8.0 KiB
| title | author | cover | color | layout | excerpt | |
|---|---|---|---|---|---|---|
| Firefox Privacy: 2021 update |
|
firefox-privacy-2021.png | linear-gradient(to bottom, rgba(158, 82, 19, 0.5), rgba(158, 82, 19, 0.9)) | post | A lot changed between now and 2019, not least in regards to Firefox. |
A lot changed between now and 2019, not least in regards to Firefox. Since our last post, Mozilla has improved privacy with Enhanced Tracking Protection (ETP). Earlier this year Mozilla introduced Total Cookie Protection (Dynamic First Party Isolation dFPI). This was then further tightened with Enhanced Cookie Clearing. We're also looking very forward to Site Isolation (code named Fission) being enabled by default in the coming releases.
Now that so many privacy features are built into the browser, there is little need for extensions made by third-party developers. Accordingly, we have updated our very outdated browser section. If you've got an old browser profile we suggest creating a new one. Some of the old advice may make your browser more unique.
Privacy Tweaks "about:config"
We're no longer recommending that users set about:config switches manually. Those switches need to be up to date and continiously maintained. They should be studied before blindly making modifications. Sometimes their behaviour changes in between Firefox releases, is superseeded by other keys or they are removed entirely. We do not see any point in duplicating the efforts of the community Arkenfox project. Arkenfox has very good documentation in their wiki and we use it ourselves.
LocalCDN and Decentraleyes
These extensions aren't required with Total Cookie Protection (TCP), which is enabled if you've set Enhanced Tracking Protection (ETP) to Strict.
Replacing scripts on CDNs with local versions is not a comprehensive solution and is a form of enumeration of badness. While it may work with some scripts that are included it doesn't help with most other third party connections.
CDN extensions never really improved privacy as far as sharing your IP address was concerned and their usage is fingerprintable as this Tor Project developer points out. They are the wrong tool for the job and are not a substitute for a good VPN or Tor. Its worth noting the resources for Decentraleyes are hugely out of date and would not be likely used anyway.
NeatURLs and ClearURLS
Previously we recommended ClearURLs to remove tracking parameters from URLs you might visit. These extensions are no longer needed with uBlock Origin's removeparam feature.
HTTPS Everywhere
The EFF announced back in September they were deprecating HTTPS-Everywhere as most browsers now have a HTTP-Only feature. We are pleased to see privacy features built into the browser and Firefox 91 introduced HTTPS by Default in Private Browsing.
Multi Account Containers and Temporary Containers
Container extensions aren't as important as they used to be for privacy now that we have Total Cookie Protection.
Multi Account Container will still have some use if you use Mozilla VPN as it is going to be intergrated allowing you to configure specified containers to use a particular VPN server. Another use might be if you want to login to multiple accounts on the same domain.
Just-In-Time Compilation (JIT)
What is "Disable JIT" in Bromite? This option disables the JavaScript performance feature JIT. It can increase security but at the cost of performance. Those trade-offs vary wildly and are explored in this publication by Johnathan Norman from the Microsoft Edge team. This option is very much a security vs performance option.
Mozilla browsers on Android
We don't recommend any Mozilla based browsers on Android. This is because we don't feel that GeckoView is quite as secure as it could be as it doesn't support site isolation, soon to be coming in desktop browsers or isolated processes.
We also noticed that there isn't an option for HTTPS-Only mode. The only way to get something similar is to install the deprecated extension HTTPS Everywhere.
There are places which Firefox on Android shines for example browsing news websites where you may want to partially load some JavaScript (but not all) using medium or hard blocking mode. The reader view is also pretty cool. We expect things will change in the future, so we're keeping a close eye on this.
Fingerprinting
Firefox has the ability to block known third party fingerprinting resources. Mozilla has advanced protection against fingerprinting (RFP is enabled with Arkenfox).
We do not recommend extensions that promise to change your browser fingerprint. Some of those those extensions are detectable by websites through JavaScript and CSS methods, particularly those which inject anything into the web content.
This includes all extensions that try to change the user agent or other browser behaviour to prevent fingerprinting. We see these often recommended on Reddit and would like to say that they will likely make you more unique and can be circumvented. Arkenfox has a good list of extensions you shouldn't be using. They also have another list of extensions you needn't bother with either. We also like to say testing sites which show you how unique you are in a set of users are often using hugely tainted results that are not indicitive of real-world usage.
Special thanks to Thorin-Oakenpants and Tommy for their help with providing advice and further documentation during the research phase.