From 5ede0acaaae65b77e7c20cd0c1b9293a86105fc1 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Fri, 1 May 2020 08:49:08 +0200 Subject: [PATCH 001/147] Fixes `mailnews.use_received_date` type and unsets it by default --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index be39ba1..42e7b4b 100644 --- a/user.js +++ b/user.js @@ -1367,7 +1367,7 @@ user_pref("mailnews.display.date_senders_timezone", false); * to make Thunderbird show the time when the message arrived on your mail server, based on the * "Received" header. Set the following preference. New messages will show the time the message * was received, rather than when it was sent. ***/ -user_pref("mailnews.use_received_date", "true"); + // user_pref("mailnews.use_received_date", true); /** ADDRESS BOOK ***/ /* 6007: Address book collection From b90bbe45b23cf31f032d558d08423e8923d8a2c0 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Fri, 1 May 2020 08:49:19 +0200 Subject: [PATCH 002/147] Bumps to v68-beta5 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 42e7b4b..ed5b31a 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: ghacks thunderbird user.js -* date: 16 April 2020 -* version v68.0-beta4: "Knock on Pants" +* date: 1 May 2020 +* version v68.0-beta5: "Knock on Pants" * authors: v52+ github | v51- www.ghacks.net * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From 30848dd7e75ad1a4701ea6a32418c8810f9e14a4 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 31 Oct 2020 22:22:23 +0100 Subject: [PATCH 003/147] Replaces gHacks occurrences by arkenfox (see arkenfox/user.js#1009) --- README.md | 4 ++-- user.js | 20 ++++++++++---------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 732f088..f4cc402 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ For a more technical breakdown and explanation, you can read more on the [overvi ### :large_blue_diamond: thunderbird user.js The Thunderbird `user.js` is a **template** which aims to provide as much privacy and enhanced security as possible. -It differs from the `ghacks user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client. +It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client. - If you're using Thunderbird with Tor we suggest that you install the [TorBirdy](https://addons.thunderbird.net/addon/torbirdy) add-on. If you are using Tor, you should also consider using [Tails](https://tails.boum.org/) or [Whonix](https://www.whonix.org/). - If you're a **Gmail** user see [this article about OAuth2](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/3.1-OAuth2-Users). @@ -20,7 +20,7 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o ### :large_blue_diamond: Acknowledgments -* [tya99](https://github.com/tya99) most of the ground work and initial port from the Firefox version of [ghacks user.js](https://github.com/ghacksuserjs/ghacks-user.js) +* [tya99](https://github.com/tya99) most of the ground work and initial port from the Firefox version of [arkenfox user.js](https://github.com/arkenfox/user.js) * [dngray](https://github.com/dngray) continual maintenance and Wiki * [HorlogeSkynet](https://github.com/HorlogeSkynet) continual maintenance diff --git a/user.js b/user.js index ed5b31a..201260d 100644 --- a/user.js +++ b/user.js @@ -1,5 +1,5 @@ /****** -* name: ghacks thunderbird user.js +* name: thunderbird user.js * date: 1 May 2020 * version v68.0-beta5: "Knock on Pants" * authors: v52+ github | v51- www.ghacks.net @@ -299,7 +299,7 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost * OS/network level, and/or configured properly in VPN setups. If you are not masking your IP, * then this won't make much difference. If you are maksing your IP, then it can only help. * [TEST] http://ipv6leak.com/ - * [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/437#issuecomment-403740626 + * [1] https://github.com/arkenfox/user.js/issues/437#issuecomment-403740626 * [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/ user_pref("network.dns.disableIPv6", true); /* 0702: disable HTTP2 @@ -410,7 +410,7 @@ user_pref("places.history.enabled", false); [1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags [2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/ [3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache - [4] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor + [4] https://github.com/arkenfox/user.js/wiki/4.2.4-Header-Editor [5] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 ***/ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); @@ -725,14 +725,14 @@ user_pref("dom.disable_window_move_resize", true); /* 2203: open links targeting new windows in a new tab instead * This stops malicious window sizes and some screen resolution leaks. * You can still right-click a link and open in a new window. - * [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen + * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen * [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/ // user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3] // user_pref("browser.link.open_newwindow.restriction", 0); // [DEFAULT: 0] /* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks * [NOTE] You can still manually toggle the browser's fullscreen state (F11), * but this pref will disable embedded video/game fullscreen controls, e.g. youtube - * [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen ***/ + * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen ***/ // user_pref("full-screen-api.enabled", false); // [DEFAULT: false] /* 2210: block popup windows * [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/ @@ -769,7 +769,7 @@ user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!"); // user_pref("dom.serviceWorkers.enabled", false); // [DEFAULT: false] /* 2304: disable Web Notifications * [NOTE] Web Notifications require service workers (2302) and are behind a prompt (2306) - * [NOTE] Unlike ghacks-user.js, we explicitly disable them as they are enabled by default. + * [NOTE] Unlike arkenfox/user.js, we explicitly disable them as they are enabled by default. * [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/ user_pref("dom.webnotifications.enabled", false); // [FF22+] user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+] @@ -882,7 +882,7 @@ user_pref("devtools.chrome.enabled", false); user_pref("devtools.debugger.remote-enabled", false); user_pref("devtools.webide.enabled", false); /* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN] - * [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc + * [TEST] https://arkenfox.github.io/TZP/tzp.html#misc * [1] https://bugzilla.mozilla.org/1173199 ***/ // user_pref("mathml.disabled", true); /* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+] @@ -1073,7 +1073,7 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAUL [NOTE] Info only: To set a size, open a XUL (chrome) page (such as about:config) which is at 100% zoom, hit Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run. Test your window size, do some math, resize to allow for all the non inner window elements - [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen + [TEST] https://arkenfox.github.io/TZP/tzp.html#screen ** 1281949 - spoof screen orientation (FF50+) ** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+) FF53: Fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044) @@ -1232,7 +1232,7 @@ user_pref("ui.use_standins_for_native_colors", true); // FF41+ // 4620: mitigate fingerprinting via canvas // [NOTE] This setting has been removed from gHacks v67 (see [1]) but is still enabled by default. - // [1] https://github.com/ghacksuserjs/ghacks-user.js/commit/8b07fd57d0f8a31dab25661d51235fe1b0c6360c + // [1] https://github.com/arkenfox/user.js/commit/8b07fd57d0f8a31dab25661d51235fe1b0c6360c user_pref("canvas.capturestream.enabled", false); // * * * / // ***/ @@ -1592,7 +1592,7 @@ user_pref("mail.server.default.acPreferEncrypt", 0); /*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED Documentation denoted as [-]. Items deprecated prior to FF61 have been archived at [1], which also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets - [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123 + [1] https://github.com/arkenfox/user.js/issues/123 ***/ user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!"); /* ESR60.x still uses all the following prefs From ce8dfe33296aae4f82d1275cf761457452a4a164 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 31 Oct 2020 22:26:10 +0100 Subject: [PATCH 004/147] Bumps to v68.0 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 201260d..6ea2322 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 1 May 2020 -* version v68.0-beta5: "Knock on Pants" +* date: 31 October 2020 +* version v68.0: "Knock on Pants" * authors: v52+ github | v51- www.ghacks.net * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From a9b016632356287528308d0a4eab7bbba52ddfa2 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 1 Nov 2020 12:09:30 +0100 Subject: [PATCH 005/147] Updates README layout to reflect latest arkenfox design --- README.md | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index f4cc402..3b0db50 100644 --- a/README.md +++ b/README.md @@ -1,15 +1,17 @@ # Thunderbird User.JS -> An ongoing comprehensive user.js template for configuring and hardening Thunderbird privacy, security and anti-fingerprinting +> Thunderbird privacy, security and anti-fingerprinting: a comprehensive user.js template for configuration and hardening -### :large_blue_diamond: user.js +### :purple_square: user.js An `user.js` is a configuration file that can control hundreds of Thunderbird settings. For a more technical breakdown and explanation, you can read more on the [overview](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/1.1-Overview) Wiki page. -### :large_blue_diamond: thunderbird user.js +### :green_square: Thunderbird user.js -The Thunderbird `user.js` is a **template** which aims to provide as much privacy and enhanced security as possible. +[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) + +The `thunderbird user.js` is a **template** which aims to provide as much privacy and enhanced security as possible. It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client. - If you're using Thunderbird with Tor we suggest that you install the [TorBirdy](https://addons.thunderbird.net/addon/torbirdy) add-on. If you are using Tor, you should also consider using [Tails](https://tails.boum.org/) or [Whonix](https://www.whonix.org/). @@ -18,15 +20,19 @@ It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird Also be aware that this `user.js` is made specifically for Thunderbird and has only been tested in the latest stable release. -### :large_blue_diamond: Acknowledgments +### :orange_square: Sitemap + +- [Releases](https://github.com/HorlogeSkynet/thunderbird-user.js/releases) +- [Issues](https://github.com/HorlogeSkynet/thunderbird-user.js/issues) +- [Wiki](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki) + +### :red_square: Acknowledgments * [tya99](https://github.com/tya99) most of the ground work and initial port from the Firefox version of [arkenfox user.js](https://github.com/arkenfox/user.js) * [dngray](https://github.com/dngray) continual maintenance and Wiki * [HorlogeSkynet](https://github.com/HorlogeSkynet) continual maintenance -### :large_blue_diamond: Related Projects +### :blue_square: Related Projects * [CHEF-KOCH/TBCK](https://github.com/CHEF-KOCH/TBCK) * [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31d.htm) - -### :large_blue_diamond: [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) From 1692de442cf909dc569bac4334cbdd378a02a58a Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 1 Nov 2020 19:08:14 +0100 Subject: [PATCH 006/147] Applies Arkenfox v68..v78 changes --- user.js | 768 +++++++++++++++++++++++++++++++++----------------------- 1 file changed, 447 insertions(+), 321 deletions(-) diff --git a/user.js b/user.js index 6ea2322..5f5be9f 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 31 October 2020 -* version v68.0: "Knock on Pants" +* date: 1 November 2020 +* version: v78-beta1 * authors: v52+ github | v51- www.ghacks.net * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) @@ -15,8 +15,8 @@ 2. READ this * https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/1.3-Implementation 3. If you skipped steps 1 and 2 above (shame on you), then here is the absolute minimum - * Auto-installing updates for Thunderbird and extensions are disabled (section 0302's) - * Real time binary checks with Google services are disabled (section 0414's) + * Auto-installing updates for Thunderbird and extensions are disabled (section 0302) + * Real time binary checks with Google services are disabled (section 0412) * Browsing related technologies, and JavaScript disabled. Use your web browser for browsing. * You will need to make changes, and to troubleshoot at times (choose wisely, there is always a trade-off). While not 100% definitive, search for "[SETUP". If required, add each pref to your overrides section at @@ -34,7 +34,7 @@ * INDEX: 0100: STARTUP - 0200: GEOLOCATION + 0200: GEOLOCATION / LANGUAGE / LOCALE 0300: QUIET BIRD 0400: BLOCKLISTS / SAFE BROWSING 0500: SYSTEM ADD-ONS / EXPERIMENTS @@ -73,6 +73,12 @@ * [1] https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/ user_pref("_user.js.parrot", "START: Oh yes, the Norwegian Blue... what's wrong with it?"); +/* 0000: disable about:config warning + * FF71-72: chrome://global/content/config.xul + * FF73+: chrome://global/content/config.xhtml ***/ +user_pref("general.warnOnAboutConfig", false); // XUL/XHTML version +user_pref("browser.aboutConfig.showWarning", false); // HTML version [FF71+] + /*** [SECTION 0100]: STARTUP ***/ user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); /* 0101: disable default browser check @@ -82,40 +88,50 @@ user_pref("mail.shell.checkDefaultMail", false); * [SETTING] Edit>Preferences>General>Thunderbird Start Page ***/ user_pref("mailnews.start_page.enabled", false); -/*** [SECTION 0200]: GEOLOCATION ***/ +/*** [SECTION 0200]: GEOLOCATION / LANGUAGE / LOCALE ***/ user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!"); +/** GEOLOCATION ***/ /* 0201: disable Location-Aware Browsing + * [NOTE] Best left at default "true", fingerprintable, is already behind a prompt (see 0202) * [1] https://www.mozilla.org/firefox/geolocation/ ***/ user_pref("geo.enabled", false); -/* 0201b: set a default permission for Location [FF58+] +/* 0202: set a default permission for Location (see 0201) [FF58+] * 0=always ask (default), 1=allow, 2=block * [NOTE] Best left at default "always ask", fingerprintable via Permissions API * [SETTING] to add site exceptions: Page Info>Permissions>Access Your Location * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Location>Settings ***/ // user_pref("permissions.default.geo", 2); -/* 0202: disable GeoIP-based search results - * [NOTE] May not be hidden if Firefox has changed your settings due to your locale - * [1] https://trac.torproject.org/projects/tor/ticket/16254 - * [2] https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine ***/ -user_pref("browser.search.region", "US"); // [HIDDEN PREF] -user_pref("browser.search.geoip.url", ""); -/* 0205: set Thunderbird language [FF59+] [RESTART] - * Go to the end of about:support to view Internationalization & Localization settings - * If set to empty, the OS locales are used. If not set at all, default locale is used - * This is the language used in menus, about pages, messages, and notifications from Firefox ***/ - // user_pref("intl.locale.requested", "en-US"); // [HIDDEN PREF] +/* 0203: use Mozilla geolocation service instead of Google when geolocation is enabled [FF74+] + * Optionally enable logging to the console (defaults to false) ***/ +user_pref("geo.provider.network.url", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"); + // user_pref("geo.provider.network.logging.enabled", true); // [HIDDEN PREF] +/* 0204: disable using the OS's geolocation service ***/ +user_pref("geo.provider.ms-windows-location", false); // [WINDOWS] +user_pref("geo.provider.use_corelocation", false); // [MAC] +user_pref("geo.provider.use_gpsd", false); // [LINUX] /* 0206: disable geographically specific results/search engines e.g. "browser.search.*.US" * i.e. ignore all of Mozilla's various search engines in multiple locales ***/ user_pref("browser.search.geoSpecificDefaults", false); user_pref("browser.search.geoSpecificDefaults.url", ""); -/* 0207: set preferred language for diplaying web pages + +/** LANGUAGE / LOCALE ***/ +/* 0210: set preferred language for displaying web pages * [TEST] https://addons.mozilla.org/about ***/ user_pref("intl.accept_languages", "en-US, en"); -/* 0208: Set dictionary to US ***/ +/* 0210b: Set dictionary to US ***/ user_pref("spellchecker.dictionary", "en-US"); -/* 0209: use APP locale over OS locale in regional preferences [FF56+] - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1379420,1364789 ***/ -user_pref("intl.regional_prefs.use_os_locales", false); +/* 0211: enforce US English locale regardless of the system locale + * [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages, see [2] + * [1] https://bugzilla.mozilla.org/867501 + * [2] https://bugzilla.mozilla.org/1629630 ***/ +user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] +/* 0212: enforce fallback text encoding to match en-US + * When the content or server doesn't declare a charset the browser will + * fallback to the "Current locale" based on your application language + * [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content (FF72-) + * [TEST] https://hsivonen.com/test/moz/check-charset.htm + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025 ***/ +user_pref("intl.charset.fallback.override", "windows-1252"); /*** [SECTION 0300]: QUIET BIRD Starting in user.js v68, we only disable the auto-INSTALL of Thunderbird. @@ -131,17 +147,18 @@ user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the // user_pref("extensions.update.enabled", false); /* 0302a: disable auto-INSTALLING Thunderbird updates [SETUP-INSTALL] [NON-WINDOWS FF65+] * [NOTE] In FF65+ on Windows this SETTING (below) is now stored in a file and the pref was removed - * [SETTING] General>Firefox Updates>Check for updates but let you choose... ***/ + * [SETTING] General>Thunderbird Updates>Check for updates but let you choose to install them... ***/ user_pref("app.update.auto", false); /* 0302b: disable auto-INSTALLING extension and theme updates (after the check in 0301b) * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/ // user_pref("extensions.update.autoUpdateDefault", false); /* 0306: disable extension metadata - * used when installing/updating an extension, and in daily background update checks: if false, it - * hides the expanded text description (if it exists) when you "show more details about an addon" ***/ + * used when installing/updating an extension, and in daily background update checks: + * when false, extension detail tabs will have no description ***/ // user_pref("extensions.getAddons.cache.enabled", false); -/* 0308: disable search update - * [SETTING] General>Firefox Updates>Automatically update search engines ***/ +/* 0308: disable search engine updates (e.g. OpenSearch) + * [NOTE] This does not affect Mozilla's built-in or Web Extension search engines + * [SETTING] General>Thunderbird Updates>Automatically update search engines (FF72-) ***/ user_pref("browser.search.update", false); /* 0310: disable sending the URL of the website where a plugin crashed ***/ user_pref("dom.ipc.plugins.reportCrashURL", false); @@ -149,14 +166,13 @@ user_pref("dom.ipc.plugins.reportCrashURL", false); user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF] /* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/ user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); -user_pref("extensions.webservice.discoverURL", ""); /* 0330: disable telemetry * the pref (.unified) affects the behavior of the pref (.enabled) * IF unified=false then .enabled controls the telemetry module * IF unified=true then .enabled ONLY controls whether to record extended data * so make sure to have both set as false. * Restoring prompted=0 would make TB ask you on fresh install. - * [NOTE] FF58+ `toolkit.telemetry.enabled` is now LOCKED to reflect prerelease + * [NOTE] FF58+ 'toolkit.telemetry.enabled' is now LOCKED to reflect prerelease * or release builds (true and false respectively), see [2]. * [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html * [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/ @@ -170,24 +186,22 @@ user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+] user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+] user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+] -user_pref("toolkit.telemetry.hybridContent.enabled", false); // [FF59+] /* 0340: disable Health Reports - * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send technical... data ***/ + * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Firefox to send technical... data ***/ user_pref("datareporting.healthreport.uploadEnabled", false); /* 0341: disable new data submission, master kill switch [FF41+] * If disabled, no policy is shown or upload takes place, ever * [1] https://bugzilla.mozilla.org/1195552 ***/ user_pref("datareporting.policy.dataSubmissionEnabled", false); /* 0342: disable Studies (see 0503) - * [NOTE] This pref has no effect when Health Reports (0340) are disabled - * [SETTING] Privacy & Security>Firefox Data Collection & Use>...>Allow Firefox to install and run studies ***/ + * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Firefox to install and run studies ***/ user_pref("app.shield.optoutstudies.enabled", false); /* 0350: disable Crash Reports ***/ user_pref("breakpad.reportURL", ""); user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+] user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] /* 0351: disable backlogged Crash Reports - * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send backlogged crash reports ***/ + * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Firefox to send backlogged crash reports ***/ user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+] /* 0390: disable Captive Portal detection * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy @@ -195,29 +209,46 @@ user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+ user_pref("captivedetect.canonicalURL", ""); user_pref("network.captive-portal-service.enabled", false); // [FF52+] -/*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING (SB) - Safe Browsing has taken many steps to preserve privacy. *IF* required, a full url is never - sent to Google, only a PART-hash of the prefix, and this is hidden with noise of other real - PART-hashes. Google also swear it is anonymized and only used to flag malicious sites. - Firefox also takes measures such as striping out identifying parameters and since SBv4 (FF57+) - doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity) - - #Required reading [#] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ - [1] https://wiki.mozilla.org/Security/Safe_Browsing -***/ +/*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING (SB) ***/ user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); /** BLOCKLISTS ***/ -/* 0401: enforce Firefox blocklist, but sanitize blocklist url +/* 0401: enforce Firefox blocklist * [NOTE] It includes updates for "revoked certificates" - * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ - * [2] https://trac.torproject.org/projects/tor/ticket/16931 ***/ + * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/ user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] -user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/"); -/* 0402: disable binaries NOT in Safe Browsing local lists being checked - * This is a real-time check with Google services - * [SETUP-SECURITY] If you do not understand this, or if you want this protection, then override it ***/ + +/** SAFE BROWSING (SB) + Safe Browsing has taken many steps to preserve privacy. *IF* required, a full url is never + sent to Google, only a PART-hash of the prefix, and this is hidden with noise of other real + PART-hashes. Google also swear it is anonymized and only used to flag malicious sites. + Firefox also takes measures such as striping out identifying parameters and since SBv4 (FF57+) + doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity) + + #Required reading [#] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ + [1] https://wiki.mozilla.org/Security/Safe_Browsing + [2] https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work +***/ +/* 0410: disable SB (Safe Browsing) + * [WARNING] Do this at your own risk! These are the master switches. + * [SETTING] Privacy & Security>Security>... "Block dangerous and deceptive content" ***/ + // user_pref("browser.safebrowsing.malware.enabled", false); + // user_pref("browser.safebrowsing.phishing.enabled", false); +/* 0411: disable SB checks for downloads (both local lookups + remote) + * This is the master switch for the safebrowsing.downloads* prefs (0412, 0413) + * [SETTING] Privacy & Security>Security>... "Block dangerous downloads" ***/ + // user_pref("browser.safebrowsing.downloads.enabled", false); +/* 0412: disable SB checks for downloads (remote) + * To verify the safety of certain executable files, Firefox may submit some information about the + * file, including the name, origin, size and a cryptographic hash of the contents, to the Google + * Safe Browsing service which helps Firefox determine whether or not the file should be blocked + * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override it ***/ user_pref("browser.safebrowsing.downloads.remote.enabled", false); -/* 0403: disable 'ignore this warning' on Safe Browsing warnings +user_pref("browser.safebrowsing.downloads.remote.url", ""); +/* 0413: disable SB checks for unwanted software + * [SETTING] Privacy & Security>Security>... "Warn you about unwanted and uncommon software" ***/ + // user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); + // user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); +/* 0419: disable 'ignore this warning' on SB warnings * If clicked, it bypasses the block for that session. This is a means for admins to enforce SB * [TEST] see github wiki APPENDIX A: Test Sites: Section 5 * [1] https://bugzilla.mozilla.org/1226490 ***/ @@ -255,7 +286,7 @@ user_pref("browser.ping-centre.telemetry", false); /* 0517: disable Form Autofill * [NOTE] Stored data is NOT secure (uses a JSON file) * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes - * [SETTING] Privacy & Security>Forms & Passwords>Autofill addresses + * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses (FF74+) * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill * [2] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/ ***/ user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] @@ -275,7 +306,7 @@ user_pref("network.prefetch-next", false); * [1] https://www.ghacks.net/2013/04/27/firefox-prefetching-what-you-need-to-know/ * [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/ user_pref("network.dns.disablePrefetch", true); -user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF] +user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF ESR] [DEFAULT: true FF70+] /* 0603: disable predictor / prefetching ***/ user_pref("network.predictor.enabled", false); user_pref("network.predictor.enable-prefetch", false); // [FF48+] @@ -283,9 +314,8 @@ user_pref("network.predictor.enable-prefetch", false); // [FF48+] * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests * [2] https://www.ghacks.net/2015/08/16/block-firefox-from-connecting-to-sites-when-you-hover-over-links/ ***/ user_pref("network.http.speculative-parallel-limit", 0); -/* 0606: disable pings (but enforce same host in case) - * [1] http://kb.mozillazine.org/Browser.send_pings - * [2] http://kb.mozillazine.org/Browser.send_pings.require_same_host ***/ +/* 0606: disable "Hyperlink Auditing" (click tracking) and enforce same host in case + * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/ user_pref("browser.send_pings", false); // [DEFAULT: false] user_pref("browser.send_pings.require_same_host", true); @@ -294,11 +324,11 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost /* 0701: disable IPv6 * IPv6 can be abused, especially regarding MAC addresses. They also do not play nice * with VPNs. That's even assuming your ISP and/or router and/or website can handle it. - * Firefox telemetry (April 2019) shows only 5% of all connections are IPv6. + * [STATS] Firefox telemetry (June 2020) shows only 5% of all connections are IPv6. * [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an * OS/network level, and/or configured properly in VPN setups. If you are not masking your IP, - * then this won't make much difference. If you are maksing your IP, then it can only help. - * [TEST] http://ipv6leak.com/ + * then this won't make much difference. If you are masking your IP, then it can only help. + * [TEST] https://ipleak.org/ * [1] https://github.com/arkenfox/user.js/issues/437#issuecomment-403740626 * [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/ user_pref("network.dns.disableIPv6", true); @@ -306,7 +336,7 @@ user_pref("network.dns.disableIPv6", true); * HTTP2 raises concerns with "multiplexing" and "server push", does nothing to * enhance privacy, and opens up a number of server-side fingerprinting opportunities. * [WARNING] Disabling this made sense in the past, and doesn't break anything, but HTTP2 is - * at 35% (April 2019) and growing [5]. Don't be that one person using HTTP1.1 on HTTP2 sites + * at 40% (December 2019) and growing [5]. Don't be that one person using HTTP1.1 on HTTP2 sites * [1] https://http2.github.io/faq/ * [2] https://blog.scottlogic.com/2014/11/07/http-2-a-quick-look.html * [3] https://http2.github.io/http2-spec/#rfc.section.10.8 @@ -327,30 +357,20 @@ user_pref("network.http.altsvc.oe", false); /* 0704: enforce the proxy server to do any DNS lookups when using SOCKS * e.g. in Tor, this stops your local DNS server from knowing your Tor destination * as a remote Tor node will handle the DNS request - * [1] http://kb.mozillazine.org/Network.proxy.socks_remote_dns - * [2] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/ + * [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/ user_pref("network.proxy.socks_remote_dns", true); -/* 0707: disable (or setup) DNS-over-HTTPS (DoH) [FF60+] - * TRR = Trusted Recursive Resolver - * .mode: 0=off, 1=race, 2=TRR first, 3=TRR only, 4=race for stats but always use native result - * [WARNING] DoH bypasses hosts and gives info to yet another party (e.g. Cloudflare) - * [1] https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/ - * [2] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ ***/ - // user_pref("network.trr.mode", 0); - // user_pref("network.trr.bootstrapAddress", ""); - // user_pref("network.trr.uri", ""); /* 0708: disable FTP [FF60+] * [1] https://www.ghacks.net/2018/02/20/firefox-60-with-new-preference-to-disable-ftp/ ***/ user_pref("network.ftp.enabled", false); /* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+] * [SETUP-CHROME] Can break extensions for profiles on network shares - * [1] https://trac.torproject.org/projects/tor/ticket/26424 ***/ + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/ user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] /* 0710: disable GIO as a potential proxy bypass vector * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda, * gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64) * [1] https://bugzilla.mozilla.org/1433507 - * [2] https://trac.torproject.org/23044 + * [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/23044 * [3] https://en.wikipedia.org/wiki/GVfs * [4] https://en.wikipedia.org/wiki/GIO_(software) ***/ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] @@ -363,9 +383,8 @@ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); /* 0801: disable location bar using search * Don't leak URL typos to a search engine, give an error message instead. * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com" - * [NOTE] Search buttons in the dropdown work, but hitting 'enter' in the location bar will fail - * [TIP] You can add keywords to search engines in options (e.g. 'd' for DuckDuckGo) and - * the dropdown will now auto-select it and you can then hit 'enter' and it will work + * [NOTE] This does **not** affect explicit user action such as using search buttons in the + * dropdown, or using keyword search shortcuts you configure in options (e.g. 'd' for DuckDuckGo) * [SETUP-CHROME] If you don't, or rarely, type URLs, or you use a default search * engine that respects privacy, then you probably don't need this ***/ user_pref("keyword.enabled", false); // [DEFAULT: false] @@ -377,10 +396,10 @@ user_pref("keyword.enabled", false); // [DEFAULT: false] * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack), * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/ user_pref("browser.fixup.alternate.enabled", false); -/* 0805: disable CSS querying page history - CSS history leak +/* 0805: disable coloring of visited links - CSS history leak * [NOTE] This has NEVER been fully "resolved": in Mozilla/docs it is stated it's * only in 'certain circumstances', also see latest comments in [2] - * [TEST] http://lcamtuf.coredump.cx/yahh/ (see github wiki APPENDIX A on how to use) + * [TEST] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use) * [1] https://dbaron.org/mozilla/visited-privacy * [2] https://bugzilla.mozilla.org/147777 * [3] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector ***/ @@ -390,11 +409,12 @@ user_pref("layout.css.visited_links_enabled", false); * [SETUP-CHROME] Change these if you trust and use a privacy respecting search engine * [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/ user_pref("browser.search.suggest.enabled", false); -/* 0860: disable search and form history [SETUP-WEB] - * [WARNING] Autocomplete form data is still (in April 2019) easily read by third parties, see [1] - * [NOTE] We also clear formdata on exiting Firefox (see 2803) +/* 0860: disable search and form history + * [SETUP-WEB] Be aware thet autocomplete form data can be read by third parties, see [1] [2] + * [NOTE] We also clear formdata on exit (see 2803) * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history - * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html ***/ + * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html + * [2] https://bugzilla.mozilla.org/381681 ***/ user_pref("browser.formfill.enable", false); /* 0862: disable browsing and download history * [NOTE] We also clear history and downloads on exiting Firefox (see 2803) @@ -402,16 +422,20 @@ user_pref("browser.formfill.enable", false); user_pref("places.history.enabled", false); /*** [SECTION 1000]: CACHE / FAVICONS - ETAG [1] and other [2][3] cache tracking/fingerprinting techniques can be averted by - disabling *BOTH* disk (1001) and memory (1003) cache. ETAGs can also be neutralized - by modifying response headers [4]. Another solution is to use a hardened configuration - with Temporary Containers [5]. Alternatively, you can *LIMIT* exposure by clearing - cache on close (2803). or on a regular basis manually or with an extension. + Cache tracking/fingerprinting techniques [1][2][3] require a cache. Disabling disk (1001) + *and* memory (1003) caches is one solution; but that's extreme and fingerprintable. A hardened + Temporary Containers configuration can effectively do the same thing, by isolating every tab [4]. + + We consider avoiding disk cache (1001) so cache is session/memory only (like Private Browsing + mode), and isolating cache to first party (4001) is sufficient and a good balance between + risk and performance. ETAGs can also be neutralized by modifying response headers [5], and + you can clear the cache manually or on a regular basis with an extension. + [1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags [2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/ [3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache - [4] https://github.com/arkenfox/user.js/wiki/4.2.4-Header-Editor - [5] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 + [4] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 + [5] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor ***/ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); /** CACHE ***/ @@ -420,14 +444,10 @@ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is m * or you use a hardened Temporary Containers, then feel free to override this * [NOTE] We also clear cache on exiting Firefox (see 2803) ***/ user_pref("browser.cache.disk.enable", false); -/* 1002: disable disk cache for SSL pages - * [1] http://kb.mozillazine.org/Browser.cache.disk_cache_ssl ***/ -user_pref("browser.cache.disk_cache_ssl", false); /* 1003: disable memory cache -/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes - * [NOTE] Not recommended due to performance issues ***/ +/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes ***/ // user_pref("browser.cache.memory.enable", false); - // user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF] + // user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF ESR] /* 1006: disable permissions manager from writing to disk [RESTART] * [NOTE] This means any permission changes are session only * [1] https://bugzilla.mozilla.org/967812 ***/ @@ -439,37 +459,42 @@ user_pref("browser.cache.disk_cache_ssl", false); * profile/shortcutCache directory. The .ico remains after the shortcut is deleted. * If set to false then the shortcuts use a generic Firefox icon ***/ user_pref("browser.shell.shortcutFavicons", false); -/* 1031: disable favicons in tabs and new bookmarks - * bookmark favicons are stored as data blobs in favicons.sqlite ***/ +/* 1031: disable favicons in history and bookmarks + * Stored as data blobs in favicons.sqlite, these don't reveal anything that your + * actual history (and bookmarks) already do. Your history is more detailed, so + * control that instead; e.g. disable history, clear history on close, use PB mode + * [NOTE] favicons.sqlite is sanitized on Firefox close, not in-session ***/ user_pref("browser.chrome.site_icons", false); /* 1032: disable favicons in web notifications ***/ -user_pref("alerts.showFavicons", false); // [DEFAULT: false] + // user_pref("alerts.showFavicons", false); // [DEFAULT: false] /*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS) - Note that your cipher and other settings can be used server side as a fingerprint attack - vector, see [1] (It's quite technical but the first part is easy to understand - and you can stop reading when you reach the second section titled "Enter Bro") - - Option 1: Use defaults for ciphers (1260's). There is nothing *weak* about these, but - due to breakage, browsers can't deprecate them until the web stops using them - Option 2: Disable the ciphers in 1261, 1262 and 1263. These shouldn't break anything. - Optionally, disable the ciphers in 1264. - + Your cipher and other settings can be used in server side fingerprinting + [TEST] https://www.ssllabs.com/ssltest/viewMyClient.html + [TEST] https://browserleaks.com/ssl + [TEST] https://ja3er.com/ [1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/ ***/ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); /** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/ -/* 1201: disable old SSL/TLS "insecure" renegotiation (vulnerable to a MiTM attack) - * [SETUP-WEB] <2% of secure sites do NOT support the newer "secure" renegotiation, see [2] +/* 1201: require safe negotiation + * Blocks connections to servers that don't support RFC 5746 [2] as they're potentially + * vulnerable to a MiTM attack [3]. A server *without* RFC 5746 can be safe from the attack + * if it disables renegotiations but the problem is that the browser can't know that. + * Setting this pref to true is the only way for the browser to ensure there will be + * no unsafe renegotiations on the channel between the browser and the server. * [1] https://wiki.mozilla.org/Security:Renegotiation - * [2] https://www.ssllabs.com/ssl-pulse/ ***/ + * [2] https://tools.ietf.org/html/rfc5746 + * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 ***/ user_pref("security.ssl.require_safe_negotiation", true); /* 1202: control TLS versions with min and max * 1=TLS 1.0, 2=TLS 1.1, 3=TLS 1.2, 4=TLS 1.3 + * [STATS] Firefox telemetry (June 2020) shows only 0.16% of SSL handshakes use 1.0 or 1.1 * [WARNING] Leave these at default, otherwise you alter your TLS fingerprint. - * Firefox telemetry (April 2019) shows only 0.5% of TLS web traffic uses 1.0 or 1.1 ***/ + * [1] https://www.ssllabs.com/ssl-pulse/ ***/ + // user_pref("security.tls.version.min", 3); // [DEFAULT: 3 FF78+] // user_pref("security.tls.version.max", 4); -/* 1203: disable SSL session tracking [FF36+] +/* 1204: disable SSL session tracking [FF36+] * SSL Session IDs are unique, last up to 24hrs in Firefox, and can be used for tracking * [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the * consequences. FPI isolates these, but it was designed with the Tor protocol in mind, @@ -478,7 +503,7 @@ user_pref("security.ssl.require_safe_negotiation", true); * [2] https://bugzilla.mozilla.org/967977 * [3] https://arxiv.org/abs/1810.07304 ***/ user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF] -/* 1204: disable SSL Error Reporting +/* 1206: disable TLS1.3 0-RTT (round-trip time) [FF51+] * [1] https://firefox-source-docs.mozilla.org/browser/base/sslerrorreport/preferences.html ***/ user_pref("security.ssl.errorReporting.automatic", false); user_pref("security.ssl.errorReporting.enabled", false); @@ -524,26 +549,24 @@ user_pref("security.pki.sha1_enforcement_level", 1); * 0=disable detecting Family Safety mode and importing the root * 1=only attempt to detect Family Safety mode (don't import the root) * 2=detect Family Safety mode and import the root - * [1] https://trac.torproject.org/projects/tor/ticket/21686 ***/ + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/ user_pref("security.family_safety.mode", 0); -/* 1222: disable intermediate certificate caching (fingerprinting attack vector) [RESTART] +/* 1222: disable intermediate certificate caching (fingerprinting attack vector) [FF41+] [RESTART] * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. * Saved logins and passwords are not available. Reset the pref and restart to return them. - * [TEST] https://fiprinca.0x90.eu/poc/ - * [1] https://bugzilla.mozilla.org/1334485 - related bug - * [2] https://bugzilla.mozilla.org/1216882 - related bug (see comment 9) ***/ + * [1] https://shiftordie.de/blog/2017/02/21/fingerprinting-firefox-users-with-cached-intermediate-ca-certificates-fiprinca/ ***/ // user_pref("security.nocertdb", true); // [HIDDEN PREF] /* 1223: enforce strict pinning * PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict * [SETUP-INSTALL] If you rely on an AV (anti-virus) to protect your web browsing * by inspecting ALL your web traffic, then leave at current 1 (default). * [NOTE] It needs to be set to 1 when connecting to the ProtonMail's Bridge for the first time. - * [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/ + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/ user_pref("security.cert_pinning.enforcement_level", 2); /** MIXED CONTENT ***/ /* 1240: disable insecure active content on https pages - * [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/ + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/ user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true] /* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/ user_pref("security.mixed_content.block_display_content", true); @@ -551,26 +574,37 @@ user_pref("security.mixed_content.block_display_content", true); * [1] https://bugzilla.mozilla.org/1190623 ***/ user_pref("security.mixed_content.block_object_subrequest", true); -/** CIPHERS [see the section 1200 intro] ***/ -/* 1261: disable 3DES (effective key size < 128) +/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro] + * These are all the ciphers still using SHA-1 and CBC which are weaker than the available alternatives. (see "Cipher Suites" in [1]) + * Additionally some have other weaknesses like key sizes of 128 (or lower) [2] and/or no Perfect Forward Secrecy [3]. + * [1] https://browserleaks.com/ssl + * [2] https://en.wikipedia.org/wiki/Key_size + * [3] https://en.wikipedia.org/wiki/Forward_secrecy + ***/ +/* 1261: disable 3DES (effective key size < 128 and no PFS) * [1] https://en.wikipedia.org/wiki/3des#Security - * [2] http://en.citizendium.org/wiki/Meet-in-the-middle_attack + * [2] https://en.wikipedia.org/wiki/Meet-in-the-middle_attack * [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/ // user_pref("security.ssl3.rsa_des_ede3_sha", false); -/* 1262: disable 128 bits ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); - // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); /* 1263: disable DHE (Diffie-Hellman Key Exchange) * [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/ - // user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); - // user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); -/* 1264: disable the remaining non-modern cipher suites as of FF52 ***/ - // user_pref("security.ssl3.rsa_aes_128_sha", false); - // user_pref("security.ssl3.rsa_aes_256_sha", false); + // user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); // [DEFAULT: false FF78+] + // user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); // [DEFAULT: false FF78+] +/* 1264: disable the remaining non-modern cipher suites as of FF78 (in order of preferred by FF) ***/ + // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); + // user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS + // user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS /** UI (User Interface) ***/ -/* 1270: display warning (red padlock) for "broken security" (see 1201) - * [1] https://wiki.mozilla.org/Security:Renegotiation ***/ +/* 1270: display warning on the padlock for "broken security" (if 1201 is false) + * Bug: warning padlock not indicated for subresources on a secure page! [2] + * [STATS] SSL Labs (June 2020) reports 98.8% of sites have secure renegotiation [3] + * [1] https://wiki.mozilla.org/Security:Renegotiation + * [2] https://bugzilla.mozilla.org/1353705 + * [3] https://www.ssllabs.com/ssl-pulse/ ***/ user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); /* 1271: control "Add Security Exception" dialog on SSL warnings * 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default) @@ -582,10 +616,8 @@ user_pref("browser.ssl_override_behavior", 1); * [TEST] https://expired.badssl.com/ ***/ user_pref("browser.xul.error_pages.expert_bad_cert", true); /* 1273: display "insecure" icon and "Not Secure" text on HTTP sites ***/ -user_pref("security.insecure_connection_icon.enabled", true); // [FF59+] +user_pref("security.insecure_connection_icon.enabled", true); // [FF59+] [DEFAULT: true FF70+] user_pref("security.insecure_connection_text.enabled", true); // [FF60+] - // user_pref("security.insecure_connection_icon.pbmode.enabled", true); - // user_pref("security.insecure_connection_text.pbmode.enabled", true); /* 1280: display warnings when insecure HTTP connections are made ***/ user_pref("security.warn_entering_weak", true); user_pref("security.warn_leaving_secure", true); @@ -595,22 +627,21 @@ user_pref("security.warn_viewing_mixed", true); user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!"); /* 1401: disable websites choosing fonts (0=block, 1=allow) * This can limit most (but not all) JS font enumeration which is a high entropy fingerprinting vector - * [SETUP-WEB] Disabling fonts can uglify the web a fair bit. + * [SETUP-WEB] Can break some PDFs (missing text). Limiting to default fonts can "uglify" the web * [SETTING] General>Language and Appearance>Fonts & Colors>Advanced>Allow pages to choose... ***/ user_pref("browser.display.use_document_fonts", 0); /* 1403: disable icon fonts (glyphs) and local fallback rendering * [1] https://bugzilla.mozilla.org/789788 - * [2] https://trac.torproject.org/projects/tor/ticket/8455 ***/ + * [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/ user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+] user_pref("gfx.downloadable_fonts.fallback_delay", -1); /* 1404: disable rendering of SVG OpenType fonts * [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/ user_pref("gfx.font_rendering.opentype_svg.enabled", false); -/* 1405: disable WOFF2 (Web Open Font Format) [FF35+] ***/ -user_pref("gfx.downloadable_fonts.woff2.enabled", false); -/* 1408: disable graphite which FF49 turned back on by default - * In the past it had security issues. Update: This continues to be the case, see [1] - * [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 ***/ +/* 1408: disable graphite + * Graphite has had many critical security issues in the past, see [1] + * [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 + * [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/ user_pref("gfx.font_rendering.graphite.enabled", false); /*** [SECTION 1600]: HEADERS / REFERERS @@ -639,7 +670,7 @@ user_pref("network.http.sendRefererHeader", 0); // [DEFAULT: 2] // user_pref("network.http.referer.trimmingPolicy", 0); // [DEFAULT: 0] /* 1603: CROSS ORIGIN: control when to send a referer * 0=always (default), 1=only if base domains match, 2=only if hosts match - * [SETUP-WEB] Known to cause issues with older modems/routers and some sites e.g vimeo ***/ + * [SETUP-WEB] Known to cause issues with older modems/routers and some sites e.g vimeo, icloud ***/ user_pref("network.http.referer.XOriginPolicy", 2); /* 1604: CROSS ORIGIN: control the amount of information to send [FF52+] * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ @@ -657,15 +688,29 @@ user_pref("network.http.referer.XOriginTrimmingPolicy", 0); // [DEFAULT: 0] user_pref("network.http.referer.defaultPolicy", 0); // [DEFAULT: 3] user_pref("network.http.referer.defaultPolicy.pbmode", 0); // [DEFAULT: 2] /* 1610: ALL: enable the DNT (Do Not Track) HTTP header - * [NOTE] DNT is enforced with Tracking Protection regardless of this pref - * [SETTING] Privacy & Security>Content Blocking>Send websites a "Do Not Track"... ***/ + * [NOTE] DNT is enforced with Enhanced Tracking Protection regardless of this pref + * [SETTING] Privacy & Security>Enhanced Tracking Protection>Send websites a "Do Not Track" signal... ***/ user_pref("privacy.donottrackheader.enabled", true); /*** [SECTION 1800]: PLUGINS ***/ user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies!"); -/* 1802: enable click to play and set to 0 minutes ***/ -user_pref("plugins.click_to_play", true); -user_pref("plugin.sessionPermissionNow.intervalInMinutes", 0); +/* 1803: disable Flash plugin + * 0=deactivated, 1=ask, 2=enabled + * ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash + * [NOTE] You can still override individual sites via site permissions ***/ +user_pref("plugin.state.flash", 0); +/* 1820: disable GMP (Gecko Media Plugins) + * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ + // user_pref("media.gmp-provider.enabled", false); +/* 1825: disable widevine CDM (Content Decryption Module) + * [SETUP-WEB] if you *need* CDM, e.g. Netflix, Amazon Prime, Hulu, whatever ***/ +user_pref("media.gmp-widevinecdm.visible", false); +user_pref("media.gmp-widevinecdm.enabled", false); +/* 1830: disable all DRM content (EME: Encryption Media Extension) + * [SETUP-WEB] if you *need* EME, e.g. Netflix, Amazon Prime, Hulu, whatever + * [SETTING] General>DRM Content>Play DRM-controlled content + * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ +user_pref("media.eme.enabled", false); /*** [SECTION 2000]: MEDIA / CAMERA / MIC ***/ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); @@ -675,42 +720,42 @@ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); * [1] https://www.privacytools.io/#webrtc ***/ user_pref("media.peerconnection.enabled", false); /* 2002: limit WebRTC IP leaks if using WebRTC + * In FF70+ these settings match Mode 4 (Mode 3 in older versions) (see [3]) * [TEST] https://browserleaks.com/webrtc - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416 - * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/ + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713 + * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy + * [3] https://tools.ietf.org/html/draft-ietf-rtcweb-ip-handling-12#section-5.2 ***/ user_pref("media.peerconnection.ice.default_address_only", true); user_pref("media.peerconnection.ice.no_host", true); // [FF51+] +user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // [FF70+] /* 2010: disable WebGL (Web Graphics Library) * [SETUP-WEB] When disabled, may break some websites. When enabled, provides high entropy, * especially with readPixels(). Some of the other entropy is lessened with RFP (see 4501) * [1] https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/ * [2] https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern ***/ user_pref("webgl.disabled", true); -user_pref("webgl.dxgl.enabled", false); // [WINDOWS] user_pref("webgl.enable-webgl2", false); /* 2012: limit WebGL ***/ user_pref("webgl.min_capability_mode", true); -user_pref("webgl.disable-extensions", true); user_pref("webgl.disable-fail-if-major-performance-caveat", true); /* 2022: disable screensharing ***/ user_pref("media.getusermedia.screensharing.enabled", false); user_pref("media.getusermedia.browser.enabled", false); user_pref("media.getusermedia.audiocapture.enabled", false); /* 2030: disable autoplay of HTML5 media [FF63+] - * 0=Allowed, 1=Blocked (2=Prompt - removed in FF66) + * 0=Allow all, 1=Block non-muted media (default in FF67+), 2=Prompt (removed in FF66), 5=Block all (FF69+) * [NOTE] You can set exceptions under site permissions - * [SETTING] Privacy & Security>Permissions>Block websites from automatically playing sound ***/ -user_pref("media.autoplay.default", 1); // [DEFAULT: 1 in FF67+] -/* 2032: disable audio autoplay in non-active tabs [FF51+] - * [1] https://www.ghacks.net/2016/11/14/firefox-51-blocks-automatic-audio-playback-in-non-active-tabs/ ***/ -user_pref("media.block-autoplay-until-in-foreground", true); // [DEFAULT: true] -/* 2033: disable autoplay for muted videos [FF63+] ***/ - // user_pref("media.autoplay.allow-muted", false); +* [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/ + // user_pref("media.autoplay.default", 5); +/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+] + * 0=sticky (default), 1=transient, 2=user + * [NOTE] If you have trouble with some video sites, then add an exception (see 2030) + * [1] https://html.spec.whatwg.org/multipage/interaction.html#sticky-activation ***/ +user_pref("media.autoplay.blocking_policy", 2); /*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/ user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!"); -/* 2201: prevent websites from disabling new window features - * [1] http://kb.mozillazine.org/Prevent_websites_from_disabling_new_window_features ***/ +/* 2201: prevent websites from disabling new window features ***/ user_pref("dom.disable_window_open_feature.close", true); user_pref("dom.disable_window_open_feature.location", true); // [DEFAULT: true] user_pref("dom.disable_window_open_feature.menubar", true); @@ -725,10 +770,11 @@ user_pref("dom.disable_window_move_resize", true); /* 2203: open links targeting new windows in a new tab instead * This stops malicious window sizes and some screen resolution leaks. * You can still right-click a link and open in a new window. + * [NOTE] Unlike arkenfox/user.js, we explicitly set them * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen - * [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/ - // user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3] - // user_pref("browser.link.open_newwindow.restriction", 0); // [DEFAULT: 0] + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ +user_pref("browser.link.open_newwindow", 3); +user_pref("browser.link.open_newwindow.restriction", 0); /* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks * [NOTE] You can still manually toggle the browser's fullscreen state (F11), * but this pref will disable embedded video/game fullscreen controls, e.g. youtube @@ -738,8 +784,7 @@ user_pref("dom.disable_window_move_resize", true); * [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/ user_pref("dom.disable_open_during_load", true); /* 2212: limit events that can cause a popup [SETUP-WEB] - * default is "change click dblclick auxclick mouseup pointerup notificationclick reset submit touchend contextmenu" - * [1] http://kb.mozillazine.org/Dom.popup_allowed_events ***/ + * default is "change click dblclick auxclick mouseup pointerup notificationclick reset submit touchend contextmenu" ***/ user_pref("dom.popup_allowed_events", "click dblclick"); /*** [SECTION 2300]: WEB WORKERS @@ -758,46 +803,54 @@ user_pref("dom.popup_allowed_events", "click dblclick"); ***/ user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!"); /* 2302: disable service workers [FF32, FF44-compat] - * Service workers essentially act as proxy servers that sit between web apps, and the browser - * and network, are event driven, and can control the web page/site it is associated with, - * intercepting and modifying navigation and resource requests, and caching resources. + * Service workers essentially act as proxy servers that sit between web apps, and the + * browser and network, are event driven, and can control the web page/site it is associated + * with, intercepting and modifying navigation and resource requests, and caching resources. * [NOTE] Service worker APIs are hidden (in Firefox) and cannot be used when in PB mode. * [NOTE] Service workers only run over HTTPS. Service workers have no DOM access. - * [SETUP-WEB] Disabling service workers will break some sites. This pref is a master switch, and controls - * notifications (2304, 2305) and service worker cache (2740) - all three are inactive. Notifications are - * behind a prompt (2306). If you enable service workers, then you may want to look at those as well ***/ - // user_pref("dom.serviceWorkers.enabled", false); // [DEFAULT: false] + * [SETUP-WEB] Disabling service workers will break some sites. This pref is required true for + * service worker notifications (2304), push notifications (disabled, 2305) and service worker + * cache (2740). If you enable this pref, then check those settings as well ***/ +user_pref("dom.serviceWorkers.enabled", false); /* 2304: disable Web Notifications - * [NOTE] Web Notifications require service workers (2302) and are behind a prompt (2306) - * [NOTE] Unlike arkenfox/user.js, we explicitly disable them as they are enabled by default. + * [NOTE] Web Notifications can also use service workers (2302) and are behind a prompt (2306) + * [NOTE] Unlike arkenfox/user.js, we explicitly disable them as they are enabled by default * [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/ user_pref("dom.webnotifications.enabled", false); // [FF22+] user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+] /* 2305: disable Push Notifications [FF44+] - * web apps can receive messages pushed to them from a server, whether or - * not the web app is in the foreground, or even currently loaded - * [NOTE] Push Notifications require service workers (2302) and are behind a prompt (2306) - * [1] https://developer.mozilla.org/docs/Web/API/Push_API ***/ - // user_pref("dom.push.enabled", false); - // user_pref("dom.push.connection.enabled", false); - // user_pref("dom.push.serverURL", ""); + * Push is an API that allows websites to send you (subscribed) messages even when the site + * isn't loaded, by pushing messages to your userAgentID through Mozilla's Push Server. + * [NOTE] Push requires service workers (2302) to subscribe to and display, and is behind + * a prompt (2306). Disabling service workers alone doesn't stop Firefox polling the + * Mozilla Push Server. To remove all subscriptions, reset your userAgentID (in about:config + * or on start), and you will get a new one within a few seconds. + * [1] https://support.mozilla.org/en-US/kb/push-notifications-firefox + * [2] https://developer.mozilla.org/en-US/docs/Web/API/Push_API ***/ +user_pref("dom.push.enabled", false); // user_pref("dom.push.userAgentID", ""); +/* 2306: set a default permission for Notifications (both 2304 and 2305) [FF58+] + * 0=always ask (default), 1=allow, 2=block + * [NOTE] Best left at default "always ask", fingerprintable via Permissions API + * [SETTING] to add site exceptions: Page Info>Permissions>Receive Notifications + * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Notifications>Settings ***/ + // user_pref("permissions.default.desktop-notification", 2); /*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT ***/ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); /* 2401: disable website control over browser right-click context menu - * [NOTE] Shift-Right-Click will always bring up the browser right-click context menu ***/ - // user_pref("dom.event.contextmenu.enabled", false); -/* 2402: disable website access to clipboard events/content - * [SETUP-WEB] This will break some sites functionality such as pasting into facebook, wordpress - * this applies to onCut, onCopy, onPaste events - i.e. you have to interact with - * the website for it to look at the clipboard - * [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ ***/ + * [NOTE] Shift-Right-Click will always bring up the browser right-click context menu + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ +user_pref("dom.event.contextmenu.enabled", false); +/* 2402: disable website access to clipboard events/content [SETUP-HARDEN] + * [NOTE] This will break some sites' functionality e.g. Outlook, Twitter, Facebook, Wordpress + * This applies to onCut/onCopy/onPaste events - i.e. it requires interaction with the website + * [WARNING] If both 'middlemouse.paste' and 'general.autoScroll' are true (at least one + * is default false) then enabling this pref can leak clipboard content, see [2] + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it + * [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ + * [2] https://bugzilla.mozilla.org/1528289 */ user_pref("dom.event.clipboardevents.enabled", false); -/* 2403: disable middlemouse paste leaking clipboard content on Linux after autoscroll - * Defense in depth if clipboard events are enabled (see 2402) - * [1] https://bugzilla.mozilla.org/1528289 */ -user_pref("middlemouse.paste", false); // [DEFAULT: false on Windows] /* 2404: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+] * this disables document.execCommand("cut"/"copy") to protect your clipboard * [1] https://bugzilla.mozilla.org/1170911 ***/ @@ -817,22 +870,27 @@ user_pref("dom.vibrator.enabled", false); * [5] https://www.mozilla.org/security/advisories/mfsa2017-05/#CVE-2017-5400 * [6] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ user_pref("javascript.options.asmjs", false); -/* 2421: disable Ion and baseline JIT to help harden JS against exploits - * [WARNING] If false, causes the odd site issue and there is also a performance loss +/* 2421: disable Ion and baseline JIT to harden against JS exploits [SETUP-HARDEN] + * [NOTE] In FF75+, when **both** Ion and JIT are disabled, **and** the new + * hidden pref is enabled, then Ion can still be used by extensions (1599226) + * [WARNING] Disabling Ion/JIT can cause some site issues and performance loss + * [NOTE] Unlike arkenfox/user.js, we explicitly disable them * [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 ***/ - // user_pref("javascript.options.ion", false); - // user_pref("javascript.options.baselinejit", false); +user_pref("javascript.options.ion", false); +user_pref("javascript.options.baselinejit", false); /* 2422: disable WebAssembly [FF52+] [SETUP-PERF] + * [NOTE] In FF71+ this no longer affects extensions (1576254) * [1] https://developer.mozilla.org/docs/WebAssembly ***/ user_pref("javascript.options.wasm", false); /* 2426: disable Intersection Observer API [FF55+] + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it * [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API * [2] https://w3c.github.io/IntersectionObserver/ * [3] https://bugzilla.mozilla.org/1243846 ***/ - // user_pref("dom.IntersectionObserver.enabled", false); +user_pref("dom.IntersectionObserver.enabled", false); /* 2429: enable (limited but sufficient) window.opener protection [FF65+] * Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/ -user_pref("dom.targetBlankNoOpener.enabled", true); +user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF78+] /*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/ user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!"); @@ -841,14 +899,12 @@ user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is m * However, it is still another metric for fingerprinting, used to raise entropy. * e.g. do you have a battery or not, current charging status, charge level, times remaining etc * [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1] + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it * [1] https://bugzilla.mozilla.org/1313580 ***/ - // user_pref("dom.battery.enabled", false); -/* 2504: disable virtual reality devices - * Optional protection depending on your connected devices - * [1] https://developer.mozilla.org/docs/Web/API/WebVR_API ***/ - // user_pref("dom.vr.enabled", false); +user_pref("dom.battery.enabled", false); /* 2505: disable media device enumeration [FF29+] * [NOTE] media.peerconnection.enabled should also be set to false (see 2001) + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it * [1] https://wiki.mozilla.org/Media/getUserMedia * [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/enumerateDevices ***/ user_pref("media.navigator.enabled", false); @@ -856,17 +912,31 @@ user_pref("media.navigator.enabled", false); * [WARNING] Affects text rendering (fonts will look different), impacts video performance, * and parts of Quantum that utilize the GPU will also be affected as they are rolled out * [SETTING] General>Performance>Custom>Use hardware acceleration when available + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it * [1] https://wiki.mozilla.org/Platform/GFX/HardwareAcceleration ***/ - // user_pref("gfx.direct2d.disabled", true); // [WINDOWS] - // user_pref("layers.acceleration.disabled", true); +user_pref("gfx.direct2d.disabled", true); // [WINDOWS] +user_pref("layers.acceleration.disabled", true); /* 2510: disable Web Audio API [FF51+] + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it * [1] https://bugzilla.mozilla.org/1288359 ***/ user_pref("dom.webaudio.enabled", false); /* 2517: disable Media Capabilities API [FF63+] * [WARNING] This *may* affect media performance if disabled, no one is sure + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it * [1] https://github.com/WICG/media-capabilities * [2] https://wicg.github.io/media-capabilities/#security-privacy-considerations ***/ - // user_pref("media.media-capabilities.enabled", false); +user_pref("media.media-capabilities.enabled", false); +/* 2520: disable virtual reality devices + * Optional protection depending on your connected devices + * [NOTE] Unlike arkenfox/user.js, we explicitly disable them + * [1] https://developer.mozilla.org/docs/Web/API/WebVR_API ***/ +user_pref("dom.vr.enabled", false); +/* 2521: set a default permission for Virtual Reality (see 2520) [FF73+] + * 0=always ask (default), 1=allow, 2=block + * [SETTING] to add site exceptions: Page Info>Permissions>Access Virtual Reality Devices + * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Virtual Reality>Settings + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ +user_pref("permissions.default.xr", 2); /*** [SECTION 2600]: MISCELLANEOUS ***/ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); @@ -877,42 +947,45 @@ user_pref("beacon.enabled", false); * [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes * [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/ user_pref("devtools.chrome.enabled", false); -/* 2608: disable WebIDE to prevent remote debugging and ADB extension download - * [1] https://trac.torproject.org/projects/tor/ticket/16222 ***/ -user_pref("devtools.debugger.remote-enabled", false); -user_pref("devtools.webide.enabled", false); +/* 2608: disable remote debugging + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/ +user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] /* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN] * [TEST] https://arkenfox.github.io/TZP/tzp.html#misc * [1] https://bugzilla.mozilla.org/1173199 ***/ // user_pref("mathml.disabled", true); /* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+] + * [NOTE] In FF70+ and ESR68.1.0+ this no longer affects extensions (1564208) * [WARNING] Expect breakage incl. youtube player controls. Best left for a "hardened" profile. * [1] https://bugzilla.mozilla.org/1216893 ***/ user_pref("svg.disabled", true); /* 2611: disable middle mouse click opening links from clipboard - * [1] https://trac.torproject.org/projects/tor/ticket/10089 - * [2] http://kb.mozillazine.org/Middlemouse.contentLoadURL ***/ + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/ user_pref("middlemouse.contentLoadURL", false); /* 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS) * [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins) * To control HTML Meta tag and JS redirects, use an extension. Default is 20 ***/ user_pref("network.http.redirection-limit", 10); /* 2619: enforce Punycode for Internationalized Domain Names to eliminate possible spoofing - * Firefox has *some* protections, but it is better to be safe than sorry. The downside: it will also - * display legitimate IDN's punycoded, which might be undesirable for users of non-latin alphabets + * Firefox has *some* protections, but it is better to be safe than sorry + * [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded * [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com) * [1] https://wiki.mozilla.org/IDN_Display_Algorithm * [2] https://en.wikipedia.org/wiki/IDN_homograph_attack * [3] CVE-2017-5383: https://www.mozilla.org/security/advisories/mfsa2017-02/ * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/ user_pref("network.IDN_show_punycode", true); +/* 2622: enforce no system colors; they can be fingerprinted + * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ +user_pref("browser.display.use_system_colors", false); // [DEFAULT: false] /** DOWNLOADS ***/ /* 2650: discourage downloading to desktop - * 0=desktop 1=downloads 2=last used + * 0=desktop, 1=downloads (default), 2=last used * [SETTING] To set your default "downloads": General>Downloads>Save files to ***/ // user_pref("browser.download.folderList", 2); -/* 2651: enforce user interaction for security by always asking where to download [SETUP-CHROME] +/* 2651: enforce user interaction for security by always asking where to download + * [SETUP-CHROME] On Android this blocks longtapping and saving images * [SETTING] General>Downloads>Always ask you where to save files ***/ user_pref("browser.download.useDownloadDir", false); /* 2652: disable adding downloads to the system's "recent documents" list ***/ @@ -934,17 +1007,17 @@ user_pref("browser.download.hide_plugins_without_extensions", false); * [1] archived: https://archive.is/DYjAM ***/ user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] -/* 2662: disable webextension restrictions on certain mozilla domains (also see 4503) [FF60+] +/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ // user_pref("extensions.webextensions.restrictedDomains", ""); /** SECURITY ***/ -/* 2680: enable CSP (Content Security Policy) +/* 2680: enforce CSP (Content Security Policy) + * [WARNING] CSP is a very important and widespread security feature. Don't disable it! * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/ user_pref("security.csp.enable", true); // [DEFAULT: true] /* 2684: enforce a security delay on some confirmation dialogs such as install, open/save - * [1] http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox - * [2] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ + * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ user_pref("security.dialog_enable_delay", 700); /*** [SECTION 2700]: PERSISTENT STORAGE @@ -963,30 +1036,31 @@ user_pref("security.dialog_enable_delay", 700); ***/ user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); /* 2701: disable cookies and site-data [SETUP-WEB] - * 0=Accept cookies and site data (default), 1=(Block) All third-party cookies, 2=(Block) All cookies, - * 3=(Block) Cookies from unvisited sites, 4=(Block) Third-party trackers (FF63+) - * [NOTE] Value 4 is tied to the Tracking Protection lists + * 0=Accept cookies and site data, 1=(Block) All third-party cookies, 2=(Block) All cookies, + * 3=(Block) Cookies from unvisited websites, 4=(Block) Cross-site and social media trackers (FF63+) (default FF69+) * [NOTE] You can set exceptions under site permissions or use an extension - * [SETTING] Privacy & Security>Content Blocking>Custom>Choose what to block>Cookies ***/ + * [NOTE] Unlike arkenfox/user.js, we block **ALL** cookies on purpose + * [SETTING] Privacy & Security>Privacy>Web Content>Accept cookies from sites ***/ user_pref("network.cookie.cookieBehavior", 2); +/* 2702: set third-party cookies (i.e ALL) (if enabled, see 2701) to session-only + and (FF58+) set third-party non-secure (i.e HTTP) cookies to session-only + [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and + .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones + * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/ +user_pref("network.cookie.thirdparty.sessionOnly", true); +user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+] +/* 2703: delete cookies and site data on close + * 0=keep until they expire (default), 2=keep until you close Thunderbird + * [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2) + * [NOTE] Unlike arkenfox/user.js, we keep them until Thunderbird exit on purpose + * [SETTING] Privacy & Security>Privacy>Web Content>Keep until: "I close Thunderbird" ***/ +user_pref("network.cookie.lifetimePolicy", 2); /* 2710: disable DOM (Document Object Model) Storage * [WARNING] This will break a LOT of sites' functionality AND extensions! * You are better off using an extension for more granular control ***/ user_pref("dom.storage.enabled", false); -/* 2720: enforce IndexedDB (IDB) as enabled - * IDB is required for extensions and Firefox internals (even before FF63 in [1]) - * To control *website* IDB data, control allowing cookies and service workers, or use - * Temporary Containers. To mitigate *website* IDB, FPI helps (4001), and/or sanitize - * on close (Offline Website Data, see 2800) or on-demand (Ctrl-Shift-Del), or automatically - * via an extension. Note that IDB currently cannot be sanitized by host. - * [1] https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/ ***/ -user_pref("dom.indexedDB.enabled", true); // [DEFAULT: true] /* 2730: disable offline cache ***/ user_pref("browser.cache.offline.enable", false); -/* 2731: enforce websites to ask to store data for offline use - * [1] https://support.mozilla.org/questions/1098540 - * [2] https://bugzilla.mozilla.org/959985 ***/ -user_pref("offline-apps.allow_by_default", false); /* 2740: disable service worker cache and cache storage * [NOTE] We clear service worker cache on exiting Firefox (see 2803) * [1] https://w3c.github.io/ServiceWorker/#privacy ***/ @@ -1042,9 +1116,10 @@ user_pref("privacy.sanitize.timeSpan", 0); ** 1300671 - isolate data:, about: URLs (FF55+) ** 1473247 - isolate IP addresses (FF63+) ** 1492607 - isolate postMessage with targetOrigin "*" (requires 4002) (FF65+) - ** 1542309 - isolate top-level domain URLs (FF68+) + ** 1542309 - isolate top-level domain URLs when host is in the public suffix list (FF68+) ** 1506693 - isolate pdfjs range-based requests (FF68+) - ** 1330467 - isolate site permissions (coming) + ** 1330467 - isolate site permissions (FF69+) + ** 1534339 - isolate IPv6 (FF73+) ***/ user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out"); /* 4001: enable First Party Isolation [FF51+] @@ -1059,8 +1134,8 @@ user_pref("privacy.firstparty.isolate", true); * [1] https://bugzilla.mozilla.org/1319773#c22 * [2] https://bugzilla.mozilla.org/1492607 * [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/ -user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] - // user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF] + // user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] + // user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR] /*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) This master switch will be used for a wide range of items, many of which will @@ -1084,18 +1159,19 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAUL This spoof *shouldn't* affect core chrome/Firefox performance ** 1217238 - reduce precision of time exposed by javascript (FF55+) ** 1369303 - spoof/disable performance API (see 2410-deprecated, 4602, 4603) (FF56+) - ** 1333651 & 1383495 & 1396468 - spoof Navigator API (see section 4700) (FF56+) - FF56: The version number will be rounded down to the nearest multiple of 10 - FF57: The version number will match current ESR (1393283, 1418672, 1418162, 1511763) - FF59: The OS will be reported as Windows, OSX, Android, or Linux (to reduce breakage) (1404608) - FF66: The OS in HTTP Headers will be reduced to Windows or Android (1509829) - FF68: Reported OS versions updated to Windows 10, OS 10.14, and Android 8.1 (1511434) + ** 1333651 & 1383495 & 1396468 - spoof User Agent & Navigator API (see section 4700) (FF56+) + FF56: Version: rounded down to the nearest multiple of 10 + FF57: Version: match current ESR (1393283, 1418672, 1418162, 1511763) + FF59: OS: Windows, OSX, Android, or Linux (to reduce breakage) (1404608) + FF66: OS: HTTP Headers reduced to Windows or Android (1509829) + FF68: OS: updated to Windows 10, OS 10.14, and Android 8.1 (1511434) + FF78: OS: updated to OS 10.15 and Android 9.0 (1635011) ** 1369319 - disable device sensor API (see 4604) (FF56+) ** 1369357 - disable site specific zoom (see 4605) (FF56+) ** 1337161 - hide gamepads from content (see 4606) (FF56+) ** 1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true (see 4607) (FF56+) ** 1333641 - reduce fingerprinting in WebSpeech API (see 4608) (FF56+) - ** 1372069 & 1403813 & 1441295 - block geolocation requests (same as denying a site permission) (see 0201, 0201b) (FF56-62) + ** 1372069 & 1403813 & 1441295 - block geolocation requests (same as denying a site permission) (see 0201 ** 1372069 & 1403813 & 1441295 - block geolocation requests (same as denying a site permission) (see 0201, 0202) (FF56-62) ** 1369309 - spoof media statistics (see 4610) (FF57+) ** 1382499 - reduce screen co-ordinate fingerprinting in Touch API (see 4611) (FF57+) ** 1217290 & 1409677 - enable fingerprinting resistance for WebGL (see 2010-12) (FF57+) @@ -1103,27 +1179,30 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAUL ** 1354633 - limit MediaError.message to a whitelist (FF57+) ** 1382533 - enable fingerprinting resistance for Presentation API (FF57+) This blocks exposure of local IP Addresses via mDNS (Multicast DNS) - ** 967895 - enable site permission prompt before allowing canvas data extraction (FF58+) + ** 967895 - spoof canvas and enable site permission prompt before allowing canvas data extraction (FF58+) FF59: Added to site permissions panel (1413780) Only prompt when triggered by user input (1376865) ** 1372073 - spoof/block fingerprinting in MediaDevices API (FF59+) Spoof: enumerate devices reports one "Internal Camera" and one "Internal Microphone" if media.navigator.enabled is true (see 2505 which we chose to keep disabled) Block: suppresses the ondevicechange event (see 4612) - ** 1039069 - warn when language prefs are set to non en-US (see 0207, 0208) (FF59+) + ** 1039069 - warn when language prefs are set to non en-US (see 0210, 0211) (FF59+) ** 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59+) Spoofing mimics the content language of the document. Currently it only supports en-US. Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected. FF60: Fix keydown/keyup events (1438795) ** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+) ** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+) - ** 1479239 - return "no-preference" with prefers-reduced-motion (FF63+) + ** 1479239 - return "no-preference" with prefers-reduced-motion (see 4617) (FF63+) ** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+) FF65: pointerEvent.pointerid (1492766) ** 1485266 - disable exposure of system colors to CSS or canvas (see 4615) (FF67+) ** 1407366 - enable inner window letterboxing (see 4504) (FF67+) - ** 1540726 - return "light" with prefers-color-scheme (FF67+) + ** 1494034 - return "light" with prefers-color-scheme (see 4616) (FF67+) [1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme ** 1564422 - spoof audioContext outputLatency (FF70+) + ** 1595823 - spoof audioContext sampleRate (FF72+) + ** 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+) + ** 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); /* 4501: enable privacy.resistFingerprinting [FF41+] @@ -1146,12 +1225,20 @@ user_pref("privacy.resistFingerprinting", true); * to sanitize or clear extensions.webextensions.restrictedDomains (see 2662) to keep that side-effect * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF] +/* 4520: disable chrome animations [FF77+] [RESTART] + * [NOTE] pref added in FF63, but applied to chrome in FF77. RFP spoofs this for web content ***/ +user_pref("ui.prefersReducedMotion", 1); // [HIDDEN PREF] /*** [SECTION 4600]: RFP ALTERNATIVES - * IF you DO use RFP (see 4500) then you DO NOT need these redundant prefs. In fact, - some even cause RFP to not behave as you would expect and alter your fingerprint. - Make sure they are RESET in about:config as per your Firefox version - * IF you DO NOT use RFP or are on ESR... then turn on each ESR section below + * non-RFP users: + Enable the whole section (see the SETUP tag below) + * RFP users: + Make sure these are reset in about:config. They are redundant. In fact, some + even cause RFP to not behave as you would expect and alter your fingerprint + * ESR RFP users: + Reset those *up to and including* your version. Add those *after* your version + as active prefs in your overrides. This is assuming that the patch wasn't also + backported to Firefox ESR. Backporting RFP patches to ESR is rare. ***/ user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan"); /* [SETUP-non-RFP] Non-RFP users replace the * with a slash on this line to enable these @@ -1159,8 +1246,8 @@ user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan // 4601: [2514] spoof (or limit?) number of CPU cores [FF48+] // [NOTE] *may* affect core chrome/Firefox performance, will affect content. // [1] https://bugzilla.mozilla.org/1008453 - // [2] https://trac.torproject.org/projects/tor/ticket/21675 - // [3] https://trac.torproject.org/projects/tor/ticket/22127 + // [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21675 + // [3] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22127 // [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency // user_pref("dom.maxHardwareConcurrency", 2); // * * * / @@ -1172,13 +1259,13 @@ user_pref("dom.enable_resource_timing", false); user_pref("dom.enable_performance", false); // 4604: [2512] disable device sensor API // Optional protection depending on your device - // [1] https://trac.torproject.org/projects/tor/ticket/15758 + // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15758 // [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/ // [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751 // user_pref("device.sensors.enabled", false); // 4606: [2501] disable gamepad API - USB device ID enumeration // Optional protection depending on your connected devices - // [1] https://trac.torproject.org/projects/tor/ticket/13023 + // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/13023 // user_pref("dom.gamepad.enabled", false); // 4607: [2503] disable giving away network info [FF31+] // e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none @@ -1194,7 +1281,7 @@ user_pref("media.webspeech.synth.enabled", false); // * * * / // FF57+ // 4610: [2506] disable video statistics - JS performance fingerprinting [FF25+] - // [1] https://trac.torproject.org/projects/tor/ticket/15757 + // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15757 // [2] https://bugzilla.mozilla.org/654550 user_pref("media.video_stats.enabled", false); // 4611: [2509] disable touch events @@ -1202,7 +1289,7 @@ user_pref("media.video_stats.enabled", false); // 0=disabled, 1=enabled, 2=autodetect // Optional protection depending on your device // [1] https://developer.mozilla.org/docs/Web/API/Touch_events - // [2] https://trac.torproject.org/projects/tor/ticket/10286 + // [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10286 // user_pref("dom.w3c_touch_events.enabled", 0); // * * * / // FF59+ @@ -1224,10 +1311,16 @@ user_pref("dom.w3c_pointer_events.enabled", false); // * * * / // FF67+ // 4615: [2618] disable exposure of system colors to CSS or canvas [FF44+] - // [NOTE] See second listed bug: may cause black on black for elements with undefined colors - // [SETUP-CHROME] Might affect CSS in themes and extensions - // [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876 + // [NOTE] See second listed bug: may cause black on black for elements with undefined colors + // [SETUP-CHROME] Might affect CSS in themes and extensions + // [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,133087 user_pref("ui.use_standins_for_native_colors", true); +// 4616: enforce prefers-color-scheme as light [FF67+] + // 0=light, 1=dark : This overrides your OS value +user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF] +// 4617: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART] + // 0=no-preference, 1=reduce +user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF] // * * * / // FF41+ // 4620: mitigate fingerprinting via canvas @@ -1242,8 +1335,8 @@ user_pref("canvas.capturestream.enabled", false); to use RFP (4500) or an extension, in which case they become POINTLESS. (a) Many of the components that make up your UA can be derived by other means. And when those values differ, you provide more bits and raise entropy. - Examples of leaks include navigator objects, date locale/formats, iframes, - headers, tcp/ip attributes, feature detection, and **many** more. + Examples of leaks include workers, navigator objects, date locale/formats, + iframes, headers, tcp/ip attributes, feature detection, and **many** more. ALL values below intentionally left blank - use RFP, or get a vetted, tested extension and mimic RFP values to *lower* entropy, or randomize to *raise* it ***/ @@ -1274,16 +1367,17 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!"); /* WARNINGS ***/ // user_pref("full-screen-api.warning.delay", 0); // user_pref("full-screen-api.warning.timeout", 0); - // user_pref("general.warnOnAboutConfig", false); /* APPEARANCE ***/ - // user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+] // user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent /* CONTENT BEHAVIOR ***/ // user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type" // user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX] /* UX BEHAVIOR ***/ - // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [WINDOWS] [MAC] + // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux] // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART] +/* UX FEATURES: disable and hide the icons and menus ***/ + // user_pref("browser.messaging-system.whatsNewPanel.enabled", false); // What's New [FF69+] + // user_pref("extensions.pocket.enabled", false); // Pocket Account [FF46+] /* OTHER ***/ // user_pref("network.manage-offline-status", false); // see bugzilla 620472 // user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR) @@ -1590,60 +1684,92 @@ user_pref("mail.server.default.enableAutocrypt", false); user_pref("mail.server.default.acPreferEncrypt", 0); /*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED - Documentation denoted as [-]. Items deprecated prior to FF61 have been archived at [1], which - also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets - [1] https://github.com/arkenfox/user.js/issues/123 + Documentation denoted as [-]. Items deprecated in FF68 or earlier have been archived at [1], + which also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets + [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123 ***/ user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!"); -/* ESR60.x still uses all the following prefs +/* ESR68.x still uses all the following prefs // [NOTE] replace the * with a slash in the line above to re-enable them -// FF61 -// 2612: disable remote JAR files being opened, regardless of content type [FF42+] - // [1] https://bugzilla.mozilla.org/1173171 - // [2] https://www.fxsitecompat.com/en-CA/docs/2015/jar-protocol-support-has-been-disabled-by-default/ - // [-] https://bugzilla.mozilla.org/1427726 -user_pref("network.jar.block-remote-files", true); -// 2613: disable JAR from opening Unsafe File Types - // [-] https://bugzilla.mozilla.org/1427726 -user_pref("network.jar.open-unsafe-types", false); +// FF69 +// 1405: disable WOFF2 (Web Open Font Format) [FF35+] + // [-] https://bugzilla.mozilla.org/1556991 + // user_pref("gfx.downloadable_fonts.woff2.enabled", false); +// 1802: enforce click-to-play for plugins + // [-] https://bugzilla.mozilla.org/1519434 +user_pref("plugins.click_to_play", true); // [DEFAULT: true FF25+] +// 2033: disable autoplay for muted videos [FF63+] - replaced by 'media.autoplay.default' options (2030) + // [-] https://bugzilla.mozilla.org/1562331 + // user_pref("media.autoplay.allow-muted", false); // * * * / -// FF62 -// 1803: disable Java plugin - // [-] (part5) https://bugzilla.mozilla.org/1461243 -user_pref("plugin.state.java", 0); +// FF71 +// 2608: disable WebIDE and ADB extension download + // [1] https://trac.torproject.org/projects/tor/ticket/16222 + // [-] https://bugzilla.mozilla.org/1539462 +user_pref("devtools.webide.enabled", false); // [DEFAULT: false FF70+] +user_pref("devtools.webide.autoinstallADBExtension", false); // [FF64+] +// 2731: enforce websites to ask to store data for offline use + // [1] https://support.mozilla.org/questions/1098540 + // [2] https://bugzilla.mozilla.org/959985 + // [-] https://bugzilla.mozilla.org/1574480 +user_pref("offline-apps.allow_by_default", false); // * * * / -// FF63 -// 0202: disable GeoIP-based search results - // [NOTE] May not be hidden if Firefox has changed your settings due to your locale - // [-] https://bugzilla.mozilla.org/1462015 -user_pref("browser.search.countryCode", "US"); // [HIDDEN PREF] -// 0301a: disable auto-update checks for Firefox - // [SETTING] General>Firefox Updates>Never check for updates - // [-] https://bugzilla.mozilla.org/1420514 - // user_pref("app.update.enabled", false); +// FF72 +// 0105a: disable Activity Stream telemetry + // [-] https://bugzilla.mozilla.org/1597697 +user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", ""); +// 0330: disable Hybdrid Content telemetry + // [-] https://bugzilla.mozilla.org/1520491 +user_pref("toolkit.telemetry.hybridContent.enabled", false); // [FF59+] +// 2720: enforce IndexedDB (IDB) as enabled + // IDB is required for extensions and Firefox internals (even before FF63 in [1]) + // To control *website* IDB data, control allowing cookies and service workers, or use + // Temporary Containers. To mitigate *website* IDB, FPI helps (4001), and/or sanitize + // on close (Offline Website Data, see 2800) or on-demand (Ctrl-Shift-Del), or automatically + // via an extension. Note that IDB currently cannot be sanitized by host. + // [1] https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/ + // [-] https://bugzilla.mozilla.org/1488583 +user_pref("dom.indexedDB.enabled", true); // [DEFAULT: true] // * * * / -// FF66 -// 0380: disable Browser Error Reporter [FF60+] - // [1] https://support.mozilla.org/en-US/kb/firefox-nightly-error-collection - // [2] https://firefox-source-docs.mozilla.org/browser/browser/BrowserErrorReporter.html - // [-] https://bugzilla.mozilla.org/1509888 -user_pref("browser.chrome.errorReporter.enabled", false); -user_pref("browser.chrome.errorReporter.submitUrl", ""); -// 0502: disable Mozilla permission to silently opt you into tests - // [-] https://bugzilla.mozilla.org/1415625 -user_pref("network.allow-experiments", false); +// FF74 +// 0203: use Mozilla geolocation service instead of Google when geolocation is enabled + // Optionally enable logging to the console (defaults to false) + // [-] https://bugzilla.mozilla.org/1613627 +user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"); + // user_pref("geo.wifi.logging.enabled", true); // [HIDDEN PREF] +// 1704: set behaviour on "+ Tab" button to display container menu [FF53+] [SETUP-CHROME] + // 0=no menu (default), 1=show when clicked, 2=show on long press + // [1] https://bugzilla.mozilla.org/1328756 + // [-] https://bugzilla.mozilla.org/1606265 +user_pref("privacy.userContext.longPressBehavior", 2); +// 2012: limit WebGL + // [-] https://bugzilla.mozilla.org/1477756 +user_pref("webgl.disable-extensions", true); // * * * / -// FF68 -// 0307: disable auto updating of lightweight themes (LWT) - // Not to be confused with themes in 0301* + 0302*, which use the FF55+ Theme API - // Mozilla plan to convert existing LWTs and remove LWT support in the future, see [1] - // [1] https://blog.mozilla.org/addons/2018/09/20/future-themes-here/ - // [-] (part3b) https://bugzilla.mozilla.org/1525762 -user_pref("lightweightThemes.update.enabled", false); -// 2682: enable CSP 1.1 experimental hash-source directive [FF29+] - // [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=855326,883975 - // [-] https://bugzilla.mozilla.org/1386214 -user_pref("security.csp.experimentalEnabled", true); +// FF76 +// 0401: sanitize blocklist url + // [2] https://trac.torproject.org/projects/tor/ticket/16931 + // [-] https://bugzilla.mozilla.org/1618188 +user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/"); +// * * * / +// FF77 +// 0850e: disable location bar one-off searches [FF51+] + // [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ + // [-] https://bugzilla.mozilla.org/1628926 + // user_pref("browser.urlbar.oneOffSearches", false); +// 2605: block web content in file processes [FF55+] + // [SETUP-WEB] You may want to disable this for corporate or developer environments + // [1] https://bugzilla.mozilla.org/1343184 + // [-] https://bugzilla.mozilla.org/1603007 +user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false); +// * * * / +// FF78 +// 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] - replaced by 'media.autoplay.blocking_policy' + // [-] https://bugzilla.mozilla.org/1509933 +user_pref("media.autoplay.enabled.user-gestures-needed", false); +// 5000's: disable chrome animations - replaced FF77+ by 'ui.prefersReducedMotion' (4520) + // [-] https://bugzilla.mozilla.org/1640501 + // user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+] // * * * / // ***/ From 10b1bb2b7cb89ecbdb75ad5d98065cde0b2431f2 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 1 Nov 2020 22:57:55 +0100 Subject: [PATCH 007/147] Merges some options and behavior from Privacy Handbuch project for v78 --- README.md | 2 +- user.js | 38 ++++++++++++++++++++++++++------------ 2 files changed, 27 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 3b0db50..26ca1a8 100644 --- a/README.md +++ b/README.md @@ -35,4 +35,4 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o ### :blue_square: Related Projects * [CHEF-KOCH/TBCK](https://github.com/CHEF-KOCH/TBCK) -* [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31d.htm) +* [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31p.htm) diff --git a/user.js b/user.js index 5f5be9f..810dab4 100644 --- a/user.js +++ b/user.js @@ -61,7 +61,7 @@ 6000: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) 6100: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) 6200: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) - 6300: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT) + 6300: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT / GNUPG) 9999: DEPRECATED / REMOVED / LEGACY / RENAMED ******/ @@ -154,8 +154,9 @@ user_pref("app.update.auto", false); // user_pref("extensions.update.autoUpdateDefault", false); /* 0306: disable extension metadata * used when installing/updating an extension, and in daily background update checks: - * when false, extension detail tabs will have no description ***/ - // user_pref("extensions.getAddons.cache.enabled", false); + * when false, extension detail tabs will have no description + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ +user_pref("extensions.getAddons.cache.enabled", false); /* 0308: disable search engine updates (e.g. OpenSearch) * [NOTE] This does not affect Mozilla's built-in or Web Extension search engines * [SETTING] General>Thunderbird Updates>Automatically update search engines (FF72-) ***/ @@ -445,8 +446,9 @@ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is m * [NOTE] We also clear cache on exiting Firefox (see 2803) ***/ user_pref("browser.cache.disk.enable", false); /* 1003: disable memory cache -/* capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes ***/ - // user_pref("browser.cache.memory.enable", false); + * capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ +user_pref("browser.cache.memory.enable", false); // user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF ESR] /* 1006: disable permissions manager from writing to disk [RESTART] * [NOTE] This means any permission changes are session only @@ -1398,8 +1400,8 @@ user_pref("mail.identity.id1.header.InReplyTo", ""); user_pref("_user.js.parrot", "6000 syntax error: this parrot is blind!"); /** AUTO CONFIG ***/ -/* 6001: Disable auto-configuration - * [SETUP-INSTALL] These options disable auto-configuration of mail servers in Thunderbird. +/* 6001: Disable auto-configuration [SETUP-INSTALL] + * These options disable auto-configuration of mail servers in Thunderbird. * Such settings require a query to Mozilla which could have privacy implications * if the user wishes to keep the existence of the mail provider private. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration ***/ @@ -1409,12 +1411,16 @@ user_pref("mailnews.auto_config.fetchFromISP.sendEmailAddress", false); user_pref("mailnews.auto_config.fetchFromExchange.enabled", false); user_pref("mailnews.auto_config_url", ""); user_pref("mailnews.auto_config.addons_url",""); +/* 6001: Disable account provisioning [SETUP-INSTALL] + * This option allows users to create a new email account through partner providers. + * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Account_Provisioner ***/ +user_pref("mail.provider.enabled", false); /** UI (User Interface) ***/ -/* 6002: Hide tab bar +/* 6003: Hide tab bar * false=Hides the tab bar if there is only one tab. (default) ***/ user_pref("mail.tabs.autoHide", true); -/* 6003: Show full email instead of just name from address book +/* 6004: Show full email instead of just name from address book * true=Show just the display name for people in the address book (default) * false=Show both the email address and display name. ***/ user_pref("mail.showCondensedAddresses", false); @@ -1519,7 +1525,7 @@ user_pref("mailnews.sendformat.auto_downgrade", false); * In the past this has mitigated a vulnerability CVE-2008-0304 (rare) * [1] https://www.mozilla.org/en-US/security/advisories/mfsa2008-12/ * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=677905 ***/ -user_pref("mailnews.display.disallow_mime_handlers", 0); +user_pref("mailnews.display.disallow_mime_handlers", 3); /* 6110: How to display HTML parts of a message body * (0=Display the HTML normally (default), 1=Convert it to text and then back again * 2=Display the HTML source, 3=Sanitize the HTML, 4=Display all body parts) @@ -1636,10 +1642,12 @@ user_pref("rss.show.summary", 1); * 0=no action, 1=load web page in default browser, on select ***/ user_pref("rss.message.loadWebPageOnSelect", 0); -/*** [SECTION 6300]: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT) - Options that relate the Enigmail addon and AutoCrypt +/*** [SECTION 6300]: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT / GNUPG) + Options that relate to Enigmail addon and AutoCrypt. + GnuPG (and RNP) specific options should also land there. [1] https://autocrypt.org [2] https://www.enigmail.net/index.php/en/user-manual/advanced-operations + [3] https://wiki.mozilla.org/Thunderbird:OpenPGP ***/ user_pref("_user.js.parrot", "6300 syntax error: this parrot is talking in codes!"); @@ -1683,6 +1691,12 @@ user_pref("mail.server.default.enableAutocrypt", false); * [1] https://redmine.tails.boum.org/code/issues/15923 ***/ user_pref("mail.server.default.acPreferEncrypt", 0); +/** GNUPG ***/ +/* 6309: Allow the use of external GnuPG + * Whenever RNP fails to decrypt a message, Thunderbird will tray against system GnuPG + * [1] https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards#Allow_the_use_of_external_GnuPG ***/ +user_pref("mail.openpgp.allow_external_gnupg", true); // [HIDDEN PREF] + /*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED Documentation denoted as [-]. Items deprecated in FF68 or earlier have been archived at [1], which also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets From 3cd96847ca18335aa4f97b5d825e6c55e07db0a9 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 1 Nov 2020 22:58:48 +0100 Subject: [PATCH 008/147] [BREAKING] Let's prefer plain text email disregarding HTML presence --- user.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index 810dab4..e71d135 100644 --- a/user.js +++ b/user.js @@ -1501,12 +1501,13 @@ user_pref("mailnews.reply_in_default_charset", true); /* 6105: Check spelling before sending [SETUP-FEATURE] * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=667133 ***/ user_pref("mail.SpellCheckBeforeSend", false); -/* 6106: Never send HTML only emails. (0=Ask, 1=Send as plain text, 2=Send as HTML anyway, - * 3=Include both plain text and HTML message bodies in message) +/* 6106: Behavior when sending HTML message [SETUP-FEATURE] + * (0=Ask, 1=Send as plain text, 2=Send as HTML anyway, + * 3=Include both plain text and HTML message bodies in message) * Email that is HTML should also have plaintext multipart for plain text users. * [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html * [SETTING] Edit > Preferences > Send Options > Send the message in both plain text and HTML ***/ -user_pref("mail.default_html_action", 3); +user_pref("mail.default_html_action", 1); /* 6107: Send email in plaintext unless expressly overridden. * [SETUP-FEATURE] Sometimes HTML is useful especially when used with Markdown Here * [NOTE] Holding down shift when you click on "Write" will bypass From 8c2ef50da0b1a281a6da683aace5778f6f839642 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 1 Nov 2020 23:25:58 +0100 Subject: [PATCH 009/147] TorBirdy is actually not compatible against Thunderbird >= v68 > See --- README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 26ca1a8..16263bd 100644 --- a/README.md +++ b/README.md @@ -14,9 +14,10 @@ For a more technical breakdown and explanation, you can read more on the [overvi The `thunderbird user.js` is a **template** which aims to provide as much privacy and enhanced security as possible. It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client. -- If you're using Thunderbird with Tor we suggest that you install the [TorBirdy](https://addons.thunderbird.net/addon/torbirdy) add-on. If you are using Tor, you should also consider using [Tails](https://tails.boum.org/) or [Whonix](https://www.whonix.org/). -- If you're a **Gmail** user see [this article about OAuth2](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/3.1-OAuth2-Users). -- For information about [extensions](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/4.1-Extensions), see the Wiki. **Calendar** users should [see this page](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/4.1.1-Calendar). +- If you're using Thunderbird (< 68) with Tor we suggest that you install the [TorBirdy](https://addons.thunderbird.net/addon/torbirdy) add-on. If you are using Tor, you should also consider using [Tails](https://tails.boum.org/) or [Whonix](https://www.whonix.org/). +- If you're using **Gmail**, please check [this article about OAuth2](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/3.1-OAuth2-Users). +- For information about [extensions](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/4.1-Extensions), see the Wiki. +- **Calendar** users should [see this page](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/4.1.1-Calendar). Also be aware that this `user.js` is made specifically for Thunderbird and has only been tested in the latest stable release. From bc1a74afa7faad6005160975c6319bfe4a0d2729 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 1 Nov 2020 23:26:35 +0100 Subject: [PATCH 010/147] @tya99's account does not exist on GitHub anymore --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 16263bd..499f398 100644 --- a/README.md +++ b/README.md @@ -29,9 +29,9 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o ### :red_square: Acknowledgments -* [tya99](https://github.com/tya99) most of the ground work and initial port from the Firefox version of [arkenfox user.js](https://github.com/arkenfox/user.js) -* [dngray](https://github.com/dngray) continual maintenance and Wiki -* [HorlogeSkynet](https://github.com/HorlogeSkynet) continual maintenance +* @tya99 most of the ground work and initial port from the Firefox version of [arkenfox user.js](https://github.com/arkenfox/user.js) +* [@dngray](https://github.com/dngray) continual maintenance and Wiki +* [@HorlogeSkynet](https://github.com/HorlogeSkynet) continual maintenance ### :blue_square: Related Projects From 08b2bf94678b2917137ffdbc14bfd3339896b2d2 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 1 Nov 2020 23:27:59 +0100 Subject: [PATCH 011/147] TBCK project is now unavailable on GitHub, waiting for owner feedback... --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 499f398..f1fa67d 100644 --- a/README.md +++ b/README.md @@ -35,5 +35,5 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o ### :blue_square: Related Projects -* [CHEF-KOCH/TBCK](https://github.com/CHEF-KOCH/TBCK) +* [~~CHEF-KOCH/TBCK~~](https://github.com/CHEF-KOCH/TBCK) * [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31p.htm) From b58655a4225f853c2c4f845bc7212fb0d2cf2f40 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 2 Nov 2020 09:58:33 +0100 Subject: [PATCH 012/147] The option following `6001` should definitely be `6002` :-) --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index e71d135..1aa8d26 100644 --- a/user.js +++ b/user.js @@ -1411,7 +1411,7 @@ user_pref("mailnews.auto_config.fetchFromISP.sendEmailAddress", false); user_pref("mailnews.auto_config.fetchFromExchange.enabled", false); user_pref("mailnews.auto_config_url", ""); user_pref("mailnews.auto_config.addons_url",""); -/* 6001: Disable account provisioning [SETUP-INSTALL] +/* 6002: Disable account provisioning [SETUP-INSTALL] * This option allows users to create a new email account through partner providers. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Account_Provisioner ***/ user_pref("mail.provider.enabled", false); From f9413919b56ae4f53af4d35338de3ecb90b8a2df Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 3 Nov 2020 10:58:34 +0100 Subject: [PATCH 013/147] Enables some previously commented-out options related to RSS feeds --- user.js | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/user.js b/user.js index 1aa8d26..5e2708e 100644 --- a/user.js +++ b/user.js @@ -1605,13 +1605,13 @@ user_pref("mail.calendar-integration.opt-out", false); user_pref("calendar.useragent.extra", ""); /** RSS ***/ -/** These features don't actually do anything as they aren't implemented +/* These features used not to do anything as they weren't implemented. * [1] https://dxr.mozilla.org/comm-release/source/mail/base/content/mailWindowOverlay.js#649 - * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=458606#c9 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=458606#c9 ***/ /* 6208: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) - * [1] https://www.privacy-handbuch.de/handbuch_31j.htm + * [1] https://www.privacy-handbuch.de/handbuch_31j.htm ***/ user_pref("rss.display.disallow_mime_handlers", 3); /* 6209: How to display HTML parts of a message body * (0=Display the HTML normally (default), 1=Convert it to text and then back again @@ -1619,15 +1619,14 @@ user_pref("rss.display.disallow_mime_handlers", 3); * (in trunk builds later than 2011-07-23) * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=602718 * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 - * [3] https://www.bucksch.org/1/projects/mozilla/108153/ + * [3] https://www.bucksch.org/1/projects/mozilla/108153/ ***/ user_pref("rss.display.html_as", 1); /* 6210: Prefer to view as plaintext or html * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body * false=Display a message as HTML when there is both a HTML and a plain text - * version of a message body. (default) + * version of a message body. (default) ***/ user_pref("rss.display.prefer_plaintext", true); -**/ /* 6211: Feed message display (summary or web page), on open. * Action on double click or enter in threadpane for a feed message. * 0=open content-base url in new window, 1=open summary in new window, From 68d36833f780ca2a88481868d79bfde37de83741 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 3 Nov 2020 10:59:41 +0100 Subject: [PATCH 014/147] Fixes wrong value type set for `mail.collect_addressbook` option... and adds the default value to template for re-enabling purposes --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index 5e2708e..e4b6664 100644 --- a/user.js +++ b/user.js @@ -1473,7 +1473,7 @@ user_pref("mailnews.display.date_senders_timezone", false); /* 6007: Address book collection * [SETUP-FEATURE] Disable address book email collection * Consider using https://addons.thunderbird.net/addon/cardbook instead ***/ -user_pref("mail.collect_addressbook", false); +user_pref("mail.collect_addressbook", ""); // [DEFAULT: "jsaddrbook://history.sqlite"] user_pref("mail.collect_email_address_outgoing", false); /*** [SECTION 6100]: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) From 787ca411fbb0d5a7665edcdd77f20de5e98b74db Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 3 Nov 2020 14:48:00 +0100 Subject: [PATCH 015/147] Prefers pointing to Arkenfox maintenance section as we do not have one --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index e4b6664..32b51ce 100644 --- a/user.js +++ b/user.js @@ -30,7 +30,7 @@ [SETUP-HARDEN] maybe you should consider using the Tor Browser * [WARNING] tags are extra special and used sparingly, so heed them 4. BACKUP your profile folder before implementing (and/or test in a new/cloned profile) - 5. KEEP UP TO DATE: https://github.com/HorlogeSkynet/thunderbird-user.js/wiki#small_orange_diamond-maintenance + 5. KEEP UP TO DATE: https://github.com/arkenfox/user.js/wiki#small_orange_diamond-maintenance * INDEX: 0100: STARTUP From 37066f8c06695959d483f97046ee306f0f869aa1 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 3 Nov 2020 18:53:06 +0100 Subject: [PATCH 016/147] Somehow, `checkDefaultMail` option got renamed to `checkDefaultClient` --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index 32b51ce..4cfa762 100644 --- a/user.js +++ b/user.js @@ -83,7 +83,7 @@ user_pref("browser.aboutConfig.showWarning", false); // HTML version [FF71+] user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); /* 0101: disable default browser check * [SETTING] Edit>Preferences>Advanced>Always check to see if Thunderbird is the default mail client on startup ***/ -user_pref("mail.shell.checkDefaultMail", false); +user_pref("mail.shell.checkDefaultClient", false); /* 0102: set START page * [SETTING] Edit>Preferences>General>Thunderbird Start Page ***/ user_pref("mailnews.start_page.enabled", false); From 52d0864e416d7614f6e3d1a344b033ce91156400 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 3 Nov 2020 18:56:53 +0100 Subject: [PATCH 017/147] Incorporates some hardening from CHEF-KOCH/TBCK (abandoned?) project : + Disables MathML by default + Lowers the HTTP redirects limit + Disables any add-on installed outside profile directory + Disables accessibility services access + Disables system timezone detection + Disables UI instrumentation + Disables network connectivity checks + Disables IPv6 network detection changes --- user.js | 77 ++++++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 55 insertions(+), 22 deletions(-) diff --git a/user.js b/user.js index 4cfa762..4e05a75 100644 --- a/user.js +++ b/user.js @@ -188,27 +188,34 @@ user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+] user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+] /* 0340: disable Health Reports - * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Firefox to send technical... data ***/ + * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Thunderbird to send technical... data ***/ user_pref("datareporting.healthreport.uploadEnabled", false); /* 0341: disable new data submission, master kill switch [FF41+] * If disabled, no policy is shown or upload takes place, ever * [1] https://bugzilla.mozilla.org/1195552 ***/ user_pref("datareporting.policy.dataSubmissionEnabled", false); /* 0342: disable Studies (see 0503) - * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Firefox to install and run studies ***/ + * [NOTE] This option is missing from Thunderbird's preferences panel (hidden?) ***/ user_pref("app.shield.optoutstudies.enabled", false); /* 0350: disable Crash Reports ***/ user_pref("breakpad.reportURL", ""); user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+] user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] /* 0351: disable backlogged Crash Reports - * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Firefox to send backlogged crash reports ***/ + * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Thunderbird to send backlogged crash reports ***/ user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+] +/* 0370: disable UI instrumentation ***/ +user_pref("mail.instrumentation.postUrl", "") +user_pref("mail.instrumentation.askUser", false) +user_pref("mail.instrumentation.userOptedIn", false) /* 0390: disable Captive Portal detection * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy * [2] https://wiki.mozilla.org/Necko/CaptivePortal ***/ user_pref("captivedetect.canonicalURL", ""); user_pref("network.captive-portal-service.enabled", false); // [FF52+] +/* 0391: disable Network Connectivity checks [FF65+] + * [1] https://bugzilla.mozilla.org/1460537 ***/ +user_pref("network.connectivity-service.enabled", false); /*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING (SB) ***/ user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); @@ -333,6 +340,7 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost * [1] https://github.com/arkenfox/user.js/issues/437#issuecomment-403740626 * [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/ user_pref("network.dns.disableIPv6", true); +user_pref("network.notify.IPv6", false); /* 0702: disable HTTP2 * HTTP2 raises concerns with "multiplexing" and "server push", does nothing to * enhance privacy, and opens up a number of server-side fingerprinting opportunities. @@ -942,6 +950,10 @@ user_pref("permissions.default.xr", 2); /*** [SECTION 2600]: MISCELLANEOUS ***/ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); +/* 2601: prevent accessibility services from accessing your browser [RESTART] [SETUP-FEATURE] + * [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser (FF80 or lower) + * [1] https://support.mozilla.org/kb/accessibility-services ***/ +user_pref("accessibility.force_disabled", 1); /* 2602: disable sending additional analytics to web servers * [1] https://developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/ user_pref("beacon.enabled", false); @@ -953,9 +965,10 @@ user_pref("devtools.chrome.enabled", false); * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/ user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] /* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN] + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it * [TEST] https://arkenfox.github.io/TZP/tzp.html#misc * [1] https://bugzilla.mozilla.org/1173199 ***/ - // user_pref("mathml.disabled", true); +user_pref("mathml.disabled", true); /* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+] * [NOTE] In FF70+ and ESR68.1.0+ this no longer affects extensions (1564208) * [WARNING] Expect breakage incl. youtube player controls. Best left for a "hardened" profile. @@ -967,7 +980,7 @@ user_pref("middlemouse.contentLoadURL", false); /* 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS) * [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins) * To control HTML Meta tag and JS redirects, use an extension. Default is 20 ***/ -user_pref("network.http.redirection-limit", 10); +user_pref("network.http.redirection-limit", 8); /* 2619: enforce Punycode for Internationalized Domain Names to eliminate possible spoofing * Firefox has *some* protections, but it is better to be safe than sorry * [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded @@ -1007,7 +1020,7 @@ user_pref("browser.download.hide_plugins_without_extensions", false); * XPI files which are installed outside of profile and application directories * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ * [1] archived: https://archive.is/DYjAM ***/ -user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] +user_pref("extensions.enabledScopes", 1); // [HIDDEN PREF] user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] /* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ @@ -1087,6 +1100,21 @@ user_pref("dom.storageManager.enabled", false); Firefox interface as "Browsing & Download History" and their values will be synced ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); +/* 2802: enable Thunderbird to clear items on shutdown (see 2803) +user_pref("privacy.sanitize.sanitizeOnShutdown", true); +/* 2803: set what items to clear on shutdown (if 2802 is true) [SETUP-CHROME] + * [NOTE] If 'history' is true, downloads will also be cleared regardless of the value + * but if 'history' is false, downloads can still be cleared independently + * However, this may not always be the case. The interface combines and syncs these + * prefs when set from there, and the sanitize code may change at any time ***/ +user_pref("privacy.clearOnShutdown.cache", true); +user_pref("privacy.clearOnShutdown.cookies", true); +user_pref("privacy.clearOnShutdown.downloads", true); // see note above +user_pref("privacy.clearOnShutdown.formdata", true); // Form & Search History +user_pref("privacy.clearOnShutdown.history", true); // Browsing & Download History +user_pref("privacy.clearOnShutdown.offlineApps", true); // Offline Website Data +user_pref("privacy.clearOnShutdown.sessions", true); // Active Logins +user_pref("privacy.clearOnShutdown.siteSettings", false); // Site Preferences /* 2804: reset default items to clear with Ctrl-Shift-Del (to match 2803) [SETUP-CHROME] * This dialog can also be accessed from the menu History>Clear Recent History * Firefox remembers your last choices. This will reset them when you start Firefox. @@ -1572,7 +1600,7 @@ user_pref("media.hardware-video-decoding.enabled", false); user_pref("permissions.default.image", 2); /*** [SECTION 6200]: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) - Options that relate to other Thunderbird components such as the chat client, calendar and rss) + Options that relate to other Thunderbird components such as the chat client, calendar and RSS) ***/ user_pref("_user.js.parrot", "6200 syntax error: this parrot is not tweeting!"); @@ -1587,33 +1615,38 @@ user_pref("purple.logging.log_ims", false); user_pref("purple.logging.log_system", false); /* 6205: Disable typing notifications ***/ user_pref("purple.conversations.im.send_typing", false); -/* 6210: When chat is enabled, do not connect to accounts automatically +/* 6206: When chat is enabled, do not connect to accounts automatically * 0=Do not connect / show the account manager, * 1=Connect automatically. (Default) ***/ // user_pref("messenger.startup.action", 0); /** CALENDAR ***/ -/* 6206: Disable calendar integration - * [SETUP-FEATURE] Lightning calendar add-on is integrated in Thunderbird 38 and later. - * Keeping this preference false allows us to properly show the opt-in/opt-out dialog - * on new profiles fresh start, see [3]. - * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=401779 - * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1130854 - * [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1130852 ***/ +/* 6210: Disable calendar integration + * [SETUP-FEATURE] Lightning calendar add-on is integrated in Thunderbird 38 and later. + * Keeping this preference false allows us to properly show the opt-in/opt-out dialog + * on new profiles fresh start, see [3]. + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=401779 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1130854 + * [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1130852 ***/ user_pref("mail.calendar-integration.opt-out", false); -/* 6207: Set user agent for calendar ***/ +/* 6211: Set user agent for calendar ***/ user_pref("calendar.useragent.extra", ""); +/* 6212: Set calendar timezone to avoid system detection [SETUP-INSTALL] + * By default, extensive system detection would be performed to find user's current timezone. + * Setting this preference to "UTC" should disable it. + * You may also directly set it to your timezone, i.e. "Pacific/Fakaofo" ***/ +user_pref("calendar.timezone.local", "UTC"); // [DEFAULT: ""] /** RSS ***/ /* These features used not to do anything as they weren't implemented. * [1] https://dxr.mozilla.org/comm-release/source/mail/base/content/mailWindowOverlay.js#649 * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=458606#c9 ***/ -/* 6208: What classes can process incoming data. +/* 6220: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) * [1] https://www.privacy-handbuch.de/handbuch_31j.htm ***/ user_pref("rss.display.disallow_mime_handlers", 3); -/* 6209: How to display HTML parts of a message body +/* 6221: How to display HTML parts of a message body * (0=Display the HTML normally (default), 1=Convert it to text and then back again * 2=Display the HTML source, 3=Sanitize the HTML, 4=Display all body parts) * (in trunk builds later than 2011-07-23) @@ -1621,24 +1654,24 @@ user_pref("rss.display.disallow_mime_handlers", 3); * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 * [3] https://www.bucksch.org/1/projects/mozilla/108153/ ***/ user_pref("rss.display.html_as", 1); -/* 6210: Prefer to view as plaintext or html +/* 6222: Prefer to view as plaintext or html * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body * false=Display a message as HTML when there is both a HTML and a plain text * version of a message body. (default) ***/ user_pref("rss.display.prefer_plaintext", true); -/* 6211: Feed message display (summary or web page), on open. +/* 6223: Feed message display (summary or web page), on open. * Action on double click or enter in threadpane for a feed message. * 0=open content-base url in new window, 1=open summary in new window, * 2=toggle load summary and content-base url in message pane, * 3=load content-base url in browser * [1] http://forums.mozillazine.org/viewtopic.php?f=39&t=2502335 ***/ user_pref("rss.show.content-base", 3); -/* 6212: Feed message display (summary or web page), on select. +/* 6224: Feed message display (summary or web page), on select. * 0=global override, load web page, 1=global override, load summary, * 2=use default feed folder setting from Subscribe dialog; if no setting default to 1 ***/ user_pref("rss.show.summary", 1); -/* 6213: Feed message additional web page display. +/* 6225: Feed message additional web page display. * 0=no action, 1=load web page in default browser, on select ***/ user_pref("rss.message.loadWebPageOnSelect", 0); From 7bc7c89ac78f809ecd2585473ed5206a40085300 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 3 Nov 2020 20:34:12 +0100 Subject: [PATCH 018/147] Exposes the default return receipt behavior pref in `5000` ("personal") --- user.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/user.js b/user.js index 4e05a75..05c842e 100644 --- a/user.js +++ b/user.js @@ -1402,6 +1402,8 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!"); /* CONTENT BEHAVIOR ***/ // user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type" // user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX] +/* RETURN RECEIPT BEHAVIOR ***/ + // user_pref("mail.mdn.report.enabled", false); // disable return receipt sending unconditionally /* UX BEHAVIOR ***/ // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux] // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART] From ac6137d6f4db0d66ef4ae6a5adaffca8612737f1 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 3 Nov 2020 20:45:51 +0100 Subject: [PATCH 019/147] Adds "Privacy Haters" as one more related project > The HTTP link has been set, as the website uses a self-signed certificate. --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index f1fa67d..ec65428 100644 --- a/README.md +++ b/README.md @@ -37,3 +37,4 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o * [~~CHEF-KOCH/TBCK~~](https://github.com/CHEF-KOCH/TBCK) * [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31p.htm) +* [Privacy Haters](http://r-36.net/scm/privacy-haters/file/README.md.html) From 8591d9b2c82fa3f40913e9d50090df1a5f8ac8a4 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 4 Nov 2020 09:59:45 +0100 Subject: [PATCH 020/147] Re-affects `6000` section identifiers to allow new intermediate prefs --- user.js | 50 +++++++++++++++++++++++++------------------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/user.js b/user.js index 05c842e..d511842 100644 --- a/user.js +++ b/user.js @@ -1447,39 +1447,39 @@ user_pref("mailnews.auto_config.addons_url",""); user_pref("mail.provider.enabled", false); /** UI (User Interface) ***/ -/* 6003: Hide tab bar +/* 6010: Hide tab bar * false=Hides the tab bar if there is only one tab. (default) ***/ user_pref("mail.tabs.autoHide", true); -/* 6004: Show full email instead of just name from address book +/* 6011: Show full email instead of just name from address book * true=Show just the display name for people in the address book (default) * false=Show both the email address and display name. ***/ user_pref("mail.showCondensedAddresses", false); -/* 6010: Disable "Filelink for Large Attachments" feature +/* 6012: Disable "Filelink for Large Attachments" feature * [1] https://support.thunderbird.net/kb/filelink-large-attachments ***/ user_pref("mail.cloud_files.enabled", false); user_pref("mail.cloud_files.inserted_urls.footer.link", ""); -/* 6020: Don't hide cookies and passwords related (advanced?) buttons ***/ +/* 6013: Don't hide cookies and passwords related (advanced?) buttons ***/ user_pref("pref.privacy.disable_button.view_cookies", false); user_pref("pref.privacy.disable_button.cookie_exceptions", false); user_pref("pref.privacy.disable_button.view_passwords", false); /** HEADERS ***/ -/* 6004: +/* 6020: * true=Show Sender header in message pane. * false=Does nothing. (default) ***/ user_pref("mailnews.headers.showSender", true); -/* 6005: +/* 6021: * true=Show User Agent header in message pane * false=Does nothing. (default) ***/ user_pref("mailnews.headers.showUserAgent", false); -/* 6006: Hello argument +/* 6022: Hello argument * Lets you replace your IP address with the specified string in Received: headers when your * IP address is not a "fully qualified domain name" (FQDN). Typically you only need to do this * when you have a NAT box to prevent it from using the NAT boxes IP address. * If you don't set it to something in your SMTP server's domain it may increase your spam * score. ***/ user_pref("mail.smtpserver.default.hello_argument", "[127.0.0.1]"); -/* 6007: Displayed dates and times +/* 6023: Displayed dates and times * [SETUP-INSTALL] When your e-mail program displays the e-mail's date and time, it normally * converts them to your time zone. If your computer's time zone settings are wrong, then you will * see the wrong time (and possibly the wrong date). @@ -1490,9 +1490,9 @@ user_pref("mail.smtpserver.default.hello_argument", "[127.0.0.1]"); * [2] http://wiki.cacert.org/ThunderBirdAdvancedConfig * ***/ user_pref("mailnews.display.original_date", false); -/* 6008: Display the sender's Timezone when set to true ***/ +/* 6024: Display the sender's Timezone when set to true ***/ user_pref("mailnews.display.date_senders_timezone", false); -/* 6009: Display Time Date based on Received Header +/* 6025: Display Time Date based on Received Header * Thunderbird shows the time when the message was sent, according to the sender. It is possible * to make Thunderbird show the time when the message arrived on your mail server, based on the * "Received" header. Set the following preference. New messages will show the time the message @@ -1500,7 +1500,7 @@ user_pref("mailnews.display.date_senders_timezone", false); // user_pref("mailnews.use_received_date", true); /** ADDRESS BOOK ***/ -/* 6007: Address book collection +/* 6030: Address book collection * [SETUP-FEATURE] Disable address book email collection * Consider using https://addons.thunderbird.net/addon/cardbook instead ***/ user_pref("mail.collect_addressbook", ""); // [DEFAULT: "jsaddrbook://history.sqlite"] @@ -1528,17 +1528,17 @@ user_pref("mailnews.send_default_charset", "UTF-8"); user_pref("mailnews.reply_in_default_charset", true); /** COMPOSITION ***/ -/* 6105: Check spelling before sending [SETUP-FEATURE] +/* 6110: Check spelling before sending [SETUP-FEATURE] * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=667133 ***/ user_pref("mail.SpellCheckBeforeSend", false); -/* 6106: Behavior when sending HTML message [SETUP-FEATURE] +/* 6111: Behavior when sending HTML message [SETUP-FEATURE] * (0=Ask, 1=Send as plain text, 2=Send as HTML anyway, * 3=Include both plain text and HTML message bodies in message) * Email that is HTML should also have plaintext multipart for plain text users. * [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html * [SETTING] Edit > Preferences > Send Options > Send the message in both plain text and HTML ***/ user_pref("mail.default_html_action", 1); -/* 6107: Send email in plaintext unless expressly overridden. +/* 6112: Send email in plaintext unless expressly overridden. * [SETUP-FEATURE] Sometimes HTML is useful especially when used with Markdown Here * [NOTE] Holding down shift when you click on "Write" will bypass * [1] http://kb.mozillazine.org/Plain_text_e-mail_%28Thunderbird%29 @@ -1546,18 +1546,18 @@ user_pref("mail.default_html_action", 1); * [3] https://markdown-here.com ***/ user_pref("mail.html_compose", false); user_pref("mail.identity.default.compose_html", false); -/* 6108: Downgrade email to plaintext by default +/* 6113: Downgrade email to plaintext by default * [SETUP-FEATURE] Only use HTML email if you need it, see above * [SETTING] Edit > Preferences > Composition > Send Options > Send messages as plain-text if possible ***/ user_pref("mailnews.sendformat.auto_downgrade", false); -/* 6109: What classes can process incoming data. +/* 6114: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) * In the past this has mitigated a vulnerability CVE-2008-0304 (rare) * [1] https://www.mozilla.org/en-US/security/advisories/mfsa2008-12/ * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=677905 ***/ user_pref("mailnews.display.disallow_mime_handlers", 3); -/* 6110: How to display HTML parts of a message body +/* 6115: How to display HTML parts of a message body * (0=Display the HTML normally (default), 1=Convert it to text and then back again * 2=Display the HTML source, 3=Sanitize the HTML, 4=Display all body parts) * (in trunk builds later than 2011-07-23) @@ -1565,36 +1565,36 @@ user_pref("mailnews.display.disallow_mime_handlers", 3); * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 * [3] https://www.bucksch.org/1/projects/mozilla/108153/ ***/ user_pref("mailnews.display.html_as", 3); -/* 6111: Prefer to view as plaintext or html [SETUP-FEATURE] +/* 6116: Prefer to view as plaintext or html [SETUP-FEATURE] * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body * false=Display a message as HTML when there is both a HTML and a plain text * version of a message body. (default) ***/ user_pref("mailnews.display.prefer_plaintext", false); -/* 6112: Inline attachments [SETUP-FEATURE] +/* 6117: Inline attachments [SETUP-FEATURE] * true=Show inlinable attachments (text, images, messages) after the message. * false=Do not display any attachments with the message ***/ user_pref("mail.inline_attachments", false); -/* 6113: Big attachment warning +/* 6118: Big attachment warning * [1] https://support.mozilla.org/en-US/questions/1081046 * [2] http://forums.mozillazine.org/viewtopic.php?f=39&t=2949521 */ user_pref("mail.compose.big_attachments.notify", true); // [DEFAULT: true] -/* 6114: Set big attachment size to warn at */ +/* 6119: Set big attachment size to warn at */ // user_pref("mailnews.message_warning_size", 20971520); // DEFAULT size /** VIEW ***/ -/* 6115: Disable JavaScript +/* 6130: Disable JavaScript * [NOTE] JavaScript is already disabled in message content. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Releases/3 * [2] https://stackoverflow.com/questions/3054315/is-javascript-supported-in-an-email-message * ***/ user_pref("javascript.enabled", false); -/* 6116: Disable media source extensions +/* 6131: Disable media source extensions * [1] https://www.ghacks.net/2014/05/10/enable-media-source-extensions-firefox ***/ user_pref("media.mediasource.enabled", false); -/* 6117: Disable hardware decoding support ***/ +/* 6132: Disable hardware decoding support ***/ user_pref("media.hardware-video-decoding.enabled", false); -/* 6118: Default image permissions +/* 6133: Default image permissions * 1=Allow all images to load, regardless of origin. (Default), * 2=Block all images from loading. * 3=Prevent third-party images from loading From 5ee06c6d890e51835e5560ce24b4f245d7b24d97 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 4 Nov 2020 10:43:38 +0100 Subject: [PATCH 021/147] "Format replies not to disclose additional information such as locale" Commit imported (before being adjusted) from CHEF-KOCH/TBCK project, external contribution by @komachi Co-authored-by: Anton Nesterov --- user.js | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/user.js b/user.js index d511842..5ee2468 100644 --- a/user.js +++ b/user.js @@ -1526,6 +1526,17 @@ user_pref("mailnews.send_default_charset", "UTF-8"); /* 6104: Forces encoding in reply to be the default charset * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=234958#c2 ***/ user_pref("mailnews.reply_in_default_charset", true); +/* 6105: Avoid information leakage in reply header + * Reply header may contain sensitive information about system locale (date and/or language) + * 0=no header + * 1=" wrote:" (see `reply_header_authorwrotesingle` below) + * 2="On wrote:" (see `reply_header_ondateauthorwrote` below [DEFAULT]) + * 3=" wrote On :" (see `reply_header_authorwroteondate` below`) + * 4=user specified (you may use below tokens to forge your own format [DISCOURAGED]) ***/ +user_pref("mailnews.reply_header_type", 1); +user_pref("mailnews.reply_header_authorwrotesingle", "#1 wrote:"); + // user_pref("mailnews.reply_header_ondateauthorwrote", "On #2 #3, #1 wrote:"); + // user_pref("mailnews.reply_header_authorwroteondate", "#1 wrote on #2 #3:"); /** COMPOSITION ***/ /* 6110: Check spelling before sending [SETUP-FEATURE] From accbfcc0093413467743f5f3fafcff244e7425cc Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 4 Nov 2020 21:05:32 +0100 Subject: [PATCH 022/147] Adds missing semicolons to `mail.instrumentation.*` prefs (closes #11) --- user.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index 5ee2468..edf2e5d 100644 --- a/user.js +++ b/user.js @@ -205,9 +205,9 @@ user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Thunderbird to send backlogged crash reports ***/ user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+] /* 0370: disable UI instrumentation ***/ -user_pref("mail.instrumentation.postUrl", "") -user_pref("mail.instrumentation.askUser", false) -user_pref("mail.instrumentation.userOptedIn", false) +user_pref("mail.instrumentation.postUrl", ""); +user_pref("mail.instrumentation.askUser", false); +user_pref("mail.instrumentation.userOptedIn", false); /* 0390: disable Captive Portal detection * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy * [2] https://wiki.mozilla.org/Necko/CaptivePortal ***/ From ba65d3345119cfec6b76cc450b921103c09999e8 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 4 Nov 2020 21:18:13 +0100 Subject: [PATCH 023/147] Bumps version field in sources according to latest tag [skip ci] --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index edf2e5d..97a3023 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js * date: 1 November 2020 -* version: v78-beta1 +* version: v78-beta3 * authors: v52+ github | v51- www.ghacks.net * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From b36710a76e9a378ca7d54a4d68c2e0a4024dad36 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 5 Nov 2020 16:00:40 +0100 Subject: [PATCH 024/147] Replaces Acorn over Travis CI by ESLint over (Microsoft) GitHub Actions > See #11, Acorn was great but not sufficient for Mozilla's libPref syntax... --- .eslintrc.yml | 45 +++++++++++++++++++++++++++++++++++ .github/workflows/linting.yml | 17 +++++++++++++ .travis.yml | 8 ------- 3 files changed, 62 insertions(+), 8 deletions(-) create mode 100644 .eslintrc.yml create mode 100644 .github/workflows/linting.yml delete mode 100644 .travis.yml diff --git a/.eslintrc.yml b/.eslintrc.yml new file mode 100644 index 0000000..b170078 --- /dev/null +++ b/.eslintrc.yml @@ -0,0 +1,45 @@ +%YAML 1.2 +--- + +root: true + +extends: 'eslint:recommended' + +globals: + # From + pref: true + user_pref: true + sticky: true + locked: true + sticky_pref: true + +rules: + # Expect a semicolon after each statement. + semi: + - "error" + - "always" + - + omitLastInOneLineBlock: false + + # As internal code style, don't allow tabulation. + no-tabs: "error" + # ... nor trailing spaces ! + no-trailing-spaces: "error" + + # Expect only double-quoted strings. + quotes: + - "error" + - "double" + + # Don't allow whitespace before semicolons. + semi-spacing: + - "error" + - + before: false + + # Don't allow irregular whitespace characters in our sheet. + no-irregular-whitespace: + - "error" + - + skipStrings: false + skipComments: false diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml new file mode 100644 index 0000000..851acec --- /dev/null +++ b/.github/workflows/linting.yml @@ -0,0 +1,17 @@ +--- +name: Linting + +on: [push, pull_request] + +jobs: + build: + name: Run ESLint on user.js + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v2 + + - uses: actions/setup-node@v1 + + - run: npm install -g eslint + - run: eslint user.js diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index b9fc006..0000000 --- a/.travis.yml +++ /dev/null @@ -1,8 +0,0 @@ -language: node_js -node_js: - - 'node' - -before_script: - - npm install -g acorn -script: - - acorn --silent user.js From e859c40916c1bddceb1deac20a56fe08f7e6c6ae Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 7 Nov 2020 19:00:33 +0100 Subject: [PATCH 025/147] [CARDBOOK] Prevent contacts display names leakages in recipients list --- user.js | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/user.js b/user.js index 97a3023..208ce42 100644 --- a/user.js +++ b/user.js @@ -1505,6 +1505,11 @@ user_pref("mailnews.display.date_senders_timezone", false); * Consider using https://addons.thunderbird.net/addon/cardbook instead ***/ user_pref("mail.collect_addressbook", ""); // [DEFAULT: "jsaddrbook://history.sqlite"] user_pref("mail.collect_email_address_outgoing", false); +/* 6031: Only use email addresses, without their Display Names [CARDBOOK] [SETUP-FEATURE] + * By default, CardBook extension incorporates contacts display names in addresses fields. + * This could leak sensitive information to all recipients. + * [SETTING] CardBook>Preferences>Email>Sending Emails>Only use email addresses, ... ***/ +user_pref("extensions.cardbook.useOnlyEmail", true); /*** [SECTION 6100]: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) Options that relate to composition, formatting and viewing email From b4a7a771ec55070163afc956d9b6eedd9c6a3f67 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 7 Nov 2020 19:05:58 +0100 Subject: [PATCH 026/147] Improves addr collect. doc + Explains how it could be done with CardBook --- user.js | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/user.js b/user.js index 208ce42..bdb7e86 100644 --- a/user.js +++ b/user.js @@ -1500,15 +1500,16 @@ user_pref("mailnews.display.date_senders_timezone", false); // user_pref("mailnews.use_received_date", true); /** ADDRESS BOOK ***/ -/* 6030: Address book collection - * [SETUP-FEATURE] Disable address book email collection - * Consider using https://addons.thunderbird.net/addon/cardbook instead ***/ +/* 6030: Address book collection [SETUP-FEATURE] + * Disable Thunderbird internal address book email collection + * Consider using CardBook extension instead (https://addons.thunderbird.net/addon/cardbook/) + * [SETTING][CARDBOOK] CardBook>Preferences>Email>Collect Outgoing Email ***/ user_pref("mail.collect_addressbook", ""); // [DEFAULT: "jsaddrbook://history.sqlite"] user_pref("mail.collect_email_address_outgoing", false); /* 6031: Only use email addresses, without their Display Names [CARDBOOK] [SETUP-FEATURE] * By default, CardBook extension incorporates contacts display names in addresses fields. * This could leak sensitive information to all recipients. - * [SETTING] CardBook>Preferences>Email>Sending Emails>Only use email addresses, ... ***/ + * [SETTING][CARDBOOK] CardBook>Preferences>Email>Sending Emails>Only use email addresses... ***/ user_pref("extensions.cardbook.useOnlyEmail", true); /*** [SECTION 6100]: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) From 667189eedb75e752eeef28510fbce1a8614555cd Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 7 Nov 2020 19:19:32 +0100 Subject: [PATCH 027/147] Specifies that `calendar.timezone.local` could be changed from settings --- user.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/user.js b/user.js index bdb7e86..5d603e0 100644 --- a/user.js +++ b/user.js @@ -1653,7 +1653,8 @@ user_pref("calendar.useragent.extra", ""); /* 6212: Set calendar timezone to avoid system detection [SETUP-INSTALL] * By default, extensive system detection would be performed to find user's current timezone. * Setting this preference to "UTC" should disable it. - * You may also directly set it to your timezone, i.e. "Pacific/Fakaofo" ***/ + * You may also directly set it to your timezone, i.e. "Pacific/Fakaofo" + * [SETTING] Edit>Preferences>Calendar>Calendar>Timezone ***/ user_pref("calendar.timezone.local", "UTC"); // [DEFAULT: ""] /** RSS ***/ From 13b544b2081b27b06dac8d226cf0d57b4024802d Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 7 Nov 2020 20:44:50 +0100 Subject: [PATCH 028/147] These UX features actually do not exist anymore --- user.js | 3 --- 1 file changed, 3 deletions(-) diff --git a/user.js b/user.js index 5d603e0..e81b718 100644 --- a/user.js +++ b/user.js @@ -1407,9 +1407,6 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!"); /* UX BEHAVIOR ***/ // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux] // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART] -/* UX FEATURES: disable and hide the icons and menus ***/ - // user_pref("browser.messaging-system.whatsNewPanel.enabled", false); // What's New [FF69+] - // user_pref("extensions.pocket.enabled", false); // Pocket Account [FF46+] /* OTHER ***/ // user_pref("network.manage-offline-status", false); // see bugzilla 620472 // user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR) From 148bfac88298f143082fbb2078d99ad003d314af Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 7 Nov 2020 21:05:24 +0100 Subject: [PATCH 029/147] Definitely removes link to CHEF-KOCH/TBCK in "related projects" list > See: --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index ec65428..4f43746 100644 --- a/README.md +++ b/README.md @@ -35,6 +35,6 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o ### :blue_square: Related Projects -* [~~CHEF-KOCH/TBCK~~](https://github.com/CHEF-KOCH/TBCK) * [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31p.htm) * [Privacy Haters](http://r-36.net/scm/privacy-haters/file/README.md.html) +* ~~CHEF-KOCH/TBCK~~ From 428fa861b991d9fd43873c554847fb9af218798a Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 7 Nov 2020 21:51:50 +0100 Subject: [PATCH 030/147] Prevents pages refresh or reload when tab/window is inactive or idle --- user.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/user.js b/user.js index e81b718..65b7c75 100644 --- a/user.js +++ b/user.js @@ -326,6 +326,9 @@ user_pref("network.http.speculative-parallel-limit", 0); * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/ user_pref("browser.send_pings", false); // [DEFAULT: false] user_pref("browser.send_pings.require_same_host", true); +/* 0610: don't refresh nor reload pages when tab/window is not active or in idle state + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=518805 ***/ +user_pref("browser.meta_refresh_when_inactive.disabled", true); /*** [SECTION 0700]: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc ***/ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!"); From fc6ea5582fcd96a260b8d404a2c4e7bd66c321b0 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 7 Nov 2020 22:52:31 +0100 Subject: [PATCH 031/147] TorBirdy is not compatible against Thunderbird v78, removing advice --- user.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/user.js b/user.js index 65b7c75..df7c8a1 100644 --- a/user.js +++ b/user.js @@ -8,8 +8,7 @@ * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases * README: - 0. Consider using Tor, use TorBirdy as well. - * https://addons.thunderbird.net/addon/torbirdy + 0. Consider using Tor 1. READ the full README * https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/README.md 2. READ this From 352394a62f4a5473c42da00c6a3bb9260967663f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 7 Nov 2020 23:08:15 +0100 Subject: [PATCH 032/147] Specifies that `mail.collect_*` could be changed from settings --- user.js | 1 + 1 file changed, 1 insertion(+) diff --git a/user.js b/user.js index df7c8a1..1928162 100644 --- a/user.js +++ b/user.js @@ -1502,6 +1502,7 @@ user_pref("mailnews.display.date_senders_timezone", false); /* 6030: Address book collection [SETUP-FEATURE] * Disable Thunderbird internal address book email collection * Consider using CardBook extension instead (https://addons.thunderbird.net/addon/cardbook/) + * [SETTING] Preferences>Composition>Addressing>Automatically add outgoing e-mail addresses... * [SETTING][CARDBOOK] CardBook>Preferences>Email>Collect Outgoing Email ***/ user_pref("mail.collect_addressbook", ""); // [DEFAULT: "jsaddrbook://history.sqlite"] user_pref("mail.collect_email_address_outgoing", false); From 700f90e954fc73dd4787a2cb05d32f76161650c0 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 8 Nov 2020 16:18:57 +0100 Subject: [PATCH 033/147] Improves consistency across some preferences default set values --- user.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/user.js b/user.js index 1928162..e57d0f7 100644 --- a/user.js +++ b/user.js @@ -1597,7 +1597,7 @@ user_pref("mail.inline_attachments", false); * [2] http://forums.mozillazine.org/viewtopic.php?f=39&t=2949521 */ user_pref("mail.compose.big_attachments.notify", true); // [DEFAULT: true] /* 6119: Set big attachment size to warn at */ - // user_pref("mailnews.message_warning_size", 20971520); // DEFAULT size + // user_pref("mailnews.message_warning_size", 20971520); // [DEFAULT: 20971520] /** VIEW ***/ /* 6130: Disable JavaScript @@ -1708,9 +1708,9 @@ user_pref("_user.js.parrot", "6300 syntax error: this parrot is talking in codes /* These used to be inversed, however it seems upstream has changed this behavior * [1] https://www.privacy-handbuch.de/handbuch_31f.htm ***/ /* 6301: Silence the Enigmail version header ***/ -user_pref("extensions.enigmail.addHeaders", false); // Default +user_pref("extensions.enigmail.addHeaders", false); // [DEFAULT: false] /* 6302: Silence the Enigmail comment ***/ -user_pref("extensions.enigmail.useDefaultComment", true); // Default +user_pref("extensions.enigmail.useDefaultComment", true); // [DEFAULT: true] /* 6303: Silence the version ***/ user_pref("extensions.enigmail.agentAdditionalParam", "--no-emit-version --no-comments"); /* 6304: Specifies the hash algorithm used by GnuPG for its cryptographic operations: @@ -1730,7 +1730,7 @@ user_pref("extensions.enigmail.protectedHeaders", 2); /* 6306: Text to use as replacement for the subject, following the Memory Hole * standard. If nothing is defined, then "Encrypted Message" is used. ***/ -user_pref("extensions.enigmail.protectedSubjectText", "Encrypted Message"); // Default +user_pref("extensions.enigmail.protectedSubjectText", "Encrypted Message"); // [DEFAULT: "Encrypted Message"] /** AUTOCRYPT ***/ /* 6307: Choose whether to enable AutoCrypt From a6a674ad37039c41ea5c8d26419d6b12c8dc560b Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 8 Nov 2020 17:49:33 +0100 Subject: [PATCH 034/147] Prevent access to emails until the master password is entered --- user.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/user.js b/user.js index e57d0f7..666a618 100644 --- a/user.js +++ b/user.js @@ -1461,6 +1461,14 @@ user_pref("mail.cloud_files.inserted_urls.footer.link", ""); user_pref("pref.privacy.disable_button.view_cookies", false); user_pref("pref.privacy.disable_button.cookie_exceptions", false); user_pref("pref.privacy.disable_button.view_passwords", false); +/* 6014: Prevent access to emails until the master password is entered + * If a master password has been set, Thunderbird will prevent access to locally available emails + * until the secret is provided. + * This preference MAY mitigate risk due to intimate relationship threat in some cases (see [2])... + * [WARNING] This DOES NOT encrypt locally cached emails anyhow (poor man's application security) + * [1] https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-master-password + * [2] https://www.schneier.com/wp-content/uploads/2020/06/Privacy_Threats_in_Intimate_Relationships-1.pdf ***/ +user_pref("mail.password_protect_local_cache", true); // [HIDDEN PREF] /** HEADERS ***/ /* 6020: From 894ae0d78b944aadccb626dc5bd465c517897989 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 8 Nov 2020 17:49:56 +0100 Subject: [PATCH 035/147] Bumps to v78-beta4 --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index 666a618..ce46c8c 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js * date: 1 November 2020 -* version: v78-beta3 +* version: v78-beta4 * authors: v52+ github | v51- www.ghacks.net * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From e7086e6b5fc56d7d967cdf8bf892c7f4688d0397 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 8 Nov 2020 22:50:22 +0100 Subject: [PATCH 036/147] Incorporates some prefs from 12bytes.org's user.js (related project too) (cc @atomGit) --- README.md | 1 + user.js | 10 +++++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 4f43746..8589a2b 100644 --- a/README.md +++ b/README.md @@ -37,4 +37,5 @@ Also be aware that this `user.js` is made specifically for Thunderbird and has o * [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31p.htm) * [Privacy Haters](http://r-36.net/scm/privacy-haters/file/README.md.html) +* [12bytes.org's user-overrides.js](https://codeberg.org/12bytes.org/thunderbird-user.js-supplement) * ~~CHEF-KOCH/TBCK~~ diff --git a/user.js b/user.js index ce46c8c..6b36338 100644 --- a/user.js +++ b/user.js @@ -1080,8 +1080,9 @@ user_pref("dom.storage.enabled", false); user_pref("browser.cache.offline.enable", false); /* 2740: disable service worker cache and cache storage * [NOTE] We clear service worker cache on exiting Firefox (see 2803) + * [NOTE] Unlike arkenfox/user.js, we explicitly disable it * [1] https://w3c.github.io/ServiceWorker/#privacy ***/ - // user_pref("dom.caches.enabled", false); +user_pref("dom.caches.enabled", false); /* 2750: disable Storage API [FF51+] * The API gives sites the ability to find out how much space they can use, how much * they are already using, and even control whether or not they need to be alerted @@ -1160,14 +1161,15 @@ user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out"); user_pref("privacy.firstparty.isolate", true); /* 4002: enforce FPI restriction for window.opener [FF54+] * [NOTE] Setting this to false may reduce the breakage in 4001 + * [NOTE] Unlike arkenfox/user.js, we explicitly set them * FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3]) * The 2nd pref removes that limitation and will only allow communication if FPDs also match. * [1] https://bugzilla.mozilla.org/1319773#c22 * [2] https://bugzilla.mozilla.org/1492607 * [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/ - // user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] - // user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR] +user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] +user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR] /*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) This master switch will be used for a wide range of items, many of which will @@ -1646,6 +1648,8 @@ user_pref("purple.conversations.im.send_typing", false); * 0=Do not connect / show the account manager, * 1=Connect automatically. (Default) ***/ // user_pref("messenger.startup.action", 0); +/* 6207: When chat is enabled, do not report idle status ***/ + // user_pref("messenger.status.reportIdle", false); /** CALENDAR ***/ /* 6210: Disable calendar integration From 6d624b759e0b24e121755c90d3e4750352f0e387 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 8 Nov 2020 22:54:46 +0100 Subject: [PATCH 037/147] Adds `[SETUP-FEATURE]` tag to chat, as it could be an expected feature --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index 6b36338..990647f 100644 --- a/user.js +++ b/user.js @@ -1634,7 +1634,7 @@ user_pref("permissions.default.image", 2); user_pref("_user.js.parrot", "6200 syntax error: this parrot is not tweeting!"); /** CHAT ***/ -/* 6201: Disable chat functionality ***/ +/* 6201: Disable chat functionality [SETUP-FEATURE] ***/ user_pref("mail.chat.enabled", false); /* 6202: Disable logging of group chats ***/ user_pref("purple.logging.log_chats", false); From b600990f300f6dffa831dc6841da6029eac3be41 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 9 Nov 2020 11:10:17 +0100 Subject: [PATCH 038/147] Publishes GitHub templates to simplify issue reporting and contributions --- .github/ISSUE_TEMPLATE/bug.md | 38 ++++++++++++++++++++++++ .github/ISSUE_TEMPLATE/change_request.md | 30 +++++++++++++++++++ .github/PULL_REQUEST_TEMPLATE.md | 28 +++++++++++++++++ 3 files changed, 96 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/bug.md create mode 100644 .github/ISSUE_TEMPLATE/change_request.md create mode 100644 .github/PULL_REQUEST_TEMPLATE.md diff --git a/.github/ISSUE_TEMPLATE/bug.md b/.github/ISSUE_TEMPLATE/bug.md new file mode 100644 index 0000000..592a844 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug.md @@ -0,0 +1,38 @@ +--- +name: Bug report +about: Create a report to help us improve Thunderbird User.JS +title: "[BUG] " +labels: 'bug' +assignees: '' + +--- + +**Describe the bug** + + + +**Expected behavior** + + + +**Screenshots** + + + +**Environment** + +- Thunderbird version used (X.Y.Z) : +- `thunderbird user.js` template version used (X.Y or commit SHA) : +- Operating system and version : +- \[IF RELEVANT\] Graphical environment name and version : + + +**Additional context** + + + +**Checklist** + +- [ ] I can confirm the bug is due to `thunderbird user.js` **template** and not an overridden preference nor an add-on ; +- [ ] I have searched for `[SETUP-*]` tags and read them up ; +- [ ] I have searched the GitHub project (issues and Wiki) for my issue. diff --git a/.github/ISSUE_TEMPLATE/change_request.md b/.github/ISSUE_TEMPLATE/change_request.md new file mode 100644 index 0000000..c77651e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/change_request.md @@ -0,0 +1,30 @@ +--- +name: Change request +about: Suggest a change for Thunderbird User.JS +title: "[RFC] " +labels: 'enhancement' +assignees: '' + +--- + +**Is your feature request related to a problem? Please describe.