0710: disable GIO as a potential proxy bypass vector - * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda, - * gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64) - * [1] https://bugzilla.mozilla.org/1433507 - * [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/23044 - * [3] https://en.wikipedia.org/wiki/GVfs - * [4] https://en.wikipedia.org/wiki/GIO_(software) ***/ -user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] - -/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS - Change items 0850 and above to suit for privacy vs convenience and functionality. Consider - your environment (no unwanted eyeballs), your device (restricted access), your device's - unattended state (locked, encrypted, forensic hardened). Likewise, you may want to check - the items cleared on shutdown in section 2800. - [NOTE] The urlbar is also commonly referred to as the location bar and address bar - #Required reading [#] https://xkcd.com/538/ -***/ -user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); -/* 0801: disable location bar using search - * Don't leak URL typos to a search engine, give an error message instead. - * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com" - * [NOTE] This does **not** affect explicit user action such as using search buttons in the - * dropdown, or using keyword search shortcuts you configure in options (e.g. 'd' for DuckDuckGo) - * [SETUP-CHROME] If you don't, or rarely, type URLs, or you use a default search - * engine that respects privacy, then you probably don't need this ***/ -user_pref("keyword.enabled", false); -/* 0802: disable location bar domain guessing - * domain guessing intercepts DNS "hostname not found errors" and resends a - * request (e.g. by adding www or .com). This is inconsistent use (e.g. FQDNs), does not work - * via Proxy Servers (different error), is a flawed use of DNS (TLDs: why treat .com - * as the 411 for DNS errors?), privacy issues (why connect to sites you didn't - * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack), - * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/ -user_pref("browser.fixup.alternate.enabled", false); -/* 0803: display all parts of the url in the location bar ***/ -user_pref("browser.urlbar.trimURLs", false); -/* 0805: disable coloring of visited links - CSS history leak - * [SETUP-HARDEN] Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive - * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing - * attacks. Don't forget clearing history on close (2803). However, social engineering [2#limits][4][5] - * and advanced targeted timing attacks could still produce usable results - * [1] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector - * [2] https://dbaron.org/mozilla/visited-privacy - * [3] https://bugzilla.mozilla.org/1632765 - * [4] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use) - * [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/ - // user_pref("layout.css.visited_links_enabled", false); -/* 0807: disable live search suggestions -/* [NOTE] Both must be true for the location bar to work - * [SETUP-CHROME] Change these if you trust and use a privacy respecting search engine - * [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/ -user_pref("browser.search.suggest.enabled", false); -user_pref("browser.urlbar.suggest.searches", false); -/* 0810: disable location bar making speculative connections [FF56+] - * [1] https://bugzilla.mozilla.org/1348275 ***/ -user_pref("browser.urlbar.speculativeConnect.enabled", false); -/* 0811: disable location bar leaking single words to a DNS provider **after searching** [FF78+] - * 0=never resolve single words, 1=heuristic (default), 2=always resolve - * [NOTE] For FF78 value 1 and 2 are the same and always resolve but that will change in future versions - * [1] https://bugzilla.mozilla.org/1642623 ***/ -user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", 0); -/* 0850a: disable location bar suggestion types - * [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest ***/ - // user_pref("browser.urlbar.suggest.history", false); - // user_pref("browser.urlbar.suggest.bookmark", false); - // user_pref("browser.urlbar.suggest.openpage", false); - // user_pref("browser.urlbar.suggest.topsites", false); // [FF78+] -/* 0850b: disable tab-to-search [FF85+] - * Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search - * [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest>Search engines ***/ - // user_pref("browser.urlbar.suggest.engines", false); -/* 0850c: disable location bar dropdown - * This value controls the total number of entries to appear in the location bar dropdown ***/ - // user_pref("browser.urlbar.maxRichResults", 0); -/* 0850d: disable location bar autofill - * [1] https://support.mozilla.org/en-US/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/ - // user_pref("browser.urlbar.autoFill", false); -/* 0860: disable search and form history - * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] - * [NOTE] We also clear formdata on exit (see 2803) - * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history - * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html - * [2] https://bugzilla.mozilla.org/381681 ***/ -user_pref("browser.formfill.enable", false); -/* 0862: disable browsing and download history - * [NOTE] We also clear history and downloads on exiting Firefox (see 2803) - * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/ - // user_pref("places.history.enabled", false); -/* 0870: disable Windows jumplist [WINDOWS] ***/ -user_pref("browser.taskbar.lists.enabled", false); -user_pref("browser.taskbar.lists.frequent.enabled", false); -user_pref("browser.taskbar.lists.recent.enabled", false); -user_pref("browser.taskbar.lists.tasks.enabled", false); -/* 0871: disable Windows taskbar preview [WINDOWS] ***/ - // user_pref("browser.taskbar.previews.enable", false); // [DEFAULT: false] - -/*** [SECTION 0900]: PASSWORDS ***/ -user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!"); -/* 0901: disable saving passwords - * [NOTE] This does not clear any passwords already saved - * [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/ - // user_pref("signon.rememberSignons", false); -/* 0902: use a primary password - * There are no preferences for this. It is all handled internally. - * [SETTING] Privacy & Security>Logins and Passwords>Use a Primary Password - * [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas ***/ -/* 0903: set how often Firefox should ask for the primary password - * 0=the first time (default), 1=every time it's needed, 2=every n minutes (see 0904) ***/ -user_pref("security.ask_for_password", 2); -/* 0904: set how often in minutes Firefox should ask for the primary password (see 0903) - * in minutes, default is 30 ***/ -user_pref("security.password_lifetime", 5); -/* 0905: disable auto-filling username & password form fields - * can leak in cross-site forms *and* be spoofed - * [NOTE] Username & password is still available when you enter the field - * [SETTING] Privacy & Security>Logins and Passwords>Autofill logins and passwords - * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ ***/ -user_pref("signon.autofillForms", false); -/* 0909: disable formless login capture for Password Manager [FF51+] ***/ -user_pref("signon.formlessCapture.enabled", false); -/* 0912: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+] - * hardens against potential credentials phishing - * 0=don't allow sub-resources to open HTTP authentication credentials dialogs - * 1=don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs - * 2=allow sub-resources to open HTTP authentication credentials dialogs (default) ***/ -user_pref("network.auth.subresource-http-auth-allow", 1); - -/*** [SECTION 1000]: CACHE / SESSION (RE)STORE / FAVICONS - Cache tracking/fingerprinting techniques [1][2][3] require a cache. Disabling disk (1001) - *and* memory (1003) caches is one solution; but that's extreme and fingerprintable. A hardened - Temporary Containers configuration can effectively do the same thing, by isolating every tab [4]. - - We consider avoiding disk cache (1001) so cache is session/memory only (like Private Browsing - mode), and isolating cache to first party (4001) is sufficient and a good balance between - risk and performance. ETAGs can also be neutralized by modifying response headers [5], and - you can clear the cache manually or on a regular basis with an extension. - - [1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags - [2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/ - [3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache - [4] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 - [5] https://github.com/arkenfox/user.js/wiki/4.2.4-Header-Editor -***/ -user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); -/** CACHE ***/ -/* 1001: disable disk cache - * [SETUP-PERF] If you think disk cache may help (heavy tab user, high-res video), - * or you use a hardened Temporary Containers, then feel free to override this - * [NOTE] We also clear cache on exiting Firefox (see 2803) ***/ -user_pref("browser.cache.disk.enable", false); -/* 1003: disable memory cache - * capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/ - // user_pref("browser.cache.memory.enable", false); - // user_pref("browser.cache.memory.capacity", 0); -/* 1006: disable permissions manager from writing to disk [RESTART] - * [NOTE] This means any permission changes are session only - * [1] https://bugzilla.mozilla.org/967812 ***/ - // user_pref("permissions.memory_only", true); // [HIDDEN PREF] -/* 1007: disable media cache from writing to disk in Private Browsing - * [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB - * [SETUP-WEB] ESR78: playback might break on subsequent loading (1650281) ***/ -user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+] -user_pref("media.memory_cache_max_size", 65536); - -/** SESSIONS & SESSION RESTORE ***/ -/* 1020: exclude "Undo Closed Tabs" in Session Restore ***/ - // user_pref("browser.sessionstore.max_tabs_undo", 0); -/* 1021: disable storing extra session data [SETUP-CHROME] - * extra session data contains contents of forms, scrollbar positions, cookies and POST data - * define on which sites to save extra session data: - * 0=everywhere, 1=unencrypted sites, 2=nowhere ***/ -user_pref("browser.sessionstore.privacy_level", 2); -/* 1022: disable resuming session from crash ***/ - // user_pref("browser.sessionstore.resume_from_crash", false); -/* 1023: set the minimum interval between session save operations - * Increasing this can help on older machines and some websites, as well as reducing writes [1] - * Default is 15000 (15 secs). Try 30000 (30 secs), 60000 (1 min) etc - * [SETUP-CHROME] This can also affect entries in the "Recently Closed Tabs" feature: - * i.e. the longer the interval the more chance a quick tab open/close won't be captured. - * This longer interval *may* affect history but we cannot replicate any history not recorded - * [1] https://bugzilla.mozilla.org/1304389 ***/ -user_pref("browser.sessionstore.interval", 30000); -/* 1024: disable automatic Firefox start and session restore after reboot [FF62+] [WINDOWS] - * [1] https://bugzilla.mozilla.org/603903 ***/ -user_pref("toolkit.winRegisterApplicationRestart", false); - -/** FAVICONS ***/ -/* 1030: disable favicons in shortcuts - * URL shortcuts use a cached randomly named .ico file which is stored in your - * profile/shortcutCache directory. The .ico remains after the shortcut is deleted. - * If set to false then the shortcuts use a generic Firefox icon ***/ -user_pref("browser.shell.shortcutFavicons", false); -/* 1031: disable favicons in history and bookmarks - * Stored as data blobs in favicons.sqlite, these don't reveal anything that your - * actual history (and bookmarks) already do. Your history is more detailed, so - * control that instead; e.g. disable history, clear history on close, use PB mode - * [NOTE] favicons.sqlite is sanitized on Firefox close, not in-session ***/ - // user_pref("browser.chrome.site_icons", false); -/* 1032: disable favicons in web notifications ***/ - // user_pref("alerts.showFavicons", false); // [DEFAULT: false] - -/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS) - Your cipher and other settings can be used in server side fingerprinting - [TEST] https://www.ssllabs.com/ssltest/viewMyClient.html - [TEST] https://browserleaks.com/ssl - [TEST] https://ja3er.com/ - [1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/ -***/ -user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); -/** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/ -/* 1201: require safe negotiation - * Blocks connections (SSL_ERROR_UNSAFE_NEGOTIATION) to servers that don't support RFC 5746 [2] - * as they're potentially vulnerable to a MiTM attack [3]. A server without RFC 5746 can be - * safe from the attack if it disables renegotiations but the problem is that the browser can't - * know that. Setting this pref to true is the only way for the browser to ensure there will be - * no unsafe renegotiations on the channel between the browser and the server. - * [STATS] SSL Labs (Dec 2020) reports 99.0% of sites have secure renegotiation [4] - * [1] https://wiki.mozilla.org/Security:Renegotiation - * [2] https://tools.ietf.org/html/rfc5746 - * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 - * [4] https://www.ssllabs.com/ssl-pulse/ ***/ -user_pref("security.ssl.require_safe_negotiation", true); -/* 1202: control TLS versions with min and max - * 1=TLS 1.0, 2=TLS 1.1, 3=TLS 1.2, 4=TLS 1.3 - * [WARNING] Leave these at default, otherwise you alter your TLS fingerprint. - * [1] https://www.ssllabs.com/ssl-pulse/ ***/ - // user_pref("security.tls.version.min", 3); // [DEFAULT: 3] - // user_pref("security.tls.version.max", 4); -/* 1203: enforce TLS 1.0 and 1.1 downgrades as session only ***/ -user_pref("security.tls.version.enable-deprecated", false); -/* 1204: disable SSL session tracking [FF36+] - * SSL Session IDs are unique and last up to 24hrs in Firefox (or longer with prolongation attacks) - * [NOTE] These are not used in PB mode. In normal windows they are isolated when using FPI (4001) - * and/or containers. In FF85+ they are isolated by default (privacy.partition.network_state) - * [WARNING] There are perf and passive fingerprinting costs, for little to no gain. Preventing - * tracking via this method does not address IPs, nor handle any sanitizing of current identifiers - * [1] https://tools.ietf.org/html/rfc5077 - * [2] https://bugzilla.mozilla.org/967977 - * [3] https://arxiv.org/abs/1810.07304 ***/ - // user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF] -/* 1206: disable TLS1.3 0-RTT (round-trip time) [FF51+] - * [1] https://github.com/tlswg/tls13-spec/issues/1001 - * [2] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/ -user_pref("security.tls.enable_0rtt_data", false); - -/** OCSP (Online Certificate Status Protocol) - #Required reading [#] https://scotthelme.co.uk/revocation-is-broken/ ***/ -/* 1210: enable OCSP Stapling - * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ ***/ -user_pref("security.ssl.enable_ocsp_stapling", true); -/* 1211: control when to use OCSP fetching (to confirm current validity of certificates) - * 0=disabled, 1=enabled (default), 2=enabled for EV certificates only - * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority) - * It's a trade-off between security (checking) and privacy (leaking info to the CA) - * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling - * [1] https://en.wikipedia.org/wiki/Ocsp ***/ -user_pref("security.OCSP.enabled", 1); -/* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail [SETUP-WEB] - * When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail) - * Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail) - * It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it - * could have been revoked) and/or you could be under attack (e.g. malicious blocking of OCSP servers) - * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ - * [2] https://www.imperialviolet.org/2014/04/19/revchecking.html ***/ -user_pref("security.OCSP.require", true); - -/** CERTS / HPKP (HTTP Public Key Pinning) ***/ -/* 1220: disable or limit SHA-1 certificates - * 0=all SHA1 certs are allowed - * 1=all SHA1 certs are blocked - * 2=deprecated option that now maps to 1 - * 3=only allowed for locally-added roots (e.g. anti-virus) - * 4=only allowed for locally-added roots or for certs in 2015 and earlier - * [SETUP-CHROME] When disabled, some man-in-the-middle devices (e.g. security scanners and - * antivirus products, may fail to connect to HTTPS sites. SHA-1 is *almost* obsolete. - * [1] https://blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ ***/ -user_pref("security.pki.sha1_enforcement_level", 1); -/* 1221: disable Windows 8.1's Microsoft Family Safety cert [FF50+] [WINDOWS] - * 0=disable detecting Family Safety mode and importing the root - * 1=only attempt to detect Family Safety mode (don't import the root) - * 2=detect Family Safety mode and import the root - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/ -user_pref("security.family_safety.mode", 0); -/* 1222: disable intermediate certificate caching (fingerprinting attack vector) [FF41+] [RESTART] - * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. - * Saved logins and passwords are not available. Reset the pref and restart to return them. - * [1] https://shiftordie.de/blog/2017/02/21/fingerprinting-firefox-users-with-cached-intermediate-ca-certificates-fiprinca/ ***/ - // user_pref("security.nocertdb", true); // [HIDDEN PREF] -/* 1223: enforce strict pinning - * PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict - * [SETUP-WEB] If you rely on an AV (antivirus) to protect your web browsing - * by inspecting ALL your web traffic, then leave at current default=1 - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/ -user_pref("security.cert_pinning.enforcement_level", 2); -/* 1224: enforce CRLite [FF73+] - * In FF84+ it covers valid certs and in mode 2 doesn't fall back to OCSP - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985 - * [2] https://blog.mozilla.org/security/tag/crlite/ ***/ -user_pref("security.remote_settings.crlite_filters.enabled", true); -user_pref("security.pki.crlite_mode", 2); - -/** MIXED CONTENT ***/ -/* 1240: enforce no insecure active content on https pages - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/ -user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true] -/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/ -user_pref("security.mixed_content.block_display_content", true); -/* 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+] - * [1] https://bugzilla.mozilla.org/1190623 ***/ -user_pref("security.mixed_content.block_object_subrequest", true); -/* 1244: enable HTTPS-Only mode [FF76+] - * When "https_only_mode" (all windows) is true, "https_only_mode_pbm" (private windows only) is ignored - * [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On/Off/Off temporarily - * [SETTING] Privacy & Security>HTTPS-Only Mode - * [TEST] http://example.com [upgrade] - * [TEST] http://neverssl.org/ [no upgrade] - * [1] https://bugzilla.mozilla.org/1613063 [META] ***/ -user_pref("dom.security.https_only_mode", true); // [FF76+] - // user_pref("dom.security.https_only_mode_pbm", true); // [FF80+] -/* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/ - // user_pref("dom.security.https_only_mode.upgrade_local", true); -/* 1246: disable HTTP background requests [FF82+] - * When attempting to upgrade, if the server doesn't respond within 3 seconds, firefox - * sends HTTP requests in order to check if the server supports HTTPS or not. - * This is done to avoid waiting for a timeout which takes 90 seconds - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/ -user_pref("dom.security.https_only_mode_send_http_background_request", false); -/* 1247: treat .onion as a secure context [FF60+] [TOR] - * [NOTE] Firefox cannot access .onion sites by default: it is strongly recommended you just use Tor Browser - * [1] https://bugzilla.mozilla.org/1382359 ***/ - // user_pref("dom.securecontext.whitelist_onions", true); - -/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro] - * These are all the ciphers still using SHA-1 and CBC which are weaker than the available alternatives. (see "Cipher Suites" in [1]) - * Additionally some have other weaknesses like key sizes of 128 (or lower) [2] and/or no Perfect Forward Secrecy [3]. - * [1] https://browserleaks.com/ssl - * [2] https://en.wikipedia.org/wiki/Key_size - * [3] https://en.wikipedia.org/wiki/Forward_secrecy - ***/ -/* 1261: disable 3DES (effective key size < 128 and no PFS) - * [1] https://en.wikipedia.org/wiki/3des#Security - * [2] https://en.wikipedia.org/wiki/Meet-in-the-middle_attack - * [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/ - // user_pref("security.ssl3.rsa_des_ede3_sha", false); -/* 1264: disable the remaining non-modern cipher suites as of FF78 (in order of preferred by FF) ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); - // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); - // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); - // user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS - // user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS - -/** UI (User Interface) ***/ -/* 1270: display warning on the padlock for "broken security" (if 1201 is false) - * Bug: warning padlock not indicated for subresources on a secure page! [2] - * [1] https://wiki.mozilla.org/Security:Renegotiation - * [2] https://bugzilla.mozilla.org/1353705 ***/ -user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); -/* 1271: control "Add Security Exception" dialog on SSL warnings - * 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default) - * [1] https://github.com/pyllyukko/user.js/issues/210 ***/ -user_pref("browser.ssl_override_behavior", 1); -/* 1272: display advanced information on Insecure Connection warning pages - * only works when it's possible to add an exception - * i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/) - * [TEST] https://expired.badssl.com/ ***/ -user_pref("browser.xul.error_pages.expert_bad_cert", true); -/* 1273: display "insecure" icon and "Not Secure" text on HTTP sites ***/ - // user_pref("security.insecure_connection_icon.enabled", true); // [FF59+] [DEFAULT: true] -user_pref("security.insecure_connection_text.enabled", true); // [FF60+] - -/*** [SECTION 1400]: FONTS ***/ -user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!"); -/* 1401: disable websites choosing fonts (0=block, 1=allow) - * This can limit most (but not all) JS font enumeration which is a high entropy fingerprinting vector - * [WARNING] **DO NOT USE**: in FF80+ RFP covers this, and non-RFP users should use font vis (4618) - * [SETTING] General>Language and Appearance>Fonts & Colors>Advanced>Allow pages to choose... ***/ - // user_pref("browser.display.use_document_fonts", 0); -/* 1403: disable icon fonts (glyphs) and local fallback rendering - * [1] https://bugzilla.mozilla.org/789788 - * [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/ - // user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+] - // user_pref("gfx.downloadable_fonts.fallback_delay", -1); -/* 1404: disable rendering of SVG OpenType fonts - * [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/ -user_pref("gfx.font_rendering.opentype_svg.enabled", false); -/* 1408: disable graphite - * Graphite has had many critical security issues in the past [1] - * [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 - * [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/ -user_pref("gfx.font_rendering.graphite.enabled", false); -/* 1409: limit system font exposure to a whitelist [FF52+] [RESTART] - * If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed - * [NOTE] In FF81+ the whitelist **overrides** RFP's font visibility (see 4618) - * [WARNING] **DO NOT USE**: in FF80+ RFP covers this, and non-RFP users should use font vis (4618) - * [1] https://bugzilla.mozilla.org/1121643 ***/ - // user_pref("font.system.whitelist", ""); // [HIDDEN PREF] - -/*** [SECTION 1600]: HEADERS / REFERERS - Only *cross domain* referers need controlling: leave 1601, 1602, 1605 and 1606 alone - --- - Expect some breakage: Use an extension if you need precise control - --- - full URI: https://example.com:8888/foo/bar.html?id=1234 - scheme+host+port+path: https://example.com:8888/foo/bar.html - scheme+host+port: https://example.com:8888 - --- - #Required reading [#] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ -***/ -user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); -/* 1601: ALL: control when images/links send a referer - * 0=never, 1=send only when links are clicked, 2=for links and images (default) ***/ - // user_pref("network.http.sendRefererHeader", 2); -/* 1602: ALL: control the amount of information to send - * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ - // user_pref("network.http.referer.trimmingPolicy", 0); -/* 1603: CROSS ORIGIN: control when to send a referer - * 0=always (default), 1=only if base domains match, 2=only if hosts match - * [SETUP-WEB] Known to cause issues with older modems/routers and some sites e.g vimeo, icloud ***/ -user_pref("network.http.referer.XOriginPolicy", 2); -/* 1604: CROSS ORIGIN: control the amount of information to send [FF52+] - * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ -user_pref("network.http.referer.XOriginTrimmingPolicy", 2); -/* 1605: ALL: disable spoofing a referer - * [WARNING] Do not set this to true, as spoofing effectively disables the anti-CSRF - * (Cross-Site Request Forgery) protections that some sites may rely on ***/ - // user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] -/* 1606: ALL: set the default Referrer Policy [FF59+] - * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade - * [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy - * [1] https://www.w3.org/TR/referrer-policy/ - * [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy - * [3] https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/ - * [4] https://blog.mozilla.org/security/2021/03/22/firefox-87-trims-http-referrers-by-default-to-protect-user-privacy/ ***/ - // user_pref("network.http.referer.defaultPolicy", 2); // [DEFAULT: 2 FF87+] - // user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2] -/* 1607: hide (not spoof) referrer when leaving a .onion domain [FF54+] [TOR] - * [NOTE] Firefox cannot access .onion sites by default: it is strongly recommended you just use Tor Browser - * [1] https://bugzilla.mozilla.org/1305144 ***/ - // user_pref("network.http.referer.hideOnionSource", true); -/* 1610: ALL: enable the DNT (Do Not Track) HTTP header - * [NOTE] DNT is enforced with Enhanced Tracking Protection regardless of this pref - * [SETTING] Privacy & Security>Enhanced Tracking Protection>Send websites a "Do Not Track" signal... ***/ -user_pref("privacy.donottrackheader.enabled", true); - -/*** [SECTION 1700]: CONTAINERS - If you want to *really* leverage containers, we highly recommend Temporary Containers [2]. - Read the article by the extension author [3], and check out the github wiki/repo [4]. - [1] https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers - [2] https://addons.mozilla.org/firefox/addon/temporary-containers/ - [3] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 - [4] https://github.com/stoically/temporary-containers/wiki -***/ -user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); -/* 1701: enable Container Tabs setting in preferences (see 1702) [FF50+] - * [1] https://bugzilla.mozilla.org/1279029 ***/ -user_pref("privacy.userContext.ui.enabled", true); -/* 1702: enable Container Tabs [FF50+] - * [SETTING] General>Tabs>Enable Container Tabs ***/ -user_pref("privacy.userContext.enabled", true); -/* 1703: set behaviour on "+ Tab" button to display container menu on left click [FF74+] - * [NOTE] The menu is always shown on long press and right click - * [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/ - // user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true); - -/*** [SECTION 1800]: PLUGINS ***/ -user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies!"); -/* 1803: disable Flash plugin - * 0=deactivated, 1=ask, 2=enabled - * ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash - * [NOTE] You can still override individual sites via site permissions ***/ -user_pref("plugin.state.flash", 0); -/* 1820: disable GMP (Gecko Media Plugins) - * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ - // user_pref("media.gmp-provider.enabled", false); -/* 1825: disable widevine CDM (Content Decryption Module) - * [NOTE] This is covered by the EME master switch (1830) ***/ - // user_pref("media.gmp-widevinecdm.enabled", false); -/* 1830: disable all DRM content (EME: Encryption Media Extension) - * [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV - * [SETTING] General>DRM Content>Play DRM-controlled content - * [TEST] https://bitmovin.com/demos/drm - * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ -user_pref("media.eme.enabled", false); - -/*** [SECTION 2000]: MEDIA / CAMERA / MIC ***/ -user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); -/* 2001: disable WebRTC (Web Real-Time Communication) - * [SETUP-WEB] WebRTC can leak your IP address from behind your VPN, but if this is not - * in your threat model, and you want Real-Time Communication, this is the pref for you - * [1] https://www.privacytools.io/#webrtc ***/ -user_pref("media.peerconnection.enabled", false); -/* 2002: limit WebRTC IP leaks if using WebRTC - * In FF70+ these settings match Mode 4 (Mode 3 in older versions) [3] - * [TEST] https://browserleaks.com/webrtc - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713 - * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy - * [3] https://tools.ietf.org/html/draft-ietf-rtcweb-ip-handling-12#section-5.2 ***/ -user_pref("media.peerconnection.ice.default_address_only", true); -user_pref("media.peerconnection.ice.no_host", true); // [FF51+] -user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // [FF70+] -/* 2010: disable WebGL (Web Graphics Library) - * [SETUP-WEB] When disabled, may break some websites. When enabled, provides high entropy, - * especially with readPixels(). Some of the other entropy is lessened with RFP (see 4501) - * [1] https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/ - * [2] https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern ***/ -user_pref("webgl.disabled", true); -user_pref("webgl.enable-webgl2", false); -/* 2012: limit WebGL ***/ -user_pref("webgl.disable-fail-if-major-performance-caveat", true); // [DEFAULT: true FF86+] -/* 2022: disable screensharing ***/ -user_pref("media.getusermedia.screensharing.enabled", false); -user_pref("media.getusermedia.browser.enabled", false); -user_pref("media.getusermedia.audiocapture.enabled", false); -/* 2024: set a default permission for Camera/Microphone [FF58+] - * 0=always ask (default), 1=allow, 2=block - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Use the Camera/Microphone - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Camera/Microphone>Settings ***/ - // user_pref("permissions.default.camera", 2); - // user_pref("permissions.default.microphone", 2); -/* 2030: disable autoplay of HTML5 media [FF63+] - * 0=Allow all, 1=Block non-muted media (default in FF67+), 2=Prompt (removed in FF66), 5=Block all (FF69+) - * [NOTE] You can set exceptions under site permissions - * [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/ - // user_pref("media.autoplay.default", 5); -/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+] - * 0=sticky (default), 1=transient, 2=user - * Firefox's Autoplay Policy Documentation [PDF] is linked below via SUMO - * [NOTE] If you have trouble with some video sites, then add an exception (see 2030) - * [1] https://support.mozilla.org/questions/1293231 ***/ -user_pref("media.autoplay.blocking_policy", 2); - -/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/ -user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!"); -/* 2202: prevent scripts from moving and resizing open windows ***/ -user_pref("dom.disable_window_move_resize", true); -/* 2203: open links targeting new windows in a new tab instead - * This stops malicious window sizes and some screen resolution leaks. - * You can still right-click a link and open in a new window. - * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ -user_pref("browser.link.open_newwindow", 3); // 1=most recent window or tab 2=new window, 3=new tab -user_pref("browser.link.open_newwindow.restriction", 0); -/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks - * [NOTE] You can still manually toggle the browser's fullscreen state (F11), - * but this pref will disable embedded video/game fullscreen controls, e.g. youtube - * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen ***/ - // user_pref("full-screen-api.enabled", false); -/* 2210: block popup windows - * [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/ -user_pref("dom.disable_open_during_load", true); -/* 2212: limit events that can cause a popup [SETUP-WEB] - * default FF86+: "change click dblclick auxclick mousedown mouseup pointerdown pointerup notificationclick reset submit touchend contextmenu ***/ -user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); - -/*** [SECTION 2300]: WEB WORKERS - A worker is a JS "background task" running in a global context, i.e. it is different from - the current window. Workers can spawn new workers (must be the same origin & scheme), - including service and shared workers. Shared workers can be utilized by multiple scripts and - communicate between browsing contexts (windows/tabs/iframes) and can even control your cache. - - [1] Web Workers: https://developer.mozilla.org/docs/Web/API/Web_Workers_API - [2] Worker: https://developer.mozilla.org/docs/Web/API/Worker - [3] Service Worker: https://developer.mozilla.org/docs/Web/API/Service_Worker_API - [4] SharedWorker: https://developer.mozilla.org/docs/Web/API/SharedWorker - [5] ChromeWorker: https://developer.mozilla.org/docs/Web/API/ChromeWorker - [6] Notifications: https://support.mozilla.org/questions/1165867#answer-981820 -***/ -user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!"); -/* 2302: disable service workers [FF32, FF44-compat] - * Service workers essentially act as proxy servers that sit between web apps, and the - * browser and network, are event driven, and can control the web page/site it is associated - * with, intercepting and modifying navigation and resource requests, and caching resources. - * [NOTE] Service worker APIs are hidden (in Firefox) and cannot be used when in PB mode. - * [NOTE] Service workers only run over HTTPS. Service workers have no DOM access. - * [SETUP-WEB] Disabling service workers will break some sites. This pref is required true for - * service worker notifications (2304), push notifications (disabled, 2305) and service worker - * cache (2740). If you enable this pref, then check those settings as well ***/ -user_pref("dom.serviceWorkers.enabled", false); -/* 2304: disable Web Notifications - * [NOTE] Web Notifications can also use service workers (2302) and are behind a prompt (2306) - * [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/ - // user_pref("dom.webnotifications.enabled", false); // [FF22+] - // user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+] -/* 2305: disable Push Notifications [FF44+] - * Push is an API that allows websites to send you (subscribed) messages even when the site - * isn't loaded, by pushing messages to your userAgentID through Mozilla's Push Server. - * [NOTE] Push requires service workers (2302) to subscribe to and display, and is behind - * a prompt (2306). Disabling service workers alone doesn't stop Firefox polling the - * Mozilla Push Server. To remove all subscriptions, reset your userAgentID (in about:config - * or on start), and you will get a new one within a few seconds. - * [1] https://support.mozilla.org/en-US/kb/push-notifications-firefox - * [2] https://developer.mozilla.org/en-US/docs/Web/API/Push_API ***/ -user_pref("dom.push.enabled", false); - // user_pref("dom.push.userAgentID", ""); -/* 2306: set a default permission for Notifications (both 2304 and 2305) [FF58+] - * 0=always ask (default), 1=allow, 2=block - * [NOTE] Best left at default "always ask", fingerprintable via Permissions API - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Receive Notifications - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Notifications>Settings ***/ - // user_pref("permissions.default.desktop-notification", 2); - -/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT ***/ -user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); -/* 2401: disable website control over browser right-click context menu - * [NOTE] Shift-Right-Click will always bring up the browser right-click context menu ***/ - // user_pref("dom.event.contextmenu.enabled", false); -/* 2402: disable website access to clipboard events/content [SETUP-HARDEN] - * [NOTE] This will break some sites' functionality e.g. Outlook, Twitter, Facebook, Wordpress - * This applies to onCut/onCopy/onPaste events - i.e. it requires interaction with the website - * [WARNING] In FF88 or lower, with clipboardevents enabled, if both 'middlemouse.paste' and - * 'general.autoScroll' are true (at least one is default false) then the clipboard can leak [1] - * [1] https://bugzilla.mozilla.org/1528289 ***/ - // user_pref("dom.event.clipboardevents.enabled", false); -/* 2404: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+] - * this disables document.execCommand("cut"/"copy") to protect your clipboard - * [1] https://bugzilla.mozilla.org/1170911 ***/ -user_pref("dom.allow_cut_copy", false); -/* 2405: disable "Confirm you want to leave" dialog on page close - * Does not prevent JS leaks of the page close event. - * [1] https://developer.mozilla.org/docs/Web/Events/beforeunload - * [2] https://support.mozilla.org/questions/1043508 ***/ -user_pref("dom.disable_beforeunload", true); -/* 2414: disable shaking the screen ***/ -user_pref("dom.vibrator.enabled", false); -/* 2420: disable asm.js [FF22+] [SETUP-PERF] - * [1] http://asmjs.org/ - * [2] https://www.mozilla.org/security/advisories/mfsa2015-29/ - * [3] https://www.mozilla.org/security/advisories/mfsa2015-50/ - * [4] https://www.mozilla.org/security/advisories/mfsa2017-01/#CVE-2017-5375 - * [5] https://www.mozilla.org/security/advisories/mfsa2017-05/#CVE-2017-5400 - * [6] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ -user_pref("javascript.options.asmjs", false); -/* 2421: disable Ion and baseline JIT to harden against JS exploits [SETUP-HARDEN] - * [NOTE] In FF75+, when **both** Ion and JIT are disabled, **and** the new - * hidden pref is enabled, then Ion can still be used by extensions (1599226) - * [WARNING] Disabling Ion/JIT can cause some site issues and performance loss - * [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 ***/ - // user_pref("javascript.options.ion", false); - // user_pref("javascript.options.baselinejit", false); - // user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF] -/* 2422: disable WebAssembly [FF52+] - * Vulnerabilities have increasingly been found, including those known and fixed - * in native programs years ago [2]. WASM has powerful low-level access, making - * certain attacks (brute-force) and vulnerabilities more possible - * [STATS] ~0.2% of websites, about half of which are for crytopmining / malvertising [2][3] - * [1] https://developer.mozilla.org/docs/WebAssembly - * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly - * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ -user_pref("javascript.options.wasm", false); -/* 2429: enable (limited but sufficient) window.opener protection [FF65+] - * Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/ -user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+] - -/*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/ -user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!"); -/* 2502: disable Battery Status API - * Initially a Linux issue (high precision readout) that was fixed. - * However, it is still another metric for fingerprinting, used to raise entropy. - * e.g. do you have a battery or not, current charging status, charge level, times remaining etc - * [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code [1] - * [1] https://bugzilla.mozilla.org/1313580 ***/ - // user_pref("dom.battery.enabled", false); -/* 2505: disable media device enumeration [FF29+] - * [NOTE] media.peerconnection.enabled should also be set to false (see 2001) - * [1] https://wiki.mozilla.org/Media/getUserMedia - * [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/enumerateDevices ***/ -user_pref("media.navigator.enabled", false); -/* 2508: disable hardware acceleration to reduce graphics fingerprinting [SETUP-HARDEN] - * [WARNING] Affects text rendering (fonts will look different), impacts video performance, - * and parts of Quantum that utilize the GPU will also be affected as they are rolled out - * [SETTING] General>Performance>Custom>Use hardware acceleration when available - * [1] https://wiki.mozilla.org/Platform/GFX/HardwareAcceleration ***/ - // user_pref("gfx.direct2d.disabled", true); // [WINDOWS] - // user_pref("layers.acceleration.disabled", true); -/* 2510: disable Web Audio API [FF51+] - * [1] https://bugzilla.mozilla.org/1288359 ***/ -user_pref("dom.webaudio.enabled", false); -/* 2517: disable Media Capabilities API [FF63+] - * [WARNING] This *may* affect media performance if disabled, no one is sure - * [1] https://github.com/WICG/media-capabilities - * [2] https://wicg.github.io/media-capabilities/#security-privacy-considerations ***/ - // user_pref("media.media-capabilities.enabled", false); -/* 2520: disable virtual reality devices - * Optional protection depending on your connected devices - * [1] https://developer.mozilla.org/docs/Web/API/WebVR_API ***/ - // user_pref("dom.vr.enabled", false); -/* 2521: set a default permission for Virtual Reality (see 2520) [FF73+] - * 0=always ask (default), 1=allow, 2=block - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Access Virtual Reality Devices - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Virtual Reality>Settings ***/ - // user_pref("permissions.default.xr", 2); - -/*** [SECTION 2600]: MISCELLANEOUS ***/ -user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); -/* 2601: prevent accessibility services from accessing your browser [RESTART] - * [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser (FF80 or lower) - * [1] https://support.mozilla.org/kb/accessibility-services ***/ -user_pref("accessibility.force_disabled", 1); -/* 2602: disable sending additional analytics to web servers - * [1] https://developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/ -user_pref("beacon.enabled", false); -/* 2603: remove temp files opened with an external application - * [1] https://bugzilla.mozilla.org/302433 ***/ -user_pref("browser.helperApps.deleteTempFileOnExit", true); -/* 2604: disable page thumbnail collection ***/ -user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] -/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/ -user_pref("browser.uitour.enabled", false); -user_pref("browser.uitour.url", ""); -/* 2607: disable various developer tools in browser context - * [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes - * [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/ -user_pref("devtools.chrome.enabled", false); -/* 2608: reset remote debugging to disabled - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/ -user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] -/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN] - * [TEST] https://arkenfox.github.io/TZP/tzp.html#misc - * [1] https://bugzilla.mozilla.org/1173199 ***/ - // user_pref("mathml.disabled", true); -/* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+] - * [WARNING] Expect breakage incl. youtube player controls. Best left for a "hardened" profile. - * [1] https://bugzilla.mozilla.org/1216893 ***/ - // user_pref("svg.disabled", true); -/* 2611: disable middle mouse click opening links from clipboard - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/ -user_pref("middlemouse.contentLoadURL", false); -/* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+] - * 0 (default) or 1=allow, 2=block - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Override Keyboard Shortcuts ***/ - // user_pref("permissions.default.shortcuts", 2); -/* 2616: remove special permissions for certain mozilla domains [FF35+] - * [1] resource://app/defaults/permissions ***/ -user_pref("permissions.manager.defaultsUrl", ""); -/* 2617: remove webchannel whitelist ***/ -user_pref("webchannel.allowObject.urlWhitelist", ""); -/* 2619: enforce Punycode for Internationalized Domain Names to eliminate possible spoofing - * Firefox has *some* protections, but it is better to be safe than sorry - * [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded - * [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com) - * [1] https://wiki.mozilla.org/IDN_Display_Algorithm - * [2] https://en.wikipedia.org/wiki/IDN_homograph_attack - * [3] CVE-2017-5383: https://www.mozilla.org/security/advisories/mfsa2017-02/ - * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/ -user_pref("network.IDN_show_punycode", true); -/* 2620: enforce PDFJS, disable PDFJS scripting [SETUP-CHROME] - * This setting controls if the option "Display in Firefox" is available in the setting below - * and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With") - * PROS: pdfjs is lightweight, open source, and as secure/vetted as any pdf reader out there (more than most) - * Exploits are rare (one serious case in seven years), treated seriously and patched quickly. - * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). - * It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. - * CONS: You may prefer a different pdf reader for security reasons - * CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare) - * [SETTING] General>Applications>Portable Document Format (PDF) ***/ -user_pref("pdfjs.disabled", false); // [DEFAULT: false] -user_pref("pdfjs.enableScripting", false); // [FF86+] -/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/ -user_pref("network.protocol-handler.external.ms-windows-store", false); -/* 2622: enforce no system colors; they can be fingerprinted - * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ -user_pref("browser.display.use_system_colors", false); // [DEFAULT: false] -/* 2623: disable permissions delegation [FF73+] - * Currently applies to cross-origin geolocation, camera, mic and screen-sharing - * permissions, and fullscreen requests. Disabling delegation means any prompts - * for these will show/use their correct 3rd party origin - * [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion ***/ -user_pref("permissions.delegation.enabled", false); -/* 2624: enable "window.name" protection [FF82+] - * If a new page from another domain is loaded into a tab, then window.name is set to an empty string. The original - * string is restored if the tab reverts back to the original page. This change prevents some cross-site attacks - * [TEST] https://arkenfox.github.io/TZP/tests/windownamea.html ***/ -user_pref("privacy.window.name.update.enabled", true); // [DEFAULT: true FF86+] -/* 2625: disable bypassing 3rd party extension install prompts [FF82+] - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1659530,1681331 ***/ -user_pref("extensions.postDownloadThirdPartyPrompt", false); - -/** DOWNLOADS ***/ -/* 2650: discourage downloading to desktop - * 0=desktop, 1=downloads (default), 2=last used - * [SETTING] To set your default "downloads": General>Downloads>Save files to ***/ - // user_pref("browser.download.folderList", 2); -/* 2651: enforce user interaction for security by always asking where to download - * [SETUP-CHROME] On Android this blocks longtapping and saving images - * [SETTING] General>Downloads>Always ask you where to save files ***/ -user_pref("browser.download.useDownloadDir", false); -/* 2652: disable adding downloads to the system's "recent documents" list ***/ -user_pref("browser.download.manager.addToRecentDocs", false); -/* 2654: disable "open with" in download dialog [FF50+] [SETUP-HARDEN] - * This is very useful to enable when the browser is sandboxed (e.g. via AppArmor) - * in such a way that it is forbidden to run external applications. - * [WARNING] This may interfere with some users' workflow or methods - * [1] https://bugzilla.mozilla.org/1281959 ***/ - // user_pref("browser.download.forbid_open_with", true); - -/** EXTENSIONS ***/ -/* 2660: lock down allowed extension directories - * [SETUP-CHROME] This will break extensions, language packs, themes and any other - * XPI files which are installed outside of profile and application directories - * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ - * [1] archived: https://archive.is/DYjAM ***/ -user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] -user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] -/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ - // user_pref("extensions.webextensions.restrictedDomains", ""); - -/** SECURITY ***/ -/* 2680: enforce CSP (Content Security Policy) - * [WARNING] CSP is a very important and widespread security feature. Don't disable it! - * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/ -user_pref("security.csp.enable", true); // [DEFAULT: true] -/* 2684: enforce a security delay on some confirmation dialogs such as install, open/save - * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ -user_pref("security.dialog_enable_delay", 700); - -/*** [SECTION 2700]: PERSISTENT STORAGE - Data SET by websites including - cookies : profile\cookies.sqlite - localStorage : profile\webappsstore.sqlite - indexedDB : profile\storage\default - appCache : profile\OfflineCache - serviceWorkers : - - [NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode - [NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage), - indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications) - If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become - accessible to websites except shared/service workers where the cookie setting *must* be "Allow" -***/ -user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); -/* 2701: disable or isolate 3rd-party cookies and site-data [SETUP-WEB] - * 0 = Accept cookies and site data - * 1 = (Block) All third-party cookies - * 2 = (Block) All cookies - * 3 = (Block) Cookies from unvisited websites - * 4 = (Block) Cross-site tracking cookies (default) - * 5 = (Isolate All) Cross-site cookies (TCP: Total Cookie Protection / dFPI: dynamic FPI) [1] (FF86+) - * Option 5 with FPI enabled (4001) is ignored and not shown, and option 4 used instead - * [NOTE] You can set cookie exceptions under site permissions or use an extension - * [NOTE] Enforcing category to custom ensures ETP related prefs are always honored - * [SETTING] Privacy & Security>Enhanced Tracking Protection>Custom>Cookies - * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ ***/ -user_pref("network.cookie.cookieBehavior", 1); -user_pref("browser.contentblocking.category", "custom"); -/* 2702: set third-party cookies (if enabled, see 2701) to session-only - [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and - .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones - * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/ -user_pref("network.cookie.thirdparty.sessionOnly", true); -user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+] -/* 2703: delete cookies and site data on close - * 0=keep until they expire (default), 2=keep until you close Firefox - * [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2) - * [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Firefox is closed ***/ - // user_pref("network.cookie.lifetimePolicy", 2); -/* 2710: enable Enhanced Tracking Protection (ETP) in all windows - * [SETTING] Privacy & Security>Enhanced Tracking Protection>Custom>Tracking content - * [SETTING] to add site exceptions: Urlbar>ETP Shield - * [SETTING] to manage site exceptions: Options>Privacy & Security>Enhanced Tracking Protection>Manage Exceptions ***/ -user_pref("privacy.trackingprotection.enabled", true); -/* 2711: enable various ETP lists ***/ -user_pref("privacy.trackingprotection.socialtracking.enabled", true); - // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] - // user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] -/* 2720: disable DOM (Document Object Model) Storage - * [WARNING] This will break a LOT of sites' functionality AND extensions! - * You are better off using an extension for more granular control ***/ - // user_pref("dom.storage.enabled", false); -/* 2730: enforce no offline cache storage (appCache) - * The API is easily fingerprinted, use the "storage" pref instead ***/ - // user_pref("browser.cache.offline.enable", false); -user_pref("browser.cache.offline.storage.enable", false); // [FF71+] [DEFAULT: false FF84+] -/* 2740: disable service worker cache and cache storage - * [NOTE] We clear service worker cache on exiting Firefox (see 2803) - * [1] https://w3c.github.io/ServiceWorker/#privacy ***/ - // user_pref("dom.caches.enabled", false); -/* 2750: disable Storage API [FF51+] - * The API gives sites the ability to find out how much space they can use, how much - * they are already using, and even control whether or not they need to be alerted - * before the user agent disposes of site data in order to make room for other things. - * [1] https://developer.mozilla.org/docs/Web/API/StorageManager - * [2] https://developer.mozilla.org/docs/Web/API/Storage_API - * [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/ - // user_pref("dom.storageManager.enabled", false); -/* 2755: disable Storage Access API [FF65+] - * [1] https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API ***/ - // user_pref("dom.storage_access.enabled", false); -/* 2760: enable Local Storage Next Generation (LSNG) [FF65+] ***/ -user_pref("dom.storage.next_gen", true); - -/*** [SECTION 2800]: SHUTDOWN - You should set the values to what suits you best. - - "Offline Website Data" includes appCache (2730), localStorage (2720), - service worker cache (2740), and QuotaManager (IndexedDB, asm-cache) - - In both 2803 + 2804, the 'download' and 'history' prefs are combined in the - Firefox interface as "Browsing & Download History" and their values will be synced -***/ -user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); -/* 2802: enable Firefox to clear items on shutdown (see 2803) - * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes ***/ -user_pref("privacy.sanitize.sanitizeOnShutdown", true); -/* 2803: set what items to clear on shutdown (if 2802 is true) [SETUP-CHROME] - * [NOTE] If 'history' is true, downloads will also be cleared regardless of the value - * but if 'history' is false, downloads can still be cleared independently - * However, this may not always be the case. The interface combines and syncs these - * prefs when set from there, and the sanitize code may change at any time - * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes>Settings ***/ -user_pref("privacy.clearOnShutdown.cache", true); -user_pref("privacy.clearOnShutdown.cookies", true); -user_pref("privacy.clearOnShutdown.downloads", true); // see note above -user_pref("privacy.clearOnShutdown.formdata", true); // Form & Search History -user_pref("privacy.clearOnShutdown.history", true); // Browsing & Download History -user_pref("privacy.clearOnShutdown.offlineApps", true); // Offline Website Data -user_pref("privacy.clearOnShutdown.sessions", true); // Active Logins -user_pref("privacy.clearOnShutdown.siteSettings", false); // Site Preferences -/* 2804: reset default items to clear with Ctrl-Shift-Del (to match 2803) [SETUP-CHROME] - * This dialog can also be accessed from the menu History>Clear Recent History - * Firefox remembers your last choices. This will reset them when you start Firefox. - * [NOTE] Regardless of what you set privacy.cpd.downloads to, as soon as the dialog - * for "Clear Recent History" is opened, it is synced to the same as 'history' ***/ -user_pref("privacy.cpd.cache", true); -user_pref("privacy.cpd.cookies", true); - // user_pref("privacy.cpd.downloads", true); // not used, see note above -user_pref("privacy.cpd.formdata", true); // Form & Search History -user_pref("privacy.cpd.history", true); // Browsing & Download History -user_pref("privacy.cpd.offlineApps", true); // Offline Website Data -user_pref("privacy.cpd.passwords", false); // this is not listed -user_pref("privacy.cpd.sessions", true); // Active Logins -user_pref("privacy.cpd.siteSettings", false); // Site Preferences -/* 2805: clear Session Restore data when sanitizing on shutdown or manually [FF34+] - * [NOTE] Not needed if Session Restore is not used (see 0102) or is already cleared with history (see 2803) - * [NOTE] privacy.clearOnShutdown.openWindows prevents resuming from crashes (see 1022) - * [NOTE] privacy.cpd.openWindows has a bug that causes an additional window to open ***/ - // user_pref("privacy.clearOnShutdown.openWindows", true); - // user_pref("privacy.cpd.openWindows", true); -/* 2806: reset default 'Time range to clear' for 'Clear Recent History' (see 2804) - * Firefox remembers your last choice. This will reset the value when you start Firefox. - * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, - * 4=today, 5=last five minutes, 6=last twenty-four hours - * [NOTE] The values 5 + 6 are not listed in the dropdown, which will display a - * blank value if they are used, but they do work as advertised ***/ -user_pref("privacy.sanitize.timeSpan", 0); - -/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION) - 1278037 - indexedDB (FF51+) - 1277803 - favicons (FF52+) - 1264562 - OCSP cache (FF52+) - 1268726 - Shared Workers (FF52+) - 1316283 - SSL session cache (FF52+) - 1317927 - media cache (FF53+) - 1323644 - HSTS and HPKP (FF54+) - 1334690 - HTTP Alternative Services (FF54+) - 1334693 - SPDY/HTTP2 (FF55+) - 1337893 - DNS cache (FF55+) - 1344170 - blob: URI (FF55+) - 1300671 - data:, about: URLs (FF55+) - 1473247 - IP addresses (FF63+) - 1492607 - postMessage with targetOrigin "*" (requires 4002) (FF65+) - 1542309 - top-level domain URLs when host is in the public suffix list (FF68+) - 1506693 - pdfjs range-based requests (FF68+) - 1330467 - site permissions (FF69+) - 1534339 - IPv6 (FF73+) -***/ -user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out"); -/* 4001: enable First Party Isolation [FF51+] - * [SETUP-WEB] May break cross-domain logins and site functionality until perfected - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1260931,1299996 ***/ -user_pref("privacy.firstparty.isolate", true); -/* 4002: enforce FPI restriction for window.opener [FF54+] - * [NOTE] Setting this to false may reduce the breakage in 4001 - * FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But - * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute [2][3] - * The 2nd pref removes that limitation and will only allow communication if FPDs also match. - * [1] https://bugzilla.mozilla.org/1319773#c22 - * [2] https://bugzilla.mozilla.org/1492607 - * [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/ - // user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] - // user_pref("privacy.firstparty.isolate.block_post_message", true); -/* 4003: enable scheme with FPI [FF78+] - * [NOTE] Experimental: existing data and site permissions are incompatible - * and some site exceptions may not work e.g. HTTPS-only mode (see 1244) ***/ - // user_pref("privacy.firstparty.isolate.use_site", true); - -/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) - RFP covers a wide range of ongoing fingerprinting solutions. - It is an all-or-nothing buy in: you cannot pick and choose what parts you want - - [WARNING] Do NOT use extensions to alter RFP protected metrics - [WARNING] Do NOT use prefs in section 4600 with RFP as they can interfere - - FF41+ - 418986 - limit window.screen & CSS media queries leaking identifiable info - [TEST] https://arkenfox.github.io/TZP/tzp.html#screen - FF50+ - 1281949 - spoof screen orientation - 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+) - FF55+ - 1330890 - spoof timezone as UTC 0 - 1360039 - spoof navigator.hardwareConcurrency as 2 (see 4601) - 1217238 - reduce precision of time exposed by javascript - FF56+ - 1369303 - spoof/disable performance API (see 4602, 4603) - 1333651 - spoof User Agent & Navigator API (see section 4700) - JS: FF78+ the version is spoofed as 78, and the OS as Windows 10, OS 10.15, Android 9, or Linux - HTTP Headers: spoofed as Windows or Android - 1369319 - disable device sensor API (see 4604) - 1369357 - disable site specific zoom (see 4605) - 1337161 - hide gamepads from content (see 4606) - 1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true (see 4607) - 1333641 - reduce fingerprinting in WebSpeech API (see 4608) - FF57+ - 1369309 - spoof media statistics (see 4610) - 1382499 - reduce screen co-ordinate fingerprinting in Touch API (see 4611) - 1217290 & 1409677 - enable fingerprinting resistance for WebGL (see 2010-12) - 1382545 - reduce fingerprinting in Animation API - 1354633 - limit MediaError.message to a whitelist - 1382533 & 1697680 - enable fingerprinting resistance for Presentation API (FF57-87) - This blocks exposure of local IP Addresses via mDNS (Multicast DNS) - FF58+ - 967895 - spoof canvas and enable site permission prompt before allowing canvas data extraction - FF59+ - 1372073 - spoof/block fingerprinting in MediaDevices API - Spoof: enumerate devices reports one "Internal Camera" and one "Internal Microphone" if - media.navigator.enabled is true (see 2505 which we chose to keep disabled) - Block: suppresses the ondevicechange event (see 4612) - 1039069 - warn when language prefs are set to non en-US (see 0210, 0211) - 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events - Spoofing mimics the content language of the document. Currently it only supports en-US. - Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected. - FF60-67 - 1337157 - disable WebGL debug renderer info (see 4613) (FF60+) - 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+) - 1479239 - return "no-preference" with prefers-reduced-motion (see 4614) (FF63+) - 1363508 - spoof/suppress Pointer Events (see 4615) (FF64+) - FF65: pointerEvent.pointerid (1492766) - 1485266 - disable exposure of system colors to CSS or canvas (see 4616) (FF67+) - 1407366 - enable inner window letterboxing (see 4504) (FF67+) - 1494034 - return "light" with prefers-color-scheme (see 4617) (FF67+) - FF68-77 - 1564422 - spoof audioContext outputLatency (FF70+) - 1595823 - spoof audioContext sampleRate (FF72+) - 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+) - FF78+ - 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+) - 1653987 - limit font visibility to bundled and "Base Fonts" (see 4618) (non-ANDROID) (FF80+) - 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82+) -***/ -user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); -/* 4501: enable privacy.resistFingerprinting [FF41+] - * This pref is the master switch for all other privacy.resist* prefs unless stated - * [SETUP-WEB] RFP can cause the odd website to break in strange ways, and has a few side affects, - * but is largely robust nowadays. Give it a try. Your choice. Also see 4504 (letterboxing). - * [1] https://bugzilla.mozilla.org/418986 ***/ -user_pref("privacy.resistFingerprinting", true); -/* 4502: set new window sizes to round to hundreds [FF55+] [SETUP-CHROME] - * Width will round down to multiples of 200s and height to 100s, to fit your screen. - * The override values are a starting point to round from if you want some control - * [1] https://bugzilla.mozilla.org/1330882 ***/ - // user_pref("privacy.window.maxInnerWidth", 1000); - // user_pref("privacy.window.maxInnerHeight", 1000); -/* 4503: disable mozAddonManager Web API [FF57+] - * [NOTE] To allow extensions to work on AMO, you also need 2662 - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ -user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF] -/* 4504: enable RFP letterboxing [FF67+] - * Dynamically resizes the inner window by applying margins in stepped ranges [2] - * If you use the dimension pref, then it will only apply those resolutions. The format is - * "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000, 1600x900") - * [SETUP-WEB] This does NOT require RFP (see 4501) **for now**, so if you're not using 4501, or you are but - * dislike margins being applied, then flip this pref, keeping in mind that it is effectively fingerprintable - * [WARNING] The dimension pref is only meant for testing, and we recommend you DO NOT USE it - * [1] https://bugzilla.mozilla.org/1407366 - * [2] https://hg.mozilla.org/mozilla-central/rev/6d2d7856e468#l2.32 ***/ -user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] - // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF] -/* 4510: disable showing about:blank as soon as possible during startup [FF60+] - * When default true this no longer masks the RFP chrome resizing activity - * [1] https://bugzilla.mozilla.org/1448423 ***/ -user_pref("browser.startup.blankWindow", false); -/* 4520: disable chrome animations [FF77+] [RESTART] - * [NOTE] pref added in FF63, but applied to chrome in FF77. RFP spoofs this for web content ***/ -user_pref("ui.prefersReducedMotion", 1); // [HIDDEN PREF] - -/*** [SECTION 4600]: RFP ALTERNATIVES - [WARNING] Do NOT use prefs in this section with RFP as they can interfere -***/ -user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan"); -/* [SETUP-non-RFP] Non-RFP users replace the * with a slash on this line to enable these -// FF55+ -// 4601: [2514] spoof (or limit?) number of CPU cores [FF48+] - // [NOTE] *may* affect core chrome/Firefox performance, will affect content. - // [1] https://bugzilla.mozilla.org/1008453 - // [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21675 - // [3] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22127 - // [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency - // user_pref("dom.maxHardwareConcurrency", 2); -// * * * / -// FF56+ -// 4602: [2411] disable resource/navigation timing -user_pref("dom.enable_resource_timing", false); -// 4603: [2412] disable timing attacks - // [1] https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI -user_pref("dom.enable_performance", false); -// 4604: [2512] disable device sensor API - // Optional protection depending on your device - // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15758 - // [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/ - // [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751 - // user_pref("device.sensors.enabled", false); -// 4605: [2515] disable site specific zoom - // Zoom levels affect screen res and are highly fingerprintable. This does not stop you using - // zoom, it will just not use/remember any site specific settings. Zoom levels on new tabs - // and new windows are reset to default and only the current tab retains the current zoom -user_pref("browser.zoom.siteSpecific", false); -// 4606: [2501] disable gamepad API - USB device ID enumeration - // Optional protection depending on your connected devices - // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/13023 - // user_pref("dom.gamepad.enabled", false); -// 4607: [2503] disable giving away network info [FF31+] - // e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none - // [1] https://developer.mozilla.org/docs/Web/API/Network_Information_API - // [2] https://wicg.github.io/netinfo/ - // [3] https://bugzilla.mozilla.org/960426 -user_pref("dom.netinfo.enabled", false); // [DEFAULT: true on Android] -// 4608: [2021] disable the SpeechSynthesis (Text-to-Speech) part of the Web Speech API - // [1] https://developer.mozilla.org/docs/Web/API/Web_Speech_API - // [2] https://developer.mozilla.org/docs/Web/API/SpeechSynthesis - // [3] https://wiki.mozilla.org/HTML5_Speech_API -user_pref("media.webspeech.synth.enabled", false); -// * * * / -// FF57+ -// 4610: [2506] disable video statistics - JS performance fingerprinting [FF25+] - // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15757 - // [2] https://bugzilla.mozilla.org/654550 -user_pref("media.video_stats.enabled", false); -// 4611: [2509] disable touch events - // fingerprinting attack vector - leaks screen res & actual screen coordinates - // 0=disabled, 1=enabled, 2=autodetect - // Optional protection depending on your device - // [1] https://developer.mozilla.org/docs/Web/API/Touch_events - // [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10286 - // user_pref("dom.w3c_touch_events.enabled", 0); -// * * * / -// FF59+ -// 4612: [2511] disable MediaDevices change detection [FF51+] - // [1] https://developer.mozilla.org/docs/Web/Events/devicechange - // [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/ondevicechange -user_pref("media.ondevicechange.enabled", false); -// * * * / -// FF60+ -// 4613: [2011] disable WebGL debug info being available to websites - // [1] https://bugzilla.mozilla.org/1171228 - // [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info -user_pref("webgl.enable-debug-renderer-info", false); -// * * * / -// FF63+ -// 4614: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART] - // 0=no-preference, 1=reduce -user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF] -// FF64+ -// 4615: [2516] disable PointerEvents [FF86 or lower] - // [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent - // [-] https://bugzilla.mozilla.org/1688105 -user_pref("dom.w3c_pointer_events.enabled", false); -// * * * / -// FF67+ -// 4616: [2618] disable exposure of system colors to CSS or canvas [FF44+] - // [NOTE] See second listed bug: may cause black on black for elements with undefined colors - // [SETUP-CHROME] Might affect CSS in themes and extensions - // [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876 -user_pref("ui.use_standins_for_native_colors", true); -// 4617: enforce prefers-color-scheme as light [FF67+] - // 0=light, 1=dark : This overrides your OS value -user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF] -// FF80+ -// 4618: limit font visibility (non-ANDROID) [FF79+] - // Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts [1] - // 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts - // [NOTE] Bundled fonts are auto-allowed - // [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc -user_pref("layout.css.font-visibility.level", 1); -// * * * / -// ***/ - -/*** [SECTION 4700]: RFP ALTERNATIVES (USER AGENT SPOOFING) - These prefs are insufficient and leak. Use RFP and **nothing else** - - Many of the user agent components can be derived by other means. When those - values differ, you provide more bits and raise entropy. Examples include - workers, iframes, headers, tcp/ip attributes, feature detection, and many more - - Web extensions also lack APIs to fully protect spoofing -***/ -user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow"); -/* 4701: navigator DOM object overrides - * [WARNING] DO NOT USE ***/ - // user_pref("general.appname.override", ""); // [HIDDEN PREF] - // user_pref("general.appversion.override", ""); // [HIDDEN PREF] - // user_pref("general.buildID.override", ""); // [HIDDEN PREF] - // user_pref("general.oscpu.override", ""); // [HIDDEN PREF] - // user_pref("general.platform.override", ""); // [HIDDEN PREF] - // user_pref("general.useragent.override", ""); // [HIDDEN PREF] - -/*** [SECTION 5000]: PERSONAL - Non-project related but useful. If any of these interest you, add them to your overrides - To save some overrides, we've made a few active as they seem to be universally used ***/ -user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!"); -/* WELCOME & WHAT's NEW NOTICES ***/ -user_pref("browser.startup.homepage_override.mstone", "ignore"); // master switch - // user_pref("startup.homepage_welcome_url", ""); - // user_pref("startup.homepage_welcome_url.additional", ""); - // user_pref("startup.homepage_override_url", ""); // What's New page after updates -/* WARNINGS ***/ - // user_pref("browser.tabs.warnOnClose", false); - // user_pref("browser.tabs.warnOnCloseOtherTabs", false); - // user_pref("browser.tabs.warnOnOpen", false); - // user_pref("full-screen-api.warning.delay", 0); - // user_pref("full-screen-api.warning.timeout", 0); -/* APPEARANCE ***/ - // user_pref("browser.download.autohideButton", false); // [FF57+] - // user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent -/* CONTENT BEHAVIOR ***/ - // user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type" - // user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX] - // user_pref("layout.spellcheckDefault", 2); // 0=none, 1-multi-line, 2=multi-line & single-line -/* UX BEHAVIOR ***/ - // user_pref("browser.backspace_action", 2); // 0=previous page, 1=scroll up, 2=do nothing - // user_pref("browser.quitShortcut.disabled", true); // disable Ctrl-Q quit shortcut [LINUX] [MAC] [FF87+] - // user_pref("browser.tabs.closeWindowWithLastTab", false); - // user_pref("browser.tabs.loadBookmarksInTabs", true); // open bookmarks in a new tab [FF57+] - // user_pref("browser.urlbar.decodeURLsOnCopy", true); // see bugzilla 1320061 [FF53+] - // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux] - // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART] - // user_pref("view_source.tab", false); // view "page/selection source" in a new window [FF68+, FF59 and under] -/* UX FEATURES: disable and hide the icons and menus ***/ -user_pref("browser.messaging-system.whatsNewPanel.enabled", false); // What's New toolbar icon [FF69+] - // user_pref("extensions.pocket.enabled", false); // Pocket Account [FF46+] - // user_pref("identity.fxaccounts.enabled", false); // Firefox Accounts & Sync [FF60+] [RESTART] - // user_pref("reader.parse-on-load.enabled", false); // Reader View -/* OTHER ***/ - // user_pref("browser.bookmarks.max_backups", 2); -user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false); // disable CFR [FF67+] - // [SETTING] General>Browsing>Recommend extensions as you browse -user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false); // disable CFR [FF67+] - // [SETTING] General>Browsing>Recommend features as you browse - // user_pref("network.manage-offline-status", false); // see bugzilla 620472 - // user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR) - -/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED - Documentation denoted as [-]. Items deprecated in FF78 or earlier have been archived at [1], - which also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets - [1] https://github.com/arkenfox/user.js/issues/123 -***/ -user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!"); -/* ESR78.x still uses all the following prefs -// [NOTE] replace the * with a slash in the line above to re-enable them -// FF79 -// 0212: enforce fallback text encoding to match en-US - // When the content or server doesn't declare a charset the browser will - // fallback to the "Current locale" based on your application language - // [TEST] https://hsivonen.com/test/moz/check-charset.htm - // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025 - // [-] https://bugzilla.mozilla.org/1603712 -user_pref("intl.charset.fallback.override", "windows-1252"); -// FF82 -// 0206: disable geographically specific results/search engines e.g. "browser.search.*.US" - // i.e. ignore all of Mozilla's various search engines in multiple locales - // [-] https://bugzilla.mozilla.org/1619926 -user_pref("browser.search.geoSpecificDefaults", false); -user_pref("browser.search.geoSpecificDefaults.url", ""); -// FF86 -// 1205: disable SSL Error Reporting - // [1] https://firefox-source-docs.mozilla.org/browser/base/sslerrorreport/preferences.html - // [-] https://bugzilla.mozilla.org/1681839 -user_pref("security.ssl.errorReporting.automatic", false); -user_pref("security.ssl.errorReporting.enabled", false); -user_pref("security.ssl.errorReporting.url", ""); -// 2653: disable hiding mime types (Options>General>Applications) not associated with a plugin - // [-] https://bugzilla.mozilla.org/1581678 -user_pref("browser.download.hide_plugins_without_extensions", false); -// FF87 -// 0105d: disable Activity Stream recent Highlights in the Library [FF57+] - // [-] https://bugzilla.mozilla.org/1689405 - // user_pref("browser.library.activity-stream.enabled", false); +/*** [SECTION 9999]: DEPRECATED / RENAMED ***/ +user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); +/* ESR128.x still uses all the following prefs +// [NOTE] replace the * with a slash in the line above to re-enable active ones +// FF132 +/* 2617: remove webchannel whitelist + // [-] https://bugzilla.mozilla.org/1275612 + // user_pref("webchannel.allowObject.urlWhitelist", ""); // ***/ /* END: internal custom pref to test for syntax errors ***/ diff --git a/wikipiki/backup01.png b/wikipiki/backup01.png deleted file mode 100644 index e10f1ea..0000000 Binary files a/wikipiki/backup01.png and /dev/null differ diff --git a/wikipiki/concurrent01.png b/wikipiki/concurrent01.png deleted file mode 100644 index 60e0c4a..0000000 Binary files a/wikipiki/concurrent01.png and /dev/null differ diff --git a/wikipiki/concurrent02.png b/wikipiki/concurrent02.png deleted file mode 100644 index 3571614..0000000 Binary files a/wikipiki/concurrent02.png and /dev/null differ diff --git a/wikipiki/concurrent03.png b/wikipiki/concurrent03.png deleted file mode 100644 index 9c97787..0000000 Binary files a/wikipiki/concurrent03.png and /dev/null differ diff --git a/wikipiki/concurrent04.png b/wikipiki/concurrent04.png deleted file mode 100644 index 04321df..0000000 Binary files a/wikipiki/concurrent04.png and /dev/null differ diff --git a/wikipiki/icon-librewolf.png b/wikipiki/icon-librewolf.png new file mode 100644 index 0000000..0bb9299 Binary files /dev/null and b/wikipiki/icon-librewolf.png differ diff --git a/wikipiki/icon-mull.png b/wikipiki/icon-mull.png new file mode 100644 index 0000000..d80042f Binary files /dev/null and b/wikipiki/icon-mull.png differ diff --git a/wikipiki/icon-mullvadbrowser.png b/wikipiki/icon-mullvadbrowser.png new file mode 100644 index 0000000..f5381b6 Binary files /dev/null and b/wikipiki/icon-mullvadbrowser.png differ diff --git a/wikipiki/icon-torbrowser.png b/wikipiki/icon-torbrowser.png new file mode 100644 index 0000000..ad7e8d1 Binary files /dev/null and b/wikipiki/icon-torbrowser.png differ diff --git a/wikipiki/overview01.png b/wikipiki/overview01.png deleted file mode 100644 index 2c8f3b6..0000000 Binary files a/wikipiki/overview01.png and /dev/null differ diff --git a/wikipiki/overview02.png b/wikipiki/overview02.png deleted file mode 100644 index 28638fb..0000000 Binary files a/wikipiki/overview02.png and /dev/null differ diff --git a/wikipiki/overview03.png b/wikipiki/overview03.png deleted file mode 100644 index 1219710..0000000 Binary files a/wikipiki/overview03.png and /dev/null differ diff --git a/wikipiki/profiles01.png b/wikipiki/profiles01.png deleted file mode 100644 index c8ba7b2..0000000 Binary files a/wikipiki/profiles01.png and /dev/null differ diff --git a/wikipiki/profiles02.png b/wikipiki/profiles02.png deleted file mode 100644 index 71b3076..0000000 Binary files a/wikipiki/profiles02.png and /dev/null differ diff --git a/wikipiki/rfpCanvas.png b/wikipiki/rfpCanvas.png new file mode 100644 index 0000000..97488cc Binary files /dev/null and b/wikipiki/rfpCanvas.png differ diff --git a/wikipiki/rfpCanvasException.png b/wikipiki/rfpCanvasException.png new file mode 100644 index 0000000..6889f80 Binary files /dev/null and b/wikipiki/rfpCanvasException.png differ diff --git a/wikipiki/uboCustom.png b/wikipiki/uboCustom.png new file mode 100644 index 0000000..2b8c443 Binary files /dev/null and b/wikipiki/uboCustom.png differ