** + + + +**List the concerned preferences** + + + +**Describe alternatives you've considered** + + + +**Additional context** + + + +**Checklist** + +- [ ] I know `thunderbird user.js` is a **template** and personal preferences should be stored elsewhere ; +- [ ] The change I want to propose should globally improve the `usability / ( privacy + security + anti-fingerprinting )` ratio ; +- [ ] I agree that subsequent modifications to my change scope may occur in the future. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..d99ccb7 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,28 @@ + + + +## Description + + + +## Reason and / or context + + + + +## How has this been tested ? + + + +## Types of changes : + +- [ ] Bug fix (non-breaking change which fixes an issue) +- [ ] Typo / style fix (non-breaking change which improves readability) +- [ ] New feature (non-breaking change which adds functionality) +- [ ] Breaking change (fix or feature that would cause existing functionality to change) + +## Checklist : + +- [ ] My changes looks good ; +- [ ] I agree that my code may be modified in the future ; +- [ ] My code follows the code style of this project (see `.eslintrc.yml`). From d751f49340589bd9d88a0f49d37b3696b0cbd175 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 9 Nov 2020 14:12:06 +0100 Subject: [PATCH 039/147] Copyright/authors cleanup (see privacytools/privacytools.io#2120) --- LICENSE | 2 +- user.js | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/LICENSE b/LICENSE index bc0d6fb..b7a2faf 100644 --- a/LICENSE +++ b/LICENSE @@ -2,7 +2,7 @@ MIT License Copyright (c) 2019-2020 HorlogeSkynet Copyright (c) 2019 dngray -Copyright (c) 2019 ghacksuserjs +Copyright (c) 2019 arkenfox [prev. ghacksuserjs] Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/user.js b/user.js index 990647f..49624db 100644 --- a/user.js +++ b/user.js @@ -2,7 +2,6 @@ * name: thunderbird user.js * date: 1 November 2020 * version: v78-beta4 -* authors: v52+ github | v51- www.ghacks.net * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases From aa773053bf81e5fe518afba544b00c04f0a52ac0 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 12 Nov 2020 14:36:38 +0100 Subject: [PATCH 040/147] Disable `about:rights` notification on fresh profiles --- user.js | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/user.js b/user.js index 49624db..fc53d3e 100644 --- a/user.js +++ b/user.js @@ -206,6 +206,16 @@ user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+ user_pref("mail.instrumentation.postUrl", ""); user_pref("mail.instrumentation.askUser", false); user_pref("mail.instrumentation.userOptedIn", false); +/* 0371: disable about:rights notification on fresh profiles + * When a profile is loaded for the first time, a bottom notification appears with a button + * showing "Know your rights...". If clicked, the _special_ page about:rights appears. + * When `mail.rights.override` is unset (default), Thunderbird falls-back on `mail.rights.version` + * value. If it's unset (default too) or lower than the current version, notification is displayed. + * false=always show the notification + * true=never show the notification + * [1] https://searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/specialTabs.js#1218 ***/ +user_pref("mail.rights.override", true); // [DEFAULT: unset] + // user_pref("mail.rights.version", 1) // [DEFAULT: unset] /* 0390: disable Captive Portal detection * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy * [2] https://wiki.mozilla.org/Necko/CaptivePortal ***/ From 0ca3d5115747ce5e930b33cff5eba2d84386eead Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 12 Nov 2020 14:42:14 +0100 Subject: [PATCH 041/147] Revert "Enables some previously commented-out options related to RSS feeds" This reverts commit f9413919b56ae4f53af4d35338de3ecb90b8a2df. + Replaces irrelevant DXR link by proper SearchFox permalink. > As of Thunderbird 78, those preferences are still **NOT** implemented. --- user.js | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/user.js b/user.js index fc53d3e..8820d63 100644 --- a/user.js +++ b/user.js @@ -1679,13 +1679,13 @@ user_pref("calendar.useragent.extra", ""); user_pref("calendar.timezone.local", "UTC"); // [DEFAULT: ""] /** RSS ***/ -/* These features used not to do anything as they weren't implemented. - * [1] https://dxr.mozilla.org/comm-release/source/mail/base/content/mailWindowOverlay.js#649 - * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=458606#c9 ***/ +/** These features don't actually do anything as they aren't implemented + * [1] https://searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/mailWindowOverlay.js#925 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=458606#c9 /* 6220: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) - * [1] https://www.privacy-handbuch.de/handbuch_31j.htm ***/ + * [1] https://www.privacy-handbuch.de/handbuch_31j.htm user_pref("rss.display.disallow_mime_handlers", 3); /* 6221: How to display HTML parts of a message body * (0=Display the HTML normally (default), 1=Convert it to text and then back again @@ -1693,14 +1693,15 @@ user_pref("rss.display.disallow_mime_handlers", 3); * (in trunk builds later than 2011-07-23) * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=602718 * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 - * [3] https://www.bucksch.org/1/projects/mozilla/108153/ ***/ + * [3] https://www.bucksch.org/1/projects/mozilla/108153/ user_pref("rss.display.html_as", 1); /* 6222: Prefer to view as plaintext or html * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body * false=Display a message as HTML when there is both a HTML and a plain text - * version of a message body. (default) ***/ + * version of a message body. (default) user_pref("rss.display.prefer_plaintext", true); +**/ /* 6223: Feed message display (summary or web page), on open. * Action on double click or enter in threadpane for a feed message. * 0=open content-base url in new window, 1=open summary in new window, From 5f8cb09775dd2e7536605029af44a60689e728ab Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 12 Nov 2020 14:48:40 +0100 Subject: [PATCH 042/147] Replaces Mozilla's DXR links by proper SearchFox ones > See --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 8820d63..9c9ebdf 100644 --- a/user.js +++ b/user.js @@ -284,7 +284,7 @@ user_pref("browser.safebrowsing.downloads.remote.url", ""); * Linux: "/usr/lib/firefox/browser/features" (or similar) [1] https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html - [2] https://dxr.mozilla.org/mozilla-central/source/browser/extensions + [2] https://searchfox.org/mozilla-central/source/browser/extensions ***/ user_pref("_user.js.parrot", "0500 syntax error: the parrot's cashed in 'is chips!"); /* 0503: disable Normandy/Shield [FF60+] @@ -1434,7 +1434,7 @@ user_pref("mail.identity.id1.header.InReplyTo", ""); /*** [SECTION 6000]: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) Options general to Thunderbird's mail configuration and user interface - [1] https://dxr.mozilla.org/comm-release/ + [1] https://searchfox.org/comm-esr78/source/ [2] http://kb.mozillazine.org/Mail_and_news_settings ***/ user_pref("_user.js.parrot", "6000 syntax error: this parrot is blind!"); From b8ef724bb01d5889ac922058a5538b061e3585e2 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 12 Nov 2020 14:54:32 +0100 Subject: [PATCH 043/147] Bumps to v78-beta5 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 9c9ebdf..b4835a6 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 1 November 2020 -* version: v78-beta4 +* date: 12 November 2020 +* version: v78-beta5 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases From 7f3b35ca64ca59e8e8a7eb20ff05593466467809 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 23 Nov 2020 18:25:35 +0100 Subject: [PATCH 044/147] Leaves `dom.IntersectionObserver.enabled` as it may break error console > Closes #13 --- user.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index b4835a6..4460c81 100644 --- a/user.js +++ b/user.js @@ -903,12 +903,12 @@ user_pref("javascript.options.baselinejit", false); * [NOTE] In FF71+ this no longer affects extensions (1576254) * [1] https://developer.mozilla.org/docs/WebAssembly ***/ user_pref("javascript.options.wasm", false); -/* 2426: disable Intersection Observer API [FF55+] - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it +/* 2426: disable Intersection Observer API [FF55+] [RESTART] + * [NOTE] Disabling it may break the error console (CTRL+SHIFT+J) * [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API * [2] https://w3c.github.io/IntersectionObserver/ * [3] https://bugzilla.mozilla.org/1243846 ***/ -user_pref("dom.IntersectionObserver.enabled", false); + // user_pref("dom.IntersectionObserver.enabled", false); /* 2429: enable (limited but sufficient) window.opener protection [FF65+] * Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/ user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF78+] From 3c70f084688566114fc97d250f3d5b870deb93d3 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 23 Nov 2020 18:26:14 +0100 Subject: [PATCH 045/147] Bumps to v78-beta6 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 4460c81..5393ef4 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 12 November 2020 -* version: v78-beta5 +* date: 23 November 2020 +* version: v78-beta6 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases From d35ac2f3307a80dfcb90932e66a6c66b132b7c8f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 26 Apr 2021 16:56:38 +0200 Subject: [PATCH 046/147] [META][GITHUB] Publishes a proper `FUNDING.yml` sponsoring file [skip ci] --- .github/FUNDING.yml | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 .github/FUNDING.yml diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..9743a25 --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,4 @@ +# repo: HorlogeSkynet/thunderbird-user.js +# filename: FUNDING.YML + +liberapay: HorlogeSkynet From d169ad4ba8f5c9ce83bf5e874a22693ee72eaf96 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 28 Aug 2021 10:19:51 +0200 Subject: [PATCH 047/147] [CI] Bumps `actions/setup-node` to v2 --- .github/workflows/linting.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 851acec..f27b850 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -11,7 +11,7 @@ jobs: steps: - uses: actions/checkout@v2 - - uses: actions/setup-node@v1 + - uses: actions/setup-node@v2 - run: npm install -g eslint - run: eslint user.js From 7c8504b6d0e4cd610f986059ed02bd6863679fd5 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 28 Aug 2021 10:20:02 +0200 Subject: [PATCH 048/147] [META] Updates copyrights for 2021 --- LICENSE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE b/LICENSE index b7a2faf..191ecac 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2019-2020 HorlogeSkynet +Copyright (c) 2019-2021 HorlogeSkynet Copyright (c) 2019 dngray Copyright (c) 2019 arkenfox [prev. ghacksuserjs] From d3308d2f5fcffa5a37b0f553194c6e16de8b6723 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 28 Aug 2021 10:20:35 +0200 Subject: [PATCH 049/147] [META] Bumps to v78.0 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 5393ef4..e790470 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 23 November 2020 -* version: v78-beta6 +* date: 28 August 2021 +* version: v78.0 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases From f675a006d51d27fafcde04c395cdb57d82b04a64 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 12 Sep 2021 19:33:39 +0200 Subject: [PATCH 050/147] [WIP] Begins Arkenfox v78..v91 migration > **WORK IN PROGRESS : DO NOT USE IT AS IS** Migration status : * updated README * updated header * updated index * moved sections 6000, 6100, 6500 & 6300 to 91XX to comply with new upstream namespace * updated sections 01XX -> 08XX --- README.md | 7 +- user.js | 597 +++++++++++++++++++++++++----------------------------- 2 files changed, 276 insertions(+), 328 deletions(-) diff --git a/README.md b/README.md index 8589a2b..b9a5f07 100644 --- a/README.md +++ b/README.md @@ -11,8 +11,11 @@ For a more technical breakdown and explanation, you can read more on the [overvi [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) -The `thunderbird user.js` is a **template** which aims to provide as much privacy and enhanced security as possible. -It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird as an **email client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client. +The `thunderbird user.js` is a **template** which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen). + +Everyone, experts included, should at least read the [implementation](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/1.3-Implementation) wiki page. + +It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird as an **e-mail client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client. - If you're using Thunderbird (< 68) with Tor we suggest that you install the [TorBirdy](https://addons.thunderbird.net/addon/torbirdy) add-on. If you are using Tor, you should also consider using [Tails](https://tails.boum.org/) or [Whonix](https://www.whonix.org/). - If you're using **Gmail**, please check [this article about OAuth2](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/3.1-OAuth2-Users). diff --git a/user.js b/user.js index e790470..502e8c9 100644 --- a/user.js +++ b/user.js @@ -1,182 +1,175 @@ /****** * name: thunderbird user.js -* date: 28 August 2021 -* version: v78.0 +* date: 12 September 2021 +* version: v91-beta * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases * README: - 0. Consider using Tor - 1. READ the full README - * https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/README.md - 2. READ this - * https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/1.3-Implementation - 3. If you skipped steps 1 and 2 above (shame on you), then here is the absolute minimum - * Auto-installing updates for Thunderbird and extensions are disabled (section 0302) - * Real time binary checks with Google services are disabled (section 0412) - * Browsing related technologies, and JavaScript disabled. Use your web browser for browsing. - * You will need to make changes, and to troubleshoot at times (choose wisely, there is always a trade-off). - While not 100% definitive, search for "[SETUP". If required, add each pref to your overrides section at - default values (or comment them out and reset them in about:config). Here are the main ones: + + 1. Consider using Tor if it meets your needs or fits your threat model + * https://www.torproject.org/about/torusers.html.en + 2. Required reading: Overview, Backing Up, and Implementation entries + * https://github.com/HorlogeSkynet/thunderbird-user.js/wiki + 3. If you skipped step 2, return to step 2 + 4. Make changes + * There are often trade-offs and conflicts between security vs privacy vs anti-fingerprinting + and these need to be balanced against functionality & convenience & breakage + * Some site breakage and unintended consequences will happen. Everyone's experience will differ + e.g. some user data is erased on close (section 2800), change this to suit your needs + * While not 100% definitive, search for "[SETUP" tags + e.g. wanna re-enable account auto configuration? check 9101 & 9102 + * Take the wiki link in step 2 and read the Troubleshooting entry + 5. Some tag info [SETUP-INSTALL] if you experience any issue during Thunderbird setting up, read it [SETUP-FEATURE] if you miss some (expected) Thunderbird features, read it [SETUP-SECURITY] it's one item, read it [SETUP-WEB] can cause some websites to break - [SETUP-CHROME] changes how Thunderbird itself behaves (i.e. NOT directly website related) - [SETUP-PERF] may impact performance - [SETUP-HARDEN] maybe you should consider using the Tor Browser - * [WARNING] tags are extra special and used sparingly, so heed them - 4. BACKUP your profile folder before implementing (and/or test in a new/cloned profile) - 5. KEEP UP TO DATE: https://github.com/arkenfox/user.js/wiki#small_orange_diamond-maintenance + [SETUP-CHROME] changes how Thunderbird itself behaves (i.e. not directly website related) * INDEX: + 0100: STARTUP 0200: GEOLOCATION / LANGUAGE / LOCALE - 0300: QUIET BIRD - 0400: BLOCKLISTS / SAFE BROWSING - 0500: SYSTEM ADD-ONS / EXPERIMENTS + 0300: QUIETER BIRD + 0400: SAFE BROWSING 0600: BLOCK IMPLICIT OUTBOUND - 0700: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc - 0800: HISTORY / FORMS - 1000: CACHE / FAVICONS - 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS) + 0700: DNS / DoH / PROXY / SOCKS / IPv6 + 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS + 0900: PASSWORDS + 1000: DISK AVOIDANCE + 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) 1400: FONTS 1600: HEADERS / REFERERS - 1800: PLUGINS - 2000: MEDIA / CAMERA / MIC - 2200: WINDOW MEDDLING & LEAKS / POPUPS + 1700: CONTAINERS + 2000: PLUGINS / MEDIA / WEBRTC 2300: WEB WORKERS - 2400: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT + 2400: DOM (DOCUMENT OBJECT MODEL) + 2500: FINGERPRINTING 2600: MISCELLANEOUS 2700: PERSISTENT STORAGE 2800: SHUTDOWN 4000: FPI (FIRST PARTY ISOLATION) 4500: RFP (RESIST FINGERPRINTING) - 4600: RFP ALTERNATIVES - 4700: RFP ALTERNATIVES (NAVIGATOR / USER AGENT (UA) SPOOFING) - 5000: PERSONAL - 6000: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) - 6100: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) - 6200: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) - 6300: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT / GNUPG) + 5000: OPTIONAL OPSEC + 5500: OPTIONAL HARDENING + 6000: DON'T TOUCH + 7000: DON'T BOTHER + 8000: DON'T BOTHER: NON-RFP + 9000: PERSONAL + 9100: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) + 9200: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) + 9300: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) + 9400: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT / GNUPG) 9999: DEPRECATED / REMOVED / LEGACY / RENAMED ******/ /* START: internal custom pref to test for syntax errors - * [NOTE] In FF60+, not all syntax errors cause parsing to abort i.e. reaching the last debug - * pref no longer necessarily means that all prefs have been applied. Check the console right + * [NOTE] Not all syntax errors cause parsing to abort i.e. reaching the last debug pref + * no longer necessarily means that all prefs have been applied. Check the console right * after startup for any warnings/error messages related to non-applied prefs * [1] https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/ user_pref("_user.js.parrot", "START: Oh yes, the Norwegian Blue... what's wrong with it?"); -/* 0000: disable about:config warning - * FF71-72: chrome://global/content/config.xul - * FF73+: chrome://global/content/config.xhtml ***/ -user_pref("general.warnOnAboutConfig", false); // XUL/XHTML version -user_pref("browser.aboutConfig.showWarning", false); // HTML version [FF71+] +/* 0000: disable about:config warning ***/ +user_pref("browser.aboutConfig.showWarning", false); /*** [SECTION 0100]: STARTUP ***/ user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); /* 0101: disable default browser check * [SETTING] Edit>Preferences>Advanced>Always check to see if Thunderbird is the default mail client on startup ***/ user_pref("mail.shell.checkDefaultClient", false); -/* 0102: set START page +/* 0102: set START page [SETUP-CHROME] * [SETTING] Edit>Preferences>General>Thunderbird Start Page ***/ user_pref("mailnews.start_page.enabled", false); /*** [SECTION 0200]: GEOLOCATION / LANGUAGE / LOCALE ***/ user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!"); -/** GEOLOCATION ***/ -/* 0201: disable Location-Aware Browsing - * [NOTE] Best left at default "true", fingerprintable, is already behind a prompt (see 0202) - * [1] https://www.mozilla.org/firefox/geolocation/ ***/ -user_pref("geo.enabled", false); -/* 0202: set a default permission for Location (see 0201) [FF58+] - * 0=always ask (default), 1=allow, 2=block - * [NOTE] Best left at default "always ask", fingerprintable via Permissions API - * [SETTING] to add site exceptions: Page Info>Permissions>Access Your Location - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Location>Settings ***/ - // user_pref("permissions.default.geo", 2); -/* 0203: use Mozilla geolocation service instead of Google when geolocation is enabled [FF74+] +/* 0201: use Mozilla geolocation service instead of Google if permission is granted [FF74+] * Optionally enable logging to the console (defaults to false) ***/ user_pref("geo.provider.network.url", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"); // user_pref("geo.provider.network.logging.enabled", true); // [HIDDEN PREF] -/* 0204: disable using the OS's geolocation service ***/ +/* 0202: disable using the OS's geolocation service ***/ user_pref("geo.provider.ms-windows-location", false); // [WINDOWS] user_pref("geo.provider.use_corelocation", false); // [MAC] user_pref("geo.provider.use_gpsd", false); // [LINUX] -/* 0206: disable geographically specific results/search engines e.g. "browser.search.*.US" - * i.e. ignore all of Mozilla's various search engines in multiple locales ***/ -user_pref("browser.search.geoSpecificDefaults", false); -user_pref("browser.search.geoSpecificDefaults.url", ""); - -/** LANGUAGE / LOCALE ***/ +/* 0203: disable region updates + * [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/ +user_pref("browser.region.network.url", ""); // [FF78+] +user_pref("browser.region.update.enabled", false); // [[FF79+] +/* 0204: set search region + * [NOTE] May not be hidden if Thunderbird has changed your settings due to your region (0203) ***/ + // user_pref("browser.search.region", "US"); // [HIDDEN PREF] /* 0210: set preferred language for displaying web pages * [TEST] https://addons.mozilla.org/about ***/ user_pref("intl.accept_languages", "en-US, en"); /* 0210b: Set dictionary to US ***/ user_pref("spellchecker.dictionary", "en-US"); -/* 0211: enforce US English locale regardless of the system locale - * [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages, see [2] - * [1] https://bugzilla.mozilla.org/867501 - * [2] https://bugzilla.mozilla.org/1629630 ***/ +/* 0211: use US English locale regardless of the system locale + * [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages [1] + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 ***/ user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] -/* 0212: enforce fallback text encoding to match en-US - * When the content or server doesn't declare a charset the browser will - * fallback to the "Current locale" based on your application language - * [SETTING] General>Language and Appearance>Fonts and Colors>Advanced>Text Encoding for Legacy Content (FF72-) - * [TEST] https://hsivonen.com/test/moz/check-charset.htm - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025 ***/ -user_pref("intl.charset.fallback.override", "windows-1252"); /*** [SECTION 0300]: QUIET BIRD Starting in user.js v68, we only disable the auto-INSTALL of Thunderbird. You still get prompts to update, in one click. We have NEVER disabled auto-CHECKING, and highly discourage that. - Previously we also disabled auto-INSTALLING of extensions (0302b). There are many legitimate reasons to turn off auto-INSTALLS, including hijacked or monetized extensions, time constraints, legacy issues, dev/testing, and fear of breakage/bugs. It is still important to do updates for security reasons, please do so manually if you make changes. ***/ user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!"); -/* 0301b: disable auto-CHECKING for extension and theme updates ***/ - // user_pref("extensions.update.enabled", false); -/* 0302a: disable auto-INSTALLING Thunderbird updates [SETUP-INSTALL] [NON-WINDOWS FF65+] - * [NOTE] In FF65+ on Windows this SETTING (below) is now stored in a file and the pref was removed +/** UPDATES ***/ +/* 0301: disable auto-INSTALLING Thunderbird updates [NON-WINDOWS] + * [NOTE] You will still get prompts to update, and should do so in a timely manner * [SETTING] General>Thunderbird Updates>Check for updates but let you choose to install them... ***/ user_pref("app.update.auto", false); -/* 0302b: disable auto-INSTALLING extension and theme updates (after the check in 0301b) +/* 0302: disable auto-INSTALLING Thunderbird updates via a background service [FF90+] [WINDOWS] + * [SETTING] General>Thunderbird Updates>Automatically install updates>Use a background service to install updates + * [1] https://support.mozilla.org/kb/enable-background-updates-firefox-windows ***/ +user_pref("app.update.background.scheduling.enabled", false); +/* 0303: disable auto-CHECKING for extension and theme updates ***/ + // user_pref("extensions.update.enabled", false); +/* 0304: disable auto-INSTALLING extension and theme updates (after the check in 0303) * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/ // user_pref("extensions.update.autoUpdateDefault", false); -/* 0306: disable extension metadata +/* 0305: disable extension metadata * used when installing/updating an extension, and in daily background update checks: * when false, extension detail tabs will have no description * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ user_pref("extensions.getAddons.cache.enabled", false); -/* 0308: disable search engine updates (e.g. OpenSearch) - * [NOTE] This does not affect Mozilla's built-in or Web Extension search engines - * [SETTING] General>Thunderbird Updates>Automatically update search engines (FF72-) ***/ +/* 0306: disable search engine updates (e.g. OpenSearch) + * [NOTE] This does not affect Mozilla's built-in or Web Extension search engines ***/ user_pref("browser.search.update", false); -/* 0310: disable sending the URL of the website where a plugin crashed ***/ -user_pref("dom.ipc.plugins.reportCrashURL", false); -/* 0320: disable about:addons' Recommendations pane (uses Google Analytics) ***/ +/* 0307: disable System Add-on updates ***/ +user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] +user_pref("extensions.systemAddon.update.url", ""); // [FF44+] + +/** RECOMMENDATIONS ***/ +/* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/ user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF] /* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/ user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); -/* 0330: disable telemetry - * the pref (.unified) affects the behavior of the pref (.enabled) - * IF unified=false then .enabled controls the telemetry module - * IF unified=true then .enabled ONLY controls whether to record extended data - * so make sure to have both set as false. - * Restoring prompted=0 would make TB ask you on fresh install. - * [NOTE] FF58+ 'toolkit.telemetry.enabled' is now LOCKED to reflect prerelease - * or release builds (true and false respectively), see [2]. + +/** TELEMETRY ***/ +/* 0330: disable new data submission [FF41+] + * If disabled, no policy is shown or upload takes place, ever + * [1] https://bugzilla.mozilla.org/1195552 ***/ +user_pref("datareporting.policy.dataSubmissionEnabled", false); +/* 0331: disable Health Reports + * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Thunderbird to send technical... data ***/ +user_pref("datareporting.healthreport.uploadEnabled", false); +/* 0332: disable telemetry + * The "unified" pref affects the behaviour of the "enabled" pref + * - If "unified" is false then "enabled" controls the telemetry module + * - If "unified" is true then "enabled" only controls whether to record extended data + * [NOTE] "toolkit.telemetry.enabled" is now LOCKED to reflect prerelease (true) or release builds (false) [2] * [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html * [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/ user_pref("toolkit.telemetry.unified", false); -user_pref("toolkit.telemetry.enabled", false); // see [NOTE] above FF58+ +user_pref("toolkit.telemetry.enabled", false); // see [NOTE] user_pref("toolkit.telemetry.prompted", 2); user_pref("toolkit.telemetry.server", "data:,"); user_pref("toolkit.telemetry.archive.enabled", false); @@ -185,23 +178,45 @@ user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+] user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+] user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+] -/* 0340: disable Health Reports - * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Thunderbird to send technical... data ***/ -user_pref("datareporting.healthreport.uploadEnabled", false); -/* 0341: disable new data submission, master kill switch [FF41+] - * If disabled, no policy is shown or upload takes place, ever - * [1] https://bugzilla.mozilla.org/1195552 ***/ -user_pref("datareporting.policy.dataSubmissionEnabled", false); -/* 0342: disable Studies (see 0503) +/* 0333: disable Telemetry Coverage + * [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/ + user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF] + user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF] + user_pref("toolkit.coverage.endpoint.base", ""); +/* 0334: disable PingCentre telemetry (used in several System Add-ons) [FF57+] + * Defense-in-depth: currently covered by 0331 ***/ +user_pref("browser.ping-centre.telemetry", false); + +/** STUDIES ***/ +/* 0340: disable Studies * [NOTE] This option is missing from Thunderbird's preferences panel (hidden?) ***/ user_pref("app.shield.optoutstudies.enabled", false); +/* 0341: disable Normandy/Shield [FF60+] + * Shield is a telemetry system that can push and test "recipes" + * [1] https://mozilla.github.io/normandy/ ***/ +user_pref("app.normandy.enabled", false); +user_pref("app.normandy.api_url", ""); + +/** CRASH REPORTS ***/ /* 0350: disable Crash Reports ***/ user_pref("breakpad.reportURL", ""); user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+] -user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] -/* 0351: disable backlogged Crash Reports + // user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] [DEFAULT: false] +/* 0351: enforce no submission of backlogged Crash Reports [FF58+] * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Thunderbird to send backlogged crash reports ***/ -user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+] +user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [DEFAULT: false] + +/** OTHER ***/ +/* 0360: disable Captive Portal detection + * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy ***/ +user_pref("captivedetect.canonicalURL", ""); +user_pref("network.captive-portal-service.enabled", false); // [FF52+] +/* 0361: disable Network Connectivity checks [FF65+] + * [1] https://bugzilla.mozilla.org/1460537 ***/ +user_pref("network.connectivity-service.enabled", false); +/* 0362: enforce disabling of Web Compatibility Reporter [FF56+] + * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla ***/ +user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] /* 0370: disable UI instrumentation ***/ user_pref("mail.instrumentation.postUrl", ""); user_pref("mail.instrumentation.askUser", false); @@ -216,177 +231,91 @@ user_pref("mail.instrumentation.userOptedIn", false); * [1] https://searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/specialTabs.js#1218 ***/ user_pref("mail.rights.override", true); // [DEFAULT: unset] // user_pref("mail.rights.version", 1) // [DEFAULT: unset] -/* 0390: disable Captive Portal detection - * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy - * [2] https://wiki.mozilla.org/Necko/CaptivePortal ***/ -user_pref("captivedetect.canonicalURL", ""); -user_pref("network.captive-portal-service.enabled", false); // [FF52+] -/* 0391: disable Network Connectivity checks [FF65+] - * [1] https://bugzilla.mozilla.org/1460537 ***/ -user_pref("network.connectivity-service.enabled", false); -/*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING (SB) ***/ -user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); -/** BLOCKLISTS ***/ -/* 0401: enforce Firefox blocklist - * [NOTE] It includes updates for "revoked certificates" - * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/ -user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] +/*** [SECTION 0400]: SAFE BROWSING (SB) + SB has taken many steps to preserve privacy. If required, a full url is never sent + to Google, only a part-hash of the prefix, hidden with noise of other real part-hashes. + Firefox takes measures such as stripping out identifying parameters and since SBv4 (FF57+) + doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity) + FWIW, Google also swear it is anonymized and only used to flag malicious sites. -/** SAFE BROWSING (SB) - Safe Browsing has taken many steps to preserve privacy. *IF* required, a full url is never - sent to Google, only a PART-hash of the prefix, and this is hidden with noise of other real - PART-hashes. Google also swear it is anonymized and only used to flag malicious sites. - Firefox also takes measures such as striping out identifying parameters and since SBv4 (FF57+) - doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity) - - #Required reading [#] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ - [1] https://wiki.mozilla.org/Security/Safe_Browsing - [2] https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work + [1] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ + [2] https://wiki.mozilla.org/Security/Safe_Browsing + [3] https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work ***/ -/* 0410: disable SB (Safe Browsing) - * [WARNING] Do this at your own risk! These are the master switches. - * [SETTING] Privacy & Security>Security>... "Block dangerous and deceptive content" ***/ +user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); +/* 0401: disable SB (Safe Browsing) + * [WARNING] Do this at your own risk! These are the master switches + * [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content ***/ // user_pref("browser.safebrowsing.malware.enabled", false); // user_pref("browser.safebrowsing.phishing.enabled", false); -/* 0411: disable SB checks for downloads (both local lookups + remote) - * This is the master switch for the safebrowsing.downloads* prefs (0412, 0413) +/* 0402: disable SB checks for downloads (both local lookups + remote) + * This is the master switch for the safebrowsing.downloads* prefs (0403, 0404) * [SETTING] Privacy & Security>Security>... "Block dangerous downloads" ***/ // user_pref("browser.safebrowsing.downloads.enabled", false); -/* 0412: disable SB checks for downloads (remote) - * To verify the safety of certain executable files, Firefox may submit some information about the +/* 0403: disable SB checks for downloads (remote) + * To verify the safety of certain executable files, Thunderbird may submit some information about the * file, including the name, origin, size and a cryptographic hash of the contents, to the Google - * Safe Browsing service which helps Firefox determine whether or not the file should be blocked + * Safe Browsing service which helps Thunderbird determine whether or not the file should be blocked * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override it ***/ user_pref("browser.safebrowsing.downloads.remote.enabled", false); user_pref("browser.safebrowsing.downloads.remote.url", ""); -/* 0413: disable SB checks for unwanted software +/* 0404: disable SB checks for unwanted software * [SETTING] Privacy & Security>Security>... "Warn you about unwanted and uncommon software" ***/ // user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); // user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); -/* 0419: disable 'ignore this warning' on SB warnings +/* 0405: disable "ignore this warning" on SB warnings [FF45+] * If clicked, it bypasses the block for that session. This is a means for admins to enforce SB * [TEST] see github wiki APPENDIX A: Test Sites: Section 5 * [1] https://bugzilla.mozilla.org/1226490 ***/ // user_pref("browser.safebrowsing.allowOverride", false); -/*** [SECTION 0500]: SYSTEM ADD-ONS / EXPERIMENTS - System Add-ons are a method for shipping extensions, considered to be - built-in features to Firefox, that are hidden from the about:addons UI. - To view your System Add-ons go to about:support, they are listed under "Firefox Features" - - Some System Add-ons have no on-off prefs. Instead you can manually remove them. Note that app - updates will restore them. They may also be updated and possibly restored automatically (see 0505) - * Portable: "...\App\Firefox64\browser\features\" (or "App\Firefox\etc" for 32bit) - * Windows: "...\Program Files\Mozilla\browser\features" (or "Program Files (X86)\etc" for 32bit) - * Mac: "...\Applications\Firefox\Contents\Resources\browser\features\" - [NOTE] On Mac you can right-click on the application and select "Show Package Contents" - * Linux: "/usr/lib/firefox/browser/features" (or similar) - - [1] https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html - [2] https://searchfox.org/mozilla-central/source/browser/extensions -***/ -user_pref("_user.js.parrot", "0500 syntax error: the parrot's cashed in 'is chips!"); -/* 0503: disable Normandy/Shield [FF60+] - * Shield is an telemetry system (including Heartbeat) that can also push and test "recipes" - * [1] https://wiki.mozilla.org/Firefox/Shield - * [2] https://github.com/mozilla/normandy ***/ -user_pref("app.normandy.enabled", false); -user_pref("app.normandy.api_url", ""); -/* 0505: disable System Add-on updates ***/ -user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] -user_pref("extensions.systemAddon.update.url", ""); // [FF44+] -/* 0506: disable PingCentre telemetry (used in several System Add-ons) [FF57+] - * Currently blocked by 'datareporting.healthreport.uploadEnabled' (see 0340) ***/ -user_pref("browser.ping-centre.telemetry", false); -/* 0517: disable Form Autofill - * [NOTE] Stored data is NOT secure (uses a JSON file) - * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes - * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses (FF74+) - * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill - * [2] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/ ***/ -user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] -user_pref("extensions.formautofill.available", "off"); // [FF56+] -user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] -user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] -/* 0518: disable Web Compatibility Reporter [FF56+] - * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla ***/ -user_pref("extensions.webcompat-reporter.enabled", false); - /*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/ user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!"); /* 0601: disable link prefetching * [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/ user_pref("network.prefetch-next", false); /* 0602: disable DNS prefetching - * [1] https://www.ghacks.net/2013/04/27/firefox-prefetching-what-you-need-to-know/ - * [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/ + * [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/ user_pref("network.dns.disablePrefetch", true); -user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF ESR] [DEFAULT: true FF70+] + // user_pref("network.dns.disablePrefetchFromHTTPS", true); // [DEFAULT: true] /* 0603: disable predictor / prefetching ***/ user_pref("network.predictor.enabled", false); -user_pref("network.predictor.enable-prefetch", false); // [FF48+] -/* 0605: disable link-mouseover opening connection to linked server - * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests - * [2] https://www.ghacks.net/2015/08/16/block-firefox-from-connecting-to-sites-when-you-hover-over-links/ ***/ + // user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false] +/* 0604: disable link-mouseover opening connection to linked server + * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/ user_pref("network.http.speculative-parallel-limit", 0); -/* 0606: disable "Hyperlink Auditing" (click tracking) and enforce same host in case +/* 0605: enforce no "Hyperlink Auditing" (click tracking) * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/ -user_pref("browser.send_pings", false); // [DEFAULT: false] -user_pref("browser.send_pings.require_same_host", true); + // user_pref("browser.send_pings", false); // [DEFAULT: false] /* 0610: don't refresh nor reload pages when tab/window is not active or in idle state * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=518805 ***/ user_pref("browser.meta_refresh_when_inactive.disabled", true); -/*** [SECTION 0700]: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc ***/ +/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS / IPv6 ***/ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!"); /* 0701: disable IPv6 - * IPv6 can be abused, especially regarding MAC addresses. They also do not play nice - * with VPNs. That's even assuming your ISP and/or router and/or website can handle it. - * [STATS] Firefox telemetry (June 2020) shows only 5% of all connections are IPv6. - * [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an + * IPv6 can be abused, especially with MAC addresses, and can leak with VPNs: assuming + * your ISP and/or router and/or website is IPv6 capable. Most sites will fall back to IPv4 + * [STATS] Firefox telemetry (July 2021) shows ~10% of all connections are IPv6 + * [NOTE] This is an application level fallback. Disabling IPv6 is best done at an * OS/network level, and/or configured properly in VPN setups. If you are not masking your IP, * then this won't make much difference. If you are masking your IP, then it can only help. + * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" * [TEST] https://ipleak.org/ - * [1] https://github.com/arkenfox/user.js/issues/437#issuecomment-403740626 - * [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/ + * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/ user_pref("network.dns.disableIPv6", true); user_pref("network.notify.IPv6", false); -/* 0702: disable HTTP2 - * HTTP2 raises concerns with "multiplexing" and "server push", does nothing to - * enhance privacy, and opens up a number of server-side fingerprinting opportunities. - * [WARNING] Disabling this made sense in the past, and doesn't break anything, but HTTP2 is - * at 40% (December 2019) and growing [5]. Don't be that one person using HTTP1.1 on HTTP2 sites - * [1] https://http2.github.io/faq/ - * [2] https://blog.scottlogic.com/2014/11/07/http-2-a-quick-look.html - * [3] https://http2.github.io/http2-spec/#rfc.section.10.8 - * [4] https://queue.acm.org/detail.cfm?id=2716278 - * [5] https://w3techs.com/technologies/details/ce-http2/all/all ***/ - // user_pref("network.http.spdy.enabled", false); - // user_pref("network.http.spdy.enabled.deps", false); - // user_pref("network.http.spdy.enabled.http2", false); - // user_pref("network.http.spdy.websockets", false); // [FF65+] -/* 0703: disable HTTP Alternative Services [FF37+] - * [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the - * consequences. FPI isolates these, but it was designed with the Tor protocol in mind, - * and the Tor Browser has extra protection, including enhanced sanitizing per Identity. - * [1] https://tools.ietf.org/html/rfc7838#section-9 - * [2] https://www.mnot.net/blog/2016/03/09/alt-svc ***/ -user_pref("network.http.altsvc.enabled", false); -user_pref("network.http.altsvc.oe", false); -/* 0704: enforce the proxy server to do any DNS lookups when using SOCKS +/* 0702: set the proxy server to do any DNS lookups when using SOCKS * e.g. in Tor, this stops your local DNS server from knowing your Tor destination * as a remote Tor node will handle the DNS request * [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/ user_pref("network.proxy.socks_remote_dns", true); -/* 0708: disable FTP [FF60+] - * [1] https://www.ghacks.net/2018/02/20/firefox-60-with-new-preference-to-disable-ftp/ ***/ -user_pref("network.ftp.enabled", false); -/* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+] +/* 0703: disable using UNC (Uniform Naming Convention) paths [FF61+] * [SETUP-CHROME] Can break extensions for profiles on network shares * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/ user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] -/* 0710: disable GIO as a potential proxy bypass vector +/* 0704: disable GIO as a potential proxy bypass vector * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda, * gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64) * [1] https://bugzilla.mozilla.org/1433507 @@ -394,17 +323,24 @@ user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] * [3] https://en.wikipedia.org/wiki/GVfs * [4] https://en.wikipedia.org/wiki/GIO_(software) ***/ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] +/* 0705: disable DNS-over-HTTPS (DoH) rollout [FF60+] + * 0=off by default, 2=TRR (Trusted Recursive Resolver) first, 3=TRR only, 5=explicitly off + * see "doh-rollout.home-region": USA Feb 2020, Canada July 2021 [3] + * [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ + * [2] https://wiki.mozilla.org/Security/DOH-resolver-policy + * [3] https://blog.mozilla.org/mozilla/news/firefox-by-default-dns-over-https-rollout-in-canada/ + * [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/ + // user_pref("network.trr.mode", 5); +/* 0706: disable proxy direct failover for system requests [FF91+] ***/ +user_pref("network.proxy.failover_direct", false); -/*** [SECTION 0800]: HISTORY / FORMS - Consider your environment (no unwanted eyeballs), your device (restricted access), - your device's unattended state (locked, encrypted, forensic hardened). -***/ +/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); /* 0801: disable location bar using search - * Don't leak URL typos to a search engine, give an error message instead. + * Don't leak URL typos to a search engine, give an error message instead * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com" - * [NOTE] This does **not** affect explicit user action such as using search buttons in the - * dropdown, or using keyword search shortcuts you configure in options (e.g. 'd' for DuckDuckGo) + * [NOTE] This does not affect explicit user action such as using search buttons in the + * dropdown, or using keyword search shortcuts you configure in options (e.g. "d" for DuckDuckGo) * [SETUP-CHROME] If you don't, or rarely, type URLs, or you use a default search * engine that respects privacy, then you probably don't need this ***/ user_pref("keyword.enabled", false); // [DEFAULT: false] @@ -416,30 +352,39 @@ user_pref("keyword.enabled", false); // [DEFAULT: false] * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack), * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/ user_pref("browser.fixup.alternate.enabled", false); -/* 0805: disable coloring of visited links - CSS history leak - * [NOTE] This has NEVER been fully "resolved": in Mozilla/docs it is stated it's - * only in 'certain circumstances', also see latest comments in [2] - * [TEST] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use) - * [1] https://dbaron.org/mozilla/visited-privacy - * [2] https://bugzilla.mozilla.org/147777 - * [3] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector ***/ -user_pref("layout.css.visited_links_enabled", false); -/* 0807: disable live search suggestions -/* [NOTE] Both must be true for the location bar to work +/* 0804: disable live search suggestions + * [NOTE] Both must be true for the location bar to work * [SETUP-CHROME] Change these if you trust and use a privacy respecting search engine * [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/ user_pref("browser.search.suggest.enabled", false); -/* 0860: disable search and form history - * [SETUP-WEB] Be aware thet autocomplete form data can be read by third parties, see [1] [2] - * [NOTE] We also clear formdata on exit (see 2803) +/* 0808: disable search and form history + * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] + * [NOTE] We also clear formdata on exit (2803) * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html * [2] https://bugzilla.mozilla.org/381681 ***/ user_pref("browser.formfill.enable", false); -/* 0862: disable browsing and download history - * [NOTE] We also clear history and downloads on exiting Firefox (see 2803) - * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/ -user_pref("places.history.enabled", false); +/* 0809: disable Form Autofill + * [NOTE] Stored data is NOT secure (uses a JSON file) + * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes + * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses + * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ +user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] +user_pref("extensions.formautofill.available", "off"); // [FF56+] +user_pref("extensions.formautofill.creditCards.available", false); // [FF57+] +user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] +user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] +/* 0810: disable coloring of visited links + * Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive + * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing + * attacks. Don't forget clearing history on close (2803). However, social engineering [2#limits][4][5] + * and advanced targeted timing attacks could still produce usable results + * [1] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector + * [2] https://dbaron.org/mozilla/visited-privacy + * [3] https://bugzilla.mozilla.org/1632765 + * [4] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use) + * [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/ +user_pref("layout.css.visited_links_enabled", false); /*** [SECTION 1000]: CACHE / FAVICONS Cache tracking/fingerprinting techniques [1][2][3] require a cache. Disabling disk (1001) @@ -1402,9 +1347,9 @@ user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow /* 4707: Limit user-agent data by imitating Firefox's user-agent */ // user_pref("general.useragent.compatMode.firefox", true); -/*** [SECTION 5000]: PERSONAL +/*** [SECTION 9000]: PERSONAL Non-project related but useful. If any of these interest you, add them to your overrides ***/ -user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!"); +user_pref("_user.js.parrot", "9000 syntax error: this is an ex-parrot!"); /* WELCOME & WHAT's NEW NOTICES ***/ //user_pref("mailnews.start_page_override.mstone", "ignore"); // master switch /* WARNINGS ***/ @@ -1431,16 +1376,16 @@ user_pref("mail.identity.id1.headers", ""); user_pref("mail.identity.id1.header.References", ""); user_pref("mail.identity.id1.header.InReplyTo", ""); -/*** [SECTION 6000]: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) +/*** [SECTION 9100]: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) Options general to Thunderbird's mail configuration and user interface - [1] https://searchfox.org/comm-esr78/source/ + [1] https://searchfox.org/comm-esr91/source/ [2] http://kb.mozillazine.org/Mail_and_news_settings ***/ -user_pref("_user.js.parrot", "6000 syntax error: this parrot is blind!"); +user_pref("_user.js.parrot", "9100 syntax error: this parrot is blind!"); /** AUTO CONFIG ***/ -/* 6001: Disable auto-configuration [SETUP-INSTALL] +/* 9101: Disable auto-configuration [SETUP-INSTALL] * These options disable auto-configuration of mail servers in Thunderbird. * Such settings require a query to Mozilla which could have privacy implications * if the user wishes to keep the existence of the mail provider private. @@ -1451,28 +1396,28 @@ user_pref("mailnews.auto_config.fetchFromISP.sendEmailAddress", false); user_pref("mailnews.auto_config.fetchFromExchange.enabled", false); user_pref("mailnews.auto_config_url", ""); user_pref("mailnews.auto_config.addons_url",""); -/* 6002: Disable account provisioning [SETUP-INSTALL] +/* 9102: Disable account provisioning [SETUP-INSTALL] * This option allows users to create a new email account through partner providers. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Account_Provisioner ***/ user_pref("mail.provider.enabled", false); /** UI (User Interface) ***/ -/* 6010: Hide tab bar +/* 9110: Hide tab bar * false=Hides the tab bar if there is only one tab. (default) ***/ user_pref("mail.tabs.autoHide", true); -/* 6011: Show full email instead of just name from address book +/* 9111: Show full email instead of just name from address book * true=Show just the display name for people in the address book (default) * false=Show both the email address and display name. ***/ user_pref("mail.showCondensedAddresses", false); -/* 6012: Disable "Filelink for Large Attachments" feature +/* 9112: Disable "Filelink for Large Attachments" feature * [1] https://support.thunderbird.net/kb/filelink-large-attachments ***/ user_pref("mail.cloud_files.enabled", false); user_pref("mail.cloud_files.inserted_urls.footer.link", ""); -/* 6013: Don't hide cookies and passwords related (advanced?) buttons ***/ +/* 9113: Don't hide cookies and passwords related (advanced?) buttons ***/ user_pref("pref.privacy.disable_button.view_cookies", false); user_pref("pref.privacy.disable_button.cookie_exceptions", false); user_pref("pref.privacy.disable_button.view_passwords", false); -/* 6014: Prevent access to emails until the master password is entered +/* 9114: Prevent access to emails until the master password is entered * If a master password has been set, Thunderbird will prevent access to locally available emails * until the secret is provided. * This preference MAY mitigate risk due to intimate relationship threat in some cases (see [2])... @@ -1482,22 +1427,22 @@ user_pref("pref.privacy.disable_button.view_passwords", false); user_pref("mail.password_protect_local_cache", true); // [HIDDEN PREF] /** HEADERS ***/ -/* 6020: +/* 9120: * true=Show Sender header in message pane. * false=Does nothing. (default) ***/ user_pref("mailnews.headers.showSender", true); -/* 6021: +/* 9121: * true=Show User Agent header in message pane * false=Does nothing. (default) ***/ user_pref("mailnews.headers.showUserAgent", false); -/* 6022: Hello argument +/* 9122: Hello argument * Lets you replace your IP address with the specified string in Received: headers when your * IP address is not a "fully qualified domain name" (FQDN). Typically you only need to do this * when you have a NAT box to prevent it from using the NAT boxes IP address. * If you don't set it to something in your SMTP server's domain it may increase your spam * score. ***/ user_pref("mail.smtpserver.default.hello_argument", "[127.0.0.1]"); -/* 6023: Displayed dates and times +/* 9123: Displayed dates and times * [SETUP-INSTALL] When your e-mail program displays the e-mail's date and time, it normally * converts them to your time zone. If your computer's time zone settings are wrong, then you will * see the wrong time (and possibly the wrong date). @@ -1508,9 +1453,9 @@ user_pref("mail.smtpserver.default.hello_argument", "[127.0.0.1]"); * [2] http://wiki.cacert.org/ThunderBirdAdvancedConfig * ***/ user_pref("mailnews.display.original_date", false); -/* 6024: Display the sender's Timezone when set to true ***/ +/* 9124: Display the sender's Timezone when set to true ***/ user_pref("mailnews.display.date_senders_timezone", false); -/* 6025: Display Time Date based on Received Header +/* 9125: Display Time Date based on Received Header * Thunderbird shows the time when the message was sent, according to the sender. It is possible * to make Thunderbird show the time when the message arrived on your mail server, based on the * "Received" header. Set the following preference. New messages will show the time the message @@ -1518,40 +1463,40 @@ user_pref("mailnews.display.date_senders_timezone", false); // user_pref("mailnews.use_received_date", true); /** ADDRESS BOOK ***/ -/* 6030: Address book collection [SETUP-FEATURE] +/* 9130: Address book collection [SETUP-FEATURE] * Disable Thunderbird internal address book email collection * Consider using CardBook extension instead (https://addons.thunderbird.net/addon/cardbook/) * [SETTING] Preferences>Composition>Addressing>Automatically add outgoing e-mail addresses... * [SETTING][CARDBOOK] CardBook>Preferences>Email>Collect Outgoing Email ***/ user_pref("mail.collect_addressbook", ""); // [DEFAULT: "jsaddrbook://history.sqlite"] user_pref("mail.collect_email_address_outgoing", false); -/* 6031: Only use email addresses, without their Display Names [CARDBOOK] [SETUP-FEATURE] +/* 9131: Only use email addresses, without their Display Names [CARDBOOK] [SETUP-FEATURE] * By default, CardBook extension incorporates contacts display names in addresses fields. * This could leak sensitive information to all recipients. * [SETTING][CARDBOOK] CardBook>Preferences>Email>Sending Emails>Only use email addresses... ***/ user_pref("extensions.cardbook.useOnlyEmail", true); -/*** [SECTION 6100]: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) +/*** [SECTION 9200]: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) Options that relate to composition, formatting and viewing email ***/ -user_pref("_user.js.parrot", "6100 syntax error: this parrot has got no mail!"); +user_pref("_user.js.parrot", "9200 syntax error: this parrot has got no mail!"); /** ENCODING ***/ -/* 6101: Prevent fallback encoding to windows-1252, prefer 7bit or 8bit UTF-8 +/* 9201: Prevent fallback encoding to windows-1252, prefer 7bit or 8bit UTF-8 * [1] http://forums.mozillazine.org/viewtopic.php?f=28&t=267341 * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=214729 * [3] https://stackoverflow.com/a/28531705 ***/ user_pref("intl.fallbackCharsetList.ISO-8859-1", "UTF-8"); -/* 6102: Set encoding of incoming mail +/* 9202: Set encoding of incoming mail * [SETTING] Display > Advanced > Fonts & Encodings > Incoming Mail ***/ user_pref("mailnews.view_default_charset", "UTF-8"); -/* 6103: Set encoding of outgoing mail +/* 9203: Set encoding of outgoing mail * [SETTING] Display > Advanced > Fonts & Encodings > Outgoing Mail ***/ user_pref("mailnews.send_default_charset", "UTF-8"); -/* 6104: Forces encoding in reply to be the default charset +/* 9204: Forces encoding in reply to be the default charset * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=234958#c2 ***/ user_pref("mailnews.reply_in_default_charset", true); -/* 6105: Avoid information leakage in reply header +/* 9205: Avoid information leakage in reply header * Reply header may contain sensitive information about system locale (date and/or language) * 0=no header * 1=" wrote:" (see `reply_header_authorwrotesingle` below) @@ -1564,17 +1509,17 @@ user_pref("mailnews.reply_header_authorwrotesingle", "#1 wrote:"); // user_pref("mailnews.reply_header_authorwroteondate", "#1 wrote on #2 #3:"); /** COMPOSITION ***/ -/* 6110: Check spelling before sending [SETUP-FEATURE] +/* 9210: Check spelling before sending [SETUP-FEATURE] * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=667133 ***/ user_pref("mail.SpellCheckBeforeSend", false); -/* 6111: Behavior when sending HTML message [SETUP-FEATURE] +/* 9211: Behavior when sending HTML message [SETUP-FEATURE] * (0=Ask, 1=Send as plain text, 2=Send as HTML anyway, * 3=Include both plain text and HTML message bodies in message) * Email that is HTML should also have plaintext multipart for plain text users. * [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html * [SETTING] Edit > Preferences > Send Options > Send the message in both plain text and HTML ***/ user_pref("mail.default_html_action", 1); -/* 6112: Send email in plaintext unless expressly overridden. +/* 9212: Send email in plaintext unless expressly overridden. * [SETUP-FEATURE] Sometimes HTML is useful especially when used with Markdown Here * [NOTE] Holding down shift when you click on "Write" will bypass * [1] http://kb.mozillazine.org/Plain_text_e-mail_%28Thunderbird%29 @@ -1582,18 +1527,18 @@ user_pref("mail.default_html_action", 1); * [3] https://markdown-here.com ***/ user_pref("mail.html_compose", false); user_pref("mail.identity.default.compose_html", false); -/* 6113: Downgrade email to plaintext by default +/* 9213: Downgrade email to plaintext by default * [SETUP-FEATURE] Only use HTML email if you need it, see above * [SETTING] Edit > Preferences > Composition > Send Options > Send messages as plain-text if possible ***/ user_pref("mailnews.sendformat.auto_downgrade", false); -/* 6114: What classes can process incoming data. +/* 9214: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) * In the past this has mitigated a vulnerability CVE-2008-0304 (rare) * [1] https://www.mozilla.org/en-US/security/advisories/mfsa2008-12/ * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=677905 ***/ user_pref("mailnews.display.disallow_mime_handlers", 3); -/* 6115: How to display HTML parts of a message body +/* 9215: How to display HTML parts of a message body * (0=Display the HTML normally (default), 1=Convert it to text and then back again * 2=Display the HTML source, 3=Sanitize the HTML, 4=Display all body parts) * (in trunk builds later than 2011-07-23) @@ -1601,67 +1546,67 @@ user_pref("mailnews.display.disallow_mime_handlers", 3); * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 * [3] https://www.bucksch.org/1/projects/mozilla/108153/ ***/ user_pref("mailnews.display.html_as", 3); -/* 6116: Prefer to view as plaintext or html [SETUP-FEATURE] +/* 9216: Prefer to view as plaintext or html [SETUP-FEATURE] * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body * false=Display a message as HTML when there is both a HTML and a plain text * version of a message body. (default) ***/ user_pref("mailnews.display.prefer_plaintext", false); -/* 6117: Inline attachments [SETUP-FEATURE] +/* 9217: Inline attachments [SETUP-FEATURE] * true=Show inlinable attachments (text, images, messages) after the message. * false=Do not display any attachments with the message ***/ user_pref("mail.inline_attachments", false); -/* 6118: Big attachment warning +/* 9218: Big attachment warning * [1] https://support.mozilla.org/en-US/questions/1081046 * [2] http://forums.mozillazine.org/viewtopic.php?f=39&t=2949521 */ user_pref("mail.compose.big_attachments.notify", true); // [DEFAULT: true] -/* 6119: Set big attachment size to warn at */ +/* 9219: Set big attachment size to warn at */ // user_pref("mailnews.message_warning_size", 20971520); // [DEFAULT: 20971520] /** VIEW ***/ -/* 6130: Disable JavaScript +/* 9230: Disable JavaScript * [NOTE] JavaScript is already disabled in message content. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Releases/3 * [2] https://stackoverflow.com/questions/3054315/is-javascript-supported-in-an-email-message * ***/ user_pref("javascript.enabled", false); -/* 6131: Disable media source extensions +/* 9231: Disable media source extensions * [1] https://www.ghacks.net/2014/05/10/enable-media-source-extensions-firefox ***/ user_pref("media.mediasource.enabled", false); -/* 6132: Disable hardware decoding support ***/ +/* 9232: Disable hardware decoding support ***/ user_pref("media.hardware-video-decoding.enabled", false); -/* 6133: Default image permissions +/* 9233: Default image permissions * 1=Allow all images to load, regardless of origin. (Default), * 2=Block all images from loading. * 3=Prevent third-party images from loading * [1] http://kb.mozillazine.org/Permissions.default.image ***/ user_pref("permissions.default.image", 2); -/*** [SECTION 6200]: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) +/*** [SECTION 9300]: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) Options that relate to other Thunderbird components such as the chat client, calendar and RSS) ***/ -user_pref("_user.js.parrot", "6200 syntax error: this parrot is not tweeting!"); +user_pref("_user.js.parrot", "9300 syntax error: this parrot is not tweeting!"); /** CHAT ***/ -/* 6201: Disable chat functionality [SETUP-FEATURE] ***/ +/* 9301: Disable chat functionality [SETUP-FEATURE] ***/ user_pref("mail.chat.enabled", false); -/* 6202: Disable logging of group chats ***/ +/* 9302: Disable logging of group chats ***/ user_pref("purple.logging.log_chats", false); -/* 6203: Disable logging of 1 to 1 conversations ***/ +/* 9303: Disable logging of 1 to 1 conversations ***/ user_pref("purple.logging.log_ims", false); -/* 6204: Disable logging of system messages ***/ +/* 9304: Disable logging of system messages ***/ user_pref("purple.logging.log_system", false); -/* 6205: Disable typing notifications ***/ +/* 9305: Disable typing notifications ***/ user_pref("purple.conversations.im.send_typing", false); -/* 6206: When chat is enabled, do not connect to accounts automatically +/* 9306: When chat is enabled, do not connect to accounts automatically * 0=Do not connect / show the account manager, * 1=Connect automatically. (Default) ***/ // user_pref("messenger.startup.action", 0); -/* 6207: When chat is enabled, do not report idle status ***/ +/* 9307: When chat is enabled, do not report idle status ***/ // user_pref("messenger.status.reportIdle", false); /** CALENDAR ***/ -/* 6210: Disable calendar integration +/* 9310: Disable calendar integration * [SETUP-FEATURE] Lightning calendar add-on is integrated in Thunderbird 38 and later. * Keeping this preference false allows us to properly show the opt-in/opt-out dialog * on new profiles fresh start, see [3]. @@ -1669,9 +1614,9 @@ user_pref("purple.conversations.im.send_typing", false); * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1130854 * [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1130852 ***/ user_pref("mail.calendar-integration.opt-out", false); -/* 6211: Set user agent for calendar ***/ +/* 9311: Set user agent for calendar ***/ user_pref("calendar.useragent.extra", ""); -/* 6212: Set calendar timezone to avoid system detection [SETUP-INSTALL] +/* 9312: Set calendar timezone to avoid system detection [SETUP-INSTALL] * By default, extensive system detection would be performed to find user's current timezone. * Setting this preference to "UTC" should disable it. * You may also directly set it to your timezone, i.e. "Pacific/Fakaofo" @@ -1682,12 +1627,12 @@ user_pref("calendar.timezone.local", "UTC"); // [DEFAULT: ""] /** These features don't actually do anything as they aren't implemented * [1] https://searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/mailWindowOverlay.js#925 * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=458606#c9 -/* 6220: What classes can process incoming data. +/* 9320: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) * [1] https://www.privacy-handbuch.de/handbuch_31j.htm user_pref("rss.display.disallow_mime_handlers", 3); -/* 6221: How to display HTML parts of a message body +/* 9321: How to display HTML parts of a message body * (0=Display the HTML normally (default), 1=Convert it to text and then back again * 2=Display the HTML source, 3=Sanitize the HTML, 4=Display all body parts) * (in trunk builds later than 2011-07-23) @@ -1695,47 +1640,47 @@ user_pref("rss.display.disallow_mime_handlers", 3); * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 * [3] https://www.bucksch.org/1/projects/mozilla/108153/ user_pref("rss.display.html_as", 1); -/* 6222: Prefer to view as plaintext or html +/* 9322: Prefer to view as plaintext or html * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body * false=Display a message as HTML when there is both a HTML and a plain text * version of a message body. (default) user_pref("rss.display.prefer_plaintext", true); **/ -/* 6223: Feed message display (summary or web page), on open. +/* 9323: Feed message display (summary or web page), on open. * Action on double click or enter in threadpane for a feed message. * 0=open content-base url in new window, 1=open summary in new window, * 2=toggle load summary and content-base url in message pane, * 3=load content-base url in browser * [1] http://forums.mozillazine.org/viewtopic.php?f=39&t=2502335 ***/ user_pref("rss.show.content-base", 3); -/* 6224: Feed message display (summary or web page), on select. +/* 9324: Feed message display (summary or web page), on select. * 0=global override, load web page, 1=global override, load summary, * 2=use default feed folder setting from Subscribe dialog; if no setting default to 1 ***/ user_pref("rss.show.summary", 1); -/* 6225: Feed message additional web page display. +/* 9325: Feed message additional web page display. * 0=no action, 1=load web page in default browser, on select ***/ user_pref("rss.message.loadWebPageOnSelect", 0); -/*** [SECTION 6300]: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT / GNUPG) +/*** [SECTION 9400]: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT / GNUPG) Options that relate to Enigmail addon and AutoCrypt. GnuPG (and RNP) specific options should also land there. [1] https://autocrypt.org [2] https://www.enigmail.net/index.php/en/user-manual/advanced-operations [3] https://wiki.mozilla.org/Thunderbird:OpenPGP ***/ -user_pref("_user.js.parrot", "6300 syntax error: this parrot is talking in codes!"); +user_pref("_user.js.parrot", "9400 syntax error: this parrot is talking in codes!"); /** ENIGMAIL ***/ /* These used to be inversed, however it seems upstream has changed this behavior * [1] https://www.privacy-handbuch.de/handbuch_31f.htm ***/ -/* 6301: Silence the Enigmail version header ***/ +/* 9401: Silence the Enigmail version header ***/ user_pref("extensions.enigmail.addHeaders", false); // [DEFAULT: false] -/* 6302: Silence the Enigmail comment ***/ +/* 9402: Silence the Enigmail comment ***/ user_pref("extensions.enigmail.useDefaultComment", true); // [DEFAULT: true] -/* 6303: Silence the version ***/ +/* 9403: Silence the version ***/ user_pref("extensions.enigmail.agentAdditionalParam", "--no-emit-version --no-comments"); -/* 6304: Specifies the hash algorithm used by GnuPG for its cryptographic operations: +/* 9404: Specifies the hash algorithm used by GnuPG for its cryptographic operations: * 0=automatic selection, let GnuPG choose (default, recommended), 1=SHA1, 2=RIPEMD160 * 3=SHA256, 4=SHA384, 5=SHA512 * [NOTE] You should probably have a decent gpg.conf with things set. Examples @@ -1743,31 +1688,31 @@ user_pref("extensions.enigmail.agentAdditionalParam", "--no-emit-version --no-co * [2] https://github.com/ioerror/torbirdy/blob/master/gpg.conf * ***/ user_pref("extensions.enigmail.mimeHashAlgorithm", 5); -/* 6305: Protect subject line +/* 9405: Protect subject line * 0=Leave subject unprotected, * 1=Show dialog with "Leave subject unprotected" (changes value to 0) * or "Protect subject" (changes value to 2, * 2=Protect subject***/ user_pref("extensions.enigmail.protectedHeaders", 2); -/* 6306: Text to use as replacement for the subject, following the Memory Hole +/* 9406: Text to use as replacement for the subject, following the Memory Hole * standard. If nothing is defined, then "Encrypted Message" is used. ***/ user_pref("extensions.enigmail.protectedSubjectText", "Encrypted Message"); // [DEFAULT: "Encrypted Message"] /** AUTOCRYPT ***/ -/* 6307: Choose whether to enable AutoCrypt +/* 9407: Choose whether to enable AutoCrypt * [1] https://autocrypt.org/level1.html * [2] https://redmine.tails.boum.org/code/issues/16186 * [SETTING] Edit > Account Settings > OpenPGP Security > Autocrypt > Enable Autocrypt ***/ user_pref("mail.server.default.enableAutocrypt", false); -/* 6308: Prefer email encryption with known contacts +/* 9408: Prefer email encryption with known contacts * [SETTING] Edit > Account Settings > OpenPGP Security > Autocrypt > * Prefer encrypted emails from the people you exchange email with * [1] https://redmine.tails.boum.org/code/issues/15923 ***/ user_pref("mail.server.default.acPreferEncrypt", 0); /** GNUPG ***/ -/* 6309: Allow the use of external GnuPG +/* 9409: Allow the use of external GnuPG * Whenever RNP fails to decrypt a message, Thunderbird will tray against system GnuPG * [1] https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards#Allow_the_use_of_external_GnuPG ***/ user_pref("mail.openpgp.allow_external_gnupg", true); // [HIDDEN PREF] From 5342ec1619a0d602c71e363cfeafc2b0663f2ca8 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 18 Sep 2021 20:15:26 +0200 Subject: [PATCH 051/147] [WIP] Continues Arkenfox v78..v91 migration > **WORK IN PROGRESS : DO NOT USE IT AS IS** Migration status : * updated sections 0900 --> 1400 --- user.js | 256 +++++++++++++++++++++++--------------------------------- 1 file changed, 106 insertions(+), 150 deletions(-) diff --git a/user.js b/user.js index 502e8c9..873aa63 100644 --- a/user.js +++ b/user.js @@ -386,55 +386,66 @@ user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] * [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/ user_pref("layout.css.visited_links_enabled", false); -/*** [SECTION 1000]: CACHE / FAVICONS - Cache tracking/fingerprinting techniques [1][2][3] require a cache. Disabling disk (1001) - *and* memory (1003) caches is one solution; but that's extreme and fingerprintable. A hardened - Temporary Containers configuration can effectively do the same thing, by isolating every tab [4]. - - We consider avoiding disk cache (1001) so cache is session/memory only (like Private Browsing - mode), and isolating cache to first party (4001) is sufficient and a good balance between - risk and performance. ETAGs can also be neutralized by modifying response headers [5], and - you can clear the cache manually or on a regular basis with an extension. - - [1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags - [2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/ - [3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache - [4] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 - [5] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor +/*** [SECTION 0900]: PASSWORDS + [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas ***/ -user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); -/** CACHE ***/ -/* 1001: disable disk cache - * [SETUP-PERF] If you think disk cache may help (heavy tab user, high-res video), - * or you use a hardened Temporary Containers, then feel free to override this - * [NOTE] We also clear cache on exiting Firefox (see 2803) ***/ -user_pref("browser.cache.disk.enable", false); -/* 1003: disable memory cache - * capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kilobytes - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ -user_pref("browser.cache.memory.enable", false); - // user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF ESR] -/* 1006: disable permissions manager from writing to disk [RESTART] - * [NOTE] This means any permission changes are session only - * [1] https://bugzilla.mozilla.org/967812 ***/ - // user_pref("permissions.memory_only", true); // [HIDDEN PREF] +user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!"); +/* 0901: set when Thunderbird should prompt for the primary password + * 0=once per session (default), 1=every time it's needed, 2=after n minutes (0902) ***/ +user_pref("security.ask_for_password", 2); +/* 0902: set how long in minutes Thunderbird should remember the primary password (0901) ***/ + // user_pref("security.password_lifetime", 30); // [DEFAULT: 30] +/* 0903: disable auto-filling username & password form fields + * can leak in cross-site forms *and* be spoofed + * [NOTE] Username & password is still available when you enter the field + * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ ***/ +user_pref("signon.autofillForms", false); +/* 0904: disable formless login capture for Password Manager [FF51+] ***/ +user_pref("signon.formlessCapture.enabled", false); +/* 0905: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+] + * hardens against potential credentials phishing + * 0 = don't allow sub-resources to open HTTP authentication credentials dialogs + * 1 = don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs + * 2 = allow sub-resources to open HTTP authentication credentials dialogs (default) ***/ +user_pref("network.auth.subresource-http-auth-allow", 1); +/* 0906: enforce no automatic authentication on Microsoft sites [FF91+] [WINDOWS 10+] + * [1] https://support.mozilla.org/kb/windows-sso ***/ +user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false] +/* 0910: prevent access to emails until the master password is entered + * If a master password has been set, Thunderbird will prevent access to locally available emails + * until the secret is provided. + * This preference MAY mitigate risk due to intimate relationship threat in some cases (see [2])... + * [WARNING] This DOES NOT encrypt locally cached emails anyhow (poor man's application security) + * [1] https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-master-password + * [2] https://www.schneier.com/wp-content/uploads/2020/06/Privacy_Threats_in_Intimate_Relationships-1.pdf ***/ +user_pref("mail.password_protect_local_cache", true); // [HIDDEN PREF] -/** FAVICONS ***/ -/* 1030: disable favicons in shortcuts +/*** [SECTION 1000]: DISK AVOIDANCE ***/ +user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); +/* 1001: disable disk cache + * [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this + * [NOTE] We also clear cache on exit (2803) ***/ +user_pref("browser.cache.disk.enable", false); +/* 1002: disable media cache from writing to disk in Private Browsing + * [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB + * [SETUP-WEB] ESR78: playback might break on subsequent loading (1650281) ***/ +user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+] +user_pref("media.memory_cache_max_size", 65536); +/* 1003: disable storing extra session data [SETUP-CHROME] + * define on which sites to save extra session data such as form content, cookies and POST data + * 0=everywhere, 1=unencrypted sites, 2=nowhere ***/ +user_pref("browser.sessionstore.privacy_level", 2); +/* 1004: set the minimum interval between session save operations + * Increasing this can help on older machines and some websites, as well as reducing writes [1] + * [1] https://bugzilla.mozilla.org/1304389 ***/ +user_pref("browser.sessionstore.interval", 30000); // [DEFAULT: 15000] +/* 1006: disable favicons in shortcuts * URL shortcuts use a cached randomly named .ico file which is stored in your - * profile/shortcutCache directory. The .ico remains after the shortcut is deleted. + * profile/shortcutCache directory. The .ico remains after the shortcut is deleted * If set to false then the shortcuts use a generic Firefox icon ***/ user_pref("browser.shell.shortcutFavicons", false); -/* 1031: disable favicons in history and bookmarks - * Stored as data blobs in favicons.sqlite, these don't reveal anything that your - * actual history (and bookmarks) already do. Your history is more detailed, so - * control that instead; e.g. disable history, clear history on close, use PB mode - * [NOTE] favicons.sqlite is sanitized on Firefox close, not in-session ***/ -user_pref("browser.chrome.site_icons", false); -/* 1032: disable favicons in web notifications ***/ - // user_pref("alerts.showFavicons", false); // [DEFAULT: false] -/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS) +/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) Your cipher and other settings can be used in server side fingerprinting [TEST] https://www.ssllabs.com/ssltest/viewMyClient.html [TEST] https://browserleaks.com/ssl @@ -444,53 +455,35 @@ user_pref("browser.chrome.site_icons", false); user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); /** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/ /* 1201: require safe negotiation - * Blocks connections to servers that don't support RFC 5746 [2] as they're potentially - * vulnerable to a MiTM attack [3]. A server *without* RFC 5746 can be safe from the attack - * if it disables renegotiations but the problem is that the browser can't know that. - * Setting this pref to true is the only way for the browser to ensure there will be + * Blocks connections (SSL_ERROR_UNSAFE_NEGOTIATION) to servers that don't support RFC 5746 [2] + * as they're potentially vulnerable to a MiTM attack [3]. A server without RFC 5746 can be + * safe from the attack if it disables renegotiations but the problem is that the browser can't + * know that. Setting this pref to true is the only way for the browser to ensure there will be * no unsafe renegotiations on the channel between the browser and the server. + * [STATS] SSL Labs (July 2021) reports over 99% of sites have secure renegotiation [4] * [1] https://wiki.mozilla.org/Security:Renegotiation * [2] https://tools.ietf.org/html/rfc5746 - * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 ***/ + * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 + * [4] https://www.ssllabs.com/ssl-pulse/ ***/ user_pref("security.ssl.require_safe_negotiation", true); -/* 1202: control TLS versions with min and max - * 1=TLS 1.0, 2=TLS 1.1, 3=TLS 1.2, 4=TLS 1.3 - * [STATS] Firefox telemetry (June 2020) shows only 0.16% of SSL handshakes use 1.0 or 1.1 - * [WARNING] Leave these at default, otherwise you alter your TLS fingerprint. - * [1] https://www.ssllabs.com/ssl-pulse/ ***/ - // user_pref("security.tls.version.min", 3); // [DEFAULT: 3 FF78+] - // user_pref("security.tls.version.max", 4); -/* 1204: disable SSL session tracking [FF36+] - * SSL Session IDs are unique, last up to 24hrs in Firefox, and can be used for tracking - * [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the - * consequences. FPI isolates these, but it was designed with the Tor protocol in mind, - * and the Tor Browser has extra protection, including enhanced sanitizing per Identity. - * [1] https://tools.ietf.org/html/rfc5077 - * [2] https://bugzilla.mozilla.org/967977 - * [3] https://arxiv.org/abs/1810.07304 ***/ -user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF] +/* 1203: reset TLS 1.0 and 1.1 downgrades i.e. session only ***/ +user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false] /* 1206: disable TLS1.3 0-RTT (round-trip time) [FF51+] - * [1] https://firefox-source-docs.mozilla.org/browser/base/sslerrorreport/preferences.html ***/ -user_pref("security.ssl.errorReporting.automatic", false); -user_pref("security.ssl.errorReporting.enabled", false); -user_pref("security.ssl.errorReporting.url", ""); -/* 1205: disable TLS1.3 0-RTT (round-trip time) [FF51+] * [1] https://github.com/tlswg/tls13-spec/issues/1001 * [2] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/ user_pref("security.tls.enable_0rtt_data", false); /** OCSP (Online Certificate Status Protocol) - #Required reading [#] https://scotthelme.co.uk/revocation-is-broken/ ***/ -/* 1210: enable OCSP Stapling - * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ ***/ -user_pref("security.ssl.enable_ocsp_stapling", true); + [1] https://scotthelme.co.uk/revocation-is-broken/ + [2] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ +***/ /* 1211: control when to use OCSP fetching (to confirm current validity of certificates) * 0=disabled, 1=enabled (default), 2=enabled for EV certificates only * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority) * It's a trade-off between security (checking) and privacy (leaking info to the CA) * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling * [1] https://en.wikipedia.org/wiki/Ocsp ***/ -user_pref("security.OCSP.enabled", 0); +user_pref("security.OCSP.enabled", 1); /* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail [SETUP-WEB] * When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail) * Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail) @@ -502,13 +495,11 @@ user_pref("security.OCSP.require", true); /** CERTS / HPKP (HTTP Public Key Pinning) ***/ /* 1220: disable or limit SHA-1 certificates - * 0=all SHA1 certs are allowed - * 1=all SHA1 certs are blocked - * 2=deprecated option that now maps to 1 - * 3=only allowed for locally-added roots (e.g. anti-virus) - * 4=only allowed for locally-added roots or for certs in 2015 and earlier - * [SETUP-CHROME] When disabled, some man-in-the-middle devices (e.g. security scanners and - * antivirus products, may fail to connect to HTTPS sites. SHA-1 is *almost* obsolete. + * 0 = allow all + * 1 = block all + * 3 = only allow locally-added roots (e.g. anti-virus) (default) + * 4 = only allow locally-added roots or for certs in 2015 and earlier + * [SETUP-CHROME] If you have problems, update your software: SHA-1 is obsolete * [1] https://blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ ***/ user_pref("security.pki.sha1_enforcement_level", 1); /* 1221: disable Windows 8.1's Microsoft Family Safety cert [FF50+] [WINDOWS] @@ -517,60 +508,44 @@ user_pref("security.pki.sha1_enforcement_level", 1); * 2=detect Family Safety mode and import the root * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/ user_pref("security.family_safety.mode", 0); -/* 1222: disable intermediate certificate caching (fingerprinting attack vector) [FF41+] [RESTART] - * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. - * Saved logins and passwords are not available. Reset the pref and restart to return them. - * [1] https://shiftordie.de/blog/2017/02/21/fingerprinting-firefox-users-with-cached-intermediate-ca-certificates-fiprinca/ ***/ - // user_pref("security.nocertdb", true); // [HIDDEN PREF] -/* 1223: enforce strict pinning +/* 1223: enable strict pinning * PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict - * [SETUP-INSTALL] If you rely on an AV (anti-virus) to protect your web browsing - * by inspecting ALL your web traffic, then leave at current 1 (default). - * [NOTE] It needs to be set to 1 when connecting to the ProtonMail's Bridge for the first time. + * [SETUP-WEB] If you rely on an AV (antivirus) to protect your web browsing + * by inspecting ALL your web traffic, then leave at current default=1 * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/ user_pref("security.cert_pinning.enforcement_level", 2); +/* 1224: enable CRLite [FF73+] + * In FF84+ it covers valid certs and in mode 2 doesn't fall back to OCSP + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985 + * [2] https://blog.mozilla.org/security/tag/crlite/ ***/ +user_pref("security.remote_settings.crlite_filters.enabled", true); +user_pref("security.pki.crlite_mode", 2); /** MIXED CONTENT ***/ -/* 1240: disable insecure active content on https pages - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/ -user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true] /* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/ user_pref("security.mixed_content.block_display_content", true); -/* 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+] - * [1] https://bugzilla.mozilla.org/1190623 ***/ -user_pref("security.mixed_content.block_object_subrequest", true); - -/** CIPHERS [WARNING: do not meddle with your cipher suite: see the section 1200 intro] - * These are all the ciphers still using SHA-1 and CBC which are weaker than the available alternatives. (see "Cipher Suites" in [1]) - * Additionally some have other weaknesses like key sizes of 128 (or lower) [2] and/or no Perfect Forward Secrecy [3]. - * [1] https://browserleaks.com/ssl - * [2] https://en.wikipedia.org/wiki/Key_size - * [3] https://en.wikipedia.org/wiki/Forward_secrecy - ***/ -/* 1261: disable 3DES (effective key size < 128 and no PFS) - * [1] https://en.wikipedia.org/wiki/3des#Security - * [2] https://en.wikipedia.org/wiki/Meet-in-the-middle_attack - * [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/ - // user_pref("security.ssl3.rsa_des_ede3_sha", false); -/* 1263: disable DHE (Diffie-Hellman Key Exchange) - * [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/ - // user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); // [DEFAULT: false FF78+] - // user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); // [DEFAULT: false FF78+] -/* 1264: disable the remaining non-modern cipher suites as of FF78 (in order of preferred by FF) ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); - // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); - // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); - // user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS - // user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS +/* 1244: enable HTTPS-Only mode in all windows [FF76+] + * When the top-level is HTTPS, insecure subresources are also upgraded (silent fail) + * [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (after "Continue to HTTP Site") + * [SETTING] Privacy & Security>HTTPS-Only Mode (and manage exceptions) + * [TEST] http://example.com [upgrade] + * [TEST] http://neverssl.com/ [no upgrade] ***/ +user_pref("dom.security.https_only_mode", true); // [FF76+] +user_pref("dom.security.https_only_mode_pbm", true); // [FF80+] +/* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/ +user_pref("dom.security.https_only_mode.upgrade_local", true); +/* 1246: disable HTTP background requests [FF82+] + * When attempting to upgrade, if the server doesn't respond within 3 seconds, + * Firefox sends HTTP requests in order to check if the server supports HTTPS or not + * This is done to avoid waiting for a timeout which takes 90 seconds + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/ +user_pref("dom.security.https_only_mode_send_http_background_request", false); /** UI (User Interface) ***/ /* 1270: display warning on the padlock for "broken security" (if 1201 is false) * Bug: warning padlock not indicated for subresources on a secure page! [2] - * [STATS] SSL Labs (June 2020) reports 98.8% of sites have secure renegotiation [3] * [1] https://wiki.mozilla.org/Security:Renegotiation - * [2] https://bugzilla.mozilla.org/1353705 - * [3] https://www.ssllabs.com/ssl-pulse/ ***/ + * [2] https://bugzilla.mozilla.org/1353705 ***/ user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); /* 1271: control "Add Security Exception" dialog on SSL warnings * 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default) @@ -581,8 +556,7 @@ user_pref("browser.ssl_override_behavior", 1); * i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/) * [TEST] https://expired.badssl.com/ ***/ user_pref("browser.xul.error_pages.expert_bad_cert", true); -/* 1273: display "insecure" icon and "Not Secure" text on HTTP sites ***/ -user_pref("security.insecure_connection_icon.enabled", true); // [FF59+] [DEFAULT: true FF70+] +/* 1273: display "Not Secure" text on HTTP sites ***/ user_pref("security.insecure_connection_text.enabled", true); // [FF60+] /* 1280: display warnings when insecure HTTP connections are made ***/ user_pref("security.warn_entering_weak", true); @@ -591,24 +565,14 @@ user_pref("security.warn_viewing_mixed", true); /*** [SECTION 1400]: FONTS ***/ user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!"); -/* 1401: disable websites choosing fonts (0=block, 1=allow) - * This can limit most (but not all) JS font enumeration which is a high entropy fingerprinting vector - * [SETUP-WEB] Can break some PDFs (missing text). Limiting to default fonts can "uglify" the web - * [SETTING] General>Language and Appearance>Fonts & Colors>Advanced>Allow pages to choose... ***/ -user_pref("browser.display.use_document_fonts", 0); -/* 1403: disable icon fonts (glyphs) and local fallback rendering - * [1] https://bugzilla.mozilla.org/789788 - * [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/ -user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+] -user_pref("gfx.downloadable_fonts.fallback_delay", -1); -/* 1404: disable rendering of SVG OpenType fonts - * [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/ +/* 1401: disable rendering of SVG OpenType fonts ***/ user_pref("gfx.font_rendering.opentype_svg.enabled", false); -/* 1408: disable graphite - * Graphite has had many critical security issues in the past, see [1] - * [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 - * [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/ -user_pref("gfx.font_rendering.graphite.enabled", false); +/* 1402: limit font visibility (Windows, Mac, some Linux) [FF79+] + * [NOTE] In FF80+ RFP ignores the pref and uses value 1 + * Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts [1], bundled fonts are auto-allowed + * 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts + * [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc ***/ +user_pref("layout.css.font-visibility.level", 1); /*** [SECTION 1600]: HEADERS / REFERERS Only *cross domain* referers need controlling: leave 1601, 1602, 1605 and 1606 alone @@ -1417,14 +1381,6 @@ user_pref("mail.cloud_files.inserted_urls.footer.link", ""); user_pref("pref.privacy.disable_button.view_cookies", false); user_pref("pref.privacy.disable_button.cookie_exceptions", false); user_pref("pref.privacy.disable_button.view_passwords", false); -/* 9114: Prevent access to emails until the master password is entered - * If a master password has been set, Thunderbird will prevent access to locally available emails - * until the secret is provided. - * This preference MAY mitigate risk due to intimate relationship threat in some cases (see [2])... - * [WARNING] This DOES NOT encrypt locally cached emails anyhow (poor man's application security) - * [1] https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-master-password - * [2] https://www.schneier.com/wp-content/uploads/2020/06/Privacy_Threats_in_Intimate_Relationships-1.pdf ***/ -user_pref("mail.password_protect_local_cache", true); // [HIDDEN PREF] /** HEADERS ***/ /* 9120: From 3b2afdd532eb8d87d6f793f7a4c31268dcffa4cf Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 19 Sep 2021 16:11:46 +0200 Subject: [PATCH 052/147] [WIP] Continues Arkenfox v78..v91 migration > **WORK IN PROGRESS : DO NOT USE IT AS IS** Migration status : * updated sections 1600 --> 2800 --- user.js | 567 +++++++++++++++++++++----------------------------------- 1 file changed, 212 insertions(+), 355 deletions(-) diff --git a/user.js b/user.js index 873aa63..cc69cb7 100644 --- a/user.js +++ b/user.js @@ -575,74 +575,43 @@ user_pref("gfx.font_rendering.opentype_svg.enabled", false); user_pref("layout.css.font-visibility.level", 1); /*** [SECTION 1600]: HEADERS / REFERERS - Only *cross domain* referers need controlling: leave 1601, 1602, 1605 and 1606 alone - --- - harden it a bit: set XOriginPolicy (1603) to 1 (as per the settings below) - harden it a bit more: set XOriginPolicy (1603) to 2 (and optionally 1604 to 1 or 2), expect breakage - --- - If you want any REAL control over referers and breakage, then use an extension. Either: - uMatrix: limited by scope, all requests are spoofed or not-spoofed - Smart Referrer: granular with source<->destination, whitelists - --- - - full URI: https://example.com:8888/foo/bar.html?id=1234 - scheme+host+port+path: https://example.com:8888/foo/bar.html - scheme+host+port: https://example.com:8888 - --- - #Required reading [#] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ + Expect some breakage e.g. banks: use an extension if you need precise control + full URI: https://example.com:8888/foo/bar.html?id=1234 + scheme+host+port+path: https://example.com:8888/foo/bar.html + scheme+host+port: https://example.com:8888 + [1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ ***/ user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); -/* 1601: ALL: control when images/links send a referer - * 0=never, 1=send only when links are clicked, 2=for links and images (default) ***/ -user_pref("network.http.sendRefererHeader", 0); // [DEFAULT: 2] -/* 1602: ALL: control the amount of information to send - * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ - // user_pref("network.http.referer.trimmingPolicy", 0); // [DEFAULT: 0] -/* 1603: CROSS ORIGIN: control when to send a referer +/* 1601: control when to send a cross-origin referer * 0=always (default), 1=only if base domains match, 2=only if hosts match - * [SETUP-WEB] Known to cause issues with older modems/routers and some sites e.g vimeo, icloud ***/ + * [SETUP-WEB] Known to cause issues with older modems/routers and some sites e.g vimeo, icloud, instagram ***/ user_pref("network.http.referer.XOriginPolicy", 2); -/* 1604: CROSS ORIGIN: control the amount of information to send [FF52+] +/* 1602: control the amount of cross-origin information to send [FF52+] * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ -user_pref("network.http.referer.XOriginTrimmingPolicy", 0); // [DEFAULT: 0] -/* 1605: ALL: disable spoofing a referer - * [WARNING] Do not set this to true, as spoofing effectively disables the anti-CSRF - * (Cross-Site Request Forgery) protections that some sites may rely on ***/ - // user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] -/* 1606: ALL: set the default Referrer Policy [FF59+] - * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade - * [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy - * [1] https://www.w3.org/TR/referrer-policy/ - * [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy - * [3] https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/ ***/ -user_pref("network.http.referer.defaultPolicy", 0); // [DEFAULT: 3] -user_pref("network.http.referer.defaultPolicy.pbmode", 0); // [DEFAULT: 2] -/* 1610: ALL: enable the DNT (Do Not Track) HTTP header - * [NOTE] DNT is enforced with Enhanced Tracking Protection regardless of this pref +user_pref("network.http.referer.XOriginTrimmingPolicy", 2); +/* 1603: enable the DNT (Do Not Track) HTTP header + * [NOTE] DNT is enforced with Enhanced Tracking Protection (2710) * [SETTING] Privacy & Security>Enhanced Tracking Protection>Send websites a "Do Not Track" signal... ***/ user_pref("privacy.donottrackheader.enabled", true); -/*** [SECTION 1800]: PLUGINS ***/ -user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies!"); -/* 1803: disable Flash plugin - * 0=deactivated, 1=ask, 2=enabled - * ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash - * [NOTE] You can still override individual sites via site permissions ***/ -user_pref("plugin.state.flash", 0); -/* 1820: disable GMP (Gecko Media Plugins) - * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ - // user_pref("media.gmp-provider.enabled", false); -/* 1825: disable widevine CDM (Content Decryption Module) - * [SETUP-WEB] if you *need* CDM, e.g. Netflix, Amazon Prime, Hulu, whatever ***/ -user_pref("media.gmp-widevinecdm.visible", false); -user_pref("media.gmp-widevinecdm.enabled", false); -/* 1830: disable all DRM content (EME: Encryption Media Extension) - * [SETUP-WEB] if you *need* EME, e.g. Netflix, Amazon Prime, Hulu, whatever - * [SETTING] General>DRM Content>Play DRM-controlled content - * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ -user_pref("media.eme.enabled", false); +/*** [SECTION 1700]: CONTAINERS + Check out Temporary Containers [2], read the article [3], and visit the wiki/repo [4] + [1] https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers + [2] https://addons.mozilla.org/firefox/addon/temporary-containers/ + [3] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 + [4] https://github.com/stoically/temporary-containers/wiki +***/ +user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); +/* 1701: enable Container Tabs and its UI setting [FF50+] + * [SETTING] General>Tabs>Enable Container Tabs ***/ +user_pref("privacy.userContext.enabled", true); +user_pref("privacy.userContext.ui.enabled", true); +/* 1702: set behaviour on "+ Tab" button to display container menu on left click [FF74+] + * [NOTE] The menu is always shown on long press and right click + * [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/ + // user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true); -/*** [SECTION 2000]: MEDIA / CAMERA / MIC ***/ +/*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); /* 2001: disable WebRTC (Web Real-Time Communication) * [SETUP-WEB] WebRTC can leak your IP address from behind your VPN, but if this is not @@ -650,7 +619,7 @@ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); * [1] https://www.privacytools.io/#webrtc ***/ user_pref("media.peerconnection.enabled", false); /* 2002: limit WebRTC IP leaks if using WebRTC - * In FF70+ these settings match Mode 4 (Mode 3 in older versions) (see [3]) + * In FF70+ these settings match Mode 4 (Mode 3 in older versions) [3] * [TEST] https://browserleaks.com/webrtc * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713 * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy @@ -658,347 +627,220 @@ user_pref("media.peerconnection.enabled", false); user_pref("media.peerconnection.ice.default_address_only", true); user_pref("media.peerconnection.ice.no_host", true); // [FF51+] user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // [FF70+] -/* 2010: disable WebGL (Web Graphics Library) - * [SETUP-WEB] When disabled, may break some websites. When enabled, provides high entropy, - * especially with readPixels(). Some of the other entropy is lessened with RFP (see 4501) - * [1] https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/ - * [2] https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern ***/ -user_pref("webgl.disabled", true); -user_pref("webgl.enable-webgl2", false); -/* 2012: limit WebGL ***/ -user_pref("webgl.min_capability_mode", true); -user_pref("webgl.disable-fail-if-major-performance-caveat", true); -/* 2022: disable screensharing ***/ -user_pref("media.getusermedia.screensharing.enabled", false); -user_pref("media.getusermedia.browser.enabled", false); -user_pref("media.getusermedia.audiocapture.enabled", false); +/* 2020: disable GMP (Gecko Media Plugins) + * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ +user_pref("media.gmp-provider.enabled", false); +/* 2021: disable widevine CDM (Content Decryption Module) + * [NOTE] This is covered by the EME master switch (2022) ***/ +user_pref("media.gmp-widevinecdm.enabled", false); +/* 2022: disable all DRM content (EME: Encryption Media Extension) + * [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV + * [SETTING] General>DRM Content>Play DRM-controlled content + * [TEST] https://bitmovin.com/demos/drm + * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ +user_pref("media.eme.enabled", false); /* 2030: disable autoplay of HTML5 media [FF63+] - * 0=Allow all, 1=Block non-muted media (default in FF67+), 2=Prompt (removed in FF66), 5=Block all (FF69+) + * 0=Allow all, 1=Block non-muted media (default), 5=Block all * [NOTE] You can set exceptions under site permissions -* [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/ - // user_pref("media.autoplay.default", 5); + * [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/ +user_pref("media.autoplay.default", 5); /* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+] * 0=sticky (default), 1=transient, 2=user - * [NOTE] If you have trouble with some video sites, then add an exception (see 2030) - * [1] https://html.spec.whatwg.org/multipage/interaction.html#sticky-activation ***/ + * Firefox's Autoplay Policy Documentation [PDF] is linked below via SUMO + * [NOTE] If you have trouble with some video sites, then add an exception (2030) + * [1] https://support.mozilla.org/questions/1293231 ***/ user_pref("media.autoplay.blocking_policy", 2); -/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/ -user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!"); -/* 2201: prevent websites from disabling new window features ***/ -user_pref("dom.disable_window_open_feature.close", true); -user_pref("dom.disable_window_open_feature.location", true); // [DEFAULT: true] -user_pref("dom.disable_window_open_feature.menubar", true); -user_pref("dom.disable_window_open_feature.minimizable", true); -user_pref("dom.disable_window_open_feature.personalbar", true); // bookmarks toolbar -user_pref("dom.disable_window_open_feature.resizable", true); // [DEFAULT: true] -user_pref("dom.disable_window_open_feature.status", true); // [DEFAULT: true] -user_pref("dom.disable_window_open_feature.titlebar", true); -user_pref("dom.disable_window_open_feature.toolbar", true); -/* 2202: prevent scripts from moving and resizing open windows ***/ -user_pref("dom.disable_window_move_resize", true); -/* 2203: open links targeting new windows in a new tab instead - * This stops malicious window sizes and some screen resolution leaks. - * You can still right-click a link and open in a new window. - * [NOTE] Unlike arkenfox/user.js, we explicitly set them - * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ -user_pref("browser.link.open_newwindow", 3); -user_pref("browser.link.open_newwindow.restriction", 0); -/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks - * [NOTE] You can still manually toggle the browser's fullscreen state (F11), - * but this pref will disable embedded video/game fullscreen controls, e.g. youtube - * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen ***/ - // user_pref("full-screen-api.enabled", false); // [DEFAULT: false] -/* 2210: block popup windows - * [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/ -user_pref("dom.disable_open_during_load", true); -/* 2212: limit events that can cause a popup [SETUP-WEB] - * default is "change click dblclick auxclick mouseup pointerup notificationclick reset submit touchend contextmenu" ***/ -user_pref("dom.popup_allowed_events", "click dblclick"); - /*** [SECTION 2300]: WEB WORKERS - A worker is a JS "background task" running in a global context, i.e. it is different from - the current window. Workers can spawn new workers (must be the same origin & scheme), - including service and shared workers. Shared workers can be utilized by multiple scripts and - communicate between browsing contexts (windows/tabs/iframes) and can even control your cache. - [NOTE] uMatrix 1.2.0+ allows a per-scope control for workers (2301-deprecated) and service workers (2302) - #Required reading [#] https://github.com/gorhill/uMatrix/releases/tag/1.2.0 - [1] Web Workers: https://developer.mozilla.org/docs/Web/API/Web_Workers_API - [2] Worker: https://developer.mozilla.org/docs/Web/API/Worker - [3] Service Worker: https://developer.mozilla.org/docs/Web/API/Service_Worker_API - [4] SharedWorker: https://developer.mozilla.org/docs/Web/API/SharedWorker - [5] ChromeWorker: https://developer.mozilla.org/docs/Web/API/ChromeWorker - [6] Notifications: https://support.mozilla.org/questions/1165867#answer-981820 + A worker is a JS "background task" running in a global context, i.e. it is different from + the current window. Workers can spawn new workers (must be the same origin & scheme), + including service and shared workers. Shared workers can be utilized by multiple scripts and + communicate between browsing contexts (windows/tabs/iframes) and can even control your cache. + + [1] Web Workers: https://developer.mozilla.org/docs/Web/API/Web_Workers_API + [2] Worker: https://developer.mozilla.org/docs/Web/API/Worker + [3] Service Worker: https://developer.mozilla.org/docs/Web/API/Service_Worker_API + [4] SharedWorker: https://developer.mozilla.org/docs/Web/API/SharedWorker + [5] ChromeWorker: https://developer.mozilla.org/docs/Web/API/ChromeWorker + [6] Notifications: https://support.mozilla.org/questions/1165867#answer-981820 ***/ user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!"); /* 2302: disable service workers [FF32, FF44-compat] * Service workers essentially act as proxy servers that sit between web apps, and the - * browser and network, are event driven, and can control the web page/site it is associated + * browser and network, are event driven, and can control the web page/site they are associated * with, intercepting and modifying navigation and resource requests, and caching resources. - * [NOTE] Service worker APIs are hidden (in Firefox) and cannot be used when in PB mode. - * [NOTE] Service workers only run over HTTPS. Service workers have no DOM access. + * [NOTE] Service workers require HTTPS, have no DOM access, and are not supported in PB mode [1] * [SETUP-WEB] Disabling service workers will break some sites. This pref is required true for * service worker notifications (2304), push notifications (disabled, 2305) and service worker - * cache (2740). If you enable this pref, then check those settings as well ***/ + * cache (2740). If you enable this pref, then check those settings as well + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1320796#c7 ***/ user_pref("dom.serviceWorkers.enabled", false); /* 2304: disable Web Notifications - * [NOTE] Web Notifications can also use service workers (2302) and are behind a prompt (2306) - * [NOTE] Unlike arkenfox/user.js, we explicitly disable them as they are enabled by default + * [NOTE] Web Notifications can also use service workers (2302) and are behind a prompt (7002) * [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/ user_pref("dom.webnotifications.enabled", false); // [FF22+] user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+] /* 2305: disable Push Notifications [FF44+] * Push is an API that allows websites to send you (subscribed) messages even when the site - * isn't loaded, by pushing messages to your userAgentID through Mozilla's Push Server. + * isn't loaded, by pushing messages to your userAgentID through Mozilla's Push Server * [NOTE] Push requires service workers (2302) to subscribe to and display, and is behind - * a prompt (2306). Disabling service workers alone doesn't stop Firefox polling the - * Mozilla Push Server. To remove all subscriptions, reset your userAgentID (in about:config - * or on start), and you will get a new one within a few seconds. - * [1] https://support.mozilla.org/en-US/kb/push-notifications-firefox - * [2] https://developer.mozilla.org/en-US/docs/Web/API/Push_API ***/ + * a prompt (7002). Disabling service workers alone doesn't stop Thunderbird polling the + * Mozilla Push Server. To remove all subscriptions, reset your userAgentID. + * [1] https://support.mozilla.org/kb/push-notifications-firefox + * [2] https://developer.mozilla.org/docs/Web/API/Push_API ***/ user_pref("dom.push.enabled", false); // user_pref("dom.push.userAgentID", ""); -/* 2306: set a default permission for Notifications (both 2304 and 2305) [FF58+] - * 0=always ask (default), 1=allow, 2=block - * [NOTE] Best left at default "always ask", fingerprintable via Permissions API - * [SETTING] to add site exceptions: Page Info>Permissions>Receive Notifications - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Notifications>Settings ***/ - // user_pref("permissions.default.desktop-notification", 2); -/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT ***/ +/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); -/* 2401: disable website control over browser right-click context menu - * [NOTE] Shift-Right-Click will always bring up the browser right-click context menu - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ -user_pref("dom.event.contextmenu.enabled", false); -/* 2402: disable website access to clipboard events/content [SETUP-HARDEN] - * [NOTE] This will break some sites' functionality e.g. Outlook, Twitter, Facebook, Wordpress - * This applies to onCut/onCopy/onPaste events - i.e. it requires interaction with the website - * [WARNING] If both 'middlemouse.paste' and 'general.autoScroll' are true (at least one - * is default false) then enabling this pref can leak clipboard content, see [2] - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it - * [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ - * [2] https://bugzilla.mozilla.org/1528289 */ -user_pref("dom.event.clipboardevents.enabled", false); -/* 2404: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+] - * this disables document.execCommand("cut"/"copy") to protect your clipboard - * [1] https://bugzilla.mozilla.org/1170911 ***/ -user_pref("dom.allow_cut_copy", false); -/* 2405: disable "Confirm you want to leave" dialog on page close - * Does not prevent JS leaks of the page close event. - * [1] https://developer.mozilla.org/docs/Web/Events/beforeunload - * [2] https://support.mozilla.org/questions/1043508 ***/ +/* 2401: disable "Confirm you want to leave" dialog on page close + * Does not prevent JS leaks of the page close event + * [1] https://developer.mozilla.org/docs/Web/Events/beforeunload ***/ user_pref("dom.disable_beforeunload", true); -/* 2414: disable shaking the screen ***/ -user_pref("dom.vibrator.enabled", false); -/* 2420: disable asm.js [FF22+] [SETUP-PERF] - * [1] http://asmjs.org/ - * [2] https://www.mozilla.org/security/advisories/mfsa2015-29/ - * [3] https://www.mozilla.org/security/advisories/mfsa2015-50/ - * [4] https://www.mozilla.org/security/advisories/mfsa2017-01/#CVE-2017-5375 - * [5] https://www.mozilla.org/security/advisories/mfsa2017-05/#CVE-2017-5400 - * [6] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ -user_pref("javascript.options.asmjs", false); -/* 2421: disable Ion and baseline JIT to harden against JS exploits [SETUP-HARDEN] - * [NOTE] In FF75+, when **both** Ion and JIT are disabled, **and** the new - * hidden pref is enabled, then Ion can still be used by extensions (1599226) - * [WARNING] Disabling Ion/JIT can cause some site issues and performance loss - * [NOTE] Unlike arkenfox/user.js, we explicitly disable them - * [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 ***/ -user_pref("javascript.options.ion", false); -user_pref("javascript.options.baselinejit", false); -/* 2422: disable WebAssembly [FF52+] [SETUP-PERF] - * [NOTE] In FF71+ this no longer affects extensions (1576254) - * [1] https://developer.mozilla.org/docs/WebAssembly ***/ -user_pref("javascript.options.wasm", false); -/* 2426: disable Intersection Observer API [FF55+] [RESTART] - * [NOTE] Disabling it may break the error console (CTRL+SHIFT+J) - * [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API - * [2] https://w3c.github.io/IntersectionObserver/ - * [3] https://bugzilla.mozilla.org/1243846 ***/ - // user_pref("dom.IntersectionObserver.enabled", false); -/* 2429: enable (limited but sufficient) window.opener protection [FF65+] - * Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/ -user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF78+] +/* 2402: prevent scripts from moving and resizing open windows ***/ +user_pref("dom.disable_window_move_resize", true); +/* 2403: block popup windows + * [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/ +user_pref("dom.disable_open_during_load", true); +/* 2404: limit events that can cause a popup [SETUP-WEB] ***/ +user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); -/*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/ +/*** [SECTION 2500]: FINGERPRINTING ***/ user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!"); -/* 2502: disable Battery Status API - * Initially a Linux issue (high precision readout) that was fixed. - * However, it is still another metric for fingerprinting, used to raise entropy. - * e.g. do you have a battery or not, current charging status, charge level, times remaining etc - * [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1] - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it - * [1] https://bugzilla.mozilla.org/1313580 ***/ -user_pref("dom.battery.enabled", false); -/* 2505: disable media device enumeration [FF29+] - * [NOTE] media.peerconnection.enabled should also be set to false (see 2001) - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it - * [1] https://wiki.mozilla.org/Media/getUserMedia - * [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/enumerateDevices ***/ -user_pref("media.navigator.enabled", false); -/* 2508: disable hardware acceleration to reduce graphics fingerprinting [SETUP-HARDEN] - * [WARNING] Affects text rendering (fonts will look different), impacts video performance, - * and parts of Quantum that utilize the GPU will also be affected as they are rolled out - * [SETTING] General>Performance>Custom>Use hardware acceleration when available - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it - * [1] https://wiki.mozilla.org/Platform/GFX/HardwareAcceleration ***/ -user_pref("gfx.direct2d.disabled", true); // [WINDOWS] -user_pref("layers.acceleration.disabled", true); -/* 2510: disable Web Audio API [FF51+] - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it - * [1] https://bugzilla.mozilla.org/1288359 ***/ -user_pref("dom.webaudio.enabled", false); -/* 2517: disable Media Capabilities API [FF63+] - * [WARNING] This *may* affect media performance if disabled, no one is sure - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it - * [1] https://github.com/WICG/media-capabilities - * [2] https://wicg.github.io/media-capabilities/#security-privacy-considerations ***/ -user_pref("media.media-capabilities.enabled", false); -/* 2520: disable virtual reality devices - * Optional protection depending on your connected devices - * [NOTE] Unlike arkenfox/user.js, we explicitly disable them - * [1] https://developer.mozilla.org/docs/Web/API/WebVR_API ***/ -user_pref("dom.vr.enabled", false); -/* 2521: set a default permission for Virtual Reality (see 2520) [FF73+] - * 0=always ask (default), 1=allow, 2=block - * [SETTING] to add site exceptions: Page Info>Permissions>Access Virtual Reality Devices - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Virtual Reality>Settings - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ -user_pref("permissions.default.xr", 2); +/* 2501: enforce no system colors + * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ +user_pref("browser.display.use_system_colors", false); // [DEFAULT: false] +/* 2502: enforce non-native widget theme + * Security: removes/reduces system API calls, e.g. win32k API [1] + * Fingerprinting: provides a uniform look and feel across platforms [2] + * [1] https://bugzilla.mozilla.org/1381938 + * [2] https://bugzilla.mozilla.org/1411425 ***/ +user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true FF89+] +/* 2503: open links targeting new windows in a new tab instead + * Stops malicious window sizes and some screen resolution leaks. + * You can still right-click a link and open in a new window + * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ +user_pref("browser.link.open_newwindow", 3); // 1=most recent window or tab 2=new window, 3=new tab +user_pref("browser.link.open_newwindow.restriction", 0); +/* 2504: disable WebGL (Web Graphics Library) + * [SETUP-WEB] If you need it then enable it. RFP still randomizes canvas for naive scripts ***/ +user_pref("webgl.disabled", true); /*** [SECTION 2600]: MISCELLANEOUS ***/ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); -/* 2601: prevent accessibility services from accessing your browser [RESTART] [SETUP-FEATURE] +/* 2601: prevent accessibility services from accessing your browser [RESTART] * [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser (FF80 or lower) * [1] https://support.mozilla.org/kb/accessibility-services ***/ user_pref("accessibility.force_disabled", 1); /* 2602: disable sending additional analytics to web servers * [1] https://developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/ user_pref("beacon.enabled", false); +/* 2603: remove temp files opened with an external application + * [1] https://bugzilla.mozilla.org/302433 ***/ +user_pref("browser.helperApps.deleteTempFileOnExit", true); +/* 2604: disable page thumbnail collection ***/ +user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] +/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/ +user_pref("browser.uitour.enabled", false); +user_pref("browser.uitour.url", ""); /* 2607: disable various developer tools in browser context * [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes * [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/ user_pref("devtools.chrome.enabled", false); -/* 2608: disable remote debugging +/* 2608: reset remote debugging to disabled * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/ user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] -/* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN] - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it - * [TEST] https://arkenfox.github.io/TZP/tzp.html#misc - * [1] https://bugzilla.mozilla.org/1173199 ***/ -user_pref("mathml.disabled", true); -/* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+] - * [NOTE] In FF70+ and ESR68.1.0+ this no longer affects extensions (1564208) - * [WARNING] Expect breakage incl. youtube player controls. Best left for a "hardened" profile. - * [1] https://bugzilla.mozilla.org/1216893 ***/ -user_pref("svg.disabled", true); /* 2611: disable middle mouse click opening links from clipboard * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/ user_pref("middlemouse.contentLoadURL", false); -/* 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS) - * [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins) - * To control HTML Meta tag and JS redirects, use an extension. Default is 20 ***/ -user_pref("network.http.redirection-limit", 8); -/* 2619: enforce Punycode for Internationalized Domain Names to eliminate possible spoofing - * Firefox has *some* protections, but it is better to be safe than sorry +/* 2615: disable websites overriding Thunderbird's keyboard shortcuts [FF58+] + * 0 (default) or 1=allow, 2=block ***/ +user_pref("permissions.default.shortcuts", 2); +/* 2616: remove special permissions for certain mozilla domains [FF35+] + * [1] resource://app/defaults/permissions ***/ +user_pref("permissions.manager.defaultsUrl", ""); +/* 2617: remove webchannel whitelist ***/ +user_pref("webchannel.allowObject.urlWhitelist", ""); +/* 2619: use Punycode in Internationalized Domain Names to eliminate possible spoofing * [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded * [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com) * [1] https://wiki.mozilla.org/IDN_Display_Algorithm * [2] https://en.wikipedia.org/wiki/IDN_homograph_attack - * [3] CVE-2017-5383: https://www.mozilla.org/security/advisories/mfsa2017-02/ + * [3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/ user_pref("network.IDN_show_punycode", true); -/* 2622: enforce no system colors; they can be fingerprinted - * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ -user_pref("browser.display.use_system_colors", false); // [DEFAULT: false] - -/** DOWNLOADS ***/ -/* 2650: discourage downloading to desktop - * 0=desktop, 1=downloads (default), 2=last used - * [SETTING] To set your default "downloads": General>Downloads>Save files to ***/ - // user_pref("browser.download.folderList", 2); -/* 2651: enforce user interaction for security by always asking where to download - * [SETUP-CHROME] On Android this blocks longtapping and saving images - * [SETTING] General>Downloads>Always ask you where to save files ***/ -user_pref("browser.download.useDownloadDir", false); -/* 2652: disable adding downloads to the system's "recent documents" list ***/ -user_pref("browser.download.manager.addToRecentDocs", false); -/* 2653: disable hiding mime types (Options>General>Applications) not associated with a plugin ***/ -user_pref("browser.download.hide_plugins_without_extensions", false); -/* 2654: disable "open with" in download dialog [FF50+] [SETUP-HARDEN] - * This is very useful to enable when the browser is sandboxed (e.g. via AppArmor) - * in such a way that it is forbidden to run external applications. - * [WARNING] This may interfere with some users' workflow or methods - * [1] https://bugzilla.mozilla.org/1281959 ***/ - // user_pref("browser.download.forbid_open_with", true); - -/** EXTENSIONS ***/ -/* 2660: lock down allowed extension directories - * [SETUP-CHROME] This will break extensions, language packs, themes and any other - * XPI files which are installed outside of profile and application directories - * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ - * [1] archived: https://archive.is/DYjAM ***/ -user_pref("extensions.enabledScopes", 1); // [HIDDEN PREF] -user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] -/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ - // user_pref("extensions.webextensions.restrictedDomains", ""); - -/** SECURITY ***/ -/* 2680: enforce CSP (Content Security Policy) - * [WARNING] CSP is a very important and widespread security feature. Don't disable it! - * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/ -user_pref("security.csp.enable", true); // [DEFAULT: true] -/* 2684: enforce a security delay on some confirmation dialogs such as install, open/save - * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ -user_pref("security.dialog_enable_delay", 700); +/* 2620: enforce PDFJS, disable PDFJS scripting [SETUP-CHROME] + * This setting controls if the option "Display in Thunderbird" is available in the setting below + * and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With") + * PROS: pdfjs is lightweight, open source, and more secure/vetted than most + * Exploits are rare (one serious case in seven years), treated seriously and patched quickly. + * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). + * It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. + * CONS: You may prefer a different pdf reader for security reasons + * CAVEAT: JS can still force a pdf to open in-browser by bundling its own code + * [SETTING] General>Applications>Portable Document Format (PDF) ***/ +user_pref("pdfjs.disabled", false); // [DEFAULT: false] +user_pref("pdfjs.enableScripting", false); // [FF86+] +/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/ +user_pref("network.protocol-handler.external.ms-windows-store", false); +/* 2623: disable permissions delegation [FF73+] + * Currently applies to cross-origin geolocation, camera, mic and screen-sharing + * permissions, and fullscreen requests. Disabling delegation means any prompts + * for these will show/use their correct 3rd party origin + * [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion ***/ +user_pref("permissions.delegation.enabled", false); /*** [SECTION 2700]: PERSISTENT STORAGE - Data SET by websites including - cookies : profile\cookies.sqlite - localStorage : profile\webappsstore.sqlite - indexedDB : profile\storage\default - appCache : profile\OfflineCache - serviceWorkers : + Data SET by websites including + cookies : profile\cookies.sqlite + localStorage : profile\webappsstore.sqlite + indexedDB : profile\storage\default + serviceWorkers : - [NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode - [NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage), - indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications) - If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become - accessible to websites except shared/service workers where the cookie setting *must* be "Allow" + [NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode + [NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage), + indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications) + If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become + accessible to websites except shared/service workers where the cookie setting must be "Allow" ***/ user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); -/* 2701: disable cookies and site-data [SETUP-WEB] - * 0=Accept cookies and site data, 1=(Block) All third-party cookies, 2=(Block) All cookies, - * 3=(Block) Cookies from unvisited websites, 4=(Block) Cross-site and social media trackers (FF63+) (default FF69+) - * [NOTE] You can set exceptions under site permissions or use an extension - * [NOTE] Unlike arkenfox/user.js, we block **ALL** cookies on purpose - * [SETTING] Privacy & Security>Privacy>Web Content>Accept cookies from sites ***/ +/* 2701: disable or isolate 3rd-party cookies and site-data [SETUP-WEB] + * 0 = Accept cookies and site data + * 1 = (Block) All third-party cookies + * 2 = (Block) All cookies + * 3 = (Block) Cookies from unvisited websites + * 4 = (Block) Cross-site tracking cookies (default) + * 5 = (Isolate All) Cross-site cookies (TCP: Total Cookie Protection / dFPI: dynamic FPI) [1] (FF86+) + * Option 5 with FPI enabled (4001) is ignored and not shown, and option 4 used instead + * [NOTE] You can set cookie exceptions under site permissions or use an extension + * [NOTE] Enforcing category to custom ensures ETP related prefs are always honored + * [SETTING] Privacy & Security>Enhanced Tracking Protection>Custom>Cookies + * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ ***/ user_pref("network.cookie.cookieBehavior", 2); -/* 2702: set third-party cookies (i.e ALL) (if enabled, see 2701) to session-only - and (FF58+) set third-party non-secure (i.e HTTP) cookies to session-only - [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and - .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones +user_pref("browser.contentblocking.category", "custom"); +/* 2702: set third-party cookies (if enabled, see 2701) to session-only + * [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and + * .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/ user_pref("network.cookie.thirdparty.sessionOnly", true); user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+] /* 2703: delete cookies and site data on close * 0=keep until they expire (default), 2=keep until you close Thunderbird * [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2) - * [NOTE] Unlike arkenfox/user.js, we keep them until Thunderbird exit on purpose - * [SETTING] Privacy & Security>Privacy>Web Content>Keep until: "I close Thunderbird" ***/ + * [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Thunderbird is closed ***/ user_pref("network.cookie.lifetimePolicy", 2); -/* 2710: disable DOM (Document Object Model) Storage - * [WARNING] This will break a LOT of sites' functionality AND extensions! - * You are better off using an extension for more granular control ***/ -user_pref("dom.storage.enabled", false); -/* 2730: disable offline cache ***/ -user_pref("browser.cache.offline.enable", false); +/* 2710: enable Enhanced Tracking Protection (ETP) in all windows + * [SETTING] Privacy & Security>Enhanced Tracking Protection>Custom>Tracking content + * [SETTING] to add site exceptions: Urlbar>ETP Shield + * [SETTING] to manage site exceptions: Options>Privacy & Security>Enhanced Tracking Protection>Manage Exceptions ***/ +user_pref("privacy.trackingprotection.enabled", true); +/* 2711: enable various ETP lists ***/ +user_pref("privacy.trackingprotection.socialtracking.enabled", true); +user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] +user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] /* 2740: disable service worker cache and cache storage - * [NOTE] We clear service worker cache on exiting Firefox (see 2803) - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it + * [NOTE] We clear service worker cache on exit (2803) * [1] https://w3c.github.io/ServiceWorker/#privacy ***/ user_pref("dom.caches.enabled", false); /* 2750: disable Storage API [FF51+] @@ -1010,24 +852,28 @@ user_pref("dom.caches.enabled", false); * [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/ user_pref("dom.storageManager.enabled", false); /* 2755: disable Storage Access API [FF65+] - * [1] https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API ***/ - // user_pref("dom.storage_access.enabled", false); // [DEFAULT: false] + * [1] https://developer.mozilla.org/docs/Web/API/Storage_Access_API ***/ +user_pref("dom.storage_access.enabled", false); +/* 2760: enable Local Storage Next Generation (LSNG) [FF65+] ***/ +user_pref("dom.storage.next_gen", true); // [DEFAULT: true FF92+] /*** [SECTION 2800]: SHUTDOWN - You should set the values to what suits you best. - - "Offline Website Data" includes appCache (2730), localStorage (2710), - service worker cache (2740), and QuotaManager (IndexedDB (2720), asm-cache) - - In both 2803 + 2804, the 'download' and 'history' prefs are combined in the - Firefox interface as "Browsing & Download History" and their values will be synced + * Sanitizing on shutdown is all or nothing. It does not use Managed Exceptions under + Privacy & Security>Delete cookies and site data when Thunderbird is closed (1681701) + * If you want to keep some sites' cookies (exception as "Allow") and optionally other site + data but clear all the rest on close, then you need to set the "cookie" and optionally the + "offlineApps" prefs below to false, and to set the cookie lifetime pref to 2 (2703) ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); -/* 2802: enable Thunderbird to clear items on shutdown (see 2803) +/* 2802: enable Thunderbird to clear items on shutdown (2803) + * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Thunderbird closes ***/ user_pref("privacy.sanitize.sanitizeOnShutdown", true); /* 2803: set what items to clear on shutdown (if 2802 is true) [SETUP-CHROME] - * [NOTE] If 'history' is true, downloads will also be cleared regardless of the value - * but if 'history' is false, downloads can still be cleared independently - * However, this may not always be the case. The interface combines and syncs these - * prefs when set from there, and the sanitize code may change at any time ***/ + * [NOTE] If "history" is true, downloads will also be cleared + * [NOTE] Active Logins: does not refer to logins via cookies, but rather HTTP Basic Authentication [1] + * [NOTE] Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache) + * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Thunderbird closes>Settings + * [1] https://en.wikipedia.org/wiki/Basic_access_authentication ***/ user_pref("privacy.clearOnShutdown.cache", true); user_pref("privacy.clearOnShutdown.cookies", true); user_pref("privacy.clearOnShutdown.downloads", true); // see note above @@ -1038,18 +884,29 @@ user_pref("privacy.clearOnShutdown.sessions", true); // Active Logins user_pref("privacy.clearOnShutdown.siteSettings", false); // Site Preferences /* 2804: reset default items to clear with Ctrl-Shift-Del (to match 2803) [SETUP-CHROME] * This dialog can also be accessed from the menu History>Clear Recent History - * Firefox remembers your last choices. This will reset them when you start Firefox. - * [NOTE] Regardless of what you set privacy.cpd.downloads to, as soon as the dialog - * for "Clear Recent History" is opened, it is synced to the same as 'history' ***/ + * Thunderbird remembers your last choices. This will reset them when you start Thunderbird + * [NOTE] Regardless of what you set "downloads" to, as soon as the dialog + * for "Clear Recent History" is opened, it is synced to the same as "history" ***/ user_pref("privacy.cpd.cache", true); user_pref("privacy.cpd.cookies", true); + // user_pref("privacy.cpd.downloads", true); // not used, see note above +user_pref("privacy.cpd.formdata", true); // Form & Search History user_pref("privacy.cpd.history", true); // Browsing & Download History -/* 2806: reset default 'Time range to clear' for 'Clear Recent History' (see 2804) - * Firefox remembers your last choice. This will reset the value when you start Firefox. - * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, - * 4=today, 5=last five minutes, 6=last twenty-four hours - * [NOTE] The values 5 + 6 are not listed in the dropdown, which will display a - * blank value if they are used, but they do work as advertised ***/ +user_pref("privacy.cpd.offlineApps", true); // Offline Website Data +user_pref("privacy.cpd.passwords", false); // this is not listed +user_pref("privacy.cpd.sessions", true); // Active Logins +user_pref("privacy.cpd.siteSettings", false); // Site Preferences +/* 2805: clear Session Restore data when sanitizing on shutdown or manually [FF34+] + * [NOTE] Not needed if Session Restore is not used (0102) or is already cleared with history (2803) + * [NOTE] privacy.clearOnShutdown.openWindows prevents resuming from crashes (also see 5008) + * [NOTE] privacy.cpd.openWindows has a bug that causes an additional window to open ***/ + // user_pref("privacy.clearOnShutdown.openWindows", true); + // user_pref("privacy.cpd.openWindows", true); +/* 2806: reset default "Time range to clear" for "Clear Recent History" (2804) + * Thunderbird remembers your last choice. This will reset the value when you start Thunderbird + * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today + * [NOTE] Values 5 (last 5 minutes) and 6 (last 24 hours) are not listed in the dropdown, + * which will display a blank value, and are not guaranteed to work ***/ user_pref("privacy.sanitize.timeSpan", 0); /*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION) From e639a79445e0898a1e9fbdc378d995d53f00473e Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 19 Sep 2021 20:03:16 +0200 Subject: [PATCH 053/147] [WIP] Continues Arkenfox v78..v91 migration > **WORK IN PROGRESS : DO NOT USE IT AS IS** Migration status : * updated sections 4000 --> 8000 * some preferences from section 7000 **SHOULD** be enforced (not done yet) --- user.js | 551 +++++++++++++++++++++++++++++++++----------------------- 1 file changed, 330 insertions(+), 221 deletions(-) diff --git a/user.js b/user.js index cc69cb7..aca4142 100644 --- a/user.js +++ b/user.js @@ -910,263 +910,372 @@ user_pref("privacy.cpd.siteSettings", false); // Site Preferences user_pref("privacy.sanitize.timeSpan", 0); /*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION) - ** 1278037 - isolate indexedDB (FF51+) - ** 1277803 - isolate favicons (FF52+) - ** 1264562 - isolate OCSP cache (FF52+) - ** 1268726 - isolate Shared Workers (FF52+) - ** 1316283 - isolate SSL session cache (FF52+) - ** 1317927 - isolate media cache (FF53+) - ** 1323644 - isolate HSTS and HPKP (FF54+) - ** 1334690 - isolate HTTP Alternative Services (FF54+) - ** 1334693 - isolate SPDY/HTTP2 (FF55+) - ** 1337893 - isolate DNS cache (FF55+) - ** 1344170 - isolate blob: URI (FF55+) - ** 1300671 - isolate data:, about: URLs (FF55+) - ** 1473247 - isolate IP addresses (FF63+) - ** 1492607 - isolate postMessage with targetOrigin "*" (requires 4002) (FF65+) - ** 1542309 - isolate top-level domain URLs when host is in the public suffix list (FF68+) - ** 1506693 - isolate pdfjs range-based requests (FF68+) - ** 1330467 - isolate site permissions (FF69+) - ** 1534339 - isolate IPv6 (FF73+) + 1278037 - indexedDB (FF51+) + 1277803 - favicons (FF52+) + 1264562 - OCSP cache (FF52+) + 1268726 - Shared Workers (FF52+) + 1316283 - SSL session cache (FF52+) + 1317927 - media cache (FF53+) + 1323644 - HSTS and HPKP (FF54+) + 1334690 - HTTP Alternative Services (FF54+) + 1334693 - SPDY/HTTP2 (FF55+) + 1337893 - DNS cache (FF55+) + 1344170 - blob: URI (FF55+) + 1300671 - data:, about: URLs (FF55+) + 1473247 - IP addresses (FF63+) + 1542309 - top-level domain URLs when host is in the public suffix list (FF68+) + 1506693 - pdfjs range-based requests (FF68+) + 1330467 - site permissions (FF69+) + 1534339 - IPv6 (FF73+) + 1721858 - WebSocket (FF92+) ***/ user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out"); /* 4001: enable First Party Isolation [FF51+] - * [SETUP-WEB] May break cross-domain logins and site functionality until perfected - * [1] https://bugzilla.mozilla.org/1260931 ***/ + * [SETUP-WEB] Breaks some cross-origin logins + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1260931,1299996 ***/ user_pref("privacy.firstparty.isolate", true); /* 4002: enforce FPI restriction for window.opener [FF54+] * [NOTE] Setting this to false may reduce the breakage in 4001 - * [NOTE] Unlike arkenfox/user.js, we explicitly set them * FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But - * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3]) - * The 2nd pref removes that limitation and will only allow communication if FPDs also match. + * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute [2][3] + * The 2nd pref removes that limitation and will only allow communication if FPDs also match * [1] https://bugzilla.mozilla.org/1319773#c22 * [2] https://bugzilla.mozilla.org/1492607 - * [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/ + * [3] https://developer.mozilla.org/docs/Web/API/Window/postMessage ***/ user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] -user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF ESR] +user_pref("privacy.firstparty.isolate.block_post_message", true); +/* 4003: enable scheme with FPI [FF78+] + * [NOTE] Experimental: existing data and site permissions are incompatible + * and some site exceptions may not work e.g. HTTPS-only mode (1244) ***/ +user_pref("privacy.firstparty.isolate.use_site", true); /*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) - This master switch will be used for a wide range of items, many of which will - **override** existing prefs from FF55+, often providing a **better** solution + RFP covers a wide range of ongoing fingerprinting solutions. + It is an all-or-nothing buy in: you cannot pick and choose what parts you want - IMPORTANT: As existing prefs become redundant, and some of them WILL interfere - with how RFP works, they will be moved to section 4600 and made inactive + [WARNING] DO NOT USE extensions to alter RFP protected metrics - ** 418986 - limit window.screen & CSS media queries leaking identifiable info (FF41+) - [NOTE] Info only: To set a size, open a XUL (chrome) page (such as about:config) which is at - 100% zoom, hit Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run. - Test your window size, do some math, resize to allow for all the non inner window elements + 418986 - limit window.screen & CSS media queries (FF41) [TEST] https://arkenfox.github.io/TZP/tzp.html#screen - ** 1281949 - spoof screen orientation (FF50+) - ** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+) - FF53: Fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044) - ** 1330890 - spoof timezone as UTC 0 (FF55+) - FF58: Date.toLocaleFormat deprecated (818634) - FF60: Date.toLocaleDateString and Intl.DateTimeFormat fixed (1409973) - ** 1360039 - spoof navigator.hardwareConcurrency as 2 (see 4601) (FF55+) - This spoof *shouldn't* affect core chrome/Firefox performance - ** 1217238 - reduce precision of time exposed by javascript (FF55+) - ** 1369303 - spoof/disable performance API (see 2410-deprecated, 4602, 4603) (FF56+) - ** 1333651 & 1383495 & 1396468 - spoof User Agent & Navigator API (see section 4700) (FF56+) - FF56: Version: rounded down to the nearest multiple of 10 - FF57: Version: match current ESR (1393283, 1418672, 1418162, 1511763) - FF59: OS: Windows, OSX, Android, or Linux (to reduce breakage) (1404608) - FF66: OS: HTTP Headers reduced to Windows or Android (1509829) - FF68: OS: updated to Windows 10, OS 10.14, and Android 8.1 (1511434) - FF78: OS: updated to OS 10.15 and Android 9.0 (1635011) - ** 1369319 - disable device sensor API (see 4604) (FF56+) - ** 1369357 - disable site specific zoom (see 4605) (FF56+) - ** 1337161 - hide gamepads from content (see 4606) (FF56+) - ** 1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true (see 4607) (FF56+) - ** 1333641 - reduce fingerprinting in WebSpeech API (see 4608) (FF56+) - ** 1372069 & 1403813 & 1441295 - block geolocation requests (same as denying a site permission) (see 0201 ** 1372069 & 1403813 & 1441295 - block geolocation requests (same as denying a site permission) (see 0201, 0202) (FF56-62) - ** 1369309 - spoof media statistics (see 4610) (FF57+) - ** 1382499 - reduce screen co-ordinate fingerprinting in Touch API (see 4611) (FF57+) - ** 1217290 & 1409677 - enable fingerprinting resistance for WebGL (see 2010-12) (FF57+) - ** 1382545 - reduce fingerprinting in Animation API (FF57+) - ** 1354633 - limit MediaError.message to a whitelist (FF57+) - ** 1382533 - enable fingerprinting resistance for Presentation API (FF57+) - This blocks exposure of local IP Addresses via mDNS (Multicast DNS) - ** 967895 - spoof canvas and enable site permission prompt before allowing canvas data extraction (FF58+) - FF59: Added to site permissions panel (1413780) Only prompt when triggered by user input (1376865) - ** 1372073 - spoof/block fingerprinting in MediaDevices API (FF59+) - Spoof: enumerate devices reports one "Internal Camera" and one "Internal Microphone" if - media.navigator.enabled is true (see 2505 which we chose to keep disabled) - Block: suppresses the ondevicechange event (see 4612) - ** 1039069 - warn when language prefs are set to non en-US (see 0210, 0211) (FF59+) - ** 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59+) + 1281949 - spoof screen orientation (FF50) + 1281963 - hide contents of navigator.plugins and navigator.mimeTypes (FF50-88) + 1330890 - spoof timezone as UTC0 (FF55) + 1360039 - spoof navigator.hardwareConcurrency as 2 (FF55) + 1217238 - reduce precision of time exposed by javascript (FF55) + FF56 + 1369303 - spoof/disable performance API + 1333651 - spoof User Agent & Navigator API + JS: FF91+ the version is spoofed as ESR, and the OS as Windows 10, OS 10.15, Android 10, or Linux + HTTP Headers: spoofed as Windows or Android + 1369319 - disable device sensor API + 1369357 - disable site specific zoom + 1337161 - hide gamepads from content + 1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true + 1333641 - reduce fingerprinting in WebSpeech API + FF57 + 1369309 - spoof media statistics + 1382499 - reduce screen co-ordinate fingerprinting in Touch API + 1217290 & 1409677 - enable some fingerprinting resistance for WebGL + 1382545 - reduce fingerprinting in Animation API + 1354633 - limit MediaError.message to a whitelist + 1382533 & 1697680 - enable fingerprinting resistance for Presentation API (FF57-87) + Blocks exposure of local IP Addresses via mDNS (Multicast DNS) + FF58-90 + 967895 - spoof canvas and enable site permission prompt (FF58) + 1372073 - spoof/block fingerprinting in MediaDevices API (FF59) + Spoof: enumerate devices as one "Internal Camera" and one "Internal Microphone" + Block: suppresses the ondevicechange event + 1039069 - warn when language prefs are not set to "en*" (also see 0210, 0211) (FF59) + 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59) Spoofing mimics the content language of the document. Currently it only supports en-US. Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected. - FF60: Fix keydown/keyup events (1438795) - ** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+) - ** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+) - ** 1479239 - return "no-preference" with prefers-reduced-motion (see 4617) (FF63+) - ** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+) - FF65: pointerEvent.pointerid (1492766) - ** 1485266 - disable exposure of system colors to CSS or canvas (see 4615) (FF67+) - ** 1407366 - enable inner window letterboxing (see 4504) (FF67+) - ** 1494034 - return "light" with prefers-color-scheme (see 4616) (FF67+) - [1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme - ** 1564422 - spoof audioContext outputLatency (FF70+) - ** 1595823 - spoof audioContext sampleRate (FF72+) - ** 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74+) - ** 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78+) + 1337157 - disable WebGL debug renderer info (FF60) + 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62) + 1479239 - return "no-preference" with prefers-reduced-motion (FF63) + 1363508 - spoof/suppress Pointer Events (FF64) + 1492766 - spoof pointerEvent.pointerid (FF65) + 1485266 - disable exposure of system colors to CSS or canvas (FF67) + 1494034 - return "light" with prefers-color-scheme (FF67) + 1564422 - spoof audioContext outputLatency (FF70) + 1595823 - return audioContext sampleRate as 44100 (FF72) + 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74) + 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78) + 1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80) + 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82) + FF91+ + 531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); /* 4501: enable privacy.resistFingerprinting [FF41+] - * This pref is the master switch for all other privacy.resist* prefs unless stated - * [SETUP-WEB] RFP can cause the odd website to break in strange ways, and has a few side affects, - * but is largely robust nowadays. Give it a try. Your choice. Also see 4504 (letterboxing). - * [NOTE] This feature currently breaks Text & Background colors settings ("Fonts & Colors"), see [2]. - * [1] https://bugzilla.mozilla.org/418986 - * [2] https://bugzilla.mozilla.org/1600074 ***/ + * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a site exception via the urlbar + * RFP also has a few side effects: mainly timezone is UTC0, and websites will prefer light theme + * [1] https://bugzilla.mozilla.org/418986 ***/ user_pref("privacy.resistFingerprinting", true); /* 4502: set new window sizes to round to hundreds [FF55+] [SETUP-CHROME] * Width will round down to multiples of 200s and height to 100s, to fit your screen. - * The override values are a starting point to round from if you want some control - * [1] https://bugzilla.mozilla.org/1330882 - * [2] https://hardware.metrics.mozilla.com/ ***/ + * The max values are a starting point to round from if you want some control + * [1] https://bugzilla.mozilla.org/1330882 ***/ // user_pref("privacy.window.maxInnerWidth", 1000); // user_pref("privacy.window.maxInnerHeight", 1000); /* 4503: disable mozAddonManager Web API [FF57+] - * [NOTE] As a side-effect in FF57-59 this allowed extensions to work on AMO. In FF60+ you also need - * to sanitize or clear extensions.webextensions.restrictedDomains (see 2662) to keep that side-effect + * [NOTE] To allow extensions to work on AMO, you also need 2662 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF] -/* 4520: disable chrome animations [FF77+] [RESTART] - * [NOTE] pref added in FF63, but applied to chrome in FF77. RFP spoofs this for web content ***/ -user_pref("ui.prefersReducedMotion", 1); // [HIDDEN PREF] +/* 4504: enable RFP letterboxing [FF67+] + * Dynamically resizes the inner window by applying margins in stepped ranges [2] + * If you use the dimension pref, then it will only apply those resolutions. + * The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000") + * [SETUP-WEB] This is independent of RFP (4501). If you're not using RFP, or you are but + * dislike the margins, then flip this pref, keeping in mind that it is effectively fingerprintable + * [WARNING] DO NOT USE: the dimension pref is only meant for testing + * [1] https://bugzilla.mozilla.org/1407366 + * [2] https://hg.mozilla.org/mozilla-central/rev/6d2d7856e468#l2.32 ***/ +user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] + // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF] -/*** [SECTION 4600]: RFP ALTERNATIVES - * non-RFP users: - Enable the whole section (see the SETUP tag below) - * RFP users: - Make sure these are reset in about:config. They are redundant. In fact, some - even cause RFP to not behave as you would expect and alter your fingerprint - * ESR RFP users: - Reset those *up to and including* your version. Add those *after* your version - as active prefs in your overrides. This is assuming that the patch wasn't also - backported to Firefox ESR. Backporting RFP patches to ESR is rare. +/*** [SECTION 5000]: OPTIONAL OPSEC + Disk avoidance, application data isolation, eyeballs... ***/ -user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan"); -/* [SETUP-non-RFP] Non-RFP users replace the * with a slash on this line to enable these -// FF55+ -// 4601: [2514] spoof (or limit?) number of CPU cores [FF48+] - // [NOTE] *may* affect core chrome/Firefox performance, will affect content. - // [1] https://bugzilla.mozilla.org/1008453 - // [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21675 - // [3] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22127 - // [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency - // user_pref("dom.maxHardwareConcurrency", 2); -// * * * / -// FF56+ -// 4602: [2411] disable resource/navigation timing -user_pref("dom.enable_resource_timing", false); -// 4603: [2412] disable timing attacks - // [1] https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI -user_pref("dom.enable_performance", false); -// 4604: [2512] disable device sensor API - // Optional protection depending on your device - // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15758 - // [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/ - // [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751 +user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow"); +/* 5001: start Thunderbird in PB (Private Browsing) mode + * [NOTE] In this mode all windows are "private windows" and the PB mode icon is not displayed + * [NOTE] The P in PB mode can be misleading: it means no "persistent" disk state such as history, + * caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode). + * In fact, PB mode limits or removes the ability to control some of these, and you need to quit + * Thunderbird to clear them. PB is best used as a one off window (Menu>New Private Window) to provide + * a temporary self-contained new session. Close all Private Windows to clear the PB mode session. + * [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode + * [1] https://wiki.mozilla.org/Private_Browsing + * [2] https://support.mozilla.org/kb/common-myths-about-private-browsing ***/ + // user_pref("browser.privatebrowsing.autostart", true); +/* 5002: disable memory cache + * capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/ +user_pref("browser.cache.memory.enable", false); +user_pref("browser.cache.memory.capacity", 0); +/* 5003: disable saving passwords + * [NOTE] This does not clear any passwords already saved + * [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/ +user_pref("signon.rememberSignons", false); +/* 5004: disable permissions manager from writing to disk [FF41+] [RESTART] + * [NOTE] This means any permission changes are session only + * [1] https://bugzilla.mozilla.org/967812 ***/ +user_pref("permissions.memory_only", true); // [HIDDEN PREF] +/* 5005: disable intermediate certificate caching [FF41+] [RESTART] + * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. + * Saved logins and passwords are not available. Reset the pref and restart to return them ***/ + // user_pref("security.nocertdb", true); // [HIDDEN PREF] +/* 5006: disable favicons in history and bookmarks + * [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your + * actual history (and bookmarks) already do. Your history is more detailed, so + * control that instead; e.g. disable history, clear history on close, use PB mode + * [NOTE] favicons.sqlite is sanitized on Thunderbird close ***/ +user_pref("browser.chrome.site_icons", false); +/* 5007: exclude "Undo Closed Tabs" in Session Restore ***/ +user_pref("browser.sessionstore.max_tabs_undo", 0); +/* 5008: disable resuming session from crash ***/ +user_pref("browser.sessionstore.resume_from_crash", false); +/* 5009: disable "open with" in download dialog [FF50+] + * Application data isolation [1] + * [1] https://bugzilla.mozilla.org/1281959 ***/ + // user_pref("browser.download.forbid_open_with", true); +/* 5013: disable browsing and download history + * [NOTE] We also clear history and downloads on exit (2803) + * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/ +user_pref("places.history.enabled", false); +/* 5016: discourage downloading to desktop + * 0=desktop, 1=downloads (default), 2=last used + * [SETTING] To set your default "downloads": General>Downloads>Save files to ***/ + // user_pref("browser.download.folderList", 2); + +/*** [SECTION 5500]: OPTIONAL HARDENING + Whereas not recommended by upstream arkenfox, we disable each one of those Web features + as we focus on keeping Thunderbird an email client and not a browser +***/ +user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!"); +/* 5501: disable MathML (Mathematical Markup Language) [FF51+] + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mathml ***/ +user_pref("mathml.disabled", true); // 1173199 +/* 5502: disable in-content SVG (Scalable Vector Graphics) [FF53+] + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+svg ***/ +user_pref("svg.disabled", true); // 1216893 +/* 5503: disable graphite + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+graphite + * [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/ +user_pref("gfx.font_rendering.graphite.enabled", false); +/* 5504: disable asm.js [FF22+] + * [1] http://asmjs.org/ + * [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js + * [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ +user_pref("javascript.options.asmjs", false); +/* 5505: disable Ion and baseline JIT to harden against JS exploits + * [NOTE] In FF75+, when **both** Ion and JIT are disabled, **and** the new + * hidden pref is enabled, then Ion can still be used by extensions (1599226) + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit ***/ +user_pref("javascript.options.ion", false); +user_pref("javascript.options.baselinejit", false); +user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF] +/* 5506: disable WebAssembly [FF52+] + * Vulnerabilities [1] have increasingly been found, including those known and fixed + * in native programs years ago [2]. WASM has powerful low-level access, making + * certain attacks (brute-force) and vulnerabilities more possible + * [STATS] ~0.2% of websites, about half of which are for crytopmining / malvertising [2][3] + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm + * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly + * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ +user_pref("javascript.options.wasm", false); + +/*** [SECTION 6000]: DON'T TOUCH ***/ +user_pref("_user.js.parrot", "6000 syntax error: the parrot's 'istory!"); +/* 6001: enforce Mozilla's blocklist + * [WHY] It includes updates for "revoked certificates" + * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/ +user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] +/* 6002: enforce no referer spoofing + * [WHY] Spoofing can affect CSRF (Cross-Site Request Forgery) protections ***/ +user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] +/* 6003: enforce CSP (Content Security Policy) + * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/ +user_pref("security.csp.enable", true); // [DEFAULT: true] +/* 6004: enforce a security delay on some confirmation dialogs such as install, open/save + * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ +user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] +/* 6005: enforce window.opener protection [FF65+] + * Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/ +user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+] +/* 6006: enforce "window.name" protection [FF82+] + * If a new page from another domain is loaded into a tab, then window.name is set to an empty string. The original + * string is restored if the tab reverts back to the original page. This change prevents some cross-site attacks + * [TEST] https://arkenfox.github.io/TZP/tests/windownamea.html ***/ +user_pref("privacy.window.name.update.enabled", true); // [DEFAULT: true FF86+] +/* 6050: prefsCleaner: reset previously active items removed from arkenfox in 79-91 ***/ + // user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", ""); + // user_pref("browser.send_pings.require_same_host", ""); + // user_pref("dom.allow_cut_copy", ""); + // user_pref("dom.vibrator.enabled", ""); + // user_pref("media.getusermedia.audiocapture.enabled", ""); + // user_pref("media.getusermedia.browser.enabled", ""); + // user_pref("media.getusermedia.screensharing.enabled", ""); + // user_pref("media.gmp-widevinecdm.visible", ""); + // user_pref("network.http.redirection-limit", ""); + // user_pref("privacy.partition.network_state", ""); + // user_pref("security.insecure_connection_icon.enabled", ""); // [DEFAULT: true FF70+] + // user_pref("security.mixed_content.block_active_content", ""); // [DEFAULT: true since at least FF60] + // user_pref("security.ssl.enable_ocsp_stapling", ""); // [DEFAULT: true FF26+] + // user_pref("webgl.disable-fail-if-major-performance-caveat", ""); // [DEFAULT: true FF86+] + // user_pref("webgl.enable-webgl2", ""); + // user_pref("webgl.min_capability_mode", ""); + +/*** [SECTION 7000]: DON'T BOTHER ***/ +user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); +/* 7001: disable APIs + * Location-Aware Browsing, Full Screen, offline cache (appCache), Virtual Reality + * [WHY] The API state is easily fingerprintable. Geo and VR are behind prompts (7002). + * appCache storage capability was removed in FF90. Full screen requires user interaction ***/ + // user_pref("geo.enabled", false); + // user_pref("full-screen-api.enabled", false); + // user_pref("browser.cache.offline.enable", false); + // user_pref("dom.vr.enabled", false); +/* 7002: set default permissions + * Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+] + * 0=always ask (default), 1=allow, 2=block + * [WHY] These are fingerprintable via Permissions API, except VR. Just add site + * exceptions as allow/block for frequently visited/annoying sites: i.e. not global + * [SETTING] to add site exceptions: Ctrl+I>Permissions> + * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ + // user_pref("permissions.default.geo", 0); + // user_pref("permissions.default.camera", 0); + // user_pref("permissions.default.microphone", 0); + // user_pref("permissions.default.desktop-notification", 0); + // user_pref("permissions.default.xr", 0); // Virtual Reality +/* 7003: disable non-modern cipher suites [1] + * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks + * [1] https://browserleaks.com/ssl ***/ + // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); + // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS + // user_pref("security.ssl3.rsa_aes_256_gcm_sha384", false); // no PFS + // user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS + // user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS + // user_pref("security.ssl3.rsa_des_ede3_sha", false); // 3DES +/* 7004: control TLS versions + * [WHY] Passive fingerprinting. Downgrades are still possible: behind user interaction ***/ + // user_pref("security.tls.version.min", 3); // [DEFAULT: 3] + // user_pref("security.tls.version.max", 4); +/* 7005: disable SSL session IDs [FF36+] + * [WHY] Passive fingerprinting and perf costs. These are session-only and isolated + * with network partitioning (FF85+) or when using FPI and/or containers ***/ + // user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF] +/* 7006: onions + * [WHY] Firefox doesn't support hidden services. Use Tor Browser ***/ + // user_pref("dom.securecontext.whitelist_onions", true); // 1382359 + // user_pref("network.http.referer.hideOnionSource", true); // 1305144 +/* 7007: referers + * [WHY] Only cross-origin referers (1600s) need control ***/ + // user_pref("network.http.sendRefererHeader", 2); + // user_pref("network.http.referer.trimmingPolicy", 0); +/* 7008: set the default Referrer Policy [FF59+] + * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade + * [WHY] Defaults are fine. They can be overridden by a site-controlled Referrer Policy ***/ + // user_pref("network.http.referer.defaultPolicy", 2); // [DEFAULT: 2 FF87+] + // user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2] +/* 7009: disable HTTP2 + * [WHY] Passive fingerprinting. ~50% of sites use HTTP2 [1] + * [1] https://w3techs.com/technologies/details/ce-http2/all/all ***/ + // user_pref("network.http.spdy.enabled", false); + // user_pref("network.http.spdy.enabled.deps", false); + // user_pref("network.http.spdy.enabled.http2", false); + // user_pref("network.http.spdy.websockets", false); // [FF65+] +/* 7010: disable HTTP Alternative Services [FF37+] + * [WHY] Already isolated by network partitioning (FF85+) or FPI ***/ + // user_pref("network.http.altsvc.enabled", false); + // user_pref("network.http.altsvc.oe", false); +/* 7011: disable website control over browser right-click context menu + * [WHY] Just use Shift-Right-Click ***/ + // user_pref("dom.event.contextmenu.enabled", false); +/* 7012: disable icon fonts (glyphs) and local fallback rendering + * [WHY] Breakage, font fallback is equivalency, also RFP + * [1] https://bugzilla.mozilla.org/789788 + * [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/ + // user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+] + // user_pref("gfx.downloadable_fonts.fallback_delay", -1); +/* 7013: disable Clipboard API + * [WHY] Fingerprintable. Breakage. Cut/copy/paste require user + * interaction, and paste is limited to focused editable fields ***/ + // user_pref("dom.event.clipboardevents.enabled", false); + +/*** [SECTION 8000]: DON'T BOTHER: NON-RFP + [WHY] They are insufficient to help anti-fingerprinting and do more harm than good + [WARNING] DO NOT USE with RFP. RFP already covers these and they can interfere +***/ +user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan"); +/* 8001: disable APIs ***/ // user_pref("device.sensors.enabled", false); -// 4606: [2501] disable gamepad API - USB device ID enumeration - // Optional protection depending on your connected devices - // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/13023 + // user_pref("dom.enable_performance", false); + // user_pref("dom.enable_resource_timing", false); // user_pref("dom.gamepad.enabled", false); -// 4607: [2503] disable giving away network info [FF31+] - // e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none - // [1] https://developer.mozilla.org/docs/Web/API/Network_Information_API - // [2] https://wicg.github.io/netinfo/ - // [3] https://bugzilla.mozilla.org/960426 -user_pref("dom.netinfo.enabled", false); // [DEFAULT: true on Android] -// 4608: [2021] disable the SpeechSynthesis (Text-to-Speech) part of the Web Speech API - // [1] https://developer.mozilla.org/docs/Web/API/Web_Speech_API - // [2] https://developer.mozilla.org/docs/Web/API/SpeechSynthesis - // [3] https://wiki.mozilla.org/HTML5_Speech_API -user_pref("media.webspeech.synth.enabled", false); -// * * * / -// FF57+ -// 4610: [2506] disable video statistics - JS performance fingerprinting [FF25+] - // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/15757 - // [2] https://bugzilla.mozilla.org/654550 -user_pref("media.video_stats.enabled", false); -// 4611: [2509] disable touch events - // fingerprinting attack vector - leaks screen res & actual screen coordinates - // 0=disabled, 1=enabled, 2=autodetect - // Optional protection depending on your device - // [1] https://developer.mozilla.org/docs/Web/API/Touch_events - // [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10286 + // user_pref("dom.netinfo.enabled", false); + // user_pref("dom.webaudio.enabled", false); +/* 8002: disable other ***/ + // user_pref("browser.display.use_document_fonts", 0); + // user_pref("browser.zoom.siteSpecific", false); // user_pref("dom.w3c_touch_events.enabled", 0); -// * * * / -// FF59+ -// 4612: [2511] disable MediaDevices change detection [FF51+] - // [1] https://developer.mozilla.org/docs/Web/Events/devicechange - // [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/ondevicechange -user_pref("media.ondevicechange.enabled", false); -// * * * / -// FF60+ -// 4613: [2011] disable WebGL debug info being available to websites - // [1] https://bugzilla.mozilla.org/1171228 - // [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info -user_pref("webgl.enable-debug-renderer-info", false); -// * * * / -// FF65+ -// 4614: [2516] disable PointerEvents - // [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent -user_pref("dom.w3c_pointer_events.enabled", false); -// * * * / -// FF67+ -// 4615: [2618] disable exposure of system colors to CSS or canvas [FF44+] - // [NOTE] See second listed bug: may cause black on black for elements with undefined colors - // [SETUP-CHROME] Might affect CSS in themes and extensions - // [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,133087 -user_pref("ui.use_standins_for_native_colors", true); -// 4616: enforce prefers-color-scheme as light [FF67+] - // 0=light, 1=dark : This overrides your OS value -user_pref("ui.systemUsesDarkTheme", 0); // [HIDDEN PREF] -// 4617: enforce prefers-reduced-motion as no-preference [FF63+] [RESTART] - // 0=no-preference, 1=reduce -user_pref("ui.prefersReducedMotion", 0); // [HIDDEN PREF] -// * * * / -// FF41+ -// 4620: mitigate fingerprinting via canvas - // [NOTE] This setting has been removed from gHacks v67 (see [1]) but is still enabled by default. - // [1] https://github.com/arkenfox/user.js/commit/8b07fd57d0f8a31dab25661d51235fe1b0c6360c -user_pref("canvas.capturestream.enabled", false); -// * * * / -// ***/ - -/*** [SECTION 4700]: RFP ALTERNATIVES (NAVIGATOR / USER AGENT (UA) SPOOFING) - This is FYI ONLY. These prefs are INSUFFICIENT(a) on their own, you need - to use RFP (4500) or an extension, in which case they become POINTLESS. - (a) Many of the components that make up your UA can be derived by other means. - And when those values differ, you provide more bits and raise entropy. - Examples of leaks include workers, navigator objects, date locale/formats, - iframes, headers, tcp/ip attributes, feature detection, and **many** more. - ALL values below intentionally left blank - use RFP, or get a vetted, tested - extension and mimic RFP values to *lower* entropy, or randomize to *raise* it -***/ -user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow"); -/* 4701: navigator.userAgent ***/ - // user_pref("general.useragent.override", ""); // [HIDDEN PREF] -/* 4702: navigator.buildID - * Revealed build time down to the second. In FF64+ it now returns a fixed timestamp - * [1] https://bugzilla.mozilla.org/583181 - * [2] https://www.fxsitecompat.com/en-CA/docs/2018/navigator-buildid-now-returns-a-fixed-timestamp/ ***/ - // user_pref("general.buildID.override", ""); // [HIDDEN PREF] -/* 4703: navigator.appName ***/ + // user_pref("media.navigator.enabled", false); + // user_pref("media.ondevicechange.enabled", false); + // user_pref("media.video_stats.enabled", false); + // user_pref("media.webspeech.synth.enabled", false); + // user_pref("webgl.enable-debug-renderer-info", false); +/* 8003: spoof ***/ + // user_pref("dom.maxHardwareConcurrency", 2); + // user_pref("font.system.whitelist", ""); // [HIDDEN PREF] // user_pref("general.appname.override", ""); // [HIDDEN PREF] -/* 4704: navigator.appVersion ***/ // user_pref("general.appversion.override", ""); // [HIDDEN PREF] -/* 4705: navigator.platform ***/ - // user_pref("general.platform.override", ""); // [HIDDEN PREF] -/* 4706: navigator.oscpu ***/ + // user_pref("general.buildID.override", ""); // [HIDDEN PREF] // user_pref("general.oscpu.override", ""); // [HIDDEN PREF] -/* 4707: Limit user-agent data by imitating Firefox's user-agent */ - // user_pref("general.useragent.compatMode.firefox", true); + // user_pref("general.platform.override", ""); // [HIDDEN PREF] + // user_pref("general.useragent.override", ""); // [HIDDEN PREF] + // user_pref("ui.use_standins_for_native_colors", true); /*** [SECTION 9000]: PERSONAL Non-project related but useful. If any of these interest you, add them to your overrides ***/ From 68b3e25656ab80ea00a9da83a82646b6d0483f7f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 17 Oct 2021 17:05:45 +0200 Subject: [PATCH 054/147] [WIP] Continues Arkenfox v78..v91 migration Migration status : * updated sections 9XXX * fixed one typo in documentation * removed `browser.zoom.siteSpecific` (does not seem to be supported by Thunderbird) --- user.js | 157 ++++++++++++++++++++++---------------------------------- 1 file changed, 61 insertions(+), 96 deletions(-) diff --git a/user.js b/user.js index aca4142..970ff05 100644 --- a/user.js +++ b/user.js @@ -1118,7 +1118,7 @@ user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN * Vulnerabilities [1] have increasingly been found, including those known and fixed * in native programs years ago [2]. WASM has powerful low-level access, making * certain attacks (brute-force) and vulnerabilities more possible - * [STATS] ~0.2% of websites, about half of which are for crytopmining / malvertising [2][3] + * [STATS] ~0.2% of websites, about half of which are for crytomining / malvertising [2][3] * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ @@ -1259,7 +1259,6 @@ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan // user_pref("dom.webaudio.enabled", false); /* 8002: disable other ***/ // user_pref("browser.display.use_document_fonts", 0); - // user_pref("browser.zoom.siteSpecific", false); // user_pref("dom.w3c_touch_events.enabled", 0); // user_pref("media.navigator.enabled", false); // user_pref("media.ondevicechange.enabled", false); @@ -1278,27 +1277,29 @@ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan // user_pref("ui.use_standins_for_native_colors", true); /*** [SECTION 9000]: PERSONAL - Non-project related but useful. If any of these interest you, add them to your overrides ***/ -user_pref("_user.js.parrot", "9000 syntax error: this is an ex-parrot!"); -/* WELCOME & WHAT's NEW NOTICES ***/ - //user_pref("mailnews.start_page_override.mstone", "ignore"); // master switch + Non-project related but useful. If any interest you, add them to your overrides +***/ +user_pref("_user.js.parrot", "9000 syntax error: the parrot's cashed in 'is chips!"); +/* WELCOME & WHAT'S NEW NOTICES ***/ +user_pref("mailnews.start_page_override.mstone", "ignore"); // master switch /* WARNINGS ***/ // user_pref("full-screen-api.warning.delay", 0); // user_pref("full-screen-api.warning.timeout", 0); /* APPEARANCE ***/ + // user_pref("ui.systemUsesDarkTheme", 1); // [FF67+] [HIDDEN PREF] + // 0=light, 1=dark: with RFP this only affects chrome // user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent + // user_pref("ui.prefersReducedMotion", 1); // disable chrome animations [FF77+] [RESTART] [HIDDEN PREF] + // 0=no-preference, 1=reduce: with RFP this only affects chrome /* CONTENT BEHAVIOR ***/ // user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type" // user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX] -/* RETURN RECEIPT BEHAVIOR ***/ - // user_pref("mail.mdn.report.enabled", false); // disable return receipt sending unconditionally /* UX BEHAVIOR ***/ // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux] // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART] -/* OTHER ***/ - // user_pref("network.manage-offline-status", false); // see bugzilla 620472 - // user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR) -/* Set custom headers ***/ +/* RETURN RECEIPT BEHAVIOR ***/ + // user_pref("mail.mdn.report.enabled", false); // disable return receipt sending unconditionally +/* CUSTOM HEADERS ***/ // user_pref("mail.identity.id1.headers", "References, InReplyTo"); // user_pref("mail.identity.id1.header.References", "References: <2ad46d80-c8ce-49a3-9896-16171788ac28@example.tld>\n <31ff00c2-b7cb-4063-beeb-a0bdd424c3a7@example1.tld>"); // user_pref("mail.identity.id1.header.InReplyTo", "In-Reply-To: <31ff00c2-b7cb-4063-beeb-a0bdd424c3a7@example1.tld>"); @@ -1640,93 +1641,57 @@ user_pref("mail.server.default.acPreferEncrypt", 0); user_pref("mail.openpgp.allow_external_gnupg", true); // [HIDDEN PREF] /*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED - Documentation denoted as [-]. Items deprecated in FF68 or earlier have been archived at [1], - which also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets - [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123 + Documentation denoted as [-]. Items deprecated in FF78 or earlier have been archived at [1] + [1] https://github.com/arkenfox/user.js/issues/123 ***/ user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!"); -/* ESR68.x still uses all the following prefs +/* ESR78.x still uses all the following prefs // [NOTE] replace the * with a slash in the line above to re-enable them -// FF69 -// 1405: disable WOFF2 (Web Open Font Format) [FF35+] - // [-] https://bugzilla.mozilla.org/1556991 - // user_pref("gfx.downloadable_fonts.woff2.enabled", false); -// 1802: enforce click-to-play for plugins - // [-] https://bugzilla.mozilla.org/1519434 -user_pref("plugins.click_to_play", true); // [DEFAULT: true FF25+] -// 2033: disable autoplay for muted videos [FF63+] - replaced by 'media.autoplay.default' options (2030) - // [-] https://bugzilla.mozilla.org/1562331 - // user_pref("media.autoplay.allow-muted", false); -// * * * / -// FF71 -// 2608: disable WebIDE and ADB extension download - // [1] https://trac.torproject.org/projects/tor/ticket/16222 - // [-] https://bugzilla.mozilla.org/1539462 -user_pref("devtools.webide.enabled", false); // [DEFAULT: false FF70+] -user_pref("devtools.webide.autoinstallADBExtension", false); // [FF64+] -// 2731: enforce websites to ask to store data for offline use - // [1] https://support.mozilla.org/questions/1098540 - // [2] https://bugzilla.mozilla.org/959985 - // [-] https://bugzilla.mozilla.org/1574480 -user_pref("offline-apps.allow_by_default", false); -// * * * / -// FF72 -// 0105a: disable Activity Stream telemetry - // [-] https://bugzilla.mozilla.org/1597697 -user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", ""); -// 0330: disable Hybdrid Content telemetry - // [-] https://bugzilla.mozilla.org/1520491 -user_pref("toolkit.telemetry.hybridContent.enabled", false); // [FF59+] -// 2720: enforce IndexedDB (IDB) as enabled - // IDB is required for extensions and Firefox internals (even before FF63 in [1]) - // To control *website* IDB data, control allowing cookies and service workers, or use - // Temporary Containers. To mitigate *website* IDB, FPI helps (4001), and/or sanitize - // on close (Offline Website Data, see 2800) or on-demand (Ctrl-Shift-Del), or automatically - // via an extension. Note that IDB currently cannot be sanitized by host. - // [1] https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/ - // [-] https://bugzilla.mozilla.org/1488583 -user_pref("dom.indexedDB.enabled", true); // [DEFAULT: true] -// * * * / -// FF74 -// 0203: use Mozilla geolocation service instead of Google when geolocation is enabled - // Optionally enable logging to the console (defaults to false) - // [-] https://bugzilla.mozilla.org/1613627 -user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"); - // user_pref("geo.wifi.logging.enabled", true); // [HIDDEN PREF] -// 1704: set behaviour on "+ Tab" button to display container menu [FF53+] [SETUP-CHROME] - // 0=no menu (default), 1=show when clicked, 2=show on long press - // [1] https://bugzilla.mozilla.org/1328756 - // [-] https://bugzilla.mozilla.org/1606265 -user_pref("privacy.userContext.longPressBehavior", 2); -// 2012: limit WebGL - // [-] https://bugzilla.mozilla.org/1477756 -user_pref("webgl.disable-extensions", true); -// * * * / -// FF76 -// 0401: sanitize blocklist url - // [2] https://trac.torproject.org/projects/tor/ticket/16931 - // [-] https://bugzilla.mozilla.org/1618188 -user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/"); -// * * * / -// FF77 -// 0850e: disable location bar one-off searches [FF51+] - // [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ - // [-] https://bugzilla.mozilla.org/1628926 - // user_pref("browser.urlbar.oneOffSearches", false); -// 2605: block web content in file processes [FF55+] - // [SETUP-WEB] You may want to disable this for corporate or developer environments - // [1] https://bugzilla.mozilla.org/1343184 - // [-] https://bugzilla.mozilla.org/1603007 -user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false); -// * * * / -// FF78 -// 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] - replaced by 'media.autoplay.blocking_policy' - // [-] https://bugzilla.mozilla.org/1509933 -user_pref("media.autoplay.enabled.user-gestures-needed", false); -// 5000's: disable chrome animations - replaced FF77+ by 'ui.prefersReducedMotion' (4520) - // [-] https://bugzilla.mozilla.org/1640501 - // user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+] -// * * * / +// FF79 +// 0212: enforce fallback text encoding to match en-US + // When the content or server doesn't declare a charset the browser will + // fallback to the "Current locale" based on your application language + // [TEST] https://hsivonen.com/test/moz/check-charset.htm + // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025 + // [-] https://bugzilla.mozilla.org/1603712 +user_pref("intl.charset.fallback.override", "windows-1252"); +// FF82 +// 0206: disable geographically specific results/search engines e.g. "browser.search.*.US" + // i.e. ignore all of Mozilla's various search engines in multiple locales + // [-] https://bugzilla.mozilla.org/1619926 +user_pref("browser.search.geoSpecificDefaults", false); +user_pref("browser.search.geoSpecificDefaults.url", ""); +// FF86 +// 1205: disable SSL Error Reporting + // [1] https://firefox-source-docs.mozilla.org/main/65.0/browser/base/sslerrorreport/preferences.html + // [-] https://bugzilla.mozilla.org/1681839 +user_pref("security.ssl.errorReporting.automatic", false); +user_pref("security.ssl.errorReporting.enabled", false); +user_pref("security.ssl.errorReporting.url", ""); +// 2653: disable hiding mime types (Options>General>Applications) not associated with a plugin + // [-] https://bugzilla.mozilla.org/1581678 +user_pref("browser.download.hide_plugins_without_extensions", false); +// FF89 +// 0309: disable sending Flash crash reports + // [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed] +user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false); +// 0310: disable sending the URL of the website where a plugin crashed + // [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed] +user_pref("dom.ipc.plugins.reportCrashURL", false); +// 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+] + // [1] https://bugzilla.mozilla.org/1190623 + // [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed] +user_pref("security.mixed_content.block_object_subrequest", true); +// 1803: disable Flash plugin + // 0=deactivated, 1=ask, 2=enabled + // ESR52.x is the last branch to fully support NPAPI, FF52+ stable only supports Flash + // [NOTE] You can still override individual sites via site permissions + // [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed] +user_pref("plugin.state.flash", 0); // [DEFAULT: 1] +// FF90 +// 0708: disable FTP [FF60+] + // [-] https://bugzilla.mozilla.org/1574475 + // user_pref("network.ftp.enabled", false); // [DEFAULT: false FF88+] // ***/ /* END: internal custom pref to test for syntax errors ***/ From 57073e7516d179039ef6f5abff21a47588d8d335 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 17 Oct 2021 17:33:16 +0200 Subject: [PATCH 055/147] [WIP] Continues Arkenfox v78..v91 migration Migration status : * uncommented some preferences from the 7000 section --- user.js | 44 ++++++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/user.js b/user.js index 970ff05..a5f47a0 100644 --- a/user.js +++ b/user.js @@ -1165,16 +1165,20 @@ user_pref("privacy.window.name.update.enabled", true); // [DEFAULT: true FF86+] // user_pref("webgl.enable-webgl2", ""); // user_pref("webgl.min_capability_mode", ""); -/*** [SECTION 7000]: DON'T BOTHER ***/ +/*** [SECTION 7000]: DON'T BOTHER + Thunderbird-User.JS maintainer here : + Actually we do, TB is an e-mail client, not a (bloated) browser. + Thus some of below preferences have been set, despite upstream (Arkenfox) warnings. +***/ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); /* 7001: disable APIs * Location-Aware Browsing, Full Screen, offline cache (appCache), Virtual Reality * [WHY] The API state is easily fingerprintable. Geo and VR are behind prompts (7002). * appCache storage capability was removed in FF90. Full screen requires user interaction ***/ - // user_pref("geo.enabled", false); - // user_pref("full-screen-api.enabled", false); - // user_pref("browser.cache.offline.enable", false); - // user_pref("dom.vr.enabled", false); +user_pref("geo.enabled", false); +user_pref("full-screen-api.enabled", false); +user_pref("browser.cache.offline.enable", false); +user_pref("dom.vr.enabled", false); /* 7002: set default permissions * Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+] * 0=always ask (default), 1=allow, 2=block @@ -1182,11 +1186,11 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies * exceptions as allow/block for frequently visited/annoying sites: i.e. not global * [SETTING] to add site exceptions: Ctrl+I>Permissions> * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ - // user_pref("permissions.default.geo", 0); - // user_pref("permissions.default.camera", 0); - // user_pref("permissions.default.microphone", 0); - // user_pref("permissions.default.desktop-notification", 0); - // user_pref("permissions.default.xr", 0); // Virtual Reality +user_pref("permissions.default.geo", 0); +user_pref("permissions.default.camera", 0); +user_pref("permissions.default.microphone", 0); +user_pref("permissions.default.desktop-notification", 0); +user_pref("permissions.default.xr", 0); // Virtual Reality /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ @@ -1213,13 +1217,13 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies // user_pref("network.http.referer.hideOnionSource", true); // 1305144 /* 7007: referers * [WHY] Only cross-origin referers (1600s) need control ***/ - // user_pref("network.http.sendRefererHeader", 2); - // user_pref("network.http.referer.trimmingPolicy", 0); +user_pref("network.http.sendRefererHeader", 0); +user_pref("network.http.referer.trimmingPolicy", 0); /* 7008: set the default Referrer Policy [FF59+] * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade * [WHY] Defaults are fine. They can be overridden by a site-controlled Referrer Policy ***/ - // user_pref("network.http.referer.defaultPolicy", 2); // [DEFAULT: 2 FF87+] - // user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2] +user_pref("network.http.referer.defaultPolicy", 0); // [DEFAULT: 2 FF87+] +user_pref("network.http.referer.defaultPolicy.pbmode", 0); // [DEFAULT: 2] /* 7009: disable HTTP2 * [WHY] Passive fingerprinting. ~50% of sites use HTTP2 [1] * [1] https://w3techs.com/technologies/details/ce-http2/all/all ***/ @@ -1229,21 +1233,21 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies // user_pref("network.http.spdy.websockets", false); // [FF65+] /* 7010: disable HTTP Alternative Services [FF37+] * [WHY] Already isolated by network partitioning (FF85+) or FPI ***/ - // user_pref("network.http.altsvc.enabled", false); - // user_pref("network.http.altsvc.oe", false); +user_pref("network.http.altsvc.enabled", false); +user_pref("network.http.altsvc.oe", false); /* 7011: disable website control over browser right-click context menu * [WHY] Just use Shift-Right-Click ***/ - // user_pref("dom.event.contextmenu.enabled", false); +user_pref("dom.event.contextmenu.enabled", false); /* 7012: disable icon fonts (glyphs) and local fallback rendering * [WHY] Breakage, font fallback is equivalency, also RFP * [1] https://bugzilla.mozilla.org/789788 * [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/ - // user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+] - // user_pref("gfx.downloadable_fonts.fallback_delay", -1); +user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+] +user_pref("gfx.downloadable_fonts.fallback_delay", -1); /* 7013: disable Clipboard API * [WHY] Fingerprintable. Breakage. Cut/copy/paste require user * interaction, and paste is limited to focused editable fields ***/ - // user_pref("dom.event.clipboardevents.enabled", false); +user_pref("dom.event.clipboardevents.enabled", false); /*** [SECTION 8000]: DON'T BOTHER: NON-RFP [WHY] They are insufficient to help anti-fingerprinting and do more harm than good From 5a1ff8ddfa7fdc1187feace408606ac3bcb0713c Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 17 Oct 2021 17:42:22 +0200 Subject: [PATCH 056/147] Adds new `mail.biff.show_badge` Thunderbird v91.0.2+ preference --- user.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/user.js b/user.js index a5f47a0..ba89dc3 100644 --- a/user.js +++ b/user.js @@ -231,6 +231,9 @@ user_pref("mail.instrumentation.userOptedIn", false); * [1] https://searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/specialTabs.js#1218 ***/ user_pref("mail.rights.override", true); // [DEFAULT: unset] // user_pref("mail.rights.version", 1) // [DEFAULT: unset] +/* 0380: disable the unread message count badge on taskbar icon + * [1] https://www.thunderbird.net/en-US/thunderbird/91.0.2/releasenotes/#whatsnew */ + // user_pref("mail.biff.show_badge", false); // [WINDOWS] /*** [SECTION 0400]: SAFE BROWSING (SB) SB has taken many steps to preserve privacy. If required, a full url is never sent From efe11df8e43223b623284a11614f230cacf439a0 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 17 Oct 2021 18:11:55 +0200 Subject: [PATCH 057/147] Gets rid of `toolkit.telemetry.prompted` (apparently removed) preference --- user.js | 1 - 1 file changed, 1 deletion(-) diff --git a/user.js b/user.js index ba89dc3..bcf8ff2 100644 --- a/user.js +++ b/user.js @@ -170,7 +170,6 @@ user_pref("datareporting.healthreport.uploadEnabled", false); * [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/ user_pref("toolkit.telemetry.unified", false); user_pref("toolkit.telemetry.enabled", false); // see [NOTE] -user_pref("toolkit.telemetry.prompted", 2); user_pref("toolkit.telemetry.server", "data:,"); user_pref("toolkit.telemetry.archive.enabled", false); user_pref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+] From 881a33958422d79cbd2a342e87909381c802b044 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 17 Oct 2021 18:24:37 +0200 Subject: [PATCH 058/147] Fixes v78..v91 Arkenfox migration (accidentally dropped preferences) --- user.js | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/user.js b/user.js index bcf8ff2..b68aad1 100644 --- a/user.js +++ b/user.js @@ -84,6 +84,10 @@ user_pref("mail.shell.checkDefaultClient", false); /* 0102: set START page [SETUP-CHROME] * [SETTING] Edit>Preferences>General>Thunderbird Start Page ***/ user_pref("mailnews.start_page.enabled", false); +/* 0104: set NEWTAB page + * true=Activity Stream (default, see 0105), false=blank page + * [SETTING] Home>New Windows and Tabs>New tabs ***/ +user_pref("browser.newtabpage.enabled", false); /*** [SECTION 0200]: GEOLOCATION / LANGUAGE / LOCALE ***/ user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!"); @@ -793,6 +797,26 @@ user_pref("network.protocol-handler.external.ms-windows-store", false); * [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion ***/ user_pref("permissions.delegation.enabled", false); +/** DOWNLOADS ***/ +/* 2651: enable user interaction for security by always asking where to download + * [SETUP-CHROME] On Android this blocks longtapping and saving images + * [SETTING] General>Downloads>Always ask you where to save files ***/ +user_pref("browser.download.useDownloadDir", false); +/* 2652: disable adding downloads to the system's "recent documents" list ***/ +user_pref("browser.download.manager.addToRecentDocs", false); + +/** EXTENSIONS ***/ +/* 2660: lock down allowed extension directories + * [SETUP-CHROME] This will break extensions, language packs, themes and any other + * XPI files which are installed outside of profile and application directories + * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ + * [1] archived: https://archive.is/DYjAM ***/ +user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] +user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] +/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ + // user_pref("extensions.webextensions.restrictedDomains", ""); + /*** [SECTION 2700]: PERSISTENT STORAGE Data SET by websites including cookies : profile\cookies.sqlite @@ -1034,6 +1058,11 @@ user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDE * [2] https://hg.mozilla.org/mozilla-central/rev/6d2d7856e468#l2.32 ***/ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF] +/* 4505: experimental RFP [FF91+] + * [WARNING] DO NOT USE unless testing, see [1] comment 12 + * [1] https://bugzilla.mozilla.org/1635603 ***/ + // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); + // user_pref("privacy.resistFingerprinting.testGranularityMask", 0); /*** [SECTION 5000]: OPTIONAL OPSEC Disk avoidance, application data isolation, eyeballs... @@ -1303,6 +1332,12 @@ user_pref("mailnews.start_page_override.mstone", "ignore"); // master switch /* UX BEHAVIOR ***/ // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux] // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART] +/* UX FEATURES ***/ + // user_pref("reader.parse-on-load.enabled", false); // Reader View +/* OTHER ***/ + // user_pref("browser.bookmarks.max_backups", 2); + // user_pref("network.manage-offline-status", false); // see bugzilla 620472 + // user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR) /* RETURN RECEIPT BEHAVIOR ***/ // user_pref("mail.mdn.report.enabled", false); // disable return receipt sending unconditionally /* CUSTOM HEADERS ***/ From 74735518beb2bae443cdb1dff35567396ec4f615 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 17 Oct 2021 18:39:08 +0200 Subject: [PATCH 059/147] Removes `permissions.default.*` preferences actually missing from TB --- user.js | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/user.js b/user.js index b68aad1..1fb7949 100644 --- a/user.js +++ b/user.js @@ -760,9 +760,6 @@ user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] /* 2611: disable middle mouse click opening links from clipboard * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/ user_pref("middlemouse.contentLoadURL", false); -/* 2615: disable websites overriding Thunderbird's keyboard shortcuts [FF58+] - * 0 (default) or 1=allow, 2=block ***/ -user_pref("permissions.default.shortcuts", 2); /* 2616: remove special permissions for certain mozilla domains [FF35+] * [1] resource://app/defaults/permissions ***/ user_pref("permissions.manager.defaultsUrl", ""); @@ -1210,18 +1207,6 @@ user_pref("geo.enabled", false); user_pref("full-screen-api.enabled", false); user_pref("browser.cache.offline.enable", false); user_pref("dom.vr.enabled", false); -/* 7002: set default permissions - * Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+] - * 0=always ask (default), 1=allow, 2=block - * [WHY] These are fingerprintable via Permissions API, except VR. Just add site - * exceptions as allow/block for frequently visited/annoying sites: i.e. not global - * [SETTING] to add site exceptions: Ctrl+I>Permissions> - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ -user_pref("permissions.default.geo", 0); -user_pref("permissions.default.camera", 0); -user_pref("permissions.default.microphone", 0); -user_pref("permissions.default.desktop-notification", 0); -user_pref("permissions.default.xr", 0); // Virtual Reality /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ From ac43ee758dfac0d0169f079f6f369160406a5f1e Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 17 Oct 2021 18:39:32 +0200 Subject: [PATCH 060/147] [META] Updates header date --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index 1fb7949..f140990 100644 --- a/user.js +++ b/user.js @@ -1,6 +1,6 @@ /****** * name: thunderbird user.js -* date: 12 September 2021 +* date: 17 October 2021 * version: v91-beta * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From f7788b2c8ad437fa71c4480e090b29f64f0d4bbf Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 17 Oct 2021 18:54:35 +0200 Subject: [PATCH 061/147] Disables very buggy `mail.password_protect_local_cache` pref. by default --- user.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/user.js b/user.js index f140990..9f8a4c7 100644 --- a/user.js +++ b/user.js @@ -422,9 +422,10 @@ user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false] * until the secret is provided. * This preference MAY mitigate risk due to intimate relationship threat in some cases (see [2])... * [WARNING] This DOES NOT encrypt locally cached emails anyhow (poor man's application security) + * [WARNING] This preference is very buggy, you might not manage to start Thunderbird when it's switched on * [1] https://support.mozilla.org/en-US/kb/protect-your-thunderbird-passwords-master-password * [2] https://www.schneier.com/wp-content/uploads/2020/06/Privacy_Threats_in_Intimate_Relationships-1.pdf ***/ -user_pref("mail.password_protect_local_cache", true); // [HIDDEN PREF] + // user_pref("mail.password_protect_local_cache", true); // [HIDDEN PREF] /*** [SECTION 1000]: DISK AVOIDANCE ***/ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); From a492b510df5c2cfd13a38aa0b28e96d230b2aa90 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 30 Oct 2021 11:33:39 +0200 Subject: [PATCH 062/147] Applies v91.0..v91.1 Arkenfox upstream changes --- user.js | 93 ++++++++++++++++++++++++++++++--------------------------- 1 file changed, 49 insertions(+), 44 deletions(-) diff --git a/user.js b/user.js index 9f8a4c7..44414fe 100644 --- a/user.js +++ b/user.js @@ -1,6 +1,6 @@ /****** * name: thunderbird user.js -* date: 17 October 2021 +* date: 30 October 2021 * version: v91-beta * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) @@ -46,7 +46,6 @@ 2000: PLUGINS / MEDIA / WEBRTC 2300: WEB WORKERS 2400: DOM (DOCUMENT OBJECT MODEL) - 2500: FINGERPRINTING 2600: MISCELLANEOUS 2700: PERSISTENT STORAGE 2800: SHUTDOWN @@ -102,11 +101,12 @@ user_pref("geo.provider.use_gpsd", false); // [LINUX] /* 0203: disable region updates * [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/ user_pref("browser.region.network.url", ""); // [FF78+] -user_pref("browser.region.update.enabled", false); // [[FF79+] +user_pref("browser.region.update.enabled", false); // [FF79+] /* 0204: set search region * [NOTE] May not be hidden if Thunderbird has changed your settings due to your region (0203) ***/ // user_pref("browser.search.region", "US"); // [HIDDEN PREF] -/* 0210: set preferred language for displaying web pages +/* 0210: set preferred language for displaying pages + * [SETTING] General>Language and Appearance>Language>Choose your preferred language... * [TEST] https://addons.mozilla.org/about ***/ user_pref("intl.accept_languages", "en-US, en"); /* 0210b: Set dictionary to US ***/ @@ -147,9 +147,6 @@ user_pref("extensions.getAddons.cache.enabled", false); /* 0306: disable search engine updates (e.g. OpenSearch) * [NOTE] This does not affect Mozilla's built-in or Web Extension search engines ***/ user_pref("browser.search.update", false); -/* 0307: disable System Add-on updates ***/ -user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] -user_pref("extensions.systemAddon.update.url", ""); // [FF44+] /** RECOMMENDATIONS ***/ /* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/ @@ -321,13 +318,12 @@ user_pref("network.proxy.socks_remote_dns", true); * [SETUP-CHROME] Can break extensions for profiles on network shares * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/ user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] -/* 0704: disable GIO as a potential proxy bypass vector +/* 0704: disable GIO as a potential proxy bypass vector [FF60+] * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda, * gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64) * [1] https://bugzilla.mozilla.org/1433507 - * [2] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/23044 - * [3] https://en.wikipedia.org/wiki/GVfs - * [4] https://en.wikipedia.org/wiki/GIO_(software) ***/ + * [2] https://en.wikipedia.org/wiki/GVfs + * [3] https://en.wikipedia.org/wiki/GIO_(software) ***/ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] /* 0705: disable DNS-over-HTTPS (DoH) rollout [FF60+] * 0=off by default, 2=TRR (Trusted Recursive Resolver) first, 3=TRR only, 5=explicitly off @@ -337,8 +333,11 @@ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] * [3] https://blog.mozilla.org/mozilla/news/firefox-by-default-dns-over-https-rollout-in-canada/ * [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/ // user_pref("network.trr.mode", 5); -/* 0706: disable proxy direct failover for system requests [FF91+] ***/ -user_pref("network.proxy.failover_direct", false); +/* 0706: disable proxy direct failover for system requests [FF91+] + * [WARNING] Default true is a security feature against malicious extensions [1] + * [SETUP-CHROME] If you use a proxy and you trust your extensions + * [1] https://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ ***/ + // user_pref("network.proxy.failover_direct", false); /*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); @@ -363,14 +362,14 @@ user_pref("browser.fixup.alternate.enabled", false); * [SETUP-CHROME] Change these if you trust and use a privacy respecting search engine * [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/ user_pref("browser.search.suggest.enabled", false); -/* 0808: disable search and form history +/* 0810: disable search and form history * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] * [NOTE] We also clear formdata on exit (2803) * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html * [2] https://bugzilla.mozilla.org/381681 ***/ user_pref("browser.formfill.enable", false); -/* 0809: disable Form Autofill +/* 0811: disable Form Autofill * [NOTE] Stored data is NOT secure (uses a JSON file) * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses @@ -380,7 +379,7 @@ user_pref("extensions.formautofill.available", "off"); // [FF56+] user_pref("extensions.formautofill.creditCards.available", false); // [FF57+] user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] -/* 0810: disable coloring of visited links +/* 0820: disable coloring of visited links * Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing * attacks. Don't forget clearing history on close (2803). However, social engineering [2#limits][4][5] @@ -484,13 +483,14 @@ user_pref("security.tls.enable_0rtt_data", false); [1] https://scotthelme.co.uk/revocation-is-broken/ [2] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ ***/ -/* 1211: control when to use OCSP fetching (to confirm current validity of certificates) +/* 1211: enforce OCSP fetching to confirm current validity of certificates * 0=disabled, 1=enabled (default), 2=enabled for EV certificates only * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority) * It's a trade-off between security (checking) and privacy (leaking info to the CA) * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling + * [SETTING] Privacy & Security>Security>Certificates>Query OCSP responder servers... * [1] https://en.wikipedia.org/wiki/Ocsp ***/ -user_pref("security.OCSP.enabled", 1); +user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] /* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail [SETUP-WEB] * When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail) * Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail) @@ -516,7 +516,7 @@ user_pref("security.pki.sha1_enforcement_level", 1); * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/ user_pref("security.family_safety.mode", 0); /* 1223: enable strict pinning - * PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict + * PKP (Public Key Pinning) 0=disabled, 1=allow user MiTM (such as your antivirus), 2=strict * [SETUP-WEB] If you rely on an AV (antivirus) to protect your web browsing * by inspecting ALL your web traffic, then leave at current default=1 * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/ @@ -555,7 +555,7 @@ user_pref("dom.security.https_only_mode_send_http_background_request", false); * [2] https://bugzilla.mozilla.org/1353705 ***/ user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); /* 1271: control "Add Security Exception" dialog on SSL warnings - * 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default) + * 0=do neither, 1=pre-populate url, 2=pre-populate url + pre-fetch cert (default) * [1] https://github.com/pyllyukko/user.js/issues/210 ***/ user_pref("browser.ssl_override_behavior", 1); /* 1272: display advanced information on Insecure Connection warning pages @@ -712,28 +712,6 @@ user_pref("dom.disable_open_during_load", true); /* 2404: limit events that can cause a popup [SETUP-WEB] ***/ user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); -/*** [SECTION 2500]: FINGERPRINTING ***/ -user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!"); -/* 2501: enforce no system colors - * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ -user_pref("browser.display.use_system_colors", false); // [DEFAULT: false] -/* 2502: enforce non-native widget theme - * Security: removes/reduces system API calls, e.g. win32k API [1] - * Fingerprinting: provides a uniform look and feel across platforms [2] - * [1] https://bugzilla.mozilla.org/1381938 - * [2] https://bugzilla.mozilla.org/1411425 ***/ -user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true FF89+] -/* 2503: open links targeting new windows in a new tab instead - * Stops malicious window sizes and some screen resolution leaks. - * You can still right-click a link and open in a new window - * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ -user_pref("browser.link.open_newwindow", 3); // 1=most recent window or tab 2=new window, 3=new tab -user_pref("browser.link.open_newwindow.restriction", 0); -/* 2504: disable WebGL (Web Graphics Library) - * [SETUP-WEB] If you need it then enable it. RFP still randomizes canvas for naive scripts ***/ -user_pref("webgl.disabled", true); - /*** [SECTION 2600]: MISCELLANEOUS ***/ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); /* 2601: prevent accessibility services from accessing your browser [RESTART] @@ -808,7 +786,7 @@ user_pref("browser.download.manager.addToRecentDocs", false); * [SETUP-CHROME] This will break extensions, language packs, themes and any other * XPI files which are installed outside of profile and application directories * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ - * [1] archived: https://archive.is/DYjAM ***/ + * [1] https://archive.is/DYjAM (archived) ***/ user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] /* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] @@ -1061,6 +1039,29 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] * [1] https://bugzilla.mozilla.org/1635603 ***/ // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); // user_pref("privacy.resistFingerprinting.testGranularityMask", 0); +/* 4510: enforce no system colors + * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ +user_pref("browser.display.use_system_colors", false); // [DEFAULT: false] +/* 4511: enforce non-native widget theme + * Security: removes/reduces system API calls, e.g. win32k API [1] + * Fingerprinting: provides a uniform look and feel across platforms [2] + * [1] https://bugzilla.mozilla.org/1381938 + * [2] https://bugzilla.mozilla.org/1411425 ***/ +user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true] +/* 4512: enforce links targeting new windows to open in a new tab instead + * 1=most recent window or tab, 2=new window, 3=new tab + * Stops malicious window sizes and some screen resolution leaks. + * You can still right-click a link and open in a new window + * [SETTING] General>Tabs>Open links in tabs instead of new windows + * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ +user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3] +/* 4513: set all open window methods to abide by "browser.link.open_newwindow" (4512) + * [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js ***/ +user_pref("browser.link.open_newwindow.restriction", 0); // [DEFAULT: 0] +/* 4520: disable WebGL (Web Graphics Library) + * [SETUP-WEB] If you need it then enable it. RFP still randomizes canvas for naive scripts ***/ +user_pref("webgl.disabled", true); /*** [SECTION 5000]: OPTIONAL OPSEC Disk avoidance, application data isolation, eyeballs... @@ -1265,6 +1266,10 @@ user_pref("gfx.downloadable_fonts.fallback_delay", -1); * [WHY] Fingerprintable. Breakage. Cut/copy/paste require user * interaction, and paste is limited to focused editable fields ***/ user_pref("dom.event.clipboardevents.enabled", false); +/* 7014: disable System Add-on updates + * [WHY] It can compromise security. System addons ship with prefs, use those ***/ + // user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] + // user_pref("extensions.systemAddon.update.url", ""); // [FF44+] /*** [SECTION 8000]: DON'T BOTHER: NON-RFP [WHY] They are insufficient to help anti-fingerprinting and do more harm than good @@ -1671,7 +1676,7 @@ user_pref("mail.openpgp.allow_external_gnupg", true); // [HIDDEN PREF] Documentation denoted as [-]. Items deprecated in FF78 or earlier have been archived at [1] [1] https://github.com/arkenfox/user.js/issues/123 ***/ -user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!"); + user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); /* ESR78.x still uses all the following prefs // [NOTE] replace the * with a slash in the line above to re-enable them // FF79 From c54c0590117c6c1dd515c4b2fd578da2ecbc0712 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 31 Oct 2021 09:42:26 +0100 Subject: [PATCH 063/147] Removes four leading spaces --- user.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/user.js b/user.js index 44414fe..1233f37 100644 --- a/user.js +++ b/user.js @@ -180,9 +180,9 @@ user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Han user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+] /* 0333: disable Telemetry Coverage * [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/ - user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF] - user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF] - user_pref("toolkit.coverage.endpoint.base", ""); +user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF] +user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF] +user_pref("toolkit.coverage.endpoint.base", ""); /* 0334: disable PingCentre telemetry (used in several System Add-ons) [FF57+] * Defense-in-depth: currently covered by 0331 ***/ user_pref("browser.ping-centre.telemetry", false); @@ -1676,7 +1676,7 @@ user_pref("mail.openpgp.allow_external_gnupg", true); // [HIDDEN PREF] Documentation denoted as [-]. Items deprecated in FF78 or earlier have been archived at [1] [1] https://github.com/arkenfox/user.js/issues/123 ***/ - user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); +user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); /* ESR78.x still uses all the following prefs // [NOTE] replace the * with a slash in the line above to re-enable them // FF79 From 3580cfd3c40a446aae009c9cd25ce3c35f1c622e Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 14 Dec 2021 10:51:48 +0100 Subject: [PATCH 064/147] Fixes `privacy.sanitize.sanitizeOnShutdown` pref getting ignored > closes #16 Co-Authored-By: atomGit --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index e790470..eec98d4 100644 --- a/user.js +++ b/user.js @@ -1112,7 +1112,7 @@ user_pref("dom.storageManager.enabled", false); Firefox interface as "Browsing & Download History" and their values will be synced ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); -/* 2802: enable Thunderbird to clear items on shutdown (see 2803) +/* 2802: enable Thunderbird to clear items on shutdown (see 2803) ***/ user_pref("privacy.sanitize.sanitizeOnShutdown", true); /* 2803: set what items to clear on shutdown (if 2802 is true) [SETUP-CHROME] * [NOTE] If 'history' is true, downloads will also be cleared regardless of the value From de8048fea63b24e26e020a48cdb139c6c7ff7696 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 14 Dec 2021 14:24:05 +0100 Subject: [PATCH 065/147] Don't clear `mail.collect_addressbook` pref (feature already disabled) > see #17 --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index eec98d4..a1f27ed 100644 --- a/user.js +++ b/user.js @@ -1523,7 +1523,7 @@ user_pref("mailnews.display.date_senders_timezone", false); * Consider using CardBook extension instead (https://addons.thunderbird.net/addon/cardbook/) * [SETTING] Preferences>Composition>Addressing>Automatically add outgoing e-mail addresses... * [SETTING][CARDBOOK] CardBook>Preferences>Email>Collect Outgoing Email ***/ -user_pref("mail.collect_addressbook", ""); // [DEFAULT: "jsaddrbook://history.sqlite"] + // user_pref("mail.collect_addressbook", "jsaddrbook://history.sqlite"); user_pref("mail.collect_email_address_outgoing", false); /* 6031: Only use email addresses, without their Display Names [CARDBOOK] [SETUP-FEATURE] * By default, CardBook extension incorporates contacts display names in addresses fields. From dcf351aa96bc1be35dc85faacfb06f53d0af8eb6 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 14 Dec 2021 14:24:28 +0100 Subject: [PATCH 066/147] [META] Bumps to v78.1 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index a1f27ed..1ff6fba 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 28 August 2021 -* version: v78.0 +* date: 14 December 2021 +* version: v78.1 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases From 1196a9ce4f859a13714ba975bff51134519ab036 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 8 Jan 2022 17:22:44 +0100 Subject: [PATCH 067/147] Removes and fixes [SETTING] tags according to what is available in UI --- user.js | 105 ++++++++++++++++++++------------------------------------ 1 file changed, 37 insertions(+), 68 deletions(-) diff --git a/user.js b/user.js index 36d365c..9f0f4cd 100644 --- a/user.js +++ b/user.js @@ -78,14 +78,13 @@ user_pref("browser.aboutConfig.showWarning", false); /*** [SECTION 0100]: STARTUP ***/ user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); /* 0101: disable default browser check - * [SETTING] Edit>Preferences>Advanced>Always check to see if Thunderbird is the default mail client on startup ***/ + * [SETTING] General > System Integration > Always check to see if Thunderbird is the default... ***/ user_pref("mail.shell.checkDefaultClient", false); /* 0102: set START page [SETUP-CHROME] - * [SETTING] Edit>Preferences>General>Thunderbird Start Page ***/ + * [SETTING] General > Thunderbird Start Page ***/ user_pref("mailnews.start_page.enabled", false); /* 0104: set NEWTAB page - * true=Activity Stream (default, see 0105), false=blank page - * [SETTING] Home>New Windows and Tabs>New tabs ***/ + * true=Activity Stream (default), false=blank page ***/ user_pref("browser.newtabpage.enabled", false); /*** [SECTION 0200]: GEOLOCATION / LANGUAGE / LOCALE ***/ @@ -106,7 +105,7 @@ user_pref("browser.region.update.enabled", false); // [FF79+] * [NOTE] May not be hidden if Thunderbird has changed your settings due to your region (0203) ***/ // user_pref("browser.search.region", "US"); // [HIDDEN PREF] /* 0210: set preferred language for displaying pages - * [SETTING] General>Language and Appearance>Language>Choose your preferred language... + * [SETTING] General > Language & Appearance > Language > Choose the language used to display... * [TEST] https://addons.mozilla.org/about ***/ user_pref("intl.accept_languages", "en-US, en"); /* 0210b: Set dictionary to US ***/ @@ -127,17 +126,16 @@ user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!"); /** UPDATES ***/ /* 0301: disable auto-INSTALLING Thunderbird updates [NON-WINDOWS] - * [NOTE] You will still get prompts to update, and should do so in a timely manner - * [SETTING] General>Thunderbird Updates>Check for updates but let you choose to install them... ***/ + * [NOTE] You will still get prompts to update, and should do so in a timely manner ***/ user_pref("app.update.auto", false); /* 0302: disable auto-INSTALLING Thunderbird updates via a background service [FF90+] [WINDOWS] - * [SETTING] General>Thunderbird Updates>Automatically install updates>Use a background service to install updates + * [SETTING] General > Thunderbird Updates > Automatically install updates > Use a background service to install updates * [1] https://support.mozilla.org/kb/enable-background-updates-firefox-windows ***/ user_pref("app.update.background.scheduling.enabled", false); /* 0303: disable auto-CHECKING for extension and theme updates ***/ // user_pref("extensions.update.enabled", false); /* 0304: disable auto-INSTALLING extension and theme updates (after the check in 0303) - * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/ + * [SETTING] about:addons > Extensions > [cog-wheel-icon] > Update Add-ons Automatically (toggle) ***/ // user_pref("extensions.update.autoUpdateDefault", false); /* 0305: disable extension metadata * used when installing/updating an extension, and in daily background update checks: @@ -160,7 +158,7 @@ user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); * [1] https://bugzilla.mozilla.org/1195552 ***/ user_pref("datareporting.policy.dataSubmissionEnabled", false); /* 0331: disable Health Reports - * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Thunderbird to send technical... data ***/ + * [SETTING] Privacy & Security > Thunderbird Data Collection and Use > Allow Thunderbird to send technical... ***/ user_pref("datareporting.healthreport.uploadEnabled", false); /* 0332: disable telemetry * The "unified" pref affects the behaviour of the "enabled" pref @@ -203,7 +201,7 @@ user_pref("breakpad.reportURL", ""); user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+] // user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] [DEFAULT: false] /* 0351: enforce no submission of backlogged Crash Reports [FF58+] - * [SETTING] Privacy & Security>Thunderbird Data Collection & Use>Allow Thunderbird to send backlogged crash reports ***/ + * [SETTING] Privacy & Security > Thunderbird Data Collection and Use > Allow Thunderbird to send backlogged crash reports... ***/ user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [DEFAULT: false] /** OTHER ***/ @@ -248,13 +246,11 @@ user_pref("mail.rights.override", true); // [DEFAULT: unset] ***/ user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); /* 0401: disable SB (Safe Browsing) - * [WARNING] Do this at your own risk! These are the master switches - * [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content ***/ + * [WARNING] Do this at your own risk! These are the master switches ***/ // user_pref("browser.safebrowsing.malware.enabled", false); // user_pref("browser.safebrowsing.phishing.enabled", false); /* 0402: disable SB checks for downloads (both local lookups + remote) - * This is the master switch for the safebrowsing.downloads* prefs (0403, 0404) - * [SETTING] Privacy & Security>Security>... "Block dangerous downloads" ***/ + * This is the master switch for the safebrowsing.downloads* prefs (0403, 0404) ***/ // user_pref("browser.safebrowsing.downloads.enabled", false); /* 0403: disable SB checks for downloads (remote) * To verify the safety of certain executable files, Thunderbird may submit some information about the @@ -263,8 +259,7 @@ user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override it ***/ user_pref("browser.safebrowsing.downloads.remote.enabled", false); user_pref("browser.safebrowsing.downloads.remote.url", ""); -/* 0404: disable SB checks for unwanted software - * [SETTING] Privacy & Security>Security>... "Warn you about unwanted and uncommon software" ***/ +/* 0404: disable SB checks for unwanted software ***/ // user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); // user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); /* 0405: disable "ignore this warning" on SB warnings [FF45+] @@ -359,20 +354,17 @@ user_pref("keyword.enabled", false); // [DEFAULT: false] user_pref("browser.fixup.alternate.enabled", false); /* 0804: disable live search suggestions * [NOTE] Both must be true for the location bar to work - * [SETUP-CHROME] Change these if you trust and use a privacy respecting search engine - * [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/ + * [SETUP-CHROME] Change these if you trust and use a privacy respecting search engine ***/ user_pref("browser.search.suggest.enabled", false); /* 0810: disable search and form history * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] * [NOTE] We also clear formdata on exit (2803) - * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html * [2] https://bugzilla.mozilla.org/381681 ***/ user_pref("browser.formfill.enable", false); /* 0811: disable Form Autofill * [NOTE] Stored data is NOT secure (uses a JSON file) * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes - * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] user_pref("extensions.formautofill.available", "off"); // [FF56+] @@ -488,7 +480,7 @@ user_pref("security.tls.enable_0rtt_data", false); * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority) * It's a trade-off between security (checking) and privacy (leaking info to the CA) * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling - * [SETTING] Privacy & Security>Security>Certificates>Query OCSP responder servers... + * [SETTING] Privacy & Security > Security > Certificates > Query OCSP responder servers... * [1] https://en.wikipedia.org/wiki/Ocsp ***/ user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] /* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail [SETUP-WEB] @@ -533,8 +525,6 @@ user_pref("security.pki.crlite_mode", 2); user_pref("security.mixed_content.block_display_content", true); /* 1244: enable HTTPS-Only mode in all windows [FF76+] * When the top-level is HTTPS, insecure subresources are also upgraded (silent fail) - * [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (after "Continue to HTTP Site") - * [SETTING] Privacy & Security>HTTPS-Only Mode (and manage exceptions) * [TEST] http://example.com [upgrade] * [TEST] http://neverssl.com/ [no upgrade] ***/ user_pref("dom.security.https_only_mode", true); // [FF76+] @@ -598,7 +588,7 @@ user_pref("network.http.referer.XOriginPolicy", 2); user_pref("network.http.referer.XOriginTrimmingPolicy", 2); /* 1603: enable the DNT (Do Not Track) HTTP header * [NOTE] DNT is enforced with Enhanced Tracking Protection (2710) - * [SETTING] Privacy & Security>Enhanced Tracking Protection>Send websites a "Do Not Track" signal... ***/ + * [SETTING] Privacy & Security > Privacy > Web Content > Send websites a "Do Not Track" signal... ***/ user_pref("privacy.donottrackheader.enabled", true); /*** [SECTION 1700]: CONTAINERS @@ -609,13 +599,11 @@ user_pref("privacy.donottrackheader.enabled", true); [4] https://github.com/stoically/temporary-containers/wiki ***/ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); -/* 1701: enable Container Tabs and its UI setting [FF50+] - * [SETTING] General>Tabs>Enable Container Tabs ***/ +/* 1701: enable Container Tabs and its UI setting [FF50+] ***/ user_pref("privacy.userContext.enabled", true); user_pref("privacy.userContext.ui.enabled", true); /* 1702: set behaviour on "+ Tab" button to display container menu on left click [FF74+] - * [NOTE] The menu is always shown on long press and right click - * [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/ + * [NOTE] The menu is always shown on long press and right click ***/ // user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true); /*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/ @@ -642,14 +630,12 @@ user_pref("media.gmp-provider.enabled", false); user_pref("media.gmp-widevinecdm.enabled", false); /* 2022: disable all DRM content (EME: Encryption Media Extension) * [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV - * [SETTING] General>DRM Content>Play DRM-controlled content * [TEST] https://bitmovin.com/demos/drm * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ user_pref("media.eme.enabled", false); /* 2030: disable autoplay of HTML5 media [FF63+] * 0=Allow all, 1=Block non-muted media (default), 5=Block all - * [NOTE] You can set exceptions under site permissions - * [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites ***/ + * [NOTE] You can set exceptions under site permissions ***/ user_pref("media.autoplay.default", 5); /* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+] * 0=sticky (default), 1=transient, 2=user @@ -706,8 +692,7 @@ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket! user_pref("dom.disable_beforeunload", true); /* 2402: prevent scripts from moving and resizing open windows ***/ user_pref("dom.disable_window_move_resize", true); -/* 2403: block popup windows - * [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/ +/* 2403: block popup windows ***/ user_pref("dom.disable_open_during_load", true); /* 2404: limit events that can cause a popup [SETUP-WEB] ***/ user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); @@ -715,7 +700,6 @@ user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); /*** [SECTION 2600]: MISCELLANEOUS ***/ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); /* 2601: prevent accessibility services from accessing your browser [RESTART] - * [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser (FF80 or lower) * [1] https://support.mozilla.org/kb/accessibility-services ***/ user_pref("accessibility.force_disabled", 1); /* 2602: disable sending additional analytics to web servers @@ -730,7 +714,6 @@ user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] user_pref("browser.uitour.enabled", false); user_pref("browser.uitour.url", ""); /* 2607: disable various developer tools in browser context - * [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes * [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/ user_pref("devtools.chrome.enabled", false); /* 2608: reset remote debugging to disabled @@ -760,8 +743,7 @@ user_pref("network.IDN_show_punycode", true); * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). * It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. * CONS: You may prefer a different pdf reader for security reasons - * CAVEAT: JS can still force a pdf to open in-browser by bundling its own code - * [SETTING] General>Applications>Portable Document Format (PDF) ***/ + * CAVEAT: JS can still force a pdf to open in-browser by bundling its own code ***/ user_pref("pdfjs.disabled", false); // [DEFAULT: false] user_pref("pdfjs.enableScripting", false); // [FF86+] /* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/ @@ -775,8 +757,7 @@ user_pref("permissions.delegation.enabled", false); /** DOWNLOADS ***/ /* 2651: enable user interaction for security by always asking where to download - * [SETUP-CHROME] On Android this blocks longtapping and saving images - * [SETTING] General>Downloads>Always ask you where to save files ***/ + * [SETUP-CHROME] On Android this blocks longtapping and saving images ***/ user_pref("browser.download.useDownloadDir", false); /* 2652: disable adding downloads to the system's "recent documents" list ***/ user_pref("browser.download.manager.addToRecentDocs", false); @@ -817,7 +798,7 @@ user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin * Option 5 with FPI enabled (4001) is ignored and not shown, and option 4 used instead * [NOTE] You can set cookie exceptions under site permissions or use an extension * [NOTE] Enforcing category to custom ensures ETP related prefs are always honored - * [SETTING] Privacy & Security>Enhanced Tracking Protection>Custom>Cookies + * [SETTING] Privacy & Security > Privacy > Web Content > Accept cookies from sites * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ ***/ user_pref("network.cookie.cookieBehavior", 2); user_pref("browser.contentblocking.category", "custom"); @@ -830,12 +811,9 @@ user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+] /* 2703: delete cookies and site data on close * 0=keep until they expire (default), 2=keep until you close Thunderbird * [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2) - * [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Thunderbird is closed ***/ + * [SETTING] Privacy & Security > Privacy > Web Content > Keep until: "I close Thunderbird" ***/ user_pref("network.cookie.lifetimePolicy", 2); -/* 2710: enable Enhanced Tracking Protection (ETP) in all windows - * [SETTING] Privacy & Security>Enhanced Tracking Protection>Custom>Tracking content - * [SETTING] to add site exceptions: Urlbar>ETP Shield - * [SETTING] to manage site exceptions: Options>Privacy & Security>Enhanced Tracking Protection>Manage Exceptions ***/ +/* 2710: enable Enhanced Tracking Protection (ETP) in all windows ***/ user_pref("privacy.trackingprotection.enabled", true); /* 2711: enable various ETP lists ***/ user_pref("privacy.trackingprotection.socialtracking.enabled", true); @@ -860,8 +838,7 @@ user_pref("dom.storage_access.enabled", false); user_pref("dom.storage.next_gen", true); // [DEFAULT: true FF92+] /*** [SECTION 2800]: SHUTDOWN - * Sanitizing on shutdown is all or nothing. It does not use Managed Exceptions under - Privacy & Security>Delete cookies and site data when Thunderbird is closed (1681701) + * Sanitizing on shutdown is all or nothing (no exception can be set) * If you want to keep some sites' cookies (exception as "Allow") and optionally other site data but clear all the rest on close, then you need to set the "cookie" and optionally the "offlineApps" prefs below to false, and to set the cookie lifetime pref to 2 (2703) @@ -873,7 +850,6 @@ user_pref("privacy.sanitize.sanitizeOnShutdown", true); * [NOTE] If "history" is true, downloads will also be cleared * [NOTE] Active Logins: does not refer to logins via cookies, but rather HTTP Basic Authentication [1] * [NOTE] Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache) - * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Thunderbird closes>Settings * [1] https://en.wikipedia.org/wiki/Basic_access_authentication ***/ user_pref("privacy.clearOnShutdown.cache", true); user_pref("privacy.clearOnShutdown.cookies", true); @@ -1039,7 +1015,7 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); // user_pref("privacy.resistFingerprinting.testGranularityMask", 0); /* 4510: enforce no system colors - * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ + * [SETTING] General > Language & Appearance > Colors... > Use system colors ***/ user_pref("browser.display.use_system_colors", false); // [DEFAULT: false] /* 4511: enforce non-native widget theme * Security: removes/reduces system API calls, e.g. win32k API [1] @@ -1051,7 +1027,6 @@ user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true] * 1=most recent window or tab, 2=new window, 3=new tab * Stops malicious window sizes and some screen resolution leaks. * You can still right-click a link and open in a new window - * [SETTING] General>Tabs>Open links in tabs instead of new windows * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3] @@ -1073,7 +1048,6 @@ user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow * In fact, PB mode limits or removes the ability to control some of these, and you need to quit * Thunderbird to clear them. PB is best used as a one off window (Menu>New Private Window) to provide * a temporary self-contained new session. Close all Private Windows to clear the PB mode session. - * [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode * [1] https://wiki.mozilla.org/Private_Browsing * [2] https://support.mozilla.org/kb/common-myths-about-private-browsing ***/ // user_pref("browser.privatebrowsing.autostart", true); @@ -1082,8 +1056,7 @@ user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow user_pref("browser.cache.memory.enable", false); user_pref("browser.cache.memory.capacity", 0); /* 5003: disable saving passwords - * [NOTE] This does not clear any passwords already saved - * [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/ + * [NOTE] This does not clear any passwords already saved ***/ user_pref("signon.rememberSignons", false); /* 5004: disable permissions manager from writing to disk [FF41+] [RESTART] * [NOTE] This means any permission changes are session only @@ -1108,12 +1081,10 @@ user_pref("browser.sessionstore.resume_from_crash", false); * [1] https://bugzilla.mozilla.org/1281959 ***/ // user_pref("browser.download.forbid_open_with", true); /* 5013: disable browsing and download history - * [NOTE] We also clear history and downloads on exit (2803) - * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/ + * [NOTE] We also clear history and downloads on exit (2803) ***/ user_pref("places.history.enabled", false); /* 5016: discourage downloading to desktop - * 0=desktop, 1=downloads (default), 2=last used - * [SETTING] To set your default "downloads": General>Downloads>Save files to ***/ + * 0=desktop, 1=downloads (default), 2=last used ***/ // user_pref("browser.download.folderList", 2); /*** [SECTION 5500]: OPTIONAL HARDENING @@ -1420,14 +1391,14 @@ user_pref("mailnews.display.date_senders_timezone", false); /* 9130: Address book collection [SETUP-FEATURE] * Disable Thunderbird internal address book email collection * Consider using CardBook extension instead (https://addons.thunderbird.net/addon/cardbook/) - * [SETTING] Preferences>Composition>Addressing>Automatically add outgoing e-mail addresses... - * [SETTING][CARDBOOK] CardBook>Preferences>Email>Collect Outgoing Email ***/ + * [SETTING] Preferences > Composition > Addressing > Automatically add outgoing e-mail addresses... + * [SETTING][CARDBOOK] CardBook > Preferences > Email > Collect Outgoing Email ***/ // user_pref("mail.collect_addressbook", "jsaddrbook://history.sqlite"); user_pref("mail.collect_email_address_outgoing", false); /* 9131: Only use email addresses, without their Display Names [CARDBOOK] [SETUP-FEATURE] * By default, CardBook extension incorporates contacts display names in addresses fields. * This could leak sensitive information to all recipients. - * [SETTING][CARDBOOK] CardBook>Preferences>Email>Sending Emails>Only use email addresses... ***/ + * [SETTING][CARDBOOK] CardBook > Preferences > Email > Sending Emails > Only use email addresses... ***/ user_pref("extensions.cardbook.useOnlyEmail", true); /*** [SECTION 9200]: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) @@ -1441,11 +1412,9 @@ user_pref("_user.js.parrot", "9200 syntax error: this parrot has got no mail!"); * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=214729 * [3] https://stackoverflow.com/a/28531705 ***/ user_pref("intl.fallbackCharsetList.ISO-8859-1", "UTF-8"); -/* 9202: Set encoding of incoming mail - * [SETTING] Display > Advanced > Fonts & Encodings > Incoming Mail ***/ +/* 9202: Set encoding of incoming mail ***/ user_pref("mailnews.view_default_charset", "UTF-8"); -/* 9203: Set encoding of outgoing mail - * [SETTING] Display > Advanced > Fonts & Encodings > Outgoing Mail ***/ +/* 9203: Set encoding of outgoing mail ***/ user_pref("mailnews.send_default_charset", "UTF-8"); /* 9204: Forces encoding in reply to be the default charset * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=234958#c2 ***/ @@ -1471,7 +1440,7 @@ user_pref("mail.SpellCheckBeforeSend", false); * 3=Include both plain text and HTML message bodies in message) * Email that is HTML should also have plaintext multipart for plain text users. * [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html - * [SETTING] Edit > Preferences > Send Options > Send the message in both plain text and HTML ***/ + * [SETTING] Account Settings > Composition & Addressing > Composition > Compose messages in HTML format ***/ user_pref("mail.default_html_action", 1); /* 9212: Send email in plaintext unless expressly overridden. * [SETUP-FEATURE] Sometimes HTML is useful especially when used with Markdown Here @@ -1483,7 +1452,7 @@ user_pref("mail.html_compose", false); user_pref("mail.identity.default.compose_html", false); /* 9213: Downgrade email to plaintext by default * [SETUP-FEATURE] Only use HTML email if you need it, see above - * [SETTING] Edit > Preferences > Composition > Send Options > Send messages as plain-text if possible ***/ + * [SETTING] Composition > Composition > HTML Style > Configure text format behavior > Send options... > Send messages as plain text if possible ***/ user_pref("mailnews.sendformat.auto_downgrade", false); /* 9214: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, @@ -1574,7 +1543,7 @@ user_pref("calendar.useragent.extra", ""); * By default, extensive system detection would be performed to find user's current timezone. * Setting this preference to "UTC" should disable it. * You may also directly set it to your timezone, i.e. "Pacific/Fakaofo" - * [SETTING] Edit>Preferences>Calendar>Calendar>Timezone ***/ + * [SETTING] Calendar > Calendar > Timezone ***/ user_pref("calendar.timezone.local", "UTC"); // [DEFAULT: ""] /** RSS ***/ From fc22408d19a5fb709f661399990c5753ae3cdfac Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 8 Jan 2022 17:23:51 +0100 Subject: [PATCH 068/147] Fixes `mailnews.sendformat.auto_downgrade` wrongly left disabled --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index 9f0f4cd..855412b 100644 --- a/user.js +++ b/user.js @@ -1453,7 +1453,7 @@ user_pref("mail.identity.default.compose_html", false); /* 9213: Downgrade email to plaintext by default * [SETUP-FEATURE] Only use HTML email if you need it, see above * [SETTING] Composition > Composition > HTML Style > Configure text format behavior > Send options... > Send messages as plain text if possible ***/ -user_pref("mailnews.sendformat.auto_downgrade", false); +user_pref("mailnews.sendformat.auto_downgrade", true); /* 9214: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) From 616c2b1553b76e563071c03ae204e554d53f2757 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 8 Jan 2022 17:40:56 +0100 Subject: [PATCH 069/147] Removes Autocrypt and Enigmail addons preferences > Rationale : Thunderbird 78+ has builtin OpenPGP support for e-mail encryption. --- user.js | 52 +++++----------------------------------------------- 1 file changed, 5 insertions(+), 47 deletions(-) diff --git a/user.js b/user.js index 855412b..dc4e114 100644 --- a/user.js +++ b/user.js @@ -60,7 +60,7 @@ 9100: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) 9200: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) 9300: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) - 9400: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT / GNUPG) + 9400: THUNDERBIRD ENCRYPTION (OPENGPG / GNUPG) 9999: DEPRECATED / REMOVED / LEGACY / RENAMED ******/ @@ -1585,55 +1585,13 @@ user_pref("rss.show.summary", 1); * 0=no action, 1=load web page in default browser, on select ***/ user_pref("rss.message.loadWebPageOnSelect", 0); -/*** [SECTION 9400]: THUNDERBIRD ENCRYPTION (ENIGMAIL / AUTOCRYPT / GNUPG) - Options that relate to Enigmail addon and AutoCrypt. - GnuPG (and RNP) specific options should also land there. - [1] https://autocrypt.org - [2] https://www.enigmail.net/index.php/en/user-manual/advanced-operations - [3] https://wiki.mozilla.org/Thunderbird:OpenPGP +/*** [SECTION 9400]: THUNDERBIRD ENCRYPTION (OPENGPG / GNUPG) + Options that relate to e-mail encryption in Thunderbird. + [1] https://wiki.mozilla.org/Thunderbird:OpenPGP + [2] https://support.mozilla.org/kb/openpgp-thunderbird-howto-and-faq ***/ user_pref("_user.js.parrot", "9400 syntax error: this parrot is talking in codes!"); -/** ENIGMAIL ***/ -/* These used to be inversed, however it seems upstream has changed this behavior - * [1] https://www.privacy-handbuch.de/handbuch_31f.htm ***/ -/* 9401: Silence the Enigmail version header ***/ -user_pref("extensions.enigmail.addHeaders", false); // [DEFAULT: false] -/* 9402: Silence the Enigmail comment ***/ -user_pref("extensions.enigmail.useDefaultComment", true); // [DEFAULT: true] -/* 9403: Silence the version ***/ -user_pref("extensions.enigmail.agentAdditionalParam", "--no-emit-version --no-comments"); -/* 9404: Specifies the hash algorithm used by GnuPG for its cryptographic operations: - * 0=automatic selection, let GnuPG choose (default, recommended), 1=SHA1, 2=RIPEMD160 - * 3=SHA256, 4=SHA384, 5=SHA512 - * [NOTE] You should probably have a decent gpg.conf with things set. Examples - * [1] https://github.com/Whonix/anon-gpg-tweaks/blob/master/etc/skel/.gnupg/gpg.conf - * [2] https://github.com/ioerror/torbirdy/blob/master/gpg.conf - * ***/ -user_pref("extensions.enigmail.mimeHashAlgorithm", 5); -/* 9405: Protect subject line - * 0=Leave subject unprotected, - * 1=Show dialog with "Leave subject unprotected" (changes value to 0) - * or "Protect subject" (changes value to 2, - * 2=Protect subject***/ -user_pref("extensions.enigmail.protectedHeaders", 2); -/* 9406: Text to use as replacement for the subject, following the Memory Hole - * standard. If nothing is defined, then "Encrypted Message" is used. - ***/ -user_pref("extensions.enigmail.protectedSubjectText", "Encrypted Message"); // [DEFAULT: "Encrypted Message"] - -/** AUTOCRYPT ***/ -/* 9407: Choose whether to enable AutoCrypt - * [1] https://autocrypt.org/level1.html - * [2] https://redmine.tails.boum.org/code/issues/16186 - * [SETTING] Edit > Account Settings > OpenPGP Security > Autocrypt > Enable Autocrypt ***/ -user_pref("mail.server.default.enableAutocrypt", false); -/* 9408: Prefer email encryption with known contacts - * [SETTING] Edit > Account Settings > OpenPGP Security > Autocrypt > - * Prefer encrypted emails from the people you exchange email with - * [1] https://redmine.tails.boum.org/code/issues/15923 ***/ -user_pref("mail.server.default.acPreferEncrypt", 0); - /** GNUPG ***/ /* 9409: Allow the use of external GnuPG * Whenever RNP fails to decrypt a message, Thunderbird will tray against system GnuPG From c96eed17c083454ca22a63259b54908ade1def77 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 8 Jan 2022 17:55:30 +0100 Subject: [PATCH 070/147] Enforces `mail.phishing.detection.*` preferences --- user.js | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/user.js b/user.js index dc4e114..ba04579 100644 --- a/user.js +++ b/user.js @@ -1504,6 +1504,13 @@ user_pref("media.hardware-video-decoding.enabled", false); * 3=Prevent third-party images from loading * [1] http://kb.mozillazine.org/Permissions.default.image ***/ user_pref("permissions.default.image", 2); +/* 9240: Builtin phishing/scamming detection + * [NOTE] These preferences are enabled by default and should not usually be touched. + * [1] https://searchfox.org/comm-central/source/mail/modules/PhishingDetector.jsm ***/ +user_pref("mail.phishing.detection.enabled", true); +user_pref("mail.phishing.detection.disallow_form_actions", true); +user_pref("mail.phishing.detection.ipaddresses", true); +user_pref("mail.phishing.detection.mismatched_hosts", true); /*** [SECTION 9300]: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) Options that relate to other Thunderbird components such as the chat client, calendar and RSS) From c41232b1c3d135987fea61d70f2808861562f335 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 13 Feb 2022 12:44:18 +0100 Subject: [PATCH 071/147] Adds `security.osclientcerts.autoload` preference (left to default) --- user.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/user.js b/user.js index ba04579..1b04a10 100644 --- a/user.js +++ b/user.js @@ -519,6 +519,10 @@ user_pref("security.cert_pinning.enforcement_level", 2); * [2] https://blog.mozilla.org/security/tag/crlite/ ***/ user_pref("security.remote_settings.crlite_filters.enabled", true); user_pref("security.pki.crlite_mode", 2); +/* 1225: enable loading of client certificates stored in OS certificate storage + * Bug: this does **NOT** work for S/MIME [1] + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1726442 ***/ + // user_pref("security.osclientcerts.autoload", true); /** MIXED CONTENT ***/ /* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/ From 2d82b7cc0cfe432ccbb5c30656f5386cb53ef7f2 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 13 Feb 2022 12:50:38 +0100 Subject: [PATCH 072/147] Shows a prompt when opening a link in external applications as hardening --- user.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/user.js b/user.js index 1b04a10..941ad1e 100644 --- a/user.js +++ b/user.js @@ -1127,6 +1127,8 @@ user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ user_pref("javascript.options.wasm", false); +/* 5590: show a prompt when opening a link in external applications ***/ +user_pref("security.external_protocol_requires_permission", true); /*** [SECTION 6000]: DON'T TOUCH ***/ user_pref("_user.js.parrot", "6000 syntax error: the parrot's 'istory!"); From 7ffec7ed571fd5a16d4ea214827f5dd4815d1e2a Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 13 Feb 2022 12:54:05 +0100 Subject: [PATCH 073/147] Highers `mail.compose.big_attachments.threshold_kb` to 9220KB --- user.js | 1 + 1 file changed, 1 insertion(+) diff --git a/user.js b/user.js index 941ad1e..b03d0c3 100644 --- a/user.js +++ b/user.js @@ -1490,6 +1490,7 @@ user_pref("mail.inline_attachments", false); * [2] http://forums.mozillazine.org/viewtopic.php?f=39&t=2949521 */ user_pref("mail.compose.big_attachments.notify", true); // [DEFAULT: true] /* 9219: Set big attachment size to warn at */ +user_pref("mail.compose.big_attachments.threshold_kb", 9220); // [DEFAULT: 5120] // user_pref("mailnews.message_warning_size", 20971520); // [DEFAULT: 20971520] /** VIEW ***/ From 8719ad5a37e223cfb61fd0d4206721397bc5bee4 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 13 Feb 2022 13:00:15 +0100 Subject: [PATCH 074/147] Hides sensitive information from chat desktop notifications (if enabled) --- user.js | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/user.js b/user.js index b03d0c3..c2ad7fb 100644 --- a/user.js +++ b/user.js @@ -1541,6 +1541,13 @@ user_pref("purple.conversations.im.send_typing", false); // user_pref("messenger.startup.action", 0); /* 9307: When chat is enabled, do not report idle status ***/ // user_pref("messenger.status.reportIdle", false); +/* 9308: Disable chat desktop notifications ***/ + // user_pref("mail.chat.show_desktop_notifications", false); +/* 9309: Decide how much information will be shown in chat notifications + * 0=Show all info (sender, chat message message preview), + * 1=Show sender's info only (not message preview), + * 2=No info (fill dummy values). ***/ +user_pref("mail.chat.notification_info", 2); /** CALENDAR ***/ /* 9310: Disable calendar integration From 9b7b22420dbde04100a7a83bfac8f3ee274c80fe Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 13 Feb 2022 13:01:30 +0100 Subject: [PATCH 075/147] Cleans removed `mail.cloud_files.inserted_urls.footer.link` preference --- user.js | 1 - 1 file changed, 1 deletion(-) diff --git a/user.js b/user.js index c2ad7fb..657b00d 100644 --- a/user.js +++ b/user.js @@ -1351,7 +1351,6 @@ user_pref("mail.showCondensedAddresses", false); /* 9112: Disable "Filelink for Large Attachments" feature * [1] https://support.thunderbird.net/kb/filelink-large-attachments ***/ user_pref("mail.cloud_files.enabled", false); -user_pref("mail.cloud_files.inserted_urls.footer.link", ""); /* 9113: Don't hide cookies and passwords related (advanced?) buttons ***/ user_pref("pref.privacy.disable_button.view_cookies", false); user_pref("pref.privacy.disable_button.cookie_exceptions", false); From c4172ac672a8ee9025fd39b2c68e27e2a7a1c03d Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 18 Apr 2022 16:42:58 +0200 Subject: [PATCH 076/147] [META] Bumps to v91.0 --- LICENSE | 2 +- user.js | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/LICENSE b/LICENSE index 191ecac..48b65d5 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2019-2021 HorlogeSkynet +Copyright (c) 2019-2022 HorlogeSkynet Copyright (c) 2019 dngray Copyright (c) 2019 arkenfox [prev. ghacksuserjs] diff --git a/user.js b/user.js index 657b00d..f70f715 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 14 December 2021 -* version: v91-beta +* date: 18 April 2022 +* version: v91.0 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases From f45c0a3d750ef4baecbd5a4d384627c122cdeadb Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Apr 2022 11:52:24 +0200 Subject: [PATCH 077/147] [CI] Bumps `actions/checkout` and `actions/setup-node` to v3 --- .github/workflows/linting.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index f27b850..5b560e8 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -9,9 +9,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v3 - - uses: actions/setup-node@v2 + - uses: actions/setup-node@v3 - run: npm install -g eslint - run: eslint user.js From e5fdab03ee2417c80a3b2c9f206c6aa9ec787a67 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 23 May 2022 16:59:43 +0200 Subject: [PATCH 078/147] Adds `mail.compose.other.header` preference to template > See #19. --- user.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/user.js b/user.js index f70f715..e87fe2e 100644 --- a/user.js +++ b/user.js @@ -594,6 +594,9 @@ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); * [NOTE] DNT is enforced with Enhanced Tracking Protection (2710) * [SETTING] Privacy & Security > Privacy > Web Content > Send websites a "Do Not Track" signal... ***/ user_pref("privacy.donottrackheader.enabled", true); +/* 1690: add emails custom headers + * [NOTE] The value of each header can be set in the compose window by clicking on the "double-arrow" drop-down ***/ + // user_pref("mail.compose.other.header", "X-Custom-Header,X-Another-Custom-Header"); /*** [SECTION 1700]: CONTAINERS Check out Temporary Containers [2], read the article [3], and visit the wiki/repo [4] From 5c59028af9035a3ee64fe7843e0844571104efcf Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 23 May 2022 17:05:15 +0200 Subject: [PATCH 079/147] Adds a note about empty User-Agent breaking Microsoft Exchange OAuth2 > See #19. --- user.js | 1 + 1 file changed, 1 insertion(+) diff --git a/user.js b/user.js index e87fe2e..08cb259 100644 --- a/user.js +++ b/user.js @@ -1253,6 +1253,7 @@ user_pref("dom.event.clipboardevents.enabled", false); /*** [SECTION 8000]: DON'T BOTHER: NON-RFP [WHY] They are insufficient to help anti-fingerprinting and do more harm than good [WARNING] DO NOT USE with RFP. RFP already covers these and they can interfere + [NOTE] An empty User-Agent may break Microsoft Exchange OAuth2 login ***/ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan"); /* 8001: disable APIs ***/ From 50afdb9a57aeacd9f086f0a77fa731e308d0731a Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 23 May 2022 18:49:57 +0200 Subject: [PATCH 080/147] Enforces `mail.suppress_content_language` & `mail.sanitize_date_header` > closes #19 --- user.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/user.js b/user.js index 08cb259..a8677a2 100644 --- a/user.js +++ b/user.js @@ -1439,6 +1439,12 @@ user_pref("mailnews.reply_header_type", 1); user_pref("mailnews.reply_header_authorwrotesingle", "#1 wrote:"); // user_pref("mailnews.reply_header_ondateauthorwrote", "On #2 #3, #1 wrote:"); // user_pref("mailnews.reply_header_authorwroteondate", "#1 wrote on #2 #3:"); +/* 9206: Prevent spellchecking dictionary leakage through Content-Language header + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1370217 ***/ +user_pref("mail.suppress_content_language", true); +/* 9207: Sanitize Date header to convert date to UTC and round to closest minute + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1603359 ***/ +user_pref("mail.sanitize_date_header", true); /** COMPOSITION ***/ /* 9210: Check spelling before sending [SETUP-FEATURE] From fb31ebb30412fd2d019d5c15c8a1c6e30495d97d Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 25 May 2022 09:05:41 +0200 Subject: [PATCH 081/147] Prefers "personal" section (9000) for `mail.compose.other.header` pref > followup for e5fdab03ee2417c80a3b2c9f206c6aa9ec787a67. --- user.js | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/user.js b/user.js index a8677a2..b5d118e 100644 --- a/user.js +++ b/user.js @@ -594,9 +594,6 @@ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); * [NOTE] DNT is enforced with Enhanced Tracking Protection (2710) * [SETTING] Privacy & Security > Privacy > Web Content > Send websites a "Do Not Track" signal... ***/ user_pref("privacy.donottrackheader.enabled", true); -/* 1690: add emails custom headers - * [NOTE] The value of each header can be set in the compose window by clicking on the "double-arrow" drop-down ***/ - // user_pref("mail.compose.other.header", "X-Custom-Header,X-Another-Custom-Header"); /*** [SECTION 1700]: CONTAINERS Check out Temporary Containers [2], read the article [3], and visit the wiki/repo [4] @@ -1312,6 +1309,7 @@ user_pref("mailnews.start_page_override.mstone", "ignore"); // master switch /* RETURN RECEIPT BEHAVIOR ***/ // user_pref("mail.mdn.report.enabled", false); // disable return receipt sending unconditionally /* CUSTOM HEADERS ***/ + // user_pref("mail.compose.other.header", "X-Custom-Header,X-Another-Custom-Header"); // corresponding values can be set in compose window ("double-arrow" drop-down) // user_pref("mail.identity.id1.headers", "References, InReplyTo"); // user_pref("mail.identity.id1.header.References", "References: <2ad46d80-c8ce-49a3-9896-16171788ac28@example.tld>\n <31ff00c2-b7cb-4063-beeb-a0bdd424c3a7@example1.tld>"); // user_pref("mail.identity.id1.header.InReplyTo", "In-Reply-To: <31ff00c2-b7cb-4063-beeb-a0bdd424c3a7@example1.tld>"); From 68628a397afd2f6a9614b8c419baee47849f7abb Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 24 May 2022 22:13:39 +0200 Subject: [PATCH 082/147] [META] Bumps to v91.1 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index b5d118e..5c112a2 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 18 April 2022 -* version: v91.0 +* date: 25 May 2022 +* version: v91.1 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases From f8466f15ddcb41b6625e6dc1c38350ba207c2a6f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 11 Jun 2022 12:20:49 +0200 Subject: [PATCH 083/147] When "HTML" literal is used in documentation, prefers its uppercase form This will simplify lookups when case-sensitivity matching is enabled. --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 5c112a2..c5dfcf8 100644 --- a/user.js +++ b/user.js @@ -1482,7 +1482,7 @@ user_pref("mailnews.display.disallow_mime_handlers", 3); * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 * [3] https://www.bucksch.org/1/projects/mozilla/108153/ ***/ user_pref("mailnews.display.html_as", 3); -/* 9216: Prefer to view as plaintext or html [SETUP-FEATURE] +/* 9216: Prefer to view as plaintext or HTML [SETUP-FEATURE] * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body * false=Display a message as HTML when there is both a HTML and a plain text @@ -1591,7 +1591,7 @@ user_pref("rss.display.disallow_mime_handlers", 3); * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 * [3] https://www.bucksch.org/1/projects/mozilla/108153/ user_pref("rss.display.html_as", 1); -/* 9322: Prefer to view as plaintext or html +/* 9322: Prefer to view as plaintext or HTML * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body * false=Display a message as HTML when there is both a HTML and a plain text From db12db282f1bc5d127a254b1ac908a335d93ac9f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 18 Jul 2022 19:56:56 +0200 Subject: [PATCH 084/147] Improves `permissions.memory_only` preference documentation * Replaces `NOTE` tag by a proper `SETUP-CHROME` as it affects Thunderbird runtime behavior * Mentions that reading from disk gets disabled too * Mentions that "remote mail content" permissions are also affected > see #23 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index c5dfcf8..402b169 100644 --- a/user.js +++ b/user.js @@ -1062,8 +1062,8 @@ user_pref("browser.cache.memory.capacity", 0); /* 5003: disable saving passwords * [NOTE] This does not clear any passwords already saved ***/ user_pref("signon.rememberSignons", false); -/* 5004: disable permissions manager from writing to disk [FF41+] [RESTART] - * [NOTE] This means any permission changes are session only +/* 5004: disable permissions manager from reading or writing to disk [FF41+] [RESTART] + * [SETUP-CHROME] This means any permission changes (cookie or mail remote content) are session only * [1] https://bugzilla.mozilla.org/967812 ***/ user_pref("permissions.memory_only", true); // [HIDDEN PREF] /* 5005: disable intermediate certificate caching [FF41+] [RESTART] From 6c5d84bc896cb07deb2390c06160e97ace360cac Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 24 Aug 2022 10:09:15 +0200 Subject: [PATCH 085/147] Leaves `mail.tabs.autoHide` to its default value (disabled) This preference is strictly _personal_ and should not be enforced in the template. > see #21 > closes #25 --- user.js | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/user.js b/user.js index 402b169..82f2a1f 100644 --- a/user.js +++ b/user.js @@ -1299,6 +1299,7 @@ user_pref("mailnews.start_page_override.mstone", "ignore"); // master switch // user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX] /* UX BEHAVIOR ***/ // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux] + // user_pref("mail.tabs.autoHide", true); // hides the tab bar if there is only one tab // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART] /* UX FEATURES ***/ // user_pref("reader.parse-on-load.enabled", false); // Reader View @@ -1343,9 +1344,6 @@ user_pref("mailnews.auto_config.addons_url",""); user_pref("mail.provider.enabled", false); /** UI (User Interface) ***/ -/* 9110: Hide tab bar - * false=Hides the tab bar if there is only one tab. (default) ***/ -user_pref("mail.tabs.autoHide", true); /* 9111: Show full email instead of just name from address book * true=Show just the display name for people in the address book (default) * false=Show both the email address and display name. ***/ From e95dc540c936a8b287323f6d0e18e29cf798da58 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 24 Aug 2022 10:10:01 +0200 Subject: [PATCH 086/147] [META] Bumps to v91.2 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 82f2a1f..a69ad15 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 25 May 2022 -* version: v91.1 +* date: 24 August 2022 +* version: v91.2 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) * releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases From 4dc99eb87ff407d605126f6bd13f704dbf0553bd Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 14 Jul 2022 13:05:16 +0200 Subject: [PATCH 087/147] Applies Arkenfox v91..v102 migration > **WORK IN PROGRESS FOR ESR 102 : DO NOT USE IT AS IS** Migration status : * updated README * updated header * updated index * updated sections --- README.md | 18 +- user.js | 731 +++++++++++++++++++++++------------------------------- 2 files changed, 316 insertions(+), 433 deletions(-) diff --git a/README.md b/README.md index b9a5f07..2032c4d 100644 --- a/README.md +++ b/README.md @@ -2,18 +2,17 @@ > Thunderbird privacy, security and anti-fingerprinting: a comprehensive user.js template for configuration and hardening -### :purple_square: user.js +### 🟪 user.js -An `user.js` is a configuration file that can control hundreds of Thunderbird settings. -For a more technical breakdown and explanation, you can read more on the [overview](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/1.1-Overview) Wiki page. +An `user.js` is a configuration file that can control Thunderbird settings - for a more technical breakdown and explanation, you can read more in the [wiki](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/1.1-Overview). -### :green_square: Thunderbird user.js +### 🟩 Thunderbird user.js [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) The `thunderbird user.js` is a **template** which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen). -Everyone, experts included, should at least read the [implementation](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/1.3-Implementation) wiki page. +Everyone, experts included, should at least read the [wiki](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki), as it contains important information regarding a few `user.js` settings. It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird as an **e-mail client** and disable as many web browsing features as possible. We believe web browsing should be done in a web browser, and not an email client. @@ -22,23 +21,22 @@ It differs from the `arkenfox user.js` in that the focus is to keep Thunderbird - For information about [extensions](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/4.1-Extensions), see the Wiki. - **Calendar** users should [see this page](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki/4.1.1-Calendar). -Also be aware that this `user.js` is made specifically for Thunderbird and has only been tested in the latest stable release. +Also be aware that this `user.js` is made specifically for Thunderbird and is only being tested against releases with extended support (ESR). -### :orange_square: Sitemap +### 🟧 Sitemap - [Releases](https://github.com/HorlogeSkynet/thunderbird-user.js/releases) - [Issues](https://github.com/HorlogeSkynet/thunderbird-user.js/issues) - [Wiki](https://github.com/HorlogeSkynet/thunderbird-user.js/wiki) -### :red_square: Acknowledgments +### 🟥 Acknowledgments * @tya99 most of the ground work and initial port from the Firefox version of [arkenfox user.js](https://github.com/arkenfox/user.js) * [@dngray](https://github.com/dngray) continual maintenance and Wiki * [@HorlogeSkynet](https://github.com/HorlogeSkynet) continual maintenance -### :blue_square: Related Projects +### 🟦 Related Projects * [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31p.htm) * [Privacy Haters](http://r-36.net/scm/privacy-haters/file/README.md.html) * [12bytes.org's user-overrides.js](https://codeberg.org/12bytes.org/thunderbird-user.js-supplement) -* ~~CHEF-KOCH/TBCK~~ diff --git a/user.js b/user.js index a69ad15..cf46d8e 100644 --- a/user.js +++ b/user.js @@ -1,26 +1,24 @@ /****** * name: thunderbird user.js * date: 24 August 2022 -* version: v91.2 +* version: v102.0-beta1 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) -* releases: https://github.com/HorlogeSkynet/thunderbird-user.js/releases * README: 1. Consider using Tor if it meets your needs or fits your threat model - * https://www.torproject.org/about/torusers.html.en - 2. Required reading: Overview, Backing Up, and Implementation entries + * https://2019.www.torproject.org/about/torusers.html + 2. Read the entire wiki * https://github.com/HorlogeSkynet/thunderbird-user.js/wiki 3. If you skipped step 2, return to step 2 4. Make changes - * There are often trade-offs and conflicts between security vs privacy vs anti-fingerprinting + * There are often trade-offs and conflicts between security vs privacy vs anti-tracking and these need to be balanced against functionality & convenience & breakage * Some site breakage and unintended consequences will happen. Everyone's experience will differ - e.g. some user data is erased on close (section 2800), change this to suit your needs + e.g. some user data is erased on exit (section 2800), change this to suit your needs * While not 100% definitive, search for "[SETUP" tags e.g. wanna re-enable account auto configuration? check 9101 & 9102 - * Take the wiki link in step 2 and read the Troubleshooting entry 5. Some tag info [SETUP-INSTALL] if you experience any issue during Thunderbird setting up, read it [SETUP-FEATURE] if you miss some (expected) Thunderbird features, read it @@ -28,6 +26,12 @@ [SETUP-WEB] can cause some websites to break [SETUP-CHROME] changes how Thunderbird itself behaves (i.e. not directly website related) +* RELEASES: https://github.com/HorlogeSkynet/thunderbird-user.js/releases + * It is best to use the release that is optimized for and matches your Thunderbird version + * ESR91 users + - If you are not using thunderbird-user.js v91... (not a definitive list) + - 9999: switch the appropriate deprecated section(s) back on + * INDEX: 0100: STARTUP @@ -44,18 +48,15 @@ 1600: HEADERS / REFERERS 1700: CONTAINERS 2000: PLUGINS / MEDIA / WEBRTC - 2300: WEB WORKERS 2400: DOM (DOCUMENT OBJECT MODEL) 2600: MISCELLANEOUS - 2700: PERSISTENT STORAGE - 2800: SHUTDOWN - 4000: FPI (FIRST PARTY ISOLATION) + 2800: SHUTDOWN & SANITIZING 4500: RFP (RESIST FINGERPRINTING) 5000: OPTIONAL OPSEC 5500: OPTIONAL HARDENING 6000: DON'T TOUCH 7000: DON'T BOTHER - 8000: DON'T BOTHER: NON-RFP + 8000: DON'T BOTHER: FINGERPRINTING 9000: PERSONAL 9100: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) 9200: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) @@ -110,12 +111,13 @@ user_pref("browser.region.update.enabled", false); // [FF79+] user_pref("intl.accept_languages", "en-US, en"); /* 0210b: Set dictionary to US ***/ user_pref("spellchecker.dictionary", "en-US"); -/* 0211: use US English locale regardless of the system locale +/* 0211: use en-US locale regardless of the system or region locale * [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages [1] + * [TEST] https://arkenfox.github.io/TZP/tests/formatting.html * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 ***/ user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] -/*** [SECTION 0300]: QUIET BIRD +/*** [SECTION 0300]: QUIETER BIRD Starting in user.js v68, we only disable the auto-INSTALL of Thunderbird. You still get prompts to update, in one click. We have NEVER disabled auto-CHECKING, and highly discourage that. @@ -124,28 +126,6 @@ user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] still important to do updates for security reasons, please do so manually if you make changes. ***/ user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!"); -/** UPDATES ***/ -/* 0301: disable auto-INSTALLING Thunderbird updates [NON-WINDOWS] - * [NOTE] You will still get prompts to update, and should do so in a timely manner ***/ -user_pref("app.update.auto", false); -/* 0302: disable auto-INSTALLING Thunderbird updates via a background service [FF90+] [WINDOWS] - * [SETTING] General > Thunderbird Updates > Automatically install updates > Use a background service to install updates - * [1] https://support.mozilla.org/kb/enable-background-updates-firefox-windows ***/ -user_pref("app.update.background.scheduling.enabled", false); -/* 0303: disable auto-CHECKING for extension and theme updates ***/ - // user_pref("extensions.update.enabled", false); -/* 0304: disable auto-INSTALLING extension and theme updates (after the check in 0303) - * [SETTING] about:addons > Extensions > [cog-wheel-icon] > Update Add-ons Automatically (toggle) ***/ - // user_pref("extensions.update.autoUpdateDefault", false); -/* 0305: disable extension metadata - * used when installing/updating an extension, and in daily background update checks: - * when false, extension detail tabs will have no description - * [NOTE] Unlike arkenfox/user.js, we explicitly disable it ***/ -user_pref("extensions.getAddons.cache.enabled", false); -/* 0306: disable search engine updates (e.g. OpenSearch) - * [NOTE] This does not affect Mozilla's built-in or Web Extension search engines ***/ -user_pref("browser.search.update", false); - /** RECOMMENDATIONS ***/ /* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/ user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF] @@ -161,7 +141,7 @@ user_pref("datareporting.policy.dataSubmissionEnabled", false); * [SETTING] Privacy & Security > Thunderbird Data Collection and Use > Allow Thunderbird to send technical... ***/ user_pref("datareporting.healthreport.uploadEnabled", false); /* 0332: disable telemetry - * The "unified" pref affects the behaviour of the "enabled" pref + * The "unified" pref affects the behavior of the "enabled" pref * - If "unified" is false then "enabled" controls the telemetry module * - If "unified" is true then "enabled" only controls whether to record extended data * [NOTE] "toolkit.telemetry.enabled" is now LOCKED to reflect prerelease (true) or release builds (false) [2] @@ -212,9 +192,6 @@ user_pref("network.captive-portal-service.enabled", false); // [FF52+] /* 0361: disable Network Connectivity checks [FF65+] * [1] https://bugzilla.mozilla.org/1460537 ***/ user_pref("network.connectivity-service.enabled", false); -/* 0362: enforce disabling of Web Compatibility Reporter [FF56+] - * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla ***/ -user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] /* 0370: disable UI instrumentation ***/ user_pref("mail.instrumentation.postUrl", ""); user_pref("mail.instrumentation.askUser", false); @@ -226,7 +203,7 @@ user_pref("mail.instrumentation.userOptedIn", false); * value. If it's unset (default too) or lower than the current version, notification is displayed. * false=always show the notification * true=never show the notification - * [1] https://searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/specialTabs.js#1218 ***/ + * [1] https://searchfox.org/comm-esr102/source/mail/base/content/specialTabs.js#1266 ***/ user_pref("mail.rights.override", true); // [DEFAULT: unset] // user_pref("mail.rights.version", 1) // [DEFAULT: unset] /* 0380: disable the unread message count badge on taskbar icon @@ -236,9 +213,8 @@ user_pref("mail.rights.override", true); // [DEFAULT: unset] /*** [SECTION 0400]: SAFE BROWSING (SB) SB has taken many steps to preserve privacy. If required, a full url is never sent to Google, only a part-hash of the prefix, hidden with noise of other real part-hashes. - Firefox takes measures such as stripping out identifying parameters and since SBv4 (FF57+) + Thunderbird takes measures such as stripping out identifying parameters and since SBv4 (FF57+) doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity) - FWIW, Google also swear it is anonymized and only used to flag malicious sites. [1] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ [2] https://wiki.mozilla.org/Security/Safe_Browsing @@ -256,15 +232,15 @@ user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); * To verify the safety of certain executable files, Thunderbird may submit some information about the * file, including the name, origin, size and a cryptographic hash of the contents, to the Google * Safe Browsing service which helps Thunderbird determine whether or not the file should be blocked - * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override it ***/ + * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override this ***/ user_pref("browser.safebrowsing.downloads.remote.enabled", false); -user_pref("browser.safebrowsing.downloads.remote.url", ""); + // user_pref("browser.safebrowsing.downloads.remote.url", ""); // Defense-in-depth /* 0404: disable SB checks for unwanted software ***/ // user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); // user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); /* 0405: disable "ignore this warning" on SB warnings [FF45+] * If clicked, it bypasses the block for that session. This is a means for admins to enforce SB - * [TEST] see github wiki APPENDIX A: Test Sites: Section 5 + * [TEST] see https://github.com/arkenfox/user.js/wiki/Appendix-A-Test-Sites#-mozilla * [1] https://bugzilla.mozilla.org/1226490 ***/ // user_pref("browser.safebrowsing.allowOverride", false); @@ -279,11 +255,11 @@ user_pref("network.dns.disablePrefetch", true); // user_pref("network.dns.disablePrefetchFromHTTPS", true); // [DEFAULT: true] /* 0603: disable predictor / prefetching ***/ user_pref("network.predictor.enabled", false); - // user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false] +user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false] /* 0604: disable link-mouseover opening connection to linked server * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/ user_pref("network.http.speculative-parallel-limit", 0); -/* 0605: enforce no "Hyperlink Auditing" (click tracking) +/* 0610: enforce no "Hyperlink Auditing" (click tracking) * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/ // user_pref("browser.send_pings", false); // [DEFAULT: false] /* 0610: don't refresh nor reload pages when tab/window is not active or in idle state @@ -314,18 +290,29 @@ user_pref("network.proxy.socks_remote_dns", true); * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/ user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] /* 0704: disable GIO as a potential proxy bypass vector [FF60+] - * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda, - * gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64) + * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, + * dav, cdda, gphoto2, trash, etc. By default only sftp is accepted (FF87+) * [1] https://bugzilla.mozilla.org/1433507 * [2] https://en.wikipedia.org/wiki/GVfs * [3] https://en.wikipedia.org/wiki/GIO_(software) ***/ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] -/* 0705: disable DNS-over-HTTPS (DoH) rollout [FF60+] +/* 0705: disable proxy direct failover for system requests [FF91+] + * [WARNING] Default true is a security feature against malicious extensions [1] + * [SETUP-CHROME] If you use a proxy and you trust your extensions + * [1] https://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ ***/ + // user_pref("network.proxy.failover_direct", false); +/* 0706: disable proxy bypass for system request failures [FF95+] + * RemoteSettings, UpdateService, Telemetry [1] + * [WARNING] If false, this will break the fallback for some security features + * [SETUP-CHROME] If you use a proxy and you understand the security impact + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 ***/ + // user_pref("network.proxy.allow_bypass", false); // [HIDDEN PREF FF95-96] +/* 0710: disable DNS-over-HTTPS (DoH) rollout [FF60+] * 0=off by default, 2=TRR (Trusted Recursive Resolver) first, 3=TRR only, 5=explicitly off - * see "doh-rollout.home-region": USA Feb 2020, Canada July 2021 [3] + * see "doh-rollout.home-region": USA 2019, Canada 2021, Russia/Ukraine 2022 [3] * [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ * [2] https://wiki.mozilla.org/Security/DOH-resolver-policy - * [3] https://blog.mozilla.org/mozilla/news/firefox-by-default-dns-over-https-rollout-in-canada/ + // * [3] https://support.mozilla.org/en-US/kb/firefox-dns-over-https * [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/ // user_pref("network.trr.mode", 5); /* 0706: disable proxy direct failover for system requests [FF91+] @@ -354,11 +341,11 @@ user_pref("keyword.enabled", false); // [DEFAULT: false] user_pref("browser.fixup.alternate.enabled", false); /* 0804: disable live search suggestions * [NOTE] Both must be true for the location bar to work - * [SETUP-CHROME] Change these if you trust and use a privacy respecting search engine ***/ + * [SETUP-CHROME] Override this if you trust and use a privacy respecting search engine ***/ user_pref("browser.search.suggest.enabled", false); /* 0810: disable search and form history * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] - * [NOTE] We also clear formdata on exit (2803) + * [NOTE] We also clear formdata on exit (2811) * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html * [2] https://bugzilla.mozilla.org/381681 ***/ user_pref("browser.formfill.enable", false); @@ -374,7 +361,7 @@ user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] /* 0820: disable coloring of visited links * Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing - * attacks. Don't forget clearing history on close (2803). However, social engineering [2#limits][4][5] + * attacks. Don't forget clearing history on exit (2811). However, social engineering [2#limits][4][5] * and advanced targeted timing attacks could still produce usable results * [1] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector * [2] https://dbaron.org/mozilla/visited-privacy @@ -387,15 +374,11 @@ user_pref("layout.css.visited_links_enabled", false); [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas ***/ user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!"); -/* 0901: set when Thunderbird should prompt for the primary password - * 0=once per session (default), 1=every time it's needed, 2=after n minutes (0902) ***/ -user_pref("security.ask_for_password", 2); -/* 0902: set how long in minutes Thunderbird should remember the primary password (0901) ***/ - // user_pref("security.password_lifetime", 30); // [DEFAULT: 30] /* 0903: disable auto-filling username & password form fields * can leak in cross-site forms *and* be spoofed * [NOTE] Username & password is still available when you enter the field - * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ ***/ + * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ + * [2] https://homes.esat.kuleuven.be/~asenol/leaky-forms/ ***/ user_pref("signon.autofillForms", false); /* 0904: disable formless login capture for Password Manager [FF51+] ***/ user_pref("signon.formlessCapture.enabled", false); @@ -422,11 +405,10 @@ user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false] user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); /* 1001: disable disk cache * [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this - * [NOTE] We also clear cache on exit (2803) ***/ + * [NOTE] We also clear cache on exit (2811) ***/ user_pref("browser.cache.disk.enable", false); /* 1002: disable media cache from writing to disk in Private Browsing - * [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB - * [SETUP-WEB] ESR78: playback might break on subsequent loading (1650281) ***/ + * [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/ user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+] user_pref("media.memory_cache_max_size", 65536); /* 1003: disable storing extra session data [SETUP-CHROME] @@ -437,11 +419,6 @@ user_pref("browser.sessionstore.privacy_level", 2); * Increasing this can help on older machines and some websites, as well as reducing writes [1] * [1] https://bugzilla.mozilla.org/1304389 ***/ user_pref("browser.sessionstore.interval", 30000); // [DEFAULT: 15000] -/* 1006: disable favicons in shortcuts - * URL shortcuts use a cached randomly named .ico file which is stored in your - * profile/shortcutCache directory. The .ico remains after the shortcut is deleted - * If set to false then the shortcuts use a generic Firefox icon ***/ -user_pref("browser.shell.shortcutFavicons", false); /*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) Your cipher and other settings can be used in server side fingerprinting @@ -453,22 +430,23 @@ user_pref("browser.shell.shortcutFavicons", false); user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); /** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/ /* 1201: require safe negotiation - * Blocks connections (SSL_ERROR_UNSAFE_NEGOTIATION) to servers that don't support RFC 5746 [2] - * as they're potentially vulnerable to a MiTM attack [3]. A server without RFC 5746 can be - * safe from the attack if it disables renegotiations but the problem is that the browser can't - * know that. Setting this pref to true is the only way for the browser to ensure there will be - * no unsafe renegotiations on the channel between the browser and the server. - * [STATS] SSL Labs (July 2021) reports over 99% of sites have secure renegotiation [4] + * Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a + * MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations + * but the problem is that the browser can't know that. Setting this pref to true is the only way for the + * browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server + * [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site? + * [STATS] SSL Labs (July 2021) reports over 99% of top sites have secure renegotiation [4] * [1] https://wiki.mozilla.org/Security:Renegotiation - * [2] https://tools.ietf.org/html/rfc5746 + * [2] https://datatracker.ietf.org/doc/html/rfc5746 * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 * [4] https://www.ssllabs.com/ssl-pulse/ ***/ user_pref("security.ssl.require_safe_negotiation", true); -/* 1203: reset TLS 1.0 and 1.1 downgrades i.e. session only ***/ -user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false] /* 1206: disable TLS1.3 0-RTT (round-trip time) [FF51+] + * This data is not forward secret, as it is encrypted solely under keys derived using + * the offered PSK. There are no guarantees of non-replay between connections * [1] https://github.com/tlswg/tls13-spec/issues/1001 - * [2] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/ + * [2] https://www.rfc-editor.org/rfc/rfc9001.html#name-replay-attacks-with-0-rtt + * [3] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/ user_pref("security.tls.enable_0rtt_data", false); /** OCSP (Online Certificate Status Protocol) @@ -484,8 +462,8 @@ user_pref("security.tls.enable_0rtt_data", false); * [1] https://en.wikipedia.org/wiki/Ocsp ***/ user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] /* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail [SETUP-WEB] - * When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail) - * Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail) + * When a CA cannot be reached to validate a cert, Thunderbird's just continues the connection (=soft-fail) + * Setting this pref to true tells Thunderbird's to instead terminate the connection (=hard-fail) * It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it * could have been revoked) and/or you could be under attack (e.g. malicious blocking of OCSP servers) * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ @@ -493,14 +471,6 @@ user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] user_pref("security.OCSP.require", true); /** CERTS / HPKP (HTTP Public Key Pinning) ***/ -/* 1220: disable or limit SHA-1 certificates - * 0 = allow all - * 1 = block all - * 3 = only allow locally-added roots (e.g. anti-virus) (default) - * 4 = only allow locally-added roots or for certs in 2015 and earlier - * [SETUP-CHROME] If you have problems, update your software: SHA-1 is obsolete - * [1] https://blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ ***/ -user_pref("security.pki.sha1_enforcement_level", 1); /* 1221: disable Windows 8.1's Microsoft Family Safety cert [FF50+] [WINDOWS] * 0=disable detecting Family Safety mode and importing the root * 1=only attempt to detect Family Safety mode (don't import the root) @@ -514,8 +484,11 @@ user_pref("security.family_safety.mode", 0); * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/ user_pref("security.cert_pinning.enforcement_level", 2); /* 1224: enable CRLite [FF73+] - * In FF84+ it covers valid certs and in mode 2 doesn't fall back to OCSP - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985 + * 0 = disabled + * 1 = consult CRLite but only collect telemetry + * 2 = consult CRLite and enforce both "Revoked" and "Not Revoked" results + * 3 = consult CRLite and enforce "Not Revoked" results, but defer to OCSP for "Revoked" (FF99+, default FF100+) + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985,1753071 * [2] https://blog.mozilla.org/security/tag/crlite/ ***/ user_pref("security.remote_settings.crlite_filters.enabled", true); user_pref("security.pki.crlite_mode", 2); @@ -530,14 +503,14 @@ user_pref("security.mixed_content.block_display_content", true); /* 1244: enable HTTPS-Only mode in all windows [FF76+] * When the top-level is HTTPS, insecure subresources are also upgraded (silent fail) * [TEST] http://example.com [upgrade] - * [TEST] http://neverssl.com/ [no upgrade] ***/ + * [TEST] http://httpforever.com/ [no upgrade] ***/ user_pref("dom.security.https_only_mode", true); // [FF76+] user_pref("dom.security.https_only_mode_pbm", true); // [FF80+] /* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/ user_pref("dom.security.https_only_mode.upgrade_local", true); /* 1246: disable HTTP background requests [FF82+] - * When attempting to upgrade, if the server doesn't respond within 3 seconds, - * Firefox sends HTTP requests in order to check if the server supports HTTPS or not + * When attempting to upgrade, if the server doesn't respond within 3 seconds, Thunderbird sends + * a top-level HTTP request without path in order to check if the server supports HTTPS or not * This is done to avoid waiting for a timeout which takes 90 seconds * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/ user_pref("dom.security.https_only_mode_send_http_background_request", false); @@ -557,8 +530,6 @@ user_pref("browser.ssl_override_behavior", 1); * i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/) * [TEST] https://expired.badssl.com/ ***/ user_pref("browser.xul.error_pages.expert_bad_cert", true); -/* 1273: display "Not Secure" text on HTTP sites ***/ -user_pref("security.insecure_connection_text.enabled", true); // [FF60+] /* 1280: display warnings when insecure HTTP connections are made ***/ user_pref("security.warn_entering_weak", true); user_pref("security.warn_leaving_secure", true); @@ -568,15 +539,17 @@ user_pref("security.warn_viewing_mixed", true); user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!"); /* 1401: disable rendering of SVG OpenType fonts ***/ user_pref("gfx.font_rendering.opentype_svg.enabled", false); -/* 1402: limit font visibility (Windows, Mac, some Linux) [FF79+] - * [NOTE] In FF80+ RFP ignores the pref and uses value 1 +/* 1402: limit font visibility (Windows, Mac, some Linux) [FF94+] * Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts [1], bundled fonts are auto-allowed + * In normal windows: uses the first applicable: RFP (4506) over TP over Standard + * In Private Browsing windows: uses the most restrictive between normal and private * 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts * [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc ***/ -user_pref("layout.css.font-visibility.level", 1); + // user_pref("layout.css.font-visibility.private", 1); + // user_pref("layout.css.font-visibility.standard", 1); + // user_pref("layout.css.font-visibility.trackingprotection", 1); /*** [SECTION 1600]: HEADERS / REFERERS - Expect some breakage e.g. banks: use an extension if you need precise control full URI: https://example.com:8888/foo/bar.html?id=1234 scheme+host+port+path: https://example.com:8888/foo/bar.html scheme+host+port: https://example.com:8888 @@ -585,47 +558,45 @@ user_pref("layout.css.font-visibility.level", 1); user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); /* 1601: control when to send a cross-origin referer * 0=always (default), 1=only if base domains match, 2=only if hosts match - * [SETUP-WEB] Known to cause issues with older modems/routers and some sites e.g vimeo, icloud, instagram ***/ + * [SETUP-WEB] Breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram + * If "2" is too strict, then override to "0" and use Smart Referer extension (Strict mode + add exceptions) ***/ user_pref("network.http.referer.XOriginPolicy", 2); /* 1602: control the amount of cross-origin information to send [FF52+] * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); -/* 1603: enable the DNT (Do Not Track) HTTP header - * [NOTE] DNT is enforced with Enhanced Tracking Protection (2710) - * [SETTING] Privacy & Security > Privacy > Web Content > Send websites a "Do Not Track" signal... ***/ -user_pref("privacy.donottrackheader.enabled", true); -/*** [SECTION 1700]: CONTAINERS - Check out Temporary Containers [2], read the article [3], and visit the wiki/repo [4] - [1] https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers - [2] https://addons.mozilla.org/firefox/addon/temporary-containers/ - [3] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 - [4] https://github.com/stoically/temporary-containers/wiki -***/ + /*** [SECTION 1700]: CONTAINERS ***/ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); -/* 1701: enable Container Tabs and its UI setting [FF50+] ***/ +/* 1701: enable Container Tabs and its UI setting [FF50+] + * https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/ user_pref("privacy.userContext.enabled", true); user_pref("privacy.userContext.ui.enabled", true); -/* 1702: set behaviour on "+ Tab" button to display container menu on left click [FF74+] +/* 1702: set behavior on "+ Tab" button to display container menu on left click [FF74+] * [NOTE] The menu is always shown on long press and right click ***/ // user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true); /*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); /* 2001: disable WebRTC (Web Real-Time Communication) - * [SETUP-WEB] WebRTC can leak your IP address from behind your VPN, but if this is not - * in your threat model, and you want Real-Time Communication, this is the pref for you - * [1] https://www.privacytools.io/#webrtc ***/ -user_pref("media.peerconnection.enabled", false); -/* 2002: limit WebRTC IP leaks if using WebRTC - * In FF70+ these settings match Mode 4 (Mode 3 in older versions) [3] + * Thunderbird uses mDNS hostname obfuscation on desktop (except Windows7/8) and the + * private IP is NEVER exposed, except if required in TRUSTED scenarios; i.e. after + * you grant device (microphone or camera) access + * [SETUP-HARDEN] Test first. Windows7/8 users only: behind a proxy who never use WebRTC * [TEST] https://browserleaks.com/webrtc - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416,1452713 - * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy - * [3] https://tools.ietf.org/html/draft-ietf-rtcweb-ip-handling-12#section-5.2 ***/ + * [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ + * [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 ***/ +user_pref("media.peerconnection.enabled", false); +/* 2002: force WebRTC inside the proxy [FF70+] ***/ +user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); +/* 2003: force a single network interface for ICE candidates generation [FF42+] + * When using a system-wide proxy, it uses the proxy interface + * [1] https://developer.mozilla.org/en-US/docs/Web/API/RTCIceCandidate + * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/ user_pref("media.peerconnection.ice.default_address_only", true); -user_pref("media.peerconnection.ice.no_host", true); // [FF51+] -user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // [FF70+] +/* 2004: force exclusion of private IPs from ICE candidates [FF51+] + * [SETUP-HARDEN] This will protect your private IP even in TRUSTED scenarios after you + * grant device access, but often results in breakage on video-conferencing platforms ***/ +user_pref("media.peerconnection.ice.no_host", true); /* 2020: disable GMP (Gecko Media Plugins) * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ user_pref("media.gmp-provider.enabled", false); @@ -633,61 +604,23 @@ user_pref("media.gmp-provider.enabled", false); * [NOTE] This is covered by the EME master switch (2022) ***/ user_pref("media.gmp-widevinecdm.enabled", false); /* 2022: disable all DRM content (EME: Encryption Media Extension) + * Optionally hide the setting which also disables the DRM prompt * [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV * [TEST] https://bitmovin.com/demos/drm * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ user_pref("media.eme.enabled", false); + // user_pref("browser.eme.ui.enabled", false); /* 2030: disable autoplay of HTML5 media [FF63+] * 0=Allow all, 1=Block non-muted media (default), 5=Block all * [NOTE] You can set exceptions under site permissions ***/ user_pref("media.autoplay.default", 5); /* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+] * 0=sticky (default), 1=transient, 2=user - * Firefox's Autoplay Policy Documentation [PDF] is linked below via SUMO + * Thunderbird's Autoplay Policy Documentation (PDF) is linked below via SUMO * [NOTE] If you have trouble with some video sites, then add an exception (2030) * [1] https://support.mozilla.org/questions/1293231 ***/ user_pref("media.autoplay.blocking_policy", 2); -/*** [SECTION 2300]: WEB WORKERS - A worker is a JS "background task" running in a global context, i.e. it is different from - the current window. Workers can spawn new workers (must be the same origin & scheme), - including service and shared workers. Shared workers can be utilized by multiple scripts and - communicate between browsing contexts (windows/tabs/iframes) and can even control your cache. - - [1] Web Workers: https://developer.mozilla.org/docs/Web/API/Web_Workers_API - [2] Worker: https://developer.mozilla.org/docs/Web/API/Worker - [3] Service Worker: https://developer.mozilla.org/docs/Web/API/Service_Worker_API - [4] SharedWorker: https://developer.mozilla.org/docs/Web/API/SharedWorker - [5] ChromeWorker: https://developer.mozilla.org/docs/Web/API/ChromeWorker - [6] Notifications: https://support.mozilla.org/questions/1165867#answer-981820 -***/ -user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!"); -/* 2302: disable service workers [FF32, FF44-compat] - * Service workers essentially act as proxy servers that sit between web apps, and the - * browser and network, are event driven, and can control the web page/site they are associated - * with, intercepting and modifying navigation and resource requests, and caching resources. - * [NOTE] Service workers require HTTPS, have no DOM access, and are not supported in PB mode [1] - * [SETUP-WEB] Disabling service workers will break some sites. This pref is required true for - * service worker notifications (2304), push notifications (disabled, 2305) and service worker - * cache (2740). If you enable this pref, then check those settings as well - * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1320796#c7 ***/ -user_pref("dom.serviceWorkers.enabled", false); -/* 2304: disable Web Notifications - * [NOTE] Web Notifications can also use service workers (2302) and are behind a prompt (7002) - * [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/ -user_pref("dom.webnotifications.enabled", false); // [FF22+] -user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+] -/* 2305: disable Push Notifications [FF44+] - * Push is an API that allows websites to send you (subscribed) messages even when the site - * isn't loaded, by pushing messages to your userAgentID through Mozilla's Push Server - * [NOTE] Push requires service workers (2302) to subscribe to and display, and is behind - * a prompt (7002). Disabling service workers alone doesn't stop Thunderbird polling the - * Mozilla Push Server. To remove all subscriptions, reset your userAgentID. - * [1] https://support.mozilla.org/kb/push-notifications-firefox - * [2] https://developer.mozilla.org/docs/Web/API/Push_API ***/ -user_pref("dom.push.enabled", false); - // user_pref("dom.push.userAgentID", ""); - /*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); /* 2401: disable "Confirm you want to leave" dialog on page close @@ -763,8 +696,11 @@ user_pref("permissions.delegation.enabled", false); /* 2651: enable user interaction for security by always asking where to download * [SETUP-CHROME] On Android this blocks longtapping and saving images ***/ user_pref("browser.download.useDownloadDir", false); -/* 2652: disable adding downloads to the system's "recent documents" list ***/ +/* 2653: disable adding downloads to the system's "recent documents" list ***/ user_pref("browser.download.manager.addToRecentDocs", false); +/* 2654: enable user interaction for security by always asking how to handle new mimetypes [FF101+] + * [SETTING] General>Files and Applications>What should Thunderbird do with other files ***/ +user_pref("browser.download.always_ask_before_handling_new_types", true); /** EXTENSIONS ***/ /* 2660: lock down allowed extension directories @@ -778,158 +714,64 @@ user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ // user_pref("extensions.webextensions.restrictedDomains", ""); -/*** [SECTION 2700]: PERSISTENT STORAGE - Data SET by websites including - cookies : profile\cookies.sqlite - localStorage : profile\webappsstore.sqlite - indexedDB : profile\storage\default - serviceWorkers : - - [NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode - [NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage), - indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications) - If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become - accessible to websites except shared/service workers where the cookie setting must be "Allow" -***/ -user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); -/* 2701: disable or isolate 3rd-party cookies and site-data [SETUP-WEB] - * 0 = Accept cookies and site data - * 1 = (Block) All third-party cookies - * 2 = (Block) All cookies - * 3 = (Block) Cookies from unvisited websites - * 4 = (Block) Cross-site tracking cookies (default) - * 5 = (Isolate All) Cross-site cookies (TCP: Total Cookie Protection / dFPI: dynamic FPI) [1] (FF86+) - * Option 5 with FPI enabled (4001) is ignored and not shown, and option 4 used instead - * [NOTE] You can set cookie exceptions under site permissions or use an extension - * [NOTE] Enforcing category to custom ensures ETP related prefs are always honored - * [SETTING] Privacy & Security > Privacy > Web Content > Accept cookies from sites - * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ ***/ -user_pref("network.cookie.cookieBehavior", 2); -user_pref("browser.contentblocking.category", "custom"); -/* 2702: set third-party cookies (if enabled, see 2701) to session-only - * [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and - * .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones - * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/ -user_pref("network.cookie.thirdparty.sessionOnly", true); -user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+] -/* 2703: delete cookies and site data on close - * 0=keep until they expire (default), 2=keep until you close Thunderbird - * [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2) - * [SETTING] Privacy & Security > Privacy > Web Content > Keep until: "I close Thunderbird" ***/ -user_pref("network.cookie.lifetimePolicy", 2); -/* 2710: enable Enhanced Tracking Protection (ETP) in all windows ***/ -user_pref("privacy.trackingprotection.enabled", true); -/* 2711: enable various ETP lists ***/ -user_pref("privacy.trackingprotection.socialtracking.enabled", true); -user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] -user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] -/* 2740: disable service worker cache and cache storage - * [NOTE] We clear service worker cache on exit (2803) - * [1] https://w3c.github.io/ServiceWorker/#privacy ***/ -user_pref("dom.caches.enabled", false); -/* 2750: disable Storage API [FF51+] - * The API gives sites the ability to find out how much space they can use, how much - * they are already using, and even control whether or not they need to be alerted - * before the user agent disposes of site data in order to make room for other things. - * [1] https://developer.mozilla.org/docs/Web/API/StorageManager - * [2] https://developer.mozilla.org/docs/Web/API/Storage_API - * [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/ -user_pref("dom.storageManager.enabled", false); -/* 2755: disable Storage Access API [FF65+] - * [1] https://developer.mozilla.org/docs/Web/API/Storage_Access_API ***/ -user_pref("dom.storage_access.enabled", false); -/* 2760: enable Local Storage Next Generation (LSNG) [FF65+] ***/ -user_pref("dom.storage.next_gen", true); // [DEFAULT: true FF92+] - -/*** [SECTION 2800]: SHUTDOWN - * Sanitizing on shutdown is all or nothing (no exception can be set) - * If you want to keep some sites' cookies (exception as "Allow") and optionally other site - data but clear all the rest on close, then you need to set the "cookie" and optionally the - "offlineApps" prefs below to false, and to set the cookie lifetime pref to 2 (2703) -***/ +/*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); -/* 2802: enable Thunderbird to clear items on shutdown (see 2803) ***/ +/** SANITIZE ON SHUTDOWN: ALLOWS COOKIES + SITE DATA EXCEPTIONS FF102+ ***/ +/* 2810: enable Thunderbird to clear items on shutdown (2811) + * [NOTE] Exceptions: A "cookie" block permission also controls "offlineApps" (see note in 2811). + * serviceWorkers require an "Allow" permission. For cross-domain logins, add exceptions for + * both sites e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on) + * [WARNING] Be selective with what cookies you keep, as they also disable partitioning (1767271) + * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Thunderbird closes + * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow (when on the website in question) + * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ user_pref("privacy.sanitize.sanitizeOnShutdown", true); -/* 2803: set what items to clear on shutdown (if 2802 is true) [SETUP-CHROME] +/* 2811: set/enforce what items to clear on shutdown (if 2810 is true) [SETUP-CHROME] * [NOTE] If "history" is true, downloads will also be cleared - * [NOTE] Active Logins: does not refer to logins via cookies, but rather HTTP Basic Authentication [1] - * [NOTE] Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache) + * [NOTE] "sessions": Active Logins: refers to HTTP Basic Authentication [1], not logins via cookies + * [NOTE] "offlineApps": Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache) * [1] https://en.wikipedia.org/wiki/Basic_access_authentication ***/ -user_pref("privacy.clearOnShutdown.cache", true); +user_pref("privacy.clearOnShutdown.cache", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown.downloads", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown.formdata", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown.history", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown.sessions", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown.offlineApps", true); user_pref("privacy.clearOnShutdown.cookies", true); -user_pref("privacy.clearOnShutdown.downloads", true); // see note above -user_pref("privacy.clearOnShutdown.formdata", true); // Form & Search History -user_pref("privacy.clearOnShutdown.history", true); // Browsing & Download History -user_pref("privacy.clearOnShutdown.offlineApps", true); // Offline Website Data -user_pref("privacy.clearOnShutdown.sessions", true); // Active Logins -user_pref("privacy.clearOnShutdown.siteSettings", false); // Site Preferences -/* 2804: reset default items to clear with Ctrl-Shift-Del (to match 2803) [SETUP-CHROME] + // user_pref("privacy.clearOnShutdown.siteSettings", false); // [DEFAULT: false] +/* 2812: delete cache on exit [FF96+] + * [NOTE] We already disable disk cache (1001) and clear on exit (2811) which is more robust + * [1] https://bugzilla.mozilla.org/1671182 ***/ + // user_pref("privacy.clearsitedata.cache.enabled", true); + +/** SANITIZE MANUAL: ALL OR NOTHING ***/ +/* 2820: reset default items to clear with Ctrl-Shift-Del [SETUP-CHROME] * This dialog can also be accessed from the menu History>Clear Recent History * Thunderbird remembers your last choices. This will reset them when you start Thunderbird * [NOTE] Regardless of what you set "downloads" to, as soon as the dialog * for "Clear Recent History" is opened, it is synced to the same as "history" ***/ -user_pref("privacy.cpd.cache", true); -user_pref("privacy.cpd.cookies", true); +user_pref("privacy.cpd.cache", true); // [DEFAULT: true] +user_pref("privacy.cpd.formdata", true); // [DEFAULT: true] +user_pref("privacy.cpd.history", true); // [DEFAULT: true] +user_pref("privacy.cpd.sessions", true); // [DEFAULT: true] +user_pref("privacy.cpd.offlineApps", false); // [DEFAULT: false] +user_pref("privacy.cpd.cookies", false); // user_pref("privacy.cpd.downloads", true); // not used, see note above -user_pref("privacy.cpd.formdata", true); // Form & Search History -user_pref("privacy.cpd.history", true); // Browsing & Download History -user_pref("privacy.cpd.offlineApps", true); // Offline Website Data -user_pref("privacy.cpd.passwords", false); // this is not listed -user_pref("privacy.cpd.sessions", true); // Active Logins -user_pref("privacy.cpd.siteSettings", false); // Site Preferences -/* 2805: clear Session Restore data when sanitizing on shutdown or manually [FF34+] - * [NOTE] Not needed if Session Restore is not used (0102) or is already cleared with history (2803) + // user_pref("privacy.cpd.passwords", false); // [DEFAULT: false] not listed + // user_pref("privacy.cpd.siteSettings", false); // [DEFAULT: false] +/* 2821: clear Session Restore data when sanitizing on shutdown or manually [FF34+] + * [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811) * [NOTE] privacy.clearOnShutdown.openWindows prevents resuming from crashes (also see 5008) * [NOTE] privacy.cpd.openWindows has a bug that causes an additional window to open ***/ // user_pref("privacy.clearOnShutdown.openWindows", true); // user_pref("privacy.cpd.openWindows", true); -/* 2806: reset default "Time range to clear" for "Clear Recent History" (2804) +/* 2822: reset default "Time range to clear" for "Clear Recent History" (2820) * Thunderbird remembers your last choice. This will reset the value when you start Thunderbird * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today * [NOTE] Values 5 (last 5 minutes) and 6 (last 24 hours) are not listed in the dropdown, * which will display a blank value, and are not guaranteed to work ***/ user_pref("privacy.sanitize.timeSpan", 0); -/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION) - 1278037 - indexedDB (FF51+) - 1277803 - favicons (FF52+) - 1264562 - OCSP cache (FF52+) - 1268726 - Shared Workers (FF52+) - 1316283 - SSL session cache (FF52+) - 1317927 - media cache (FF53+) - 1323644 - HSTS and HPKP (FF54+) - 1334690 - HTTP Alternative Services (FF54+) - 1334693 - SPDY/HTTP2 (FF55+) - 1337893 - DNS cache (FF55+) - 1344170 - blob: URI (FF55+) - 1300671 - data:, about: URLs (FF55+) - 1473247 - IP addresses (FF63+) - 1542309 - top-level domain URLs when host is in the public suffix list (FF68+) - 1506693 - pdfjs range-based requests (FF68+) - 1330467 - site permissions (FF69+) - 1534339 - IPv6 (FF73+) - 1721858 - WebSocket (FF92+) -***/ -user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out"); -/* 4001: enable First Party Isolation [FF51+] - * [SETUP-WEB] Breaks some cross-origin logins - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1260931,1299996 ***/ -user_pref("privacy.firstparty.isolate", true); -/* 4002: enforce FPI restriction for window.opener [FF54+] - * [NOTE] Setting this to false may reduce the breakage in 4001 - * FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But - * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute [2][3] - * The 2nd pref removes that limitation and will only allow communication if FPDs also match - * [1] https://bugzilla.mozilla.org/1319773#c22 - * [2] https://bugzilla.mozilla.org/1492607 - * [3] https://developer.mozilla.org/docs/Web/API/Window/postMessage ***/ -user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] -user_pref("privacy.firstparty.isolate.block_post_message", true); -/* 4003: enable scheme with FPI [FF78+] - * [NOTE] Experimental: existing data and site permissions are incompatible - * and some site exceptions may not work e.g. HTTPS-only mode (1244) ***/ -user_pref("privacy.firstparty.isolate.use_site", true); - /*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) RFP covers a wide range of ongoing fingerprinting solutions. It is an all-or-nothing buy in: you cannot pick and choose what parts you want @@ -939,15 +781,16 @@ user_pref("privacy.firstparty.isolate.use_site", true); 418986 - limit window.screen & CSS media queries (FF41) [TEST] https://arkenfox.github.io/TZP/tzp.html#screen 1281949 - spoof screen orientation (FF50) - 1281963 - hide contents of navigator.plugins and navigator.mimeTypes (FF50-88) + 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50-99) + FF53: fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044) 1330890 - spoof timezone as UTC0 (FF55) 1360039 - spoof navigator.hardwareConcurrency as 2 (FF55) 1217238 - reduce precision of time exposed by javascript (FF55) FF56 1369303 - spoof/disable performance API 1333651 - spoof User Agent & Navigator API - JS: FF91+ the version is spoofed as ESR, and the OS as Windows 10, OS 10.15, Android 10, or Linux - HTTP Headers: spoofed as Windows or Android + version: spoofed as ESR (FF102+ this is limited to Android) + OS: JS spoofed as Windows 10, OS 10.15, Android 10, or Linux | HTTP Headers spoofed as Windows or Android 1369319 - disable device sensor API 1369357 - disable site specific zoom 1337161 - hide gamepads from content @@ -959,8 +802,6 @@ user_pref("privacy.firstparty.isolate.use_site", true); 1217290 & 1409677 - enable some fingerprinting resistance for WebGL 1382545 - reduce fingerprinting in Animation API 1354633 - limit MediaError.message to a whitelist - 1382533 & 1697680 - enable fingerprinting resistance for Presentation API (FF57-87) - Blocks exposure of local IP Addresses via mDNS (Multicast DNS) FF58-90 967895 - spoof canvas and enable site permission prompt (FF58) 1372073 - spoof/block fingerprinting in MediaDevices API (FF59) @@ -985,6 +826,8 @@ user_pref("privacy.firstparty.isolate.use_site", true); 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82) FF91+ 531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1) + 1756280 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF100) + 1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was capped at 100ms) (FF102) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); /* 4501: enable privacy.resistFingerprinting [FF41+] @@ -992,12 +835,11 @@ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs") * RFP also has a few side effects: mainly timezone is UTC0, and websites will prefer light theme * [1] https://bugzilla.mozilla.org/418986 ***/ user_pref("privacy.resistFingerprinting", true); -/* 4502: set new window sizes to round to hundreds [FF55+] [SETUP-CHROME] - * Width will round down to multiples of 200s and height to 100s, to fit your screen. - * The max values are a starting point to round from if you want some control +/* 4502: set new window size rounding max values [FF55+] + * [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen * [1] https://bugzilla.mozilla.org/1330882 ***/ - // user_pref("privacy.window.maxInnerWidth", 1000); - // user_pref("privacy.window.maxInnerHeight", 1000); +user_pref("privacy.window.maxInnerWidth", 1600); +user_pref("privacy.window.maxInnerHeight", 900); /* 4503: disable mozAddonManager Web API [FF57+] * [NOTE] To allow extensions to work on AMO, you also need 2662 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ @@ -1018,9 +860,11 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] * [1] https://bugzilla.mozilla.org/1635603 ***/ // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); // user_pref("privacy.resistFingerprinting.testGranularityMask", 0); -/* 4510: enforce no system colors - * [SETTING] General > Language & Appearance > Colors... > Use system colors ***/ -user_pref("browser.display.use_system_colors", false); // [DEFAULT: false] +/* 4506: set RFP's font visibility level (1402) [FF94+] ***/ + // user_pref("layout.css.font-visibility.resistFingerprinting", 1); // [DEFAULT: 1] +/* 4510: disable using system colors + * [SETTING] General > Language and Appearance > Fonts and Colors > Colors > Use system colors ***/ +user_pref("browser.display.use_system_colors", false); // [DEFAULT false NON-WINDOWS] /* 4511: enforce non-native widget theme * Security: removes/reduces system API calls, e.g. win32k API [1] * Fingerprinting: provides a uniform look and feel across platforms [2] @@ -1031,14 +875,18 @@ user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true] * 1=most recent window or tab, 2=new window, 3=new tab * Stops malicious window sizes and some screen resolution leaks. * You can still right-click a link and open in a new window + * [NOTE] Thunderbird only supports 3 (see [2]) * [TEST] https://arkenfox.github.io/TZP/tzp.html#screen - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ + * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 + * [2] https://searchfox.org/comm-esr102/source/mail/app/profile/all-thunderbird.js#721 ***/ user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3] /* 4513: set all open window methods to abide by "browser.link.open_newwindow" (4512) - * [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js ***/ -user_pref("browser.link.open_newwindow.restriction", 0); // [DEFAULT: 0] + * [NOTE] Thunderbird only supports 0 (see [2]) + * [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js + * [2] https://searchfox.org/comm-esr102/source/mail/app/profile/all-thunderbird.js#730 ***/ +user_pref("browser.link.open_newwindow.restriction", 0); /* 4520: disable WebGL (Web Graphics Library) - * [SETUP-WEB] If you need it then enable it. RFP still randomizes canvas for naive scripts ***/ + * [SETUP-WEB] If you need it then override it. RFP still randomizes canvas for naive scripts ***/ user_pref("webgl.disabled", true); /*** [SECTION 5000]: OPTIONAL OPSEC @@ -1069,11 +917,11 @@ user_pref("permissions.memory_only", true); // [HIDDEN PREF] /* 5005: disable intermediate certificate caching [FF41+] [RESTART] * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. * Saved logins and passwords are not available. Reset the pref and restart to return them ***/ - // user_pref("security.nocertdb", true); // [HIDDEN PREF] + // user_pref("security.nocertdb", true); // [HIDDEN PREF in FF101 or lower] /* 5006: disable favicons in history and bookmarks * [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your * actual history (and bookmarks) already do. Your history is more detailed, so - * control that instead; e.g. disable history, clear history on close, use PB mode + * control that instead; e.g. disable history, clear history on exit, use PB mode * [NOTE] favicons.sqlite is sanitized on Thunderbird close ***/ user_pref("browser.chrome.site_icons", false); /* 5007: exclude "Undo Closed Tabs" in Session Restore ***/ @@ -1085,15 +933,16 @@ user_pref("browser.sessionstore.resume_from_crash", false); * [1] https://bugzilla.mozilla.org/1281959 ***/ // user_pref("browser.download.forbid_open_with", true); /* 5013: disable browsing and download history - * [NOTE] We also clear history and downloads on exit (2803) ***/ + * [NOTE] We also clear history and downloads on exit (2811) ***/ user_pref("places.history.enabled", false); /* 5016: discourage downloading to desktop * 0=desktop, 1=downloads (default), 2=last used ***/ // user_pref("browser.download.folderList", 2); /*** [SECTION 5500]: OPTIONAL HARDENING - Whereas not recommended by upstream arkenfox, we disable each one of those Web features - as we focus on keeping Thunderbird an email client and not a browser + Thunderbird-User.JS maintainer here : + Whereas not recommended by upstream arkenfox, we disable each one of those Web + features as we focus on keeping Thunderbird an email client and not a browser. ***/ user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!"); /* 5501: disable MathML (Mathematical Markup Language) [FF51+] @@ -1112,9 +961,10 @@ user_pref("gfx.font_rendering.graphite.enabled", false); * [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ user_pref("javascript.options.asmjs", false); /* 5505: disable Ion and baseline JIT to harden against JS exploits - * [NOTE] In FF75+, when **both** Ion and JIT are disabled, **and** the new - * hidden pref is enabled, then Ion can still be used by extensions (1599226) - * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit ***/ + * [NOTE] When both Ion and JIT are disabled, and trustedprincipals + * is enabled, then Ion can still be used by extensions (1599226) + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit + * [2] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ ***/ user_pref("javascript.options.ion", false); user_pref("javascript.options.baselinejit", false); user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF] @@ -1139,37 +989,40 @@ user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] /* 6002: enforce no referer spoofing * [WHY] Spoofing can affect CSRF (Cross-Site Request Forgery) protections ***/ user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] -/* 6003: enforce CSP (Content Security Policy) - * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/ -user_pref("security.csp.enable", true); // [DEFAULT: true] /* 6004: enforce a security delay on some confirmation dialogs such as install, open/save * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] -/* 6005: enforce window.opener protection [FF65+] - * Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/ -user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+] -/* 6006: enforce "window.name" protection [FF82+] - * If a new page from another domain is loaded into a tab, then window.name is set to an empty string. The original - * string is restored if the tab reverts back to the original page. This change prevents some cross-site attacks - * [TEST] https://arkenfox.github.io/TZP/tests/windownamea.html ***/ -user_pref("privacy.window.name.update.enabled", true); // [DEFAULT: true FF86+] -/* 6050: prefsCleaner: reset previously active items removed from arkenfox in 79-91 ***/ - // user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", ""); - // user_pref("browser.send_pings.require_same_host", ""); - // user_pref("dom.allow_cut_copy", ""); - // user_pref("dom.vibrator.enabled", ""); - // user_pref("media.getusermedia.audiocapture.enabled", ""); - // user_pref("media.getusermedia.browser.enabled", ""); - // user_pref("media.getusermedia.screensharing.enabled", ""); - // user_pref("media.gmp-widevinecdm.visible", ""); - // user_pref("network.http.redirection-limit", ""); - // user_pref("privacy.partition.network_state", ""); - // user_pref("security.insecure_connection_icon.enabled", ""); // [DEFAULT: true FF70+] - // user_pref("security.mixed_content.block_active_content", ""); // [DEFAULT: true since at least FF60] - // user_pref("security.ssl.enable_ocsp_stapling", ""); // [DEFAULT: true FF26+] - // user_pref("webgl.disable-fail-if-major-performance-caveat", ""); // [DEFAULT: true FF86+] - // user_pref("webgl.enable-webgl2", ""); - // user_pref("webgl.min_capability_mode", ""); +/* 6008: enforce no First Party Isolation [FF51+] + * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), + * and enabling FPI disables those. FPI is no longer maintained ***/ +user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false] +/* 6009: enforce SmartBlock shims [FF81+] + * In FF96+ these are listed in about:compat + * [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/ +user_pref("extensions.webcompat.enable_shims", true); // [DEFAULT: true] +/* 6010: enforce/reset TLS 1.0/1.1 downgrades to session only + * [NOTE] In FF97+ the TLS 1.0/1.1 downgrade UX was removed + * [TEST] https://tls-v1-1.badssl.com:1010/ ***/ +user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false] +/* 6011: enforce disabling of Web Compatibility Reporter [FF56+] + * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla + * [WHY] To prevent wasting Mozilla's time with a custom setup ***/ +user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] +/* 6012: disable SHA-1 certificates ***/ +user_pref("security.pki.sha1_enforcement_level", 1); // [DEFAULT: 1 FF102+] +/* 6050: prefsCleaner: reset items removed from arkenfox FF92+ ***/ + // user_pref("browser.urlbar.trimURLs", ""); + // user_pref("dom.caches.enabled", ""); + // user_pref("dom.storageManager.enabled", ""); + // user_pref("dom.storage_access.enabled", ""); + // user_pref("dom.targetBlankNoOpener.enabled", ""); + // user_pref("network.cookie.thirdparty.sessionOnly", ""); + // user_pref("network.cookie.thirdparty.nonsecureSessionOnly", ""); + // user_pref("privacy.firstparty.isolate.block_post_message", ""); + // user_pref("privacy.firstparty.isolate.restrict_opener_access", ""); + // user_pref("privacy.firstparty.isolate.use_site", ""); + // user_pref("privacy.window.name.update.enabled", ""); + // user_pref("security.insecure_connection_text.enabled", ""); /*** [SECTION 7000]: DON'T BOTHER Thunderbird-User.JS maintainer here : @@ -1184,7 +1037,7 @@ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies user_pref("geo.enabled", false); user_pref("full-screen-api.enabled", false); user_pref("browser.cache.offline.enable", false); -user_pref("dom.vr.enabled", false); +user_pref("dom.vr.enabled", false); // [DEFAULT: false FF97+] /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ @@ -1196,18 +1049,17 @@ user_pref("dom.vr.enabled", false); // user_pref("security.ssl3.rsa_aes_256_gcm_sha384", false); // no PFS // user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS // user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS - // user_pref("security.ssl3.rsa_des_ede3_sha", false); // 3DES /* 7004: control TLS versions - * [WHY] Passive fingerprinting. Downgrades are still possible: behind user interaction ***/ + * [WHY] Passive fingerprinting and security ***/ // user_pref("security.tls.version.min", 3); // [DEFAULT: 3] // user_pref("security.tls.version.max", 4); /* 7005: disable SSL session IDs [FF36+] - * [WHY] Passive fingerprinting and perf costs. These are session-only and isolated - * with network partitioning (FF85+) or when using FPI and/or containers ***/ - // user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF] + * [WHY] Passive fingerprinting and perf costs. These are session-only + * and isolated with network partitioning (FF85+) and/or containers ***/ + // user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF in FF101 or lower] /* 7006: onions - * [WHY] Firefox doesn't support hidden services. Use Tor Browser ***/ - // user_pref("dom.securecontext.whitelist_onions", true); // 1382359 + * [WHY] Thunderbird doesn't support hidden services. Use Tor Browser ***/ + // user_pref("dom.securecontext.allowlist_onions", true); // [FF97+] 1382359/1744006 // user_pref("network.http.referer.hideOnionSource", true); // 1305144 /* 7007: referers * [WHY] Only cross-origin referers (1600s) need control ***/ @@ -1216,19 +1068,12 @@ user_pref("network.http.referer.trimmingPolicy", 0); /* 7008: set the default Referrer Policy [FF59+] * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade * [WHY] Defaults are fine. They can be overridden by a site-controlled Referrer Policy ***/ -user_pref("network.http.referer.defaultPolicy", 0); // [DEFAULT: 2 FF87+] +user_pref("network.http.referer.defaultPolicy", 0); // [DEFAULT: 2] user_pref("network.http.referer.defaultPolicy.pbmode", 0); // [DEFAULT: 2] -/* 7009: disable HTTP2 - * [WHY] Passive fingerprinting. ~50% of sites use HTTP2 [1] - * [1] https://w3techs.com/technologies/details/ce-http2/all/all ***/ - // user_pref("network.http.spdy.enabled", false); - // user_pref("network.http.spdy.enabled.deps", false); - // user_pref("network.http.spdy.enabled.http2", false); - // user_pref("network.http.spdy.websockets", false); // [FF65+] /* 7010: disable HTTP Alternative Services [FF37+] - * [WHY] Already isolated by network partitioning (FF85+) or FPI ***/ + * [WHY] Already isolated with network partitioning (FF85+) ***/ user_pref("network.http.altsvc.enabled", false); -user_pref("network.http.altsvc.oe", false); + // user_pref("network.http.altsvc.oe", false); // [DEFAULT: false FF94+] /* 7011: disable website control over browser right-click context menu * [WHY] Just use Shift-Right-Click ***/ user_pref("dom.event.contextmenu.enabled", false); @@ -1246,8 +1091,36 @@ user_pref("dom.event.clipboardevents.enabled", false); * [WHY] It can compromise security. System addons ship with prefs, use those ***/ // user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] // user_pref("extensions.systemAddon.update.url", ""); // [FF44+] +/* 7015: enable the DNT (Do Not Track) HTTP header + * [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/ + // user_pref("privacy.donottrackheader.enabled", true); +/* 7016: customize ETP settings + * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ + // user_pref("network.cookie.cookieBehavior", 5); + // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); + // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] + // user_pref("privacy.partition.network_state.ocsp_cache", true); + // user_pref("privacy.query_stripping.enabled", true); // [FF101+] [ETP FF102+] + // user_pref("privacy.trackingprotection.enabled", true); + // user_pref("privacy.trackingprotection.socialtracking.enabled", true); + // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] + // user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] +/* 7017: disable service workers + * [WHY] Already isolated (FF96+) with TCP (2701) behind a pref (2710) + * or blocked with TCP in 3rd parties (FF95 or lower) ***/ + // user_pref("dom.serviceWorkers.enabled", false); +/* 7018: disable Web Notifications + * [WHY] Web Notifications are behind a prompt (7002) + * [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ ***/ + // user_pref("dom.webnotifications.enabled", false); // [FF22+] + // user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+] +/* 7019: disable Push Notifications [FF44+] + * [WHY] Push requires subscription + * [NOTE] To remove all subscriptions, reset "dom.push.userAgentID" + * [1] https://support.mozilla.org/kb/push-notifications-firefox ***/ + // user_pref("dom.push.enabled", false); -/*** [SECTION 8000]: DON'T BOTHER: NON-RFP +/*** [SECTION 8000]: DON'T BOTHER: FINGERPRINTING [WHY] They are insufficient to help anti-fingerprinting and do more harm than good [WARNING] DO NOT USE with RFP. RFP already covers these and they can interfere [NOTE] An empty User-Agent may break Microsoft Exchange OAuth2 login @@ -1258,7 +1131,7 @@ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan // user_pref("dom.enable_performance", false); // user_pref("dom.enable_resource_timing", false); // user_pref("dom.gamepad.enabled", false); - // user_pref("dom.netinfo.enabled", false); + // user_pref("dom.netinfo.enabled", false); // [DEFAULT: false NON-ANDROID: false ANDROID FF99+] // user_pref("dom.webaudio.enabled", false); /* 8002: disable other ***/ // user_pref("browser.display.use_document_fonts", 0); @@ -1286,14 +1159,25 @@ user_pref("_user.js.parrot", "9000 syntax error: the parrot's cashed in 'is chip /* WELCOME & WHAT'S NEW NOTICES ***/ user_pref("mailnews.start_page_override.mstone", "ignore"); // master switch /* WARNINGS ***/ + // user_pref("browser.tabs.warnOnClose", false); // [DEFAULT false FF94+] + // user_pref("browser.tabs.warnOnOpen", false); // user_pref("full-screen-api.warning.delay", 0); // user_pref("full-screen-api.warning.timeout", 0); +/* UPDATES ***/ + // user_pref("app.update.auto", false); // [NON-WINDOWS] disable auto app updates + // [NOTE] You will still get prompts to update, and should do so in a timely manner + // user_pref("browser.search.update", false); // disable search engine updates (e.g. OpenSearch) + // [NOTE] This does not affect Mozilla's built-in or Web Extension search engines + // user_pref("extensions.update.enabled", false); // disable extension and theme update checks + // user_pref("extensions.update.autoUpdateDefault", false); // disable installing extension and theme updates + // [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) + // user_pref("extensions.getAddons.cache.enabled", false); // disable extension metadata (extension detail tab) /* APPEARANCE ***/ - // user_pref("ui.systemUsesDarkTheme", 1); // [FF67+] [HIDDEN PREF] - // 0=light, 1=dark: with RFP this only affects chrome // user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent // user_pref("ui.prefersReducedMotion", 1); // disable chrome animations [FF77+] [RESTART] [HIDDEN PREF] // 0=no-preference, 1=reduce: with RFP this only affects chrome + // user_pref("ui.systemUsesDarkTheme", 1); // [FF67+] [HIDDEN PREF] + // 0=light, 1=dark: with RFP this only affects chrome /* CONTENT BEHAVIOR ***/ // user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type" // user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX] @@ -1574,7 +1458,7 @@ user_pref("calendar.timezone.local", "UTC"); // [DEFAULT: ""] /** RSS ***/ /** These features don't actually do anything as they aren't implemented - * [1] https://searchfox.org/comm-esr78/rev/384830b0570096c48770398060f87fbe556f6f01/mail/base/content/mailWindowOverlay.js#925 + * [1] https://searchfox.org/comm-esr102/source/mail/base/content/mailWindowOverlay.js#1082 * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=458606#c9 /* 9320: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, @@ -1625,57 +1509,58 @@ user_pref("_user.js.parrot", "9400 syntax error: this parrot is talking in codes user_pref("mail.openpgp.allow_external_gnupg", true); // [HIDDEN PREF] /*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED - Documentation denoted as [-]. Items deprecated in FF78 or earlier have been archived at [1] + Documentation denoted as [-]. Items deprecated prior to FF91 have been archived at [1] [1] https://github.com/arkenfox/user.js/issues/123 ***/ user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); -/* ESR78.x still uses all the following prefs +/* ESR91.x still uses all the following prefs // [NOTE] replace the * with a slash in the line above to re-enable them -// FF79 -// 0212: enforce fallback text encoding to match en-US - // When the content or server doesn't declare a charset the browser will - // fallback to the "Current locale" based on your application language - // [TEST] https://hsivonen.com/test/moz/check-charset.htm - // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/20025 - // [-] https://bugzilla.mozilla.org/1603712 -user_pref("intl.charset.fallback.override", "windows-1252"); -// FF82 -// 0206: disable geographically specific results/search engines e.g. "browser.search.*.US" - // i.e. ignore all of Mozilla's various search engines in multiple locales - // [-] https://bugzilla.mozilla.org/1619926 -user_pref("browser.search.geoSpecificDefaults", false); -user_pref("browser.search.geoSpecificDefaults.url", ""); -// FF86 -// 1205: disable SSL Error Reporting - // [1] https://firefox-source-docs.mozilla.org/main/65.0/browser/base/sslerrorreport/preferences.html - // [-] https://bugzilla.mozilla.org/1681839 -user_pref("security.ssl.errorReporting.automatic", false); -user_pref("security.ssl.errorReporting.enabled", false); -user_pref("security.ssl.errorReporting.url", ""); -// 2653: disable hiding mime types (Options>General>Applications) not associated with a plugin - // [-] https://bugzilla.mozilla.org/1581678 -user_pref("browser.download.hide_plugins_without_extensions", false); -// FF89 -// 0309: disable sending Flash crash reports - // [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed] -user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false); -// 0310: disable sending the URL of the website where a plugin crashed - // [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed] -user_pref("dom.ipc.plugins.reportCrashURL", false); -// 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+] - // [1] https://bugzilla.mozilla.org/1190623 - // [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed] -user_pref("security.mixed_content.block_object_subrequest", true); -// 1803: disable Flash plugin - // 0=deactivated, 1=ask, 2=enabled - // ESR52.x is the last branch to fully support NPAPI, FF52+ stable only supports Flash - // [NOTE] You can still override individual sites via site permissions - // [-] https://bugzilla.mozilla.org/1682030 [underlying NPAPI code removed] -user_pref("plugin.state.flash", 0); // [DEFAULT: 1] -// FF90 -// 0708: disable FTP [FF60+] - // [-] https://bugzilla.mozilla.org/1574475 - // user_pref("network.ftp.enabled", false); // [DEFAULT: false FF88+] +// FF93 +// 7003: disable non-modern cipher suites + // [-] https://bugzilla.mozilla.org/1724072 + // user_pref("security.ssl3.rsa_des_ede3_sha", false); // 3DES +// FF94 +// 1402: limit font visibility (Windows, Mac, some Linux) [FF79+] - replaced by new 1402 + // [-] https://bugzilla.mozilla.org/1715507 + // user_pref("layout.css.font-visibility.level", 1); +// FF96 +// 0302: disable auto-INSTALLING Thunderbird updates via a background service + hide the setting [FF90+] [WINDOWS] + // [1] https://support.mozilla.org/kb/enable-background-updates-firefox-windows + // [-] https://bugzilla.mozilla.org/1738983 +user_pref("app.update.background.scheduling.enabled", false); +// FF97 +// 7006: onions - replaced by new 7006 "allowlist" + // [-] https://bugzilla.mozilla.org/1744006 + // user_pref("dom.securecontext.whitelist_onions", true); // 1382359 +// FF99 +// 6003: enforce CSP (Content Security Policy) + // [1] https://developer.mozilla.org/docs/Web/HTTP/CSP + // [-] https://bugzilla.mozilla.org/1754301 +user_pref("security.csp.enable", true); // [DEFAULT: true] +// FF100 +// 7009: disable HTTP2 - replaced by network.http.http2* prefs + // [WHY] Passive fingerprinting. ~50% of sites use HTTP2 [1] + // [1] https://w3techs.com/technologies/details/ce-http2/all/all + // [-] https://bugzilla.mozilla.org/1752621 + // user_pref("network.http.spdy.enabled", false); + // user_pref("network.http.spdy.enabled.deps", false); + // user_pref("network.http.spdy.enabled.http2", false); + // user_pref("network.http.spdy.websockets", false); // [FF65+] +// FF102 + // 0901: set when Thunderbird should prompt for the primary password + // 0=once per session (default), 1=every time it's needed, 2=after n minutes (0902) + // [-] https://bugzilla.mozilla.org/1767099 +user_pref("security.ask_for_password", 2); + // 0902: set how long in minutes Thunderbird should remember the primary password (0901) + // [-] https://bugzilla.mozilla.org/1767099 +user_pref("security.password_lifetime", 5); // [DEFAULT: 30] + // 2801: delete cookies and site data on exit - replaced by sanitizeOnShutdown* (2810) + // 0=keep until they expire (default), 2=keep until you close Thunderbird + // [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1681493,1681495,1681498,1759665 +user_pref("network.cookie.lifetimePolicy", 2); + // 6007: enforce Local Storage Next Generation (LSNG) [FF65+] + // [-] https://bugzilla.mozilla.org/1764696 +user_pref("dom.storage.next_gen", true); // [DEFAULT: true FF92+] // ***/ /* END: internal custom pref to test for syntax errors ***/ From 39aaee7fa32256913c7fdfd9ae3c49d4ddc7aea6 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 14 Jul 2022 15:35:58 +0200 Subject: [PATCH 088/147] Allows Thunderbird to be used without any configured email account (v93) --- user.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/user.js b/user.js index cf46d8e..8a3e842 100644 --- a/user.js +++ b/user.js @@ -206,6 +206,8 @@ user_pref("mail.instrumentation.userOptedIn", false); * [1] https://searchfox.org/comm-esr102/source/mail/base/content/specialTabs.js#1266 ***/ user_pref("mail.rights.override", true); // [DEFAULT: unset] // user_pref("mail.rights.version", 1) // [DEFAULT: unset] +/* 0372: allow Thunderbird usage without any configured email account [SETUP-INSTALL] ***/ +user_pref("app.use_without_mail_account", true); /* 0380: disable the unread message count badge on taskbar icon * [1] https://www.thunderbird.net/en-US/thunderbird/91.0.2/releasenotes/#whatsnew */ // user_pref("mail.biff.show_badge", false); // [WINDOWS] From 5a787eb8ce3f9cb0d6898655841e4626a0d5fdd4 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 14 Jul 2022 16:00:48 +0200 Subject: [PATCH 089/147] Adds `mail.compose.warn_public_recipients.*` preferences * Adds `mail.compose.warn_public_recipients.threshold` with its default value * Enables `mail.compose.warn_public_recipients.aggressive` to show an alert if previous setting warning has not be addressed (v93+) --- user.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/user.js b/user.js index 8a3e842..42f4cb6 100644 --- a/user.js +++ b/user.js @@ -1383,6 +1383,10 @@ user_pref("mail.compose.big_attachments.notify", true); // [DEFAULT: true] /* 9219: Set big attachment size to warn at */ user_pref("mail.compose.big_attachments.threshold_kb", 9220); // [DEFAULT: 5120] // user_pref("mailnews.message_warning_size", 20971520); // [DEFAULT: 20971520] +/* 9220: Set public recipients number from which BCC is advised ***/ + // user_pref("mail.compose.warn_public_recipients.threshold", 15); // [DEFAULT: 15] +/* 9221: Show an alert if the warning above has not been addressed ***/ +user_pref("mail.compose.warn_public_recipients.aggressive", true); /** VIEW ***/ /* 9230: Disable JavaScript From 5caedc08de0eadf02a9e9813af6ac12ac9a9dbbe Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 14:40:22 +0200 Subject: [PATCH 090/147] Switches to `mail.default_send_format` to send plaintext email (v101) Thunderbird 101 replaced legacy `mail.default_html_action` and `mailnews.sendformat.auto_downgrade` by `mail.default_send_format` new preference to choose email sending format. Whereas a proper "migration" is performed on first start, we stick to plaintext email enforcement in this template, as done before. See . > see #21 --- user.js | 35 +++++++++++++++++++++++------------ 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/user.js b/user.js index 42f4cb6..a8b9015 100644 --- a/user.js +++ b/user.js @@ -1332,25 +1332,25 @@ user_pref("mail.sanitize_date_header", true); /* 9210: Check spelling before sending [SETUP-FEATURE] * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=667133 ***/ user_pref("mail.SpellCheckBeforeSend", false); -/* 9211: Behavior when sending HTML message [SETUP-FEATURE] - * (0=Ask, 1=Send as plain text, 2=Send as HTML anyway, - * 3=Include both plain text and HTML message bodies in message) - * Email that is HTML should also have plaintext multipart for plain text users. - * [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html - * [SETTING] Account Settings > Composition & Addressing > Composition > Compose messages in HTML format ***/ -user_pref("mail.default_html_action", 1); -/* 9212: Send email in plaintext unless expressly overridden. +/* 9212: Compose email in plaintext unless expressly overridden * [SETUP-FEATURE] Sometimes HTML is useful especially when used with Markdown Here + * [SETTING] Account Settings > Composition & Addressing > Composition > Compose messages in HTML format * [NOTE] Holding down shift when you click on "Write" will bypass * [1] http://kb.mozillazine.org/Plain_text_e-mail_%28Thunderbird%29 * [2] https://support.mozilla.org/en-US/questions/1004181 * [3] https://markdown-here.com ***/ user_pref("mail.html_compose", false); user_pref("mail.identity.default.compose_html", false); -/* 9213: Downgrade email to plaintext by default - * [SETUP-FEATURE] Only use HTML email if you need it, see above - * [SETTING] Composition > Composition > HTML Style > Configure text format behavior > Send options... > Send messages as plain text if possible ***/ -user_pref("mailnews.sendformat.auto_downgrade", true); +/* 9213: Send only plaintext email by default + * [SETUP-FEATURE] Only use HTML email if you need it, see [1] + * Email that is HTML should also have plaintext multipart for plain text users. + * 0=auto (default, send only plain text if the message is free of any rich formatting + or inserted elements. Otherwise send both a HTML part and plain text alternative part) + * 1=plain text (only send a plain text part, losing any rich formatting or inserted elements) + * 2=HTML (only send a HTML part) + * 3=both (send both the HTML part and the plain text alternative part) + * [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html ***/ +user_pref("mail.default_send_format", 1); /* 9214: What classes can process incoming data. * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) @@ -1552,6 +1552,17 @@ user_pref("security.csp.enable", true); // [DEFAULT: true] // user_pref("network.http.spdy.enabled.deps", false); // user_pref("network.http.spdy.enabled.http2", false); // user_pref("network.http.spdy.websockets", false); // [FF65+] +// FF101 +// 9211: Behavior when sending HTML message + // (0=Ask, 1=Send as plain text, 2=Send as HTML anyway, + // 3=Include both plain text and HTML message bodies in message) + // Email that is HTML should also have plaintext multipart for plain text users. + // [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html + // [-] https://bugzilla.mozilla.org/1727493 +user_pref("mail.default_html_action", 1); +// 9213: Downgrade email to plaintext by default + // [-] https://bugzilla.mozilla.org/1727493 +user_pref("mailnews.sendformat.auto_downgrade", true); // FF102 // 0901: set when Thunderbird should prompt for the primary password // 0=once per session (default), 1=every time it's needed, 2=after n minutes (0902) From fdcaf8570be3e2ccda551122fe669889c6a553ab Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 14:56:03 +0200 Subject: [PATCH 091/147] Adds `mail.biff.use_new_count_in_badge` to template (left to default) --- user.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/user.js b/user.js index a8b9015..08648a5 100644 --- a/user.js +++ b/user.js @@ -208,9 +208,11 @@ user_pref("mail.rights.override", true); // [DEFAULT: unset] // user_pref("mail.rights.version", 1) // [DEFAULT: unset] /* 0372: allow Thunderbird usage without any configured email account [SETUP-INSTALL] ***/ user_pref("app.use_without_mail_account", true); -/* 0380: disable the unread message count badge on taskbar icon +/* 0380: disable the new/unread message count badge on taskbar icon * [1] https://www.thunderbird.net/en-US/thunderbird/91.0.2/releasenotes/#whatsnew */ // user_pref("mail.biff.show_badge", false); // [WINDOWS] +/* 0381: show the number of "new" messages on taskbar icon (not the number of unread ones) ***/ + // user_pref("mail.biff.use_new_count_in_badge", true); /*** [SECTION 0400]: SAFE BROWSING (SB) SB has taken many steps to preserve privacy. If required, a full url is never sent From 22efe768347a5e6610df996dbc84a157b14b021e Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 15:03:12 +0200 Subject: [PATCH 092/147] Gets rid of `calendar.useragent.extra` (removed in TB 78 ESR) --- user.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/user.js b/user.js index 08648a5..39b3523 100644 --- a/user.js +++ b/user.js @@ -1455,8 +1455,6 @@ user_pref("mail.chat.notification_info", 2); * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1130854 * [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1130852 ***/ user_pref("mail.calendar-integration.opt-out", false); -/* 9311: Set user agent for calendar ***/ -user_pref("calendar.useragent.extra", ""); /* 9312: Set calendar timezone to avoid system detection [SETUP-INSTALL] * By default, extensive system detection would be performed to find user's current timezone. * Setting this preference to "UTC" should disable it. From 5387c41c915eefb7da4c68a7631c3ee016055233 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 15:04:05 +0200 Subject: [PATCH 093/147] Gets rid of `mail.calendar-integration.opt-out` (removed in TB 68 ESR) --- user.js | 8 -------- 1 file changed, 8 deletions(-) diff --git a/user.js b/user.js index 39b3523..4433e67 100644 --- a/user.js +++ b/user.js @@ -1447,14 +1447,6 @@ user_pref("purple.conversations.im.send_typing", false); user_pref("mail.chat.notification_info", 2); /** CALENDAR ***/ -/* 9310: Disable calendar integration - * [SETUP-FEATURE] Lightning calendar add-on is integrated in Thunderbird 38 and later. - * Keeping this preference false allows us to properly show the opt-in/opt-out dialog - * on new profiles fresh start, see [3]. - * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=401779 - * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1130854 - * [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1130852 ***/ -user_pref("mail.calendar-integration.opt-out", false); /* 9312: Set calendar timezone to avoid system detection [SETUP-INSTALL] * By default, extensive system detection would be performed to find user's current timezone. * Setting this preference to "UTC" should disable it. From 838529ffbdd7fd9fb586ac1bbfd223712448ba33 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 15:07:40 +0200 Subject: [PATCH 094/147] Cleans outdated `0300` section documentation (related to auto-install) --- user.js | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/user.js b/user.js index 4433e67..0bb19e6 100644 --- a/user.js +++ b/user.js @@ -117,14 +117,7 @@ user_pref("spellchecker.dictionary", "en-US"); * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 ***/ user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] -/*** [SECTION 0300]: QUIETER BIRD - Starting in user.js v68, we only disable the auto-INSTALL of Thunderbird. - You still get prompts to update, in one click. - We have NEVER disabled auto-CHECKING, and highly discourage that. - There are many legitimate reasons to turn off auto-INSTALLS, including hijacked or monetized - extensions, time constraints, legacy issues, dev/testing, and fear of breakage/bugs. It is - still important to do updates for security reasons, please do so manually if you make changes. -***/ +/*** [SECTION 0300]: QUIETER BIRD ***/ user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!"); /** RECOMMENDATIONS ***/ /* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/ From 03c86462d89ecf7064a2e163f8225218408681bc Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 15:19:38 +0200 Subject: [PATCH 095/147] Disables new `calendar.extract.service.enabled` preference --- user.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/user.js b/user.js index 0bb19e6..5914730 100644 --- a/user.js +++ b/user.js @@ -1446,6 +1446,8 @@ user_pref("mail.chat.notification_info", 2); * You may also directly set it to your timezone, i.e. "Pacific/Fakaofo" * [SETTING] Calendar > Calendar > Timezone ***/ user_pref("calendar.timezone.local", "UTC"); // [DEFAULT: ""] +/* 9313: Disable calendar service performing event "extraction" from email content ***/ +user_pref("calendar.extract.service.enabled", false); // [DEFAULT: false] /** RSS ***/ /** These features don't actually do anything as they aren't implemented From 0abbda8e39525f048863ee772f904cfe2299f3ce Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 15:34:01 +0200 Subject: [PATCH 096/147] Adds `mail.biff.show_alert` and `mail.biff.alert.show_*` preferences --- user.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/user.js b/user.js index 5914730..aadd708 100644 --- a/user.js +++ b/user.js @@ -206,6 +206,15 @@ user_pref("app.use_without_mail_account", true); // user_pref("mail.biff.show_badge", false); // [WINDOWS] /* 0381: show the number of "new" messages on taskbar icon (not the number of unread ones) ***/ // user_pref("mail.biff.use_new_count_in_badge", true); +/* 0390: disable new email alerts + * [SETTING] General > Incoming Mails > When new messages arrive > Show an alert ***/ + // user_pref("mail.biff.show_alert", false); +/* 0391: control the kind of information disclosed in new email alerts + * [SETTING] General > Incoming Mails > When new messages arrive > Show an alert > Customize... ***/ +user_pref("mail.biff.alert.show_preview", false); +user_pref("mail.biff.alert.show_subject", false); +user_pref("mail.biff.alert.show_sender", false); + // user_pref("mail.biff.alert.preview_length", 40); // [HIDDEN PREF] /*** [SECTION 0400]: SAFE BROWSING (SB) SB has taken many steps to preserve privacy. If required, a full url is never sent From 255ccd84ae9ea8f45909c61c13334ad3b134e94c Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 15:45:15 +0200 Subject: [PATCH 097/147] Applies Arkenfox v102.0..v102.1 migration --- user.js | 62 ++++++++++++++++++++++++++++----------------------------- 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/user.js b/user.js index aadd708..c62e4e9 100644 --- a/user.js +++ b/user.js @@ -344,7 +344,7 @@ user_pref("keyword.enabled", false); // [DEFAULT: false] * as the 411 for DNS errors?), privacy issues (why connect to sites you didn't * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack), * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/ -user_pref("browser.fixup.alternate.enabled", false); +user_pref("browser.fixup.alternate.enabled", false); // [DEFAULT: false FF104+] /* 0804: disable live search suggestions * [NOTE] Both must be true for the location bar to work * [SETUP-CHROME] Override this if you trust and use a privacy respecting search engine ***/ @@ -483,11 +483,10 @@ user_pref("security.OCSP.require", true); * 2=detect Family Safety mode and import the root * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/ user_pref("security.family_safety.mode", 0); -/* 1223: enable strict pinning - * PKP (Public Key Pinning) 0=disabled, 1=allow user MiTM (such as your antivirus), 2=strict - * [SETUP-WEB] If you rely on an AV (antivirus) to protect your web browsing - * by inspecting ALL your web traffic, then leave at current default=1 - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16206 ***/ +/* 1223: enable strict PKP (Public Key Pinning) + * 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict + * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE: If you rely on an AV (antivirus) to protect + * your web browsing by inspecting ALL your web traffic, then override to current default ***/ user_pref("security.cert_pinning.enforcement_level", 2); /* 1224: enable CRLite [FF73+] * 0 = disabled @@ -722,17 +721,26 @@ user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] /*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); -/** SANITIZE ON SHUTDOWN: ALLOWS COOKIES + SITE DATA EXCEPTIONS FF102+ ***/ -/* 2810: enable Thunderbird to clear items on shutdown (2811) - * [NOTE] Exceptions: A "cookie" block permission also controls "offlineApps" (see note in 2811). - * serviceWorkers require an "Allow" permission. For cross-domain logins, add exceptions for - * both sites e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on) - * [WARNING] Be selective with what cookies you keep, as they also disable partitioning (1767271) - * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Thunderbird closes - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow (when on the website in question) +/** COOKIES + SITE DATA : ALLOWS EXCEPTIONS ***/ +/* 2801: delete cookies and site data on exit + * 0=keep until they expire (default), 2=keep until you close Thunderbird + * [NOTE] A "cookie" block permission also controls localStorage/sessionStorage, indexedDB, + * sharedWorkers and serviceWorkers. serviceWorkers require an "Allow" permission + * [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Thunderbird is closed + * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ +user_pref("network.cookie.lifetimePolicy", 2); +/* 2802: delete cache on exit [FF96+] + * [NOTE] We already disable disk cache (1001) and clear on exit (2811) which is more robust + * [1] https://bugzilla.mozilla.org/1671182 ***/ + // user_pref("privacy.clearsitedata.cache.enabled", true); + +/** SANITIZE ON SHUTDOWN : ALL OR NOTHING ***/ +/* 2810: enable Thunderbird to clear items on shutdown (2811) + * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Thunderbird closes ***/ user_pref("privacy.sanitize.sanitizeOnShutdown", true); /* 2811: set/enforce what items to clear on shutdown (if 2810 is true) [SETUP-CHROME] + * These items do not use exceptions, it is all or nothing (1681701) * [NOTE] If "history" is true, downloads will also be cleared * [NOTE] "sessions": Active Logins: refers to HTTP Basic Authentication [1], not logins via cookies * [NOTE] "offlineApps": Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache) @@ -742,13 +750,9 @@ user_pref("privacy.clearOnShutdown.downloads", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.formdata", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.history", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.sessions", true); // [DEFAULT: true] -user_pref("privacy.clearOnShutdown.offlineApps", true); +user_pref("privacy.clearOnShutdown.offlineApps", true); // [DEFAULT: false] user_pref("privacy.clearOnShutdown.cookies", true); - // user_pref("privacy.clearOnShutdown.siteSettings", false); // [DEFAULT: false] -/* 2812: delete cache on exit [FF96+] - * [NOTE] We already disable disk cache (1001) and clear on exit (2811) which is more robust - * [1] https://bugzilla.mozilla.org/1671182 ***/ - // user_pref("privacy.clearsitedata.cache.enabled", true); + // user_pref("privacy.clearOnShutdown.siteSettings", false); /** SANITIZE MANUAL: ALL OR NOTHING ***/ /* 2820: reset default items to clear with Ctrl-Shift-Del [SETUP-CHROME] @@ -760,15 +764,14 @@ user_pref("privacy.cpd.cache", true); // [DEFAULT: true] user_pref("privacy.cpd.formdata", true); // [DEFAULT: true] user_pref("privacy.cpd.history", true); // [DEFAULT: true] user_pref("privacy.cpd.sessions", true); // [DEFAULT: true] -user_pref("privacy.cpd.offlineApps", false); // [DEFAULT: false] -user_pref("privacy.cpd.cookies", false); +user_pref("privacy.cpd.offlineApps", true); // [DEFAULT: false] +user_pref("privacy.cpd.cookies", true); // user_pref("privacy.cpd.downloads", true); // not used, see note above - // user_pref("privacy.cpd.passwords", false); // [DEFAULT: false] not listed - // user_pref("privacy.cpd.siteSettings", false); // [DEFAULT: false] + // user_pref("privacy.cpd.passwords", false); + // user_pref("privacy.cpd.siteSettings", false); /* 2821: clear Session Restore data when sanitizing on shutdown or manually [FF34+] * [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811) - * [NOTE] privacy.clearOnShutdown.openWindows prevents resuming from crashes (also see 5008) - * [NOTE] privacy.cpd.openWindows has a bug that causes an additional window to open ***/ + * [NOTE] privacy.clearOnShutdown.openWindows prevents resuming from crashes (also see 5008) ***/ // user_pref("privacy.clearOnShutdown.openWindows", true); // user_pref("privacy.cpd.openWindows", true); /* 2822: reset default "Time range to clear" for "Clear Recent History" (2820) @@ -932,7 +935,8 @@ user_pref("permissions.memory_only", true); // [HIDDEN PREF] user_pref("browser.chrome.site_icons", false); /* 5007: exclude "Undo Closed Tabs" in Session Restore ***/ user_pref("browser.sessionstore.max_tabs_undo", 0); -/* 5008: disable resuming session from crash ***/ +/* 5008: disable resuming session from crash + * [TEST] about:crashparent ***/ user_pref("browser.sessionstore.resume_from_crash", false); /* 5009: disable "open with" in download dialog [FF50+] * Application data isolation [1] @@ -1567,10 +1571,6 @@ user_pref("security.ask_for_password", 2); // 0902: set how long in minutes Thunderbird should remember the primary password (0901) // [-] https://bugzilla.mozilla.org/1767099 user_pref("security.password_lifetime", 5); // [DEFAULT: 30] - // 2801: delete cookies and site data on exit - replaced by sanitizeOnShutdown* (2810) - // 0=keep until they expire (default), 2=keep until you close Thunderbird - // [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1681493,1681495,1681498,1759665 -user_pref("network.cookie.lifetimePolicy", 2); // 6007: enforce Local Storage Next Generation (LSNG) [FF65+] // [-] https://bugzilla.mozilla.org/1764696 user_pref("dom.storage.next_gen", true); // [DEFAULT: true FF92+] From f885b50de5300d4af25dca2a3a4cc14f3d1e8ba3 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 23 Jul 2022 15:46:53 +0200 Subject: [PATCH 098/147] Removes unnecessary leading spaces in some documentation lines --- user.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index c62e4e9..a3100ae 100644 --- a/user.js +++ b/user.js @@ -150,7 +150,7 @@ user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+] user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+] /* 0333: disable Telemetry Coverage - * [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/ + * [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/ user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF] user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF] user_pref("toolkit.coverage.endpoint.base", ""); @@ -498,8 +498,8 @@ user_pref("security.cert_pinning.enforcement_level", 2); user_pref("security.remote_settings.crlite_filters.enabled", true); user_pref("security.pki.crlite_mode", 2); /* 1225: enable loading of client certificates stored in OS certificate storage - * Bug: this does **NOT** work for S/MIME [1] - * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1726442 ***/ + * Bug: this does **NOT** work for S/MIME [1] + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1726442 ***/ // user_pref("security.osclientcerts.autoload", true); /** MIXED CONTENT ***/ From ea3c48a7a9ad4bc588b9b423d526c6afc78d812c Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 3 Sep 2022 10:00:56 +0200 Subject: [PATCH 099/147] Leaves `app.use_without_mail_account` disabled not to hide emails UI > See Co-Authored-By: Dupond --- user.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index a3100ae..8f9d751 100644 --- a/user.js +++ b/user.js @@ -199,8 +199,9 @@ user_pref("mail.instrumentation.userOptedIn", false); * [1] https://searchfox.org/comm-esr102/source/mail/base/content/specialTabs.js#1266 ***/ user_pref("mail.rights.override", true); // [DEFAULT: unset] // user_pref("mail.rights.version", 1) // [DEFAULT: unset] -/* 0372: allow Thunderbird usage without any configured email account [SETUP-INSTALL] ***/ -user_pref("app.use_without_mail_account", true); +/* 0372: allow Thunderbird usage without any configured email account [SETUP-INSTALL] + * [NOTE] Only enable this if you don't plan to use emails at all and want to hide the account setup ***/ + // user_pref("app.use_without_mail_account", true); /* 0380: disable the new/unread message count badge on taskbar icon * [1] https://www.thunderbird.net/en-US/thunderbird/91.0.2/releasenotes/#whatsnew */ // user_pref("mail.biff.show_badge", false); // [WINDOWS] From 902231ecf021402d1b637a5c3746159edf996150 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 10 Sep 2022 14:19:29 +0200 Subject: [PATCH 100/147] Restores two preferences in section 2700 `privacy.antitracking.enableWebcompat` & `privacy.partition.serviceWorkers` are actually present in TB ESR 102. --- user.js | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/user.js b/user.js index 8f9d751..cee1455 100644 --- a/user.js +++ b/user.js @@ -50,6 +50,7 @@ 2000: PLUGINS / MEDIA / WEBRTC 2400: DOM (DOCUMENT OBJECT MODEL) 2600: MISCELLANEOUS + 2700: ETP (ENHANCED TRACKING PROTECTION) 2800: SHUTDOWN & SANITIZING 4500: RFP (RESIST FINGERPRINTING) 5000: OPTIONAL OPSEC @@ -720,6 +721,18 @@ user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ // user_pref("extensions.webextensions.restrictedDomains", ""); +/*** [SECTION 2700]: ETP (ENHANCED TRACKING PROTECTION) ***/ +user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); +/* 2702: disable ETP web compat features [FF93+] + * [SETUP-HARDEN] Includes skip lists, heuristics (SmartBlock) and automatic grants + * Opener and redirect heuristics are granted for 30 days, see [3] + * [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/ + * [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12 + * [3] https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ + // user_pref("privacy.antitracking.enableWebcompat", false); +/* 2710: enable state partitioning of service workers [FF96+] ***/ +user_pref("privacy.partition.serviceWorkers", true); + /*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); /** COOKIES + SITE DATA : ALLOWS EXCEPTIONS ***/ From d778e6d7b692846a884f1aa8de2bd224be26f62a Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 10 Sep 2022 14:20:05 +0200 Subject: [PATCH 101/147] Adds corresponding SETTING tag for `mail.default_send_format` --- user.js | 1 + 1 file changed, 1 insertion(+) diff --git a/user.js b/user.js index cee1455..ded3fd7 100644 --- a/user.js +++ b/user.js @@ -1365,6 +1365,7 @@ user_pref("mail.html_compose", false); user_pref("mail.identity.default.compose_html", false); /* 9213: Send only plaintext email by default * [SETUP-FEATURE] Only use HTML email if you need it, see [1] + * [SETTING] Composition > Composition > Sending Format * Email that is HTML should also have plaintext multipart for plain text users. * 0=auto (default, send only plain text if the message is free of any rich formatting or inserted elements. Otherwise send both a HTML part and plain text alternative part) From 0ccd0c0e998a468219c96a1f9764d9019bf8497e Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 10 Sep 2022 17:16:47 +0200 Subject: [PATCH 102/147] Enforces `mail.compose.add_link_preview` --- user.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/user.js b/user.js index ded3fd7..ef33803 100644 --- a/user.js +++ b/user.js @@ -1410,6 +1410,9 @@ user_pref("mail.compose.big_attachments.threshold_kb", 9220); // [DEFAULT: 5120] // user_pref("mail.compose.warn_public_recipients.threshold", 15); // [DEFAULT: 15] /* 9221: Show an alert if the warning above has not been addressed ***/ user_pref("mail.compose.warn_public_recipients.aggressive", true); +/* 9222: Disable link previews + * [SETTING] Composition > Composition > Add link previews when pasting URLs ***/ +user_pref("mail.compose.add_link_preview", false); // [DEFAULT: false] /** VIEW ***/ /* 9230: Disable JavaScript From 0dcc49687fee1a1c08a35cdef8685e66d9fba5d4 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 10 Sep 2022 17:20:49 +0200 Subject: [PATCH 103/147] Enforces `mailnews.message_display.disable_remote_image` --- user.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/user.js b/user.js index ef33803..07c02be 100644 --- a/user.js +++ b/user.js @@ -1439,6 +1439,9 @@ user_pref("mail.phishing.detection.enabled", true); user_pref("mail.phishing.detection.disallow_form_actions", true); user_pref("mail.phishing.detection.ipaddresses", true); user_pref("mail.phishing.detection.mismatched_hosts", true); +/* 9250: Disable remote content loading + * [SETTING] Privacy & Security > Privacy > Mail content > Allow remote content in messages ***/ +user_pref("mailnews.message_display.disable_remote_image", true); // [DEFAULT: true] /*** [SECTION 9300]: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) Options that relate to other Thunderbird components such as the chat client, calendar and RSS) From c1e6a54f75d62d2282920af592961dec0268e600 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 10 Sep 2022 14:20:22 +0200 Subject: [PATCH 104/147] Bumps to v102.0-beta2 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 07c02be..f27cb96 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 24 August 2022 -* version: v102.0-beta1 +* date: 10 September 2022 +* version: v102.0-beta2 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From a3a5c4ad86b7dd663f5dad61bbc967b49cd885f2 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 28 Sep 2022 20:51:45 +0200 Subject: [PATCH 105/147] Bumps to v102.0 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index f27cb96..fc9ec1c 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 10 September 2022 -* version: v102.0-beta2 +* date: 28 September 2022 +* version: v102.0 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From 08713b3ea9c969896b9f6582df1a8ec2af15d982 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 1 Oct 2022 11:18:23 +0200 Subject: [PATCH 106/147] Resets `mail.biff.alert.*` back to default values Let's leave new email alert preferences to their default values, but note that they may be appreciated in some environments. > See #27 --- user.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index fc9ec1c..795db2a 100644 --- a/user.js +++ b/user.js @@ -212,10 +212,11 @@ user_pref("mail.rights.override", true); // [DEFAULT: unset] * [SETTING] General > Incoming Mails > When new messages arrive > Show an alert ***/ // user_pref("mail.biff.show_alert", false); /* 0391: control the kind of information disclosed in new email alerts + * These preferences MAY be appreciated in environments with inquisitive eyes wandering behind your screen. * [SETTING] General > Incoming Mails > When new messages arrive > Show an alert > Customize... ***/ -user_pref("mail.biff.alert.show_preview", false); -user_pref("mail.biff.alert.show_subject", false); -user_pref("mail.biff.alert.show_sender", false); + // user_pref("mail.biff.alert.show_preview", false); + // user_pref("mail.biff.alert.show_subject", false); + // user_pref("mail.biff.alert.show_sender", false); // user_pref("mail.biff.alert.preview_length", 40); // [HIDDEN PREF] /*** [SECTION 0400]: SAFE BROWSING (SB) From 8970a6fda1f7dbbc8e63082852985c7ba5dc83e5 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 1 Oct 2022 16:22:28 +0200 Subject: [PATCH 107/147] Removes `privacy.userContext.newTabContainerOnLeftClick.enabled` It appears this preference has never been implemented in Thunderbird. --- user.js | 3 --- 1 file changed, 3 deletions(-) diff --git a/user.js b/user.js index 795db2a..3f34647 100644 --- a/user.js +++ b/user.js @@ -579,9 +579,6 @@ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); * https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/ user_pref("privacy.userContext.enabled", true); user_pref("privacy.userContext.ui.enabled", true); -/* 1702: set behavior on "+ Tab" button to display container menu on left click [FF74+] - * [NOTE] The menu is always shown on long press and right click ***/ - // user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true); /*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); From 494f684d746fa81aaff1028c36851bbc41b735f8 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 1 Oct 2022 17:41:20 +0200 Subject: [PATCH 108/147] Adds `mail.openpgp.remind_encryption_possible` (TB 102.2+) --- user.js | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 3f34647..6aae64c 100644 --- a/user.js +++ b/user.js @@ -62,7 +62,7 @@ 9100: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) 9200: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) 9300: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) - 9400: THUNDERBIRD ENCRYPTION (OPENGPG / GNUPG) + 9400: THUNDERBIRD ENCRYPTION (OPENPGP / GNUPG) 9999: DEPRECATED / REMOVED / LEGACY / RENAMED ******/ @@ -1520,13 +1520,17 @@ user_pref("rss.show.summary", 1); * 0=no action, 1=load web page in default browser, on select ***/ user_pref("rss.message.loadWebPageOnSelect", 0); -/*** [SECTION 9400]: THUNDERBIRD ENCRYPTION (OPENGPG / GNUPG) +/*** [SECTION 9400]: THUNDERBIRD ENCRYPTION (OPENPGP / GNUPG) Options that relate to e-mail encryption in Thunderbird. [1] https://wiki.mozilla.org/Thunderbird:OpenPGP [2] https://support.mozilla.org/kb/openpgp-thunderbird-howto-and-faq ***/ user_pref("_user.js.parrot", "9400 syntax error: this parrot is talking in codes!"); +/** OPENPGP ***/ +/* 9400: disable OpenPGP "encryption is possible" reminder ***/ + // user_pref("mail.openpgp.remind_encryption_possible", false); // [TB102+] + /** GNUPG ***/ /* 9409: Allow the use of external GnuPG * Whenever RNP fails to decrypt a message, Thunderbird will tray against system GnuPG From d8d79d6c84d24fc9c9ca6ad72e1f5625e0c66309 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 1 Oct 2022 16:09:12 +0200 Subject: [PATCH 109/147] Workaround ETP Strict Mode lack of support in 102 In #24, we wrongly assumed that ETP Strict Mode was available in TB 102 (as it was for FF 102). This patch aims to workaround this (security) issue by : * Re-enabling FPI ; * Re-enabling DNT header ; * Restoring `network.cookie.cookieBehavior` tweak ; * Re-enabling ETP with custom settings (including query parameter stripping) ; * Re-dealing with persistent storage-related preferences (`2700`). This increases divergence with Arkenfox upstream template. > see #27 --- user.js | 142 ++++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 112 insertions(+), 30 deletions(-) diff --git a/user.js b/user.js index 6aae64c..157a2a3 100644 --- a/user.js +++ b/user.js @@ -50,8 +50,9 @@ 2000: PLUGINS / MEDIA / WEBRTC 2400: DOM (DOCUMENT OBJECT MODEL) 2600: MISCELLANEOUS - 2700: ETP (ENHANCED TRACKING PROTECTION) + 2700: PERSISTENT STORAGE & ETP (ENHANCED TRACKING PROTECTION) 2800: SHUTDOWN & SANITIZING + 4000: FPI (FIRST PARTY ISOLATION) 4500: RFP (RESIST FINGERPRINTING) 5000: OPTIONAL OPSEC 5500: OPTIONAL HARDENING @@ -572,6 +573,9 @@ user_pref("network.http.referer.XOriginPolicy", 2); /* 1602: control the amount of cross-origin information to send [FF52+] * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); +/* 1603: enable the DNT (Do Not Track) HTTP header + * [SETTING] Privacy & Security > Privacy > Web Content > Send websites a "Do Not Track" signal... ***/ +user_pref("privacy.donottrackheader.enabled", true); /*** [SECTION 1700]: CONTAINERS ***/ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); @@ -719,16 +723,80 @@ user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ // user_pref("extensions.webextensions.restrictedDomains", ""); -/*** [SECTION 2700]: ETP (ENHANCED TRACKING PROTECTION) ***/ +/*** [SECTION 2700]: PERSISTENT STORAGE & ETP (ENHANCED TRACKING PROTECTION) + Data SET by websites including + cookies : profile\cookies.sqlite + localStorage : profile\webappsstore.sqlite + indexedDB : profile\storage\default + serviceWorkers : + [NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode + [NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage), + indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications) + If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become + accessible to websites except shared/service workers where the cookie setting must be "Allow" + + [NOTE] As Thunderbird lacks of ETP Strict Mode support at the moment, we still enable FPI (4000), + have to deal with persistent storage here and enable state partitioning of service workers (2790) +***/ user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); -/* 2702: disable ETP web compat features [FF93+] +/* 2701: disable or isolate 3rd-party cookies and site-data [SETUP-WEB] + * 0 = Accept cookies and site data + * 1 = (Block) All third-party cookies + * 2 = (Block) All cookies + * 3 = (Block) Cookies from unvisited websites + * 4 = (Block) Cross-site tracking cookies (default) + * 5 = (Isolate All) Cross-site cookies (TCP: Total Cookie Protection / dFPI: dynamic FPI) [1] (FF86+) + * Option 5 with FPI enabled (4001) is ignored and not shown, and option 4 used instead + * [NOTE] You can set cookie exceptions under site permissions or use an extension + * [NOTE] Enforcing category to custom ensures ETP related prefs are always honored + * [SETTING] Privacy & Security > Privacy > Web Content > Accept cookies from sites + * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ ***/ +user_pref("network.cookie.cookieBehavior", 2); +/* 2702: set third-party cookies (if enabled, see 2701) to session-only + * [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and + * .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones + * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/ +user_pref("network.cookie.thirdparty.sessionOnly", true); +user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+] +/* 2703: delete cookies and site data on close + * 0=keep until they expire (default), 2=keep until you close Thunderbird + * [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2) + * [SETTING] Privacy & Security > Privacy > Web Content > Keep until: "I close Thunderbird" ***/ +user_pref("network.cookie.lifetimePolicy", 2); +/* 2710: enable Enhanced Tracking Protection (ETP) in all windows ***/ +user_pref("privacy.trackingprotection.enabled", true); +/* 2711: enable various ETP lists ***/ +user_pref("privacy.trackingprotection.socialtracking.enabled", true); +user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] +user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] +/* 2712: disable ETP web compat features [FF93+] * [SETUP-HARDEN] Includes skip lists, heuristics (SmartBlock) and automatic grants * Opener and redirect heuristics are granted for 30 days, see [3] * [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/ * [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12 * [3] https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ // user_pref("privacy.antitracking.enableWebcompat", false); -/* 2710: enable state partitioning of service workers [FF96+] ***/ +/* 2720: customize ETP settings (as Strict Mode is not available) */ +user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); // [DEFAULT: true] +user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [DEFAULT: true FF100+] +user_pref("privacy.partition.network_state.ocsp_cache", true); +user_pref("privacy.query_stripping.enabled", true); // [FF101+] +/* 2740: disable service worker cache and cache storage + * [NOTE] We clear service worker cache on exit (2811) + * [1] https://w3c.github.io/ServiceWorker/#privacy ***/ +user_pref("dom.caches.enabled", false); +/* 2750: disable Storage API [FF51+] + * The API gives sites the ability to find out how much space they can use, how much + * they are already using, and even control whether or not they need to be alerted + * before the user agent disposes of site data in order to make room for other things. + * [1] https://developer.mozilla.org/docs/Web/API/StorageManager + * [2] https://developer.mozilla.org/docs/Web/API/Storage_API + * [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/ +user_pref("dom.storageManager.enabled", false); +/* 2755: disable Storage Access API [FF65+] + * [1] https://developer.mozilla.org/docs/Web/API/Storage_Access_API ***/ +user_pref("dom.storage_access.enabled", false); // [DEFAULT: false] +/* 2790: enable state partitioning of service workers [FF96+] ***/ user_pref("privacy.partition.serviceWorkers", true); /*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ @@ -793,6 +861,46 @@ user_pref("privacy.cpd.cookies", true); * which will display a blank value, and are not guaranteed to work ***/ user_pref("privacy.sanitize.timeSpan", 0); +/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION) + 1278037 - indexedDB (FF51+) + 1277803 - favicons (FF52+) + 1264562 - OCSP cache (FF52+) + 1268726 - Shared Workers (FF52+) + 1316283 - SSL session cache (FF52+) + 1317927 - media cache (FF53+) + 1323644 - HSTS and HPKP (FF54+) + 1334690 - HTTP Alternative Services (FF54+) + 1334693 - SPDY/HTTP2 (FF55+) + 1337893 - DNS cache (FF55+) + 1344170 - blob: URI (FF55+) + 1300671 - data:, about: URLs (FF55+) + 1473247 - IP addresses (FF63+) + 1542309 - top-level domain URLs when host is in the public suffix list (FF68+) + 1506693 - pdfjs range-based requests (FF68+) + 1330467 - site permissions (FF69+) + 1534339 - IPv6 (FF73+) + 1721858 - WebSocket (FF92+) +***/ +user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out"); +/* 4001: enable First Party Isolation [FF51+] + * [SETUP-WEB] Breaks some cross-origin logins + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1260931,1299996 ***/ +user_pref("privacy.firstparty.isolate", true); +/* 4002: enforce FPI restriction for window.opener [FF54+] + * [NOTE] Setting this to false may reduce the breakage in 4001 + * FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But + * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute [2][3] + * The 2nd pref removes that limitation and will only allow communication if FPDs also match + * [1] https://bugzilla.mozilla.org/1319773#c22 + * [2] https://bugzilla.mozilla.org/1492607 + * [3] https://developer.mozilla.org/docs/Web/API/Window/postMessage ***/ +user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] +user_pref("privacy.firstparty.isolate.block_post_message", true); +/* 4003: enable scheme with FPI [FF78+] + * [NOTE] Experimental: existing data and site permissions are incompatible + * and some site exceptions may not work e.g. HTTPS-only mode (1244) ***/ +user_pref("privacy.firstparty.isolate.use_site", true); + /*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) RFP covers a wide range of ongoing fingerprinting solutions. It is an all-or-nothing buy in: you cannot pick and choose what parts you want @@ -1014,10 +1122,6 @@ user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] /* 6004: enforce a security delay on some confirmation dialogs such as install, open/save * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] -/* 6008: enforce no First Party Isolation [FF51+] - * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), - * and enabling FPI disables those. FPI is no longer maintained ***/ -user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false] /* 6009: enforce SmartBlock shims [FF81+] * In FF96+ these are listed in about:compat * [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/ @@ -1034,15 +1138,7 @@ user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] user_pref("security.pki.sha1_enforcement_level", 1); // [DEFAULT: 1 FF102+] /* 6050: prefsCleaner: reset items removed from arkenfox FF92+ ***/ // user_pref("browser.urlbar.trimURLs", ""); - // user_pref("dom.caches.enabled", ""); - // user_pref("dom.storageManager.enabled", ""); - // user_pref("dom.storage_access.enabled", ""); // user_pref("dom.targetBlankNoOpener.enabled", ""); - // user_pref("network.cookie.thirdparty.sessionOnly", ""); - // user_pref("network.cookie.thirdparty.nonsecureSessionOnly", ""); - // user_pref("privacy.firstparty.isolate.block_post_message", ""); - // user_pref("privacy.firstparty.isolate.restrict_opener_access", ""); - // user_pref("privacy.firstparty.isolate.use_site", ""); // user_pref("privacy.window.name.update.enabled", ""); // user_pref("security.insecure_connection_text.enabled", ""); @@ -1113,20 +1209,6 @@ user_pref("dom.event.clipboardevents.enabled", false); * [WHY] It can compromise security. System addons ship with prefs, use those ***/ // user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] // user_pref("extensions.systemAddon.update.url", ""); // [FF44+] -/* 7015: enable the DNT (Do Not Track) HTTP header - * [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/ - // user_pref("privacy.donottrackheader.enabled", true); -/* 7016: customize ETP settings - * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ - // user_pref("network.cookie.cookieBehavior", 5); - // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); - // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] - // user_pref("privacy.partition.network_state.ocsp_cache", true); - // user_pref("privacy.query_stripping.enabled", true); // [FF101+] [ETP FF102+] - // user_pref("privacy.trackingprotection.enabled", true); - // user_pref("privacy.trackingprotection.socialtracking.enabled", true); - // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] - // user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] /* 7017: disable service workers * [WHY] Already isolated (FF96+) with TCP (2701) behind a pref (2710) * or blocked with TCP in 3rd parties (FF95 or lower) ***/ From eba6bc4dea9a86cc84b39f831188a0c6f2b671f5 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 2 Oct 2022 11:23:04 +0200 Subject: [PATCH 110/147] Bumps to v102.1 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 157a2a3..29f97a5 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 28 September 2022 -* version: v102.0 +* date: 2 October 2022 +* version: v102.1 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From cc6cab65250c4e5150daa99668cd2c8bfa6597c6 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 22 Oct 2022 17:01:31 +0200 Subject: [PATCH 111/147] Restores `security.cert_pinning.enforcement_level` note about PM Bridge It has been silently dropped during 5342ec1 (v78 -> v91 Arkenfox migration). --- user.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/user.js b/user.js index 29f97a5..35ad61b 100644 --- a/user.js +++ b/user.js @@ -490,7 +490,8 @@ user_pref("security.family_safety.mode", 0); /* 1223: enable strict PKP (Public Key Pinning) * 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE: If you rely on an AV (antivirus) to protect - * your web browsing by inspecting ALL your web traffic, then override to current default ***/ + * your web browsing by inspecting ALL your web traffic, then override to current default + * [NOTE] It needs to be set to 1 when connecting to the ProtonMail Bridge for the first time ***/ user_pref("security.cert_pinning.enforcement_level", 2); /* 1224: enable CRLite [FF73+] * 0 = disabled From 4f5cde426c4b0d8d0a31659f2a3c315f1feb9cc0 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 27 Nov 2022 15:36:16 +0100 Subject: [PATCH 112/147] Resets `signon.rememberSignons` preference to let the user choose By disabling this preference, we prevented Thunderbird from even asking whether passwords of new setup mail accounts should be saved or not. This could be pretty confusing and not handy for daily usage. Users with _specific_ needs can still unconditionally disable passwords saving by uncommenting `5003`. > closes #30 Co-Authored-By: atomGit --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 35ad61b..65f4ded 100644 --- a/user.js +++ b/user.js @@ -1038,8 +1038,8 @@ user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow user_pref("browser.cache.memory.enable", false); user_pref("browser.cache.memory.capacity", 0); /* 5003: disable saving passwords - * [NOTE] This does not clear any passwords already saved ***/ -user_pref("signon.rememberSignons", false); + * [NOTE] This does not clear any already saved passwords and will make TB ask for it every time ***/ + // user_pref("signon.rememberSignons", false); /* 5004: disable permissions manager from reading or writing to disk [FF41+] [RESTART] * [SETUP-CHROME] This means any permission changes (cookie or mail remote content) are session only * [1] https://bugzilla.mozilla.org/967812 ***/ From 32663905d01e0e951fe014a3049c59c882cf3f9f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Tue, 28 Feb 2023 17:13:11 +0100 Subject: [PATCH 113/147] Adds `mail.compose.warned_about_customize_from` preference to template --- user.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/user.js b/user.js index 65f4ded..a4a547d 100644 --- a/user.js +++ b/user.js @@ -204,6 +204,8 @@ user_pref("mail.rights.override", true); // [DEFAULT: unset] /* 0372: allow Thunderbird usage without any configured email account [SETUP-INSTALL] * [NOTE] Only enable this if you don't plan to use emails at all and want to hide the account setup ***/ // user_pref("app.use_without_mail_account", true); +/* 0373: disable warning when customizing "From address" ***/ + // user_pref("mail.compose.warned_about_customize_from", true); /* 0380: disable the new/unread message count badge on taskbar icon * [1] https://www.thunderbird.net/en-US/thunderbird/91.0.2/releasenotes/#whatsnew */ // user_pref("mail.biff.show_badge", false); // [WINDOWS] From 32afc0b38dd8e20b5a10ce757faf56e5c6851c4b Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 2 Mar 2023 18:51:00 +0100 Subject: [PATCH 114/147] Removes duplicate `network.cookie.lifetimePolicy` This commit is a follow-up for d8d79d6c, where we re-introduced this preference, during a (partial) revert, to workaround the lack of strict ETP support. > closes #33 --- user.js | 5 ----- 1 file changed, 5 deletions(-) diff --git a/user.js b/user.js index a4a547d..c299b5c 100644 --- a/user.js +++ b/user.js @@ -761,11 +761,6 @@ user_pref("network.cookie.cookieBehavior", 2); * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/ user_pref("network.cookie.thirdparty.sessionOnly", true); user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+] -/* 2703: delete cookies and site data on close - * 0=keep until they expire (default), 2=keep until you close Thunderbird - * [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2) - * [SETTING] Privacy & Security > Privacy > Web Content > Keep until: "I close Thunderbird" ***/ -user_pref("network.cookie.lifetimePolicy", 2); /* 2710: enable Enhanced Tracking Protection (ETP) in all windows ***/ user_pref("privacy.trackingprotection.enabled", true); /* 2711: enable various ETP lists ***/ From d2283b8c91ab327394bd98d9b66e52daf556eec1 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Mon, 6 Mar 2023 18:46:48 +0100 Subject: [PATCH 115/147] Bumps to v102.2 --- LICENSE | 2 +- user.js | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/LICENSE b/LICENSE index 48b65d5..3283feb 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2019-2022 HorlogeSkynet +Copyright (c) 2019-2023 HorlogeSkynet Copyright (c) 2019 dngray Copyright (c) 2019 arkenfox [prev. ghacksuserjs] diff --git a/user.js b/user.js index c299b5c..d84d305 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 2 October 2022 -* version: v102.1 +* date: 6 March 2023 +* version: v102.2 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From 07d26c788110bd6230b2d8097ef9e8071c26142f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 15 Jul 2023 18:56:50 +0200 Subject: [PATCH 116/147] Resets `mail.SpellCheckBeforeSend` > see #35 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index d84d305..77b37f2 100644 --- a/user.js +++ b/user.js @@ -1429,9 +1429,9 @@ user_pref("mail.suppress_content_language", true); user_pref("mail.sanitize_date_header", true); /** COMPOSITION ***/ -/* 9210: Check spelling before sending [SETUP-FEATURE] +/* 9210: Check spelling before sending * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=667133 ***/ -user_pref("mail.SpellCheckBeforeSend", false); + // user_pref("mail.SpellCheckBeforeSend", false); /* 9212: Compose email in plaintext unless expressly overridden * [SETUP-FEATURE] Sometimes HTML is useful especially when used with Markdown Here * [SETTING] Account Settings > Composition & Addressing > Composition > Compose messages in HTML format From 439e5b5e7d7be91bd202d883ca11a21cd6831d6f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 15 Jul 2023 19:03:42 +0200 Subject: [PATCH 117/147] Adds `mail.inline_attachments.text` to template This preference controls whether "text attachments" (e.g. CSV, HTML or even plain text) should **also** be directly rendered in message body. > see #35 --- user.js | 1 + 1 file changed, 1 insertion(+) diff --git a/user.js b/user.js index 77b37f2..aaaa2b1 100644 --- a/user.js +++ b/user.js @@ -1477,6 +1477,7 @@ user_pref("mailnews.display.prefer_plaintext", false); * true=Show inlinable attachments (text, images, messages) after the message. * false=Do not display any attachments with the message ***/ user_pref("mail.inline_attachments", false); + // user_pref("mail.inline_attachments.text", false); /* 9218: Big attachment warning * [1] https://support.mozilla.org/en-US/questions/1081046 * [2] http://forums.mozillazine.org/viewtopic.php?f=39&t=2949521 */ From ac8a715b067749c9a7845d2fe862764f34bef20f Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 15 Jul 2023 19:13:06 +0200 Subject: [PATCH 118/147] Adds missing semi-colon in reset `mail.rights.version` --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index aaaa2b1..3970c6b 100644 --- a/user.js +++ b/user.js @@ -200,7 +200,7 @@ user_pref("mail.instrumentation.userOptedIn", false); * true=never show the notification * [1] https://searchfox.org/comm-esr102/source/mail/base/content/specialTabs.js#1266 ***/ user_pref("mail.rights.override", true); // [DEFAULT: unset] - // user_pref("mail.rights.version", 1) // [DEFAULT: unset] + // user_pref("mail.rights.version", 1); // [DEFAULT: unset] /* 0372: allow Thunderbird usage without any configured email account [SETUP-INSTALL] * [NOTE] Only enable this if you don't plan to use emails at all and want to hide the account setup ***/ // user_pref("app.use_without_mail_account", true); From fc144d3cb15c5a35fc923c9ae7230ef7e51f995c Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 14 Sep 2023 09:57:47 +0200 Subject: [PATCH 119/147] Fixes related project repository link > closes #38 --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 2032c4d..e936387 100644 --- a/README.md +++ b/README.md @@ -39,4 +39,4 @@ Also be aware that this `user.js` is made specifically for Thunderbird and is on * [Privacy Handbuch](https://www.privacy-handbuch.de/handbuch_31p.htm) * [Privacy Haters](http://r-36.net/scm/privacy-haters/file/README.md.html) -* [12bytes.org's user-overrides.js](https://codeberg.org/12bytes.org/thunderbird-user.js-supplement) +* [12bytes's user-overrides.js](https://codeberg.org/12bytes/thunderbird-user.js-supplement) From 8bd612fd82b2221eee8746c5e290cccbc6855080 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 30 Jul 2023 12:16:10 +0200 Subject: [PATCH 120/147] Adds preferences from TB 115 ESR mailnews.js --- user.js | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 3970c6b..4a65a2c 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 6 March 2023 -* version: v102.2 +* date: 30 July 2023 +* version: v115.0-beta1 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) @@ -431,6 +431,8 @@ user_pref("browser.sessionstore.privacy_level", 2); * Increasing this can help on older machines and some websites, as well as reducing writes [1] * [1] https://bugzilla.mozilla.org/1304389 ***/ user_pref("browser.sessionstore.interval", 30000); // [DEFAULT: 15000] +/* 1901: disable disk cache for messages not in offline store */ +user_pref("mail.imap.use_disk_cache2", false); /*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) Your cipher and other settings can be used in server side fingerprinting @@ -1066,6 +1068,11 @@ user_pref("places.history.enabled", false); /* 5016: discourage downloading to desktop * 0=desktop, 1=downloads (default), 2=last used ***/ // user_pref("browser.download.folderList", 2); +/* 5901: Enforce Private Browsing for OAuth sign-in + * Providers may expect a device identifier from the browser, which could cause issues with PB. As + * many users could suffer from this we keep this it disabled, feel free to switch it on if yours + * supports it. */ + // user_pref("mailnews.oauth.usePrivateBrowser", true); /*** [SECTION 5500]: OPTIONAL HARDENING Thunderbird-User.JS maintainer here : @@ -1317,11 +1324,14 @@ user_pref("_user.js.parrot", "9100 syntax error: this parrot is blind!"); * These options disable auto-configuration of mail servers in Thunderbird. * Such settings require a query to Mozilla which could have privacy implications * if the user wishes to keep the existence of the mail provider private. + * We also enforce (valid) SSL/TLS connections if auto-configuration happens to be enabled. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration ***/ user_pref("mailnews.auto_config.guess.enabled", false); user_pref("mailnews.auto_config.fetchFromISP.enabled", false); user_pref("mailnews.auto_config.fetchFromISP.sendEmailAddress", false); user_pref("mailnews.auto_config.fetchFromExchange.enabled", false); +user_pref("mailnews.auto_config.guess.sslOnly", true); +user_pref("mailnews.auto_config.guess.requireGoodCert", true); // [DEFAULT: true] user_pref("mailnews.auto_config_url", ""); user_pref("mailnews.auto_config.addons_url",""); /* 9102: Disable account provisioning [SETUP-INSTALL] @@ -1377,6 +1387,9 @@ user_pref("mailnews.display.date_senders_timezone", false); * "Received" header. Set the following preference. New messages will show the time the message * was received, rather than when it was sent. ***/ // user_pref("mailnews.use_received_date", true); +/* 9126: Send minimal User-Agent in outgoing email messages (default) */ +user_pref("mailnews.headers.sendUserAgent", true); +user_pref("mailnews.headers.useMinimalUserAgent", true); /** ADDRESS BOOK ***/ /* 9130: Address book collection [SETUP-FEATURE] From 167ddc02be1a36a0c2328d38dd2d08e87912f741 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 30 Jul 2023 12:43:09 +0200 Subject: [PATCH 121/147] Removes preferences related to charset dropped in ESR 78 --- user.js | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/user.js b/user.js index 4a65a2c..0e05312 100644 --- a/user.js +++ b/user.js @@ -1411,18 +1411,6 @@ user_pref("extensions.cardbook.useOnlyEmail", true); user_pref("_user.js.parrot", "9200 syntax error: this parrot has got no mail!"); /** ENCODING ***/ -/* 9201: Prevent fallback encoding to windows-1252, prefer 7bit or 8bit UTF-8 - * [1] http://forums.mozillazine.org/viewtopic.php?f=28&t=267341 - * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=214729 - * [3] https://stackoverflow.com/a/28531705 ***/ -user_pref("intl.fallbackCharsetList.ISO-8859-1", "UTF-8"); -/* 9202: Set encoding of incoming mail ***/ -user_pref("mailnews.view_default_charset", "UTF-8"); -/* 9203: Set encoding of outgoing mail ***/ -user_pref("mailnews.send_default_charset", "UTF-8"); -/* 9204: Forces encoding in reply to be the default charset - * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=234958#c2 ***/ -user_pref("mailnews.reply_in_default_charset", true); /* 9205: Avoid information leakage in reply header * Reply header may contain sensitive information about system locale (date and/or language) * 0=no header From 5a59c1b7e755505219834de29b3025179a0adf30 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 30 Jul 2023 12:48:36 +0200 Subject: [PATCH 122/147] Enforces `mail.html_sanitize.drop_conditional_css` (TB 78 ESR) --- user.js | 1 + 1 file changed, 1 insertion(+) diff --git a/user.js b/user.js index 0e05312..bca6fda 100644 --- a/user.js +++ b/user.js @@ -1468,6 +1468,7 @@ user_pref("mailnews.display.disallow_mime_handlers", 3); * [2] https://hg.mozilla.org/comm-central/rev/c1ef44a22eb2 * [3] https://www.bucksch.org/1/projects/mozilla/108153/ ***/ user_pref("mailnews.display.html_as", 3); +user_pref("mail.html_sanitize.drop_conditional_css", true); // [DEFAULT: true] /* 9216: Prefer to view as plaintext or HTML [SETUP-FEATURE] * true=Display a message as plain text when there is both a HTML and a plain * text version of a message body From 87b0d325e210a91697a1a24ea75dad4d4402cef0 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 19 Oct 2023 19:48:36 +0200 Subject: [PATCH 123/147] Revert "Workaround ETP Strict Mode lack of support in 102" This reverts commit d8d79d6c84d24fc9c9ca6ad72e1f5625e0c66309. --- user.js | 137 +++++++++++++------------------------------------------- 1 file changed, 30 insertions(+), 107 deletions(-) diff --git a/user.js b/user.js index bca6fda..2fe08c6 100644 --- a/user.js +++ b/user.js @@ -50,9 +50,8 @@ 2000: PLUGINS / MEDIA / WEBRTC 2400: DOM (DOCUMENT OBJECT MODEL) 2600: MISCELLANEOUS - 2700: PERSISTENT STORAGE & ETP (ENHANCED TRACKING PROTECTION) + 2700: ETP (ENHANCED TRACKING PROTECTION) 2800: SHUTDOWN & SANITIZING - 4000: FPI (FIRST PARTY ISOLATION) 4500: RFP (RESIST FINGERPRINTING) 5000: OPTIONAL OPSEC 5500: OPTIONAL HARDENING @@ -578,9 +577,6 @@ user_pref("network.http.referer.XOriginPolicy", 2); /* 1602: control the amount of cross-origin information to send [FF52+] * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); -/* 1603: enable the DNT (Do Not Track) HTTP header - * [SETTING] Privacy & Security > Privacy > Web Content > Send websites a "Do Not Track" signal... ***/ -user_pref("privacy.donottrackheader.enabled", true); /*** [SECTION 1700]: CONTAINERS ***/ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); @@ -728,75 +724,16 @@ user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ // user_pref("extensions.webextensions.restrictedDomains", ""); -/*** [SECTION 2700]: PERSISTENT STORAGE & ETP (ENHANCED TRACKING PROTECTION) - Data SET by websites including - cookies : profile\cookies.sqlite - localStorage : profile\webappsstore.sqlite - indexedDB : profile\storage\default - serviceWorkers : - [NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode - [NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage), - indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications) - If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become - accessible to websites except shared/service workers where the cookie setting must be "Allow" - - [NOTE] As Thunderbird lacks of ETP Strict Mode support at the moment, we still enable FPI (4000), - have to deal with persistent storage here and enable state partitioning of service workers (2790) -***/ +/*** [SECTION 2700]: ETP (ENHANCED TRACKING PROTECTION) ***/ user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); -/* 2701: disable or isolate 3rd-party cookies and site-data [SETUP-WEB] - * 0 = Accept cookies and site data - * 1 = (Block) All third-party cookies - * 2 = (Block) All cookies - * 3 = (Block) Cookies from unvisited websites - * 4 = (Block) Cross-site tracking cookies (default) - * 5 = (Isolate All) Cross-site cookies (TCP: Total Cookie Protection / dFPI: dynamic FPI) [1] (FF86+) - * Option 5 with FPI enabled (4001) is ignored and not shown, and option 4 used instead - * [NOTE] You can set cookie exceptions under site permissions or use an extension - * [NOTE] Enforcing category to custom ensures ETP related prefs are always honored - * [SETTING] Privacy & Security > Privacy > Web Content > Accept cookies from sites - * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ ***/ -user_pref("network.cookie.cookieBehavior", 2); -/* 2702: set third-party cookies (if enabled, see 2701) to session-only - * [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and - * .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones - * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ ***/ -user_pref("network.cookie.thirdparty.sessionOnly", true); -user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+] -/* 2710: enable Enhanced Tracking Protection (ETP) in all windows ***/ -user_pref("privacy.trackingprotection.enabled", true); -/* 2711: enable various ETP lists ***/ -user_pref("privacy.trackingprotection.socialtracking.enabled", true); -user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] -user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] -/* 2712: disable ETP web compat features [FF93+] +/* 2702: disable ETP web compat features [FF93+] * [SETUP-HARDEN] Includes skip lists, heuristics (SmartBlock) and automatic grants * Opener and redirect heuristics are granted for 30 days, see [3] * [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/ * [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12 * [3] https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ // user_pref("privacy.antitracking.enableWebcompat", false); -/* 2720: customize ETP settings (as Strict Mode is not available) */ -user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); // [DEFAULT: true] -user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [DEFAULT: true FF100+] -user_pref("privacy.partition.network_state.ocsp_cache", true); -user_pref("privacy.query_stripping.enabled", true); // [FF101+] -/* 2740: disable service worker cache and cache storage - * [NOTE] We clear service worker cache on exit (2811) - * [1] https://w3c.github.io/ServiceWorker/#privacy ***/ -user_pref("dom.caches.enabled", false); -/* 2750: disable Storage API [FF51+] - * The API gives sites the ability to find out how much space they can use, how much - * they are already using, and even control whether or not they need to be alerted - * before the user agent disposes of site data in order to make room for other things. - * [1] https://developer.mozilla.org/docs/Web/API/StorageManager - * [2] https://developer.mozilla.org/docs/Web/API/Storage_API - * [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/ -user_pref("dom.storageManager.enabled", false); -/* 2755: disable Storage Access API [FF65+] - * [1] https://developer.mozilla.org/docs/Web/API/Storage_Access_API ***/ -user_pref("dom.storage_access.enabled", false); // [DEFAULT: false] -/* 2790: enable state partitioning of service workers [FF96+] ***/ +/* 2710: enable state partitioning of service workers [FF96+] ***/ user_pref("privacy.partition.serviceWorkers", true); /*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ @@ -861,46 +798,6 @@ user_pref("privacy.cpd.cookies", true); * which will display a blank value, and are not guaranteed to work ***/ user_pref("privacy.sanitize.timeSpan", 0); -/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION) - 1278037 - indexedDB (FF51+) - 1277803 - favicons (FF52+) - 1264562 - OCSP cache (FF52+) - 1268726 - Shared Workers (FF52+) - 1316283 - SSL session cache (FF52+) - 1317927 - media cache (FF53+) - 1323644 - HSTS and HPKP (FF54+) - 1334690 - HTTP Alternative Services (FF54+) - 1334693 - SPDY/HTTP2 (FF55+) - 1337893 - DNS cache (FF55+) - 1344170 - blob: URI (FF55+) - 1300671 - data:, about: URLs (FF55+) - 1473247 - IP addresses (FF63+) - 1542309 - top-level domain URLs when host is in the public suffix list (FF68+) - 1506693 - pdfjs range-based requests (FF68+) - 1330467 - site permissions (FF69+) - 1534339 - IPv6 (FF73+) - 1721858 - WebSocket (FF92+) -***/ -user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out"); -/* 4001: enable First Party Isolation [FF51+] - * [SETUP-WEB] Breaks some cross-origin logins - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1260931,1299996 ***/ -user_pref("privacy.firstparty.isolate", true); -/* 4002: enforce FPI restriction for window.opener [FF54+] - * [NOTE] Setting this to false may reduce the breakage in 4001 - * FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But - * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute [2][3] - * The 2nd pref removes that limitation and will only allow communication if FPDs also match - * [1] https://bugzilla.mozilla.org/1319773#c22 - * [2] https://bugzilla.mozilla.org/1492607 - * [3] https://developer.mozilla.org/docs/Web/API/Window/postMessage ***/ -user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true] -user_pref("privacy.firstparty.isolate.block_post_message", true); -/* 4003: enable scheme with FPI [FF78+] - * [NOTE] Experimental: existing data and site permissions are incompatible - * and some site exceptions may not work e.g. HTTPS-only mode (1244) ***/ -user_pref("privacy.firstparty.isolate.use_site", true); - /*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) RFP covers a wide range of ongoing fingerprinting solutions. It is an all-or-nothing buy in: you cannot pick and choose what parts you want @@ -1127,6 +1024,10 @@ user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] /* 6004: enforce a security delay on some confirmation dialogs such as install, open/save * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] +/* 6008: enforce no First Party Isolation [FF51+] + * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), + * and enabling FPI disables those. FPI is no longer maintained ***/ +user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false] /* 6009: enforce SmartBlock shims [FF81+] * In FF96+ these are listed in about:compat * [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/ @@ -1143,7 +1044,15 @@ user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] user_pref("security.pki.sha1_enforcement_level", 1); // [DEFAULT: 1 FF102+] /* 6050: prefsCleaner: reset items removed from arkenfox FF92+ ***/ // user_pref("browser.urlbar.trimURLs", ""); + // user_pref("dom.caches.enabled", ""); + // user_pref("dom.storageManager.enabled", ""); + // user_pref("dom.storage_access.enabled", ""); // user_pref("dom.targetBlankNoOpener.enabled", ""); + // user_pref("network.cookie.thirdparty.sessionOnly", ""); + // user_pref("network.cookie.thirdparty.nonsecureSessionOnly", ""); + // user_pref("privacy.firstparty.isolate.block_post_message", ""); + // user_pref("privacy.firstparty.isolate.restrict_opener_access", ""); + // user_pref("privacy.firstparty.isolate.use_site", ""); // user_pref("privacy.window.name.update.enabled", ""); // user_pref("security.insecure_connection_text.enabled", ""); @@ -1214,6 +1123,20 @@ user_pref("dom.event.clipboardevents.enabled", false); * [WHY] It can compromise security. System addons ship with prefs, use those ***/ // user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] // user_pref("extensions.systemAddon.update.url", ""); // [FF44+] +/* 7015: enable the DNT (Do Not Track) HTTP header + * [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/ + // user_pref("privacy.donottrackheader.enabled", true); +/* 7016: customize ETP settings + * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ + // user_pref("network.cookie.cookieBehavior", 5); + // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); + // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] + // user_pref("privacy.partition.network_state.ocsp_cache", true); + // user_pref("privacy.query_stripping.enabled", true); // [FF101+] [ETP FF102+] + // user_pref("privacy.trackingprotection.enabled", true); + // user_pref("privacy.trackingprotection.socialtracking.enabled", true); + // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] + // user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] /* 7017: disable service workers * [WHY] Already isolated (FF96+) with TCP (2701) behind a pref (2710) * or blocked with TCP in 3rd parties (FF95 or lower) ***/ From 088da14f7e3a4314372dd03a35c3d36990dd4e34 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 19 Oct 2023 22:08:02 +0200 Subject: [PATCH 124/147] Applies Arkenfox v102.1..v115.1 migration --- user.js | 544 +++++++++++++++++++++----------------------------------- 1 file changed, 206 insertions(+), 338 deletions(-) diff --git a/user.js b/user.js index 2fe08c6..5bef05c 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 30 July 2023 -* version: v115.0-beta1 +* date: 19 October 2023 +* version: v115.0 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) @@ -28,9 +28,10 @@ * RELEASES: https://github.com/HorlogeSkynet/thunderbird-user.js/releases * It is best to use the release that is optimized for and matches your Thunderbird version - * ESR91 users - - If you are not using thunderbird-user.js v91... (not a definitive list) - - 9999: switch the appropriate deprecated section(s) back on + * ESR102 + - If you are not using thunderbird-user.js v102-1... (not a definitive list) + - 2815: clearOnShutdown cookies + offlineApps should be false + - 9999: switch the appropriate deprecated section(s) back on * INDEX: @@ -39,13 +40,13 @@ 0300: QUIETER BIRD 0400: SAFE BROWSING 0600: BLOCK IMPLICIT OUTBOUND - 0700: DNS / DoH / PROXY / SOCKS / IPv6 + 0700: DNS / DoH / PROXY / SOCKS 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS 0900: PASSWORDS 1000: DISK AVOIDANCE 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) 1400: FONTS - 1600: HEADERS / REFERERS + 1600: REFERERS 1700: CONTAINERS 2000: PLUGINS / MEDIA / WEBRTC 2400: DOM (DOCUMENT OBJECT MODEL) @@ -58,7 +59,7 @@ 6000: DON'T TOUCH 7000: DON'T BOTHER 8000: DON'T BOTHER: FINGERPRINTING - 9000: PERSONAL + 9000: NON-PROJECT RELATED 9100: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) 9200: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) 9300: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) @@ -79,14 +80,11 @@ user_pref("browser.aboutConfig.showWarning", false); /*** [SECTION 0100]: STARTUP ***/ user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); -/* 0101: disable default browser check - * [SETTING] General > System Integration > Always check to see if Thunderbird is the default... ***/ -user_pref("mail.shell.checkDefaultClient", false); /* 0102: set START page [SETUP-CHROME] * [SETTING] General > Thunderbird Start Page ***/ user_pref("mailnews.start_page.enabled", false); /* 0104: set NEWTAB page - * true=Activity Stream (default), false=blank page ***/ + * true=? (default), false=blank page ***/ user_pref("browser.newtabpage.enabled", false); /*** [SECTION 0200]: GEOLOCATION / LANGUAGE / LOCALE ***/ @@ -99,13 +97,7 @@ user_pref("geo.provider.network.url", "https://location.services.mozilla.com/v1/ user_pref("geo.provider.ms-windows-location", false); // [WINDOWS] user_pref("geo.provider.use_corelocation", false); // [MAC] user_pref("geo.provider.use_gpsd", false); // [LINUX] -/* 0203: disable region updates - * [1] https://firefox-source-docs.mozilla.org/toolkit/modules/toolkit_modules/Region.html ***/ -user_pref("browser.region.network.url", ""); // [FF78+] -user_pref("browser.region.update.enabled", false); // [FF79+] -/* 0204: set search region - * [NOTE] May not be hidden if Thunderbird has changed your settings due to your region (0203) ***/ - // user_pref("browser.search.region", "US"); // [HIDDEN PREF] +user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX] /* 0210: set preferred language for displaying pages * [SETTING] General > Language & Appearance > Language > Choose the language used to display... * [TEST] https://addons.mozilla.org/about ***/ @@ -114,7 +106,6 @@ user_pref("intl.accept_languages", "en-US, en"); user_pref("spellchecker.dictionary", "en-US"); /* 0211: use en-US locale regardless of the system or region locale * [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages [1] - * [TEST] https://arkenfox.github.io/TZP/tests/formatting.html * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 ***/ user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] @@ -230,6 +221,7 @@ user_pref("mail.rights.override", true); // [DEFAULT: unset] [1] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ [2] https://wiki.mozilla.org/Security/Safe_Browsing [3] https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work + [4] https://educatedguesswork.org/posts/safe-browsing-privacy/ ***/ user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); /* 0401: disable SB (Safe Browsing) @@ -277,20 +269,8 @@ user_pref("network.http.speculative-parallel-limit", 0); * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=518805 ***/ user_pref("browser.meta_refresh_when_inactive.disabled", true); -/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS / IPv6 ***/ +/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS ***/ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!"); -/* 0701: disable IPv6 - * IPv6 can be abused, especially with MAC addresses, and can leak with VPNs: assuming - * your ISP and/or router and/or website is IPv6 capable. Most sites will fall back to IPv4 - * [STATS] Firefox telemetry (July 2021) shows ~10% of all connections are IPv6 - * [NOTE] This is an application level fallback. Disabling IPv6 is best done at an - * OS/network level, and/or configured properly in VPN setups. If you are not masking your IP, - * then this won't make much difference. If you are masking your IP, then it can only help. - * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" - * [TEST] https://ipleak.org/ - * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/ -user_pref("network.dns.disableIPv6", true); -user_pref("network.notify.IPv6", false); /* 0702: set the proxy server to do any DNS lookups when using SOCKS * e.g. in Tor, this stops your local DNS server from knowing your Tor destination * as a remote Tor node will handle the DNS request @@ -317,10 +297,11 @@ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] * [WARNING] If false, this will break the fallback for some security features * [SETUP-CHROME] If you use a proxy and you understand the security impact * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 ***/ - // user_pref("network.proxy.allow_bypass", false); // [HIDDEN PREF FF95-96] + // user_pref("network.proxy.allow_bypass", false); /* 0710: disable DNS-over-HTTPS (DoH) rollout [FF60+] - * 0=off by default, 2=TRR (Trusted Recursive Resolver) first, 3=TRR only, 5=explicitly off + * 0=default, 2=increased (TRR (Trusted Recursive Resolver) first), 3=max (TRR only), 5=off * see "doh-rollout.home-region": USA 2019, Canada 2021, Russia/Ukraine 2022 [3] + * [SETTING] General > Network & Disk Space > Connection > Settings... > Enable DNS over HTTPS * [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ * [2] https://wiki.mozilla.org/Security/DOH-resolver-policy // * [3] https://support.mozilla.org/en-US/kb/firefox-dns-over-https @@ -334,14 +315,6 @@ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] /*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); -/* 0801: disable location bar using search - * Don't leak URL typos to a search engine, give an error message instead - * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com" - * [NOTE] This does not affect explicit user action such as using search buttons in the - * dropdown, or using keyword search shortcuts you configure in options (e.g. "d" for DuckDuckGo) - * [SETUP-CHROME] If you don't, or rarely, type URLs, or you use a default search - * engine that respects privacy, then you probably don't need this ***/ -user_pref("keyword.enabled", false); // [DEFAULT: false] /* 0802: disable location bar domain guessing * domain guessing intercepts DNS "hostname not found errors" and resends a * request (e.g. by adding www or .com). This is inconsistent use (e.g. FQDNs), does not work @@ -360,15 +333,6 @@ user_pref("browser.search.suggest.enabled", false); * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html * [2] https://bugzilla.mozilla.org/381681 ***/ user_pref("browser.formfill.enable", false); -/* 0811: disable Form Autofill - * [NOTE] Stored data is NOT secure (uses a JSON file) - * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes - * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ -user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] -user_pref("extensions.formautofill.available", "off"); // [FF56+] -user_pref("extensions.formautofill.creditCards.available", false); // [FF57+] -user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] -user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] /* 0820: disable coloring of visited links * Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing @@ -401,7 +365,7 @@ user_pref("signon.formlessCapture.enabled", false); user_pref("network.auth.subresource-http-auth-allow", 1); /* 0906: enforce no automatic authentication on Microsoft sites [FF91+] [WINDOWS 10+] * [1] https://support.mozilla.org/kb/windows-sso ***/ -user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false] + // user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false] /* 0910: prevent access to emails until the master password is entered * If a master password has been set, Thunderbird will prevent access to locally available emails * until the secret is provided. @@ -426,10 +390,6 @@ user_pref("media.memory_cache_max_size", 65536); * define on which sites to save extra session data such as form content, cookies and POST data * 0=everywhere, 1=unencrypted sites, 2=nowhere ***/ user_pref("browser.sessionstore.privacy_level", 2); -/* 1004: set the minimum interval between session save operations - * Increasing this can help on older machines and some websites, as well as reducing writes [1] - * [1] https://bugzilla.mozilla.org/1304389 ***/ -user_pref("browser.sessionstore.interval", 30000); // [DEFAULT: 15000] /* 1901: disable disk cache for messages not in offline store */ user_pref("mail.imap.use_disk_cache2", false); @@ -448,7 +408,7 @@ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); * but the problem is that the browser can't know that. Setting this pref to true is the only way for the * browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server * [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site? - * [STATS] SSL Labs (July 2021) reports over 99% of top sites have secure renegotiation [4] + * [STATS] SSL Labs (Feb 2023) reports over 99.3% of top sites have secure renegotiation [4] * [1] https://wiki.mozilla.org/Security:Renegotiation * [2] https://datatracker.ietf.org/doc/html/rfc5746 * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 @@ -471,10 +431,11 @@ user_pref("security.tls.enable_0rtt_data", false); * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority) * It's a trade-off between security (checking) and privacy (leaking info to the CA) * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling - * [SETTING] Privacy & Security > Security > Certificates > Query OCSP responder servers... + * [SETTING] Privacy & Security > Security > Certificates > Query OCSP responder servers to confirm * [1] https://en.wikipedia.org/wiki/Ocsp ***/ user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] -/* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail [SETUP-WEB] +/* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail + * [SETUP-WEB] SEC_ERROR_OCSP_SERVER_ERROR * When a CA cannot be reached to validate a cert, Thunderbird's just continues the connection (=soft-fail) * Setting this pref to true tells Thunderbird's to instead terminate the connection (=hard-fail) * It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it @@ -492,9 +453,8 @@ user_pref("security.OCSP.require", true); user_pref("security.family_safety.mode", 0); /* 1223: enable strict PKP (Public Key Pinning) * 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict - * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE: If you rely on an AV (antivirus) to protect - * your web browsing by inspecting ALL your web traffic, then override to current default - * [NOTE] It needs to be set to 1 when connecting to the ProtonMail Bridge for the first time ***/ + * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE + * [SETUP-INSTALL] It needs to be set to 1 when connecting to the ProtonMail Bridge for the first time ***/ user_pref("security.cert_pinning.enforcement_level", 2); /* 1224: enable CRLite [FF73+] * 0 = disabled @@ -511,12 +471,12 @@ user_pref("security.pki.crlite_mode", 2); // user_pref("security.osclientcerts.autoload", true); /** MIXED CONTENT ***/ -/* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/ -user_pref("security.mixed_content.block_display_content", true); +/* 1241: disable insecure passive content (such as images) on https pages ***/ +user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244) /* 1244: enable HTTPS-Only mode in all windows [FF76+] * When the top-level is HTTPS, insecure subresources are also upgraded (silent fail) * [TEST] http://example.com [upgrade] - * [TEST] http://httpforever.com/ [no upgrade] ***/ + * [TEST] http://httpforever.com/ | http://http.rip [no upgrade] ***/ user_pref("dom.security.https_only_mode", true); // [FF76+] user_pref("dom.security.https_only_mode_pbm", true); // [FF80+] /* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/ @@ -534,10 +494,6 @@ user_pref("dom.security.https_only_mode_send_http_background_request", false); * [1] https://wiki.mozilla.org/Security:Renegotiation * [2] https://bugzilla.mozilla.org/1353705 ***/ user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); -/* 1271: control "Add Security Exception" dialog on SSL warnings - * 0=do neither, 1=pre-populate url, 2=pre-populate url + pre-fetch cert (default) - * [1] https://github.com/pyllyukko/user.js/issues/210 ***/ -user_pref("browser.ssl_override_behavior", 1); /* 1272: display advanced information on Insecure Connection warning pages * only works when it's possible to add an exception * i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/) @@ -550,8 +506,6 @@ user_pref("security.warn_viewing_mixed", true); /*** [SECTION 1400]: FONTS ***/ user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!"); -/* 1401: disable rendering of SVG OpenType fonts ***/ -user_pref("gfx.font_rendering.opentype_svg.enabled", false); /* 1402: limit font visibility (Windows, Mac, some Linux) [FF94+] * Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts [1], bundled fonts are auto-allowed * In normal windows: uses the first applicable: RFP (4506) over TP over Standard @@ -562,18 +516,13 @@ user_pref("gfx.font_rendering.opentype_svg.enabled", false); // user_pref("layout.css.font-visibility.standard", 1); // user_pref("layout.css.font-visibility.trackingprotection", 1); -/*** [SECTION 1600]: HEADERS / REFERERS +/*** [SECTION 1600]: REFERERS full URI: https://example.com:8888/foo/bar.html?id=1234 scheme+host+port+path: https://example.com:8888/foo/bar.html scheme+host+port: https://example.com:8888 [1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ ***/ user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); -/* 1601: control when to send a cross-origin referer - * 0=always (default), 1=only if base domains match, 2=only if hosts match - * [SETUP-WEB] Breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram - * If "2" is too strict, then override to "0" and use Smart Referer extension (Strict mode + add exceptions) ***/ -user_pref("network.http.referer.XOriginPolicy", 2); /* 1602: control the amount of cross-origin information to send [FF52+] * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ user_pref("network.http.referer.XOriginTrimmingPolicy", 2); @@ -587,15 +536,6 @@ user_pref("privacy.userContext.ui.enabled", true); /*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); -/* 2001: disable WebRTC (Web Real-Time Communication) - * Thunderbird uses mDNS hostname obfuscation on desktop (except Windows7/8) and the - * private IP is NEVER exposed, except if required in TRUSTED scenarios; i.e. after - * you grant device (microphone or camera) access - * [SETUP-HARDEN] Test first. Windows7/8 users only: behind a proxy who never use WebRTC - * [TEST] https://browserleaks.com/webrtc - * [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ - * [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 ***/ -user_pref("media.peerconnection.enabled", false); /* 2002: force WebRTC inside the proxy [FF70+] ***/ user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); /* 2003: force a single network interface for ICE candidates generation [FF42+] @@ -610,65 +550,26 @@ user_pref("media.peerconnection.ice.no_host", true); /* 2020: disable GMP (Gecko Media Plugins) * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ user_pref("media.gmp-provider.enabled", false); -/* 2021: disable widevine CDM (Content Decryption Module) - * [NOTE] This is covered by the EME master switch (2022) ***/ -user_pref("media.gmp-widevinecdm.enabled", false); -/* 2022: disable all DRM content (EME: Encryption Media Extension) - * Optionally hide the setting which also disables the DRM prompt - * [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV - * [TEST] https://bitmovin.com/demos/drm - * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ -user_pref("media.eme.enabled", false); - // user_pref("browser.eme.ui.enabled", false); -/* 2030: disable autoplay of HTML5 media [FF63+] - * 0=Allow all, 1=Block non-muted media (default), 5=Block all - * [NOTE] You can set exceptions under site permissions ***/ -user_pref("media.autoplay.default", 5); -/* 2031: disable autoplay of HTML5 media if you interacted with the site [FF78+] - * 0=sticky (default), 1=transient, 2=user - * Thunderbird's Autoplay Policy Documentation (PDF) is linked below via SUMO - * [NOTE] If you have trouble with some video sites, then add an exception (2030) - * [1] https://support.mozilla.org/questions/1293231 ***/ -user_pref("media.autoplay.blocking_policy", 2); /*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); -/* 2401: disable "Confirm you want to leave" dialog on page close - * Does not prevent JS leaks of the page close event - * [1] https://developer.mozilla.org/docs/Web/Events/beforeunload ***/ -user_pref("dom.disable_beforeunload", true); /* 2402: prevent scripts from moving and resizing open windows ***/ user_pref("dom.disable_window_move_resize", true); -/* 2403: block popup windows ***/ -user_pref("dom.disable_open_during_load", true); -/* 2404: limit events that can cause a popup [SETUP-WEB] ***/ -user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); /*** [SECTION 2600]: MISCELLANEOUS ***/ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); /* 2601: prevent accessibility services from accessing your browser [RESTART] * [1] https://support.mozilla.org/kb/accessibility-services ***/ user_pref("accessibility.force_disabled", 1); -/* 2602: disable sending additional analytics to web servers - * [1] https://developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/ -user_pref("beacon.enabled", false); /* 2603: remove temp files opened with an external application * [1] https://bugzilla.mozilla.org/302433 ***/ user_pref("browser.helperApps.deleteTempFileOnExit", true); -/* 2604: disable page thumbnail collection ***/ -user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] /* 2606: disable UITour backend so there is no chance that a remote page can use it ***/ user_pref("browser.uitour.enabled", false); -user_pref("browser.uitour.url", ""); -/* 2607: disable various developer tools in browser context - * [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/ -user_pref("devtools.chrome.enabled", false); +user_pref("browser.uitour.url", ""); // Defense-in-depth /* 2608: reset remote debugging to disabled * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/ user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] -/* 2611: disable middle mouse click opening links from clipboard - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/10089 ***/ -user_pref("middlemouse.contentLoadURL", false); /* 2616: remove special permissions for certain mozilla domains [FF35+] * [1] resource://app/defaults/permissions ***/ user_pref("permissions.manager.defaultsUrl", ""); @@ -682,25 +583,26 @@ user_pref("webchannel.allowObject.urlWhitelist", ""); * [3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/ user_pref("network.IDN_show_punycode", true); -/* 2620: enforce PDFJS, disable PDFJS scripting [SETUP-CHROME] +/* 2620: enforce PDFJS, disable PDFJS scripting * This setting controls if the option "Display in Thunderbird" is available in the setting below * and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With") - * PROS: pdfjs is lightweight, open source, and more secure/vetted than most - * Exploits are rare (one serious case in seven years), treated seriously and patched quickly. + * [WHY] pdfjs is lightweight, open source, and secure: the last exploit was June 2015 [1] * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). * It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. - * CONS: You may prefer a different pdf reader for security reasons - * CAVEAT: JS can still force a pdf to open in-browser by bundling its own code ***/ + * [NOTE] JS can still force a pdf to open in-browser by bundling its own code + * [SETUP-CHROME] You may prefer a different pdf reader for security/workflow reasons + * [SETTING] General > Files & Attachments > Portable Document Format (PDF) + * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/ user_pref("pdfjs.disabled", false); // [DEFAULT: false] user_pref("pdfjs.enableScripting", false); // [FF86+] -/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] ***/ -user_pref("network.protocol-handler.external.ms-windows-store", false); /* 2623: disable permissions delegation [FF73+] * Currently applies to cross-origin geolocation, camera, mic and screen-sharing * permissions, and fullscreen requests. Disabling delegation means any prompts * for these will show/use their correct 3rd party origin * [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion ***/ user_pref("permissions.delegation.enabled", false); +/* 2624: disable middle click on new tab button opening URLs or searches using clipboard [FF115+] */ +user_pref("browser.tabs.searchclipboardfor.middleclick", false); // [DEFAULT: false NON-LINUX] /** DOWNLOADS ***/ /* 2651: enable user interaction for security by always asking where to download @@ -708,8 +610,7 @@ user_pref("permissions.delegation.enabled", false); user_pref("browser.download.useDownloadDir", false); /* 2653: disable adding downloads to the system's "recent documents" list ***/ user_pref("browser.download.manager.addToRecentDocs", false); -/* 2654: enable user interaction for security by always asking how to handle new mimetypes [FF101+] - * [SETTING] General>Files and Applications>What should Thunderbird do with other files ***/ +/* 2654: enable user interaction for security by always asking how to handle new mimetypes [FF101+] ***/ user_pref("browser.download.always_ask_before_handling_new_types", true); /** EXTENSIONS ***/ @@ -734,44 +635,45 @@ user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin * [3] https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ // user_pref("privacy.antitracking.enableWebcompat", false); /* 2710: enable state partitioning of service workers [FF96+] ***/ -user_pref("privacy.partition.serviceWorkers", true); +user_pref("privacy.partition.serviceWorkers", true); // [DEFAULT: true FF105+] +/* 2720: enable APS (Always Partitioning Storage) ***/ +user_pref("privacy.partition.always_partition_third_party_non_cookie_storage", true); // [FF104+] [DEFAULT: true FF109+] +user_pref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", false); // [FF105+] [DEFAULT: false FF109+] /*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); -/** COOKIES + SITE DATA : ALLOWS EXCEPTIONS ***/ -/* 2801: delete cookies and site data on exit - * 0=keep until they expire (default), 2=keep until you close Thunderbird - * [NOTE] A "cookie" block permission also controls localStorage/sessionStorage, indexedDB, - * sharedWorkers and serviceWorkers. serviceWorkers require an "Allow" permission - * [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Thunderbird is closed - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ -user_pref("network.cookie.lifetimePolicy", 2); -/* 2802: delete cache on exit [FF96+] - * [NOTE] We already disable disk cache (1001) and clear on exit (2811) which is more robust - * [1] https://bugzilla.mozilla.org/1671182 ***/ - // user_pref("privacy.clearsitedata.cache.enabled", true); - -/** SANITIZE ON SHUTDOWN : ALL OR NOTHING ***/ -/* 2810: enable Thunderbird to clear items on shutdown (2811) - * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Thunderbird closes ***/ +/* 2810: enable Thunderbird to clear items on shutdown ***/ user_pref("privacy.sanitize.sanitizeOnShutdown", true); + +/** SANITIZE ON SHUTDOWN: IGNORES "ALLOW" SITE EXCEPTIONS ***/ /* 2811: set/enforce what items to clear on shutdown (if 2810 is true) [SETUP-CHROME] - * These items do not use exceptions, it is all or nothing (1681701) * [NOTE] If "history" is true, downloads will also be cleared * [NOTE] "sessions": Active Logins: refers to HTTP Basic Authentication [1], not logins via cookies - * [NOTE] "offlineApps": Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache) * [1] https://en.wikipedia.org/wiki/Basic_access_authentication ***/ user_pref("privacy.clearOnShutdown.cache", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.downloads", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.formdata", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.history", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.sessions", true); // [DEFAULT: true] -user_pref("privacy.clearOnShutdown.offlineApps", true); // [DEFAULT: false] -user_pref("privacy.clearOnShutdown.cookies", true); - // user_pref("privacy.clearOnShutdown.siteSettings", false); + // user_pref("privacy.clearOnShutdown.siteSettings", false); // [DEFAULT: false] +/* 2812: set Session Restore to clear on shutdown (if 2810 is true) [FF34+] + * [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811) + * [NOTE] If true, this prevents resuming from crashes (also see 5008) ***/ + // user_pref("privacy.clearOnShutdown.openWindows", true); -/** SANITIZE MANUAL: ALL OR NOTHING ***/ +/** SANITIZE ON SHUTDOWN: RESPECTS "ALLOW" SITE EXCEPTIONS FF103+ ***/ +/* 2815: set "Cookies" and "Site Data" to clear on shutdown (if 2810 is true) [SETUP-CHROME] + * [NOTE] Exceptions: A "cookie" block permission also controls "offlineApps" (see note below). + * serviceWorkers require an "Allow" permission. For cross-domain logins, add exceptions for + * both sites e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on) + * [NOTE] "offlineApps": Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache) + * [WARNING] Be selective with what sites you "Allow", as they also disable partitioning (1767271) + * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow (when on the website in question) + * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ +user_pref("privacy.clearOnShutdown.cookies", true); // Cookies +user_pref("privacy.clearOnShutdown.offlineApps", true); // Site Data + +/** SANITIZE MANUAL: IGNORES "ALLOW" SITE EXCEPTIONS ***/ /* 2820: reset default items to clear with Ctrl-Shift-Del [SETUP-CHROME] * This dialog can also be accessed from the menu History>Clear Recent History * Thunderbird remembers your last choices. This will reset them when you start Thunderbird @@ -784,13 +686,9 @@ user_pref("privacy.cpd.sessions", true); // [DEFAULT: true] user_pref("privacy.cpd.offlineApps", true); // [DEFAULT: false] user_pref("privacy.cpd.cookies", true); // user_pref("privacy.cpd.downloads", true); // not used, see note above + // user_pref("privacy.cpd.openWindows", false); // Session Restore // user_pref("privacy.cpd.passwords", false); // user_pref("privacy.cpd.siteSettings", false); -/* 2821: clear Session Restore data when sanitizing on shutdown or manually [FF34+] - * [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811) - * [NOTE] privacy.clearOnShutdown.openWindows prevents resuming from crashes (also see 5008) ***/ - // user_pref("privacy.clearOnShutdown.openWindows", true); - // user_pref("privacy.cpd.openWindows", true); /* 2822: reset default "Time range to clear" for "Clear Recent History" (2820) * Thunderbird remembers your last choice. This will reset the value when you start Thunderbird * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today @@ -801,21 +699,19 @@ user_pref("privacy.sanitize.timeSpan", 0); /*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) RFP covers a wide range of ongoing fingerprinting solutions. It is an all-or-nothing buy in: you cannot pick and choose what parts you want + [TEST] https://arkenfox.github.io/TZP/tzp.html [WARNING] DO NOT USE extensions to alter RFP protected metrics 418986 - limit window.screen & CSS media queries (FF41) - [TEST] https://arkenfox.github.io/TZP/tzp.html#screen 1281949 - spoof screen orientation (FF50) - 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50-99) - FF53: fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044) 1330890 - spoof timezone as UTC0 (FF55) 1360039 - spoof navigator.hardwareConcurrency as 2 (FF55) 1217238 - reduce precision of time exposed by javascript (FF55) FF56 1369303 - spoof/disable performance API 1333651 - spoof User Agent & Navigator API - version: spoofed as ESR (FF102+ this is limited to Android) + version: android version spoofed as ESR OS: JS spoofed as Windows 10, OS 10.15, Android 10, or Linux | HTTP Headers spoofed as Windows or Android 1369319 - disable device sensor API 1369357 - disable site specific zoom @@ -828,8 +724,7 @@ user_pref("privacy.sanitize.timeSpan", 0); 1217290 & 1409677 - enable some fingerprinting resistance for WebGL 1382545 - reduce fingerprinting in Animation API 1354633 - limit MediaError.message to a whitelist - FF58-90 - 967895 - spoof canvas and enable site permission prompt (FF58) + FF58+ 1372073 - spoof/block fingerprinting in MediaDevices API (FF59) Spoof: enumerate devices as one "Internal Camera" and one "Internal Microphone" Block: suppresses the ondevicechange event @@ -848,19 +743,23 @@ user_pref("privacy.sanitize.timeSpan", 0); 1595823 - return audioContext sampleRate as 44100 (FF72) 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74) 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78) + 1506364 - return "no-preference" with prefers-contrast (FF80) 1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80) 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82) - FF91+ 531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1) 1756280 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF100) - 1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was capped at 100ms) (FF102) + 1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms) (FF102) + 1422237 - return "srgb" with color-gamut (FF110) + 1794628 - return "none" with inverted-colors (FF114) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); -/* 4501: enable privacy.resistFingerprinting [FF41+] +/* 4501: enable privacy.resistFingerprinting * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a site exception via the urlbar * RFP also has a few side effects: mainly timezone is UTC0, and websites will prefer light theme + * [NOTE] pbmode applies if true and the original pref is false * [1] https://bugzilla.mozilla.org/418986 ***/ -user_pref("privacy.resistFingerprinting", true); +user_pref("privacy.resistFingerprinting", true); // [FF41+] + // user_pref("privacy.resistFingerprinting.pbmode", true); // [FF114+] /* 4502: set new window size rounding max values [FF55+] * [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen * [1] https://bugzilla.mozilla.org/1330882 ***/ @@ -869,7 +768,7 @@ user_pref("privacy.window.maxInnerHeight", 900); /* 4503: disable mozAddonManager Web API [FF57+] * [NOTE] To allow extensions to work on AMO, you also need 2662 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ -user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF] +user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF FF57-108] /* 4504: enable RFP letterboxing [FF67+] * Dynamically resizes the inner window by applying margins in stepped ranges [2] * If you use the dimension pref, then it will only apply those resolutions. @@ -885,12 +784,11 @@ user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] * [WARNING] DO NOT USE unless testing, see [1] comment 12 * [1] https://bugzilla.mozilla.org/1635603 ***/ // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); - // user_pref("privacy.resistFingerprinting.testGranularityMask", 0); /* 4506: set RFP's font visibility level (1402) [FF94+] ***/ // user_pref("layout.css.font-visibility.resistFingerprinting", 1); // [DEFAULT: 1] /* 4510: disable using system colors - * [SETTING] General > Language and Appearance > Fonts and Colors > Colors > Use system colors ***/ -user_pref("browser.display.use_system_colors", false); // [DEFAULT false NON-WINDOWS] + * [SETTING] General > Language and Appearance > Fonts and Colors > Colors... > Use system colors ***/ +user_pref("browser.display.use_system_colors", false); // [DEFAULT: false NON-WINDOWS] /* 4511: enforce non-native widget theme * Security: removes/reduces system API calls, e.g. win32k API [1] * Fingerprinting: provides a uniform look and feel across platforms [2] @@ -925,7 +823,7 @@ user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow * caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode). * In fact, PB mode limits or removes the ability to control some of these, and you need to quit * Thunderbird to clear them. PB is best used as a one off window (Menu>New Private Window) to provide - * a temporary self-contained new session. Close all Private Windows to clear the PB mode session. + * a temporary self-contained new session. Close all private windows to clear the PB session. * [1] https://wiki.mozilla.org/Private_Browsing * [2] https://support.mozilla.org/kb/common-myths-about-private-browsing ***/ // user_pref("browser.privatebrowsing.autostart", true); @@ -943,7 +841,7 @@ user_pref("permissions.memory_only", true); // [HIDDEN PREF] /* 5005: disable intermediate certificate caching [FF41+] [RESTART] * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. * Saved logins and passwords are not available. Reset the pref and restart to return them ***/ - // user_pref("security.nocertdb", true); // [HIDDEN PREF in FF101 or lower] + // user_pref("security.nocertdb", true); /* 5006: disable favicons in history and bookmarks * [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your * actual history (and bookmarks) already do. Your history is more detailed, so @@ -963,8 +861,20 @@ user_pref("browser.sessionstore.resume_from_crash", false); * [NOTE] We also clear history and downloads on exit (2811) ***/ user_pref("places.history.enabled", false); /* 5016: discourage downloading to desktop - * 0=desktop, 1=downloads (default), 2=last used ***/ + * 0=desktop, 1=downloads (default), 2=custom ***/ // user_pref("browser.download.folderList", 2); +/* 5017: disable Form Autofill + * If .supportedCountries includes your region (browser.search.region) and .supported + * is "detect" (default), then the UI will show. Stored data is not secure, uses JSON + * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ + user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] + user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] +/* 5018: limit events that can cause a pop-up ***/ +user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); +/* 5019: disable page thumbnail collection ***/ +user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] +/* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/ + // user_pref("alerts.useSystemBackend.windows.notificationserver.enabled", false); /* 5901: Enforce Private Browsing for OAuth sign-in * Providers may expect a device identifier from the browser, which could cause issues with PB. As * many users could suffer from this we keep this it disabled, feel free to switch it on if yours @@ -1009,6 +919,26 @@ user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ user_pref("javascript.options.wasm", false); +/* 5507: disable rendering of SVG OpenType fonts ***/ +user_pref("gfx.font_rendering.opentype_svg.enabled", false); +/* 5508: disable all DRM content (EME: Encryption Media Extension) + * Optionally hide the UI setting which also disables the DRM prompt + * [TEST] https://bitmovin.com/demos/drm + * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ +user_pref("media.eme.enabled", false); +user_pref("browser.eme.ui.enabled", false); +/* 5509: disable IPv6 if using a VPN + * This is an application level fallback. Disabling IPv6 is best done at an OS/network + * level, and/or configured properly in system wide VPN setups. + * If you see PR_CONNECT_RESET_ERROR, this pref *might* be the cause + * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" + * [TEST] https://ipleak.org/ + * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/ + // user_pref("network.dns.disableIPv6", true); +/* 5510: control when to send a cross-origin referer + * 0=always (default), 1=only if base domains match, 2=only if hosts match + * [NOTE] Will cause breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram ***/ +user_pref("network.http.referer.XOriginPolicy", 2); /* 5590: show a prompt when opening a link in external applications ***/ user_pref("security.external_protocol_requires_permission", true); @@ -1025,36 +955,38 @@ user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] /* 6008: enforce no First Party Isolation [FF51+] - * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), - * and enabling FPI disables those. FPI is no longer maintained ***/ + * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), and enabling FPI + * disables those. FPI is no longer maintained except at Tor Project for Tor Browser's config ***/ user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false] /* 6009: enforce SmartBlock shims [FF81+] * In FF96+ these are listed in about:compat * [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/ user_pref("extensions.webcompat.enable_shims", true); // [DEFAULT: true] -/* 6010: enforce/reset TLS 1.0/1.1 downgrades to session only - * [NOTE] In FF97+ the TLS 1.0/1.1 downgrade UX was removed +/* 6010: enforce no TLS 1.0/1.1 downgrades * [TEST] https://tls-v1-1.badssl.com:1010/ ***/ user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false] /* 6011: enforce disabling of Web Compatibility Reporter [FF56+] * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla * [WHY] To prevent wasting Mozilla's time with a custom setup ***/ user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] -/* 6012: disable SHA-1 certificates ***/ -user_pref("security.pki.sha1_enforcement_level", 1); // [DEFAULT: 1 FF102+] -/* 6050: prefsCleaner: reset items removed from arkenfox FF92+ ***/ - // user_pref("browser.urlbar.trimURLs", ""); - // user_pref("dom.caches.enabled", ""); - // user_pref("dom.storageManager.enabled", ""); - // user_pref("dom.storage_access.enabled", ""); - // user_pref("dom.targetBlankNoOpener.enabled", ""); - // user_pref("network.cookie.thirdparty.sessionOnly", ""); - // user_pref("network.cookie.thirdparty.nonsecureSessionOnly", ""); - // user_pref("privacy.firstparty.isolate.block_post_message", ""); - // user_pref("privacy.firstparty.isolate.restrict_opener_access", ""); - // user_pref("privacy.firstparty.isolate.use_site", ""); - // user_pref("privacy.window.name.update.enabled", ""); - // user_pref("security.insecure_connection_text.enabled", ""); +/* 6012: enforce Quarantined Domains [FF115+] + * [WHY] https://support.mozilla.org/kb/quarantined-domains */ +user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true] +/* 6050: prefsCleaner: reset previously active items removed from arkenfox FF102+ ***/ + // user_pref("beacon.enabled", ""); + // user_pref("browser.region.network.url", ""); + // user_pref("browser.region.update.enabled", ""); + // user_pref("browser.ssl_override_behavior", ""); + // user_pref("devtools.chrome.enabled", ""); + // user_pref("dom.disable_beforeunload", ""); + // user_pref("dom.disable_open_during_load", ""); + // user_pref("extensions.formautofill.available", ""); + // user_pref("extensions.formautofill.addresses.supported", ""); + // user_pref("extensions.formautofill.creditCards.available", ""); + // user_pref("extensions.formautofill.creditCards.supported", ""); + // user_pref("middlemouse.contentLoadURL", ""); +/* 6051: prefsCleaner: reset previously active items removed from arkenfox FF115+ ***/ + // user_pref("network.protocol-handler.external.ms-windows-store", ""); /*** [SECTION 7000]: DON'T BOTHER Thunderbird-User.JS maintainer here : @@ -1063,18 +995,16 @@ user_pref("security.pki.sha1_enforcement_level", 1); // [DEFAULT: 1 FF102+] ***/ user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); /* 7001: disable APIs - * Location-Aware Browsing, Full Screen, offline cache (appCache), Virtual Reality - * [WHY] The API state is easily fingerprintable. Geo and VR are behind prompts (7002). - * appCache storage capability was removed in FF90. Full screen requires user interaction ***/ + * Location-Aware Browsing, Full Screen + * [WHY] The API state is easily fingerprintable. + * Geo is behind a prompt (7002). Full screen requires user interaction ***/ user_pref("geo.enabled", false); user_pref("full-screen-api.enabled", false); -user_pref("browser.cache.offline.enable", false); -user_pref("dom.vr.enabled", false); // [DEFAULT: false FF97+] /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // [DEFAULT: false FF109+] + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF109+] // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS @@ -1088,13 +1018,13 @@ user_pref("dom.vr.enabled", false); // [DEFAULT: false FF97+] /* 7005: disable SSL session IDs [FF36+] * [WHY] Passive fingerprinting and perf costs. These are session-only * and isolated with network partitioning (FF85+) and/or containers ***/ - // user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF in FF101 or lower] + // user_pref("security.ssl.disable_session_identifiers", true); /* 7006: onions * [WHY] Thunderbird doesn't support hidden services. Use Tor Browser ***/ // user_pref("dom.securecontext.allowlist_onions", true); // [FF97+] 1382359/1744006 // user_pref("network.http.referer.hideOnionSource", true); // 1305144 /* 7007: referers - * [WHY] Only cross-origin referers (1600s) need control ***/ + * [WHY] Only cross-origin referers (1602, 5510) matter ***/ user_pref("network.http.sendRefererHeader", 0); user_pref("network.http.referer.trimmingPolicy", 0); /* 7008: set the default Referrer Policy [FF59+] @@ -1105,7 +1035,6 @@ user_pref("network.http.referer.defaultPolicy.pbmode", 0); // [DEFAULT: 2] /* 7010: disable HTTP Alternative Services [FF37+] * [WHY] Already isolated with network partitioning (FF85+) ***/ user_pref("network.http.altsvc.enabled", false); - // user_pref("network.http.altsvc.oe", false); // [DEFAULT: false FF94+] /* 7011: disable website control over browser right-click context menu * [WHY] Just use Shift-Right-Click ***/ user_pref("dom.event.contextmenu.enabled", false); @@ -1128,7 +1057,7 @@ user_pref("dom.event.clipboardevents.enabled", false); // user_pref("privacy.donottrackheader.enabled", true); /* 7016: customize ETP settings * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ - // user_pref("network.cookie.cookieBehavior", 5); + // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5 FF103+] // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] // user_pref("privacy.partition.network_state.ocsp_cache", true); @@ -1138,8 +1067,7 @@ user_pref("dom.event.clipboardevents.enabled", false); // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] // user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] /* 7017: disable service workers - * [WHY] Already isolated (FF96+) with TCP (2701) behind a pref (2710) - * or blocked with TCP in 3rd parties (FF95 or lower) ***/ + * [WHY] Already isolated with TCP (2701) behind a pref (2710) ***/ // user_pref("dom.serviceWorkers.enabled", false); /* 7018: disable Web Notifications * [WHY] Web Notifications are behind a prompt (7002) @@ -1151,6 +1079,13 @@ user_pref("dom.event.clipboardevents.enabled", false); * [NOTE] To remove all subscriptions, reset "dom.push.userAgentID" * [1] https://support.mozilla.org/kb/push-notifications-firefox ***/ // user_pref("dom.push.enabled", false); +/* 7020: disable WebRTC (Web Real-Time Communication) + * [WHY] Firefox desktop uses mDNS hostname obfuscation and the private IP is never exposed until + * required in TRUSTED scenarios; i.e. after you grant device (microphone or camera) access + * [TEST] https://browserleaks.com/webrtc + * [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ + * [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 ***/ +user_pref("media.peerconnection.enabled", false); /*** [SECTION 8000]: DON'T BOTHER: FINGERPRINTING [WHY] They are insufficient to help anti-fingerprinting and do more harm than good @@ -1158,81 +1093,41 @@ user_pref("dom.event.clipboardevents.enabled", false); [NOTE] An empty User-Agent may break Microsoft Exchange OAuth2 login ***/ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan"); -/* 8001: disable APIs ***/ - // user_pref("device.sensors.enabled", false); - // user_pref("dom.enable_performance", false); - // user_pref("dom.enable_resource_timing", false); - // user_pref("dom.gamepad.enabled", false); - // user_pref("dom.netinfo.enabled", false); // [DEFAULT: false NON-ANDROID: false ANDROID FF99+] - // user_pref("dom.webaudio.enabled", false); -/* 8002: disable other ***/ - // user_pref("browser.display.use_document_fonts", 0); - // user_pref("dom.w3c_touch_events.enabled", 0); - // user_pref("media.navigator.enabled", false); - // user_pref("media.ondevicechange.enabled", false); - // user_pref("media.video_stats.enabled", false); - // user_pref("media.webspeech.synth.enabled", false); - // user_pref("webgl.enable-debug-renderer-info", false); -/* 8003: spoof ***/ - // user_pref("dom.maxHardwareConcurrency", 2); - // user_pref("font.system.whitelist", ""); // [HIDDEN PREF] - // user_pref("general.appname.override", ""); // [HIDDEN PREF] - // user_pref("general.appversion.override", ""); // [HIDDEN PREF] - // user_pref("general.buildID.override", ""); // [HIDDEN PREF] - // user_pref("general.oscpu.override", ""); // [HIDDEN PREF] - // user_pref("general.platform.override", ""); // [HIDDEN PREF] - // user_pref("general.useragent.override", ""); // [HIDDEN PREF] - // user_pref("ui.use_standins_for_native_colors", true); +/* 8001: prefsCleaner: reset items useless for anti-fingerprinting ***/ + // user_pref("browser.display.use_document_fonts", ""); + // user_pref("browser.zoom.siteSpecific", ""); + // user_pref("device.sensors.enabled", ""); + // user_pref("dom.enable_performance", ""); + // user_pref("dom.enable_resource_timing", ""); + // user_pref("dom.gamepad.enabled", ""); + // user_pref("dom.maxHardwareConcurrency", ""); + // user_pref("dom.w3c_touch_events.enabled", ""); + // user_pref("dom.webaudio.enabled", ""); + // user_pref("font.system.whitelist", ""); + // user_pref("general.appname.override", ""); + // user_pref("general.appversion.override", ""); + // user_pref("general.buildID.override", ""); + // user_pref("general.oscpu.override", ""); + // user_pref("general.platform.override", ""); + // user_pref("general.useragent.override", ""); + // user_pref("media.navigator.enabled", ""); + // user_pref("media.ondevicechange.enabled", ""); + // user_pref("media.video_stats.enabled", ""); + // user_pref("media.webspeech.synth.enabled", ""); + // user_pref("ui.use_standins_for_native_colors", ""); + // user_pref("webgl.enable-debug-renderer-info", ""); -/*** [SECTION 9000]: PERSONAL - Non-project related but useful. If any interest you, add them to your overrides -***/ +/*** [SECTION 9000]: NON-PROJECT RELATED ***/ user_pref("_user.js.parrot", "9000 syntax error: the parrot's cashed in 'is chips!"); -/* WELCOME & WHAT'S NEW NOTICES ***/ -user_pref("mailnews.start_page_override.mstone", "ignore"); // master switch -/* WARNINGS ***/ - // user_pref("browser.tabs.warnOnClose", false); // [DEFAULT false FF94+] - // user_pref("browser.tabs.warnOnOpen", false); - // user_pref("full-screen-api.warning.delay", 0); - // user_pref("full-screen-api.warning.timeout", 0); -/* UPDATES ***/ - // user_pref("app.update.auto", false); // [NON-WINDOWS] disable auto app updates - // [NOTE] You will still get prompts to update, and should do so in a timely manner - // user_pref("browser.search.update", false); // disable search engine updates (e.g. OpenSearch) - // [NOTE] This does not affect Mozilla's built-in or Web Extension search engines - // user_pref("extensions.update.enabled", false); // disable extension and theme update checks - // user_pref("extensions.update.autoUpdateDefault", false); // disable installing extension and theme updates - // [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) - // user_pref("extensions.getAddons.cache.enabled", false); // disable extension metadata (extension detail tab) -/* APPEARANCE ***/ - // user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent - // user_pref("ui.prefersReducedMotion", 1); // disable chrome animations [FF77+] [RESTART] [HIDDEN PREF] - // 0=no-preference, 1=reduce: with RFP this only affects chrome - // user_pref("ui.systemUsesDarkTheme", 1); // [FF67+] [HIDDEN PREF] - // 0=light, 1=dark: with RFP this only affects chrome -/* CONTENT BEHAVIOR ***/ - // user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type" - // user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX] -/* UX BEHAVIOR ***/ - // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [DEFAULT: false on Linux] - // user_pref("mail.tabs.autoHide", true); // hides the tab bar if there is only one tab - // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART] -/* UX FEATURES ***/ - // user_pref("reader.parse-on-load.enabled", false); // Reader View -/* OTHER ***/ - // user_pref("browser.bookmarks.max_backups", 2); - // user_pref("network.manage-offline-status", false); // see bugzilla 620472 - // user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR) -/* RETURN RECEIPT BEHAVIOR ***/ - // user_pref("mail.mdn.report.enabled", false); // disable return receipt sending unconditionally -/* CUSTOM HEADERS ***/ +/* 9001: disable welcome notices ***/ +user_pref("browser.startup.homepage_override.mstone", "ignore"); +/* 9090: disable return receipt sending unconditionally ***/ + // user_pref("mail.mdn.report.enabled", false); +/* 9099: e-mail custom headers (examples) ***/ // user_pref("mail.compose.other.header", "X-Custom-Header,X-Another-Custom-Header"); // corresponding values can be set in compose window ("double-arrow" drop-down) // user_pref("mail.identity.id1.headers", "References, InReplyTo"); // user_pref("mail.identity.id1.header.References", "References: <2ad46d80-c8ce-49a3-9896-16171788ac28@example.tld>\n <31ff00c2-b7cb-4063-beeb-a0bdd424c3a7@example1.tld>"); // user_pref("mail.identity.id1.header.InReplyTo", "In-Reply-To: <31ff00c2-b7cb-4063-beeb-a0bdd424c3a7@example1.tld>"); -user_pref("mail.identity.id1.headers", ""); -user_pref("mail.identity.id1.header.References", ""); -user_pref("mail.identity.id1.header.InReplyTo", ""); /*** [SECTION 9100]: THUNDERBIRD (AUTO CONFIG / UI / HEADERS / ADDRESS BOOK) Options general to Thunderbird's mail configuration and user interface @@ -1548,61 +1443,34 @@ user_pref("mail.openpgp.allow_external_gnupg", true); // [HIDDEN PREF] [1] https://github.com/arkenfox/user.js/issues/123 ***/ user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); -/* ESR91.x still uses all the following prefs -// [NOTE] replace the * with a slash in the line above to re-enable them -// FF93 -// 7003: disable non-modern cipher suites - // [-] https://bugzilla.mozilla.org/1724072 - // user_pref("security.ssl3.rsa_des_ede3_sha", false); // 3DES -// FF94 -// 1402: limit font visibility (Windows, Mac, some Linux) [FF79+] - replaced by new 1402 - // [-] https://bugzilla.mozilla.org/1715507 - // user_pref("layout.css.font-visibility.level", 1); -// FF96 -// 0302: disable auto-INSTALLING Thunderbird updates via a background service + hide the setting [FF90+] [WINDOWS] - // [1] https://support.mozilla.org/kb/enable-background-updates-firefox-windows - // [-] https://bugzilla.mozilla.org/1738983 -user_pref("app.update.background.scheduling.enabled", false); -// FF97 -// 7006: onions - replaced by new 7006 "allowlist" - // [-] https://bugzilla.mozilla.org/1744006 - // user_pref("dom.securecontext.whitelist_onions", true); // 1382359 -// FF99 -// 6003: enforce CSP (Content Security Policy) - // [1] https://developer.mozilla.org/docs/Web/HTTP/CSP - // [-] https://bugzilla.mozilla.org/1754301 -user_pref("security.csp.enable", true); // [DEFAULT: true] -// FF100 -// 7009: disable HTTP2 - replaced by network.http.http2* prefs - // [WHY] Passive fingerprinting. ~50% of sites use HTTP2 [1] - // [1] https://w3techs.com/technologies/details/ce-http2/all/all - // [-] https://bugzilla.mozilla.org/1752621 - // user_pref("network.http.spdy.enabled", false); - // user_pref("network.http.spdy.enabled.deps", false); - // user_pref("network.http.spdy.enabled.http2", false); - // user_pref("network.http.spdy.websockets", false); // [FF65+] -// FF101 -// 9211: Behavior when sending HTML message - // (0=Ask, 1=Send as plain text, 2=Send as HTML anyway, - // 3=Include both plain text and HTML message bodies in message) - // Email that is HTML should also have plaintext multipart for plain text users. - // [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html - // [-] https://bugzilla.mozilla.org/1727493 -user_pref("mail.default_html_action", 1); -// 9213: Downgrade email to plaintext by default - // [-] https://bugzilla.mozilla.org/1727493 -user_pref("mailnews.sendformat.auto_downgrade", true); -// FF102 - // 0901: set when Thunderbird should prompt for the primary password - // 0=once per session (default), 1=every time it's needed, 2=after n minutes (0902) - // [-] https://bugzilla.mozilla.org/1767099 -user_pref("security.ask_for_password", 2); - // 0902: set how long in minutes Thunderbird should remember the primary password (0901) - // [-] https://bugzilla.mozilla.org/1767099 -user_pref("security.password_lifetime", 5); // [DEFAULT: 30] - // 6007: enforce Local Storage Next Generation (LSNG) [FF65+] - // [-] https://bugzilla.mozilla.org/1764696 -user_pref("dom.storage.next_gen", true); // [DEFAULT: true FF92+] +/* ESR102.x still uses all the following prefs +// [NOTE] replace the * with a slash in the line above to re-enable active ones +// FF103 +// 2801: delete cookies and site data on exit - replaced by sanitizeOnShutdown* (2810) + // 0=keep until they expire (default), 2=keep until you close Thunderbird + // [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1681493,1681495,1681498,1759665,1764761 +user_pref("network.cookie.lifetimePolicy", 2); +// 6012: disable SHA-1 certificates + // [-] https://bugzilla.mozilla.org/1766687 + // user_pref("security.pki.sha1_enforcement_level", 1); // [DEFAULT: 1] +// FF114 +// 2816: set cache to clear on exit [FF96+] + // [NOTE] We already disable disk cache (1001) and clear on exit (2811) which is more robust + // [1] https://bugzilla.mozilla.org/1671182 + // [-] https://bugzilla.mozilla.org/1821651 + // user_pref("privacy.clearsitedata.cache.enabled", true); +// 4505: experimental RFP [FF91+] + // [-] https://bugzilla.mozilla.org/1824235 + // user_pref("privacy.resistFingerprinting.testGranularityMask", 0); +// 5017: disable Form Autofill heuristics + // Heuristics controls Form Autofill on forms without @autocomplete attributes + // [-] https://bugzilla.mozilla.org/1829670 + // user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] +// FF115 + // 7001: disable offline cache (appCache) + // [NOTE] appCache storage capability was removed in FF90 + // [-] https://bugzilla.mozilla.org/1677718 + // user_pref("browser.cache.offline.enable", false); // ***/ /* END: internal custom pref to test for syntax errors ***/ From 3996c279fdb067e2d9ffb0109d3b1016978f5c0d Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Fri, 20 Oct 2023 14:32:06 +0200 Subject: [PATCH 125/147] Enforces `datareporting.policy.dataSubmissionPolicyBypassNotification` to completely disable telemetry (by preventing new data submission) --- user.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/user.js b/user.js index 5bef05c..ee8cd81 100644 --- a/user.js +++ b/user.js @@ -120,8 +120,10 @@ user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); /** TELEMETRY ***/ /* 0330: disable new data submission [FF41+] * If disabled, no policy is shown or upload takes place, ever - * [1] https://bugzilla.mozilla.org/1195552 ***/ + * [1] https://bugzilla.mozilla.org/1195552 + * [2] https://searchfox.org/comm-esr115/source/mail/components/telemetry/README.md#165 ***/ user_pref("datareporting.policy.dataSubmissionEnabled", false); +user_pref("datareporting.policy.dataSubmissionPolicyBypassNotification", true); /* 0331: disable Health Reports * [SETTING] Privacy & Security > Thunderbird Data Collection and Use > Allow Thunderbird to send technical... ***/ user_pref("datareporting.healthreport.uploadEnabled", false); From ee80afc278e1df5e66e32cd7327ac7e92597a024 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Fri, 20 Oct 2023 14:37:07 +0200 Subject: [PATCH 126/147] Prevents donation appeal page opening on fresh profiles unconditionally --- user.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/user.js b/user.js index ee8cd81..6054ee1 100644 --- a/user.js +++ b/user.js @@ -198,6 +198,12 @@ user_pref("mail.rights.override", true); // [DEFAULT: unset] // user_pref("app.use_without_mail_account", true); /* 0373: disable warning when customizing "From address" ***/ // user_pref("mail.compose.warned_about_customize_from", true); +/* 0374: prevent donation appeal page opening on fresh profiles + * $url Web page is opened if $viewed is lower than $version (and 0330 policy bypass notification is disabled) + * [1] https://searchfox.org/comm-esr115/source/mail/base/content/messenger.js#455 ***/ + // user_pref("app.donation.eoy.version", 2); +user_pref("app.donation.eoy.version.viewed", 999); + // user_pref("app.donation.eoy.url", "https://www.thunderbird.net/thunderbird/115.0/appeal/"); /* 0380: disable the new/unread message count badge on taskbar icon * [1] https://www.thunderbird.net/en-US/thunderbird/91.0.2/releasenotes/#whatsnew */ // user_pref("mail.biff.show_badge", false); // [WINDOWS] From d6b18302e46349d9924c8a76951bae6efca51501 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 18 Nov 2023 15:02:30 +0100 Subject: [PATCH 127/147] Bumps to v115.0 --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index 6054ee1..31f0692 100644 --- a/user.js +++ b/user.js @@ -1,6 +1,6 @@ /****** * name: thunderbird user.js -* date: 19 October 2023 +* date: 18 November 2023 * version: v115.0 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From ad0cac10b2d9ffd85712cf6d4ecbbf96849eabb6 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 21 Apr 2024 20:29:29 +0200 Subject: [PATCH 128/147] Mentions RFP breaks mozAddonManager integration (AMO/ATN) It appears that re-enabling JavaScript is also required. See wiki page : > closes #43 --- user.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index 31f0692..d06861d 100644 --- a/user.js +++ b/user.js @@ -1,6 +1,6 @@ /****** * name: thunderbird user.js -* date: 18 November 2023 +* date: 21 April 2024 * version: v115.0 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) @@ -774,7 +774,7 @@ user_pref("privacy.resistFingerprinting", true); // [FF41+] user_pref("privacy.window.maxInnerWidth", 1600); user_pref("privacy.window.maxInnerHeight", 900); /* 4503: disable mozAddonManager Web API [FF57+] - * [NOTE] To allow extensions to work on AMO, you also need 2662 + * [NOTE] To allow extensions to work on AMO, you also need 2662 and 4505 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF FF57-108] /* 4504: enable RFP letterboxing [FF67+] @@ -789,9 +789,10 @@ user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDE user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF] /* 4505: experimental RFP [FF91+] + * List of domains exempted from RFP (comma-separated). * [WARNING] DO NOT USE unless testing, see [1] comment 12 * [1] https://bugzilla.mozilla.org/1635603 ***/ - // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); + // user_pref("privacy.resistFingerprinting.exemptedDomains", "addons.thunderbird.net"); /* 4506: set RFP's font visibility level (1402) [FF94+] ***/ // user_pref("layout.css.font-visibility.resistFingerprinting", 1); // [DEFAULT: 1] /* 4510: disable using system colors From e6c5df30f27fba4955360ed8b0bc0478b8934ab2 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 21 Apr 2024 21:47:04 +0200 Subject: [PATCH 129/147] Disables ESLint "flat configuration" format --- .github/workflows/linting.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 5b560e8..64dc95e 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -7,6 +7,8 @@ jobs: build: name: Run ESLint on user.js runs-on: ubuntu-latest + env: + ESLINT_USE_FLAT_CONFIG: false steps: - uses: actions/checkout@v3 From 7390a8056c7e4cc97566ee629306df82b304520e Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 24 Apr 2024 22:58:24 +0200 Subject: [PATCH 130/147] [META] Updates copyrights for 2024 --- LICENSE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE b/LICENSE index 3283feb..721b1eb 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2019-2023 HorlogeSkynet +Copyright (c) 2019-2024 HorlogeSkynet Copyright (c) 2019 dngray Copyright (c) 2019 arkenfox [prev. ghacksuserjs] From ee7649a8b49864af83cca2b34e6fcb75ff35cf2b Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 24 Apr 2024 23:01:01 +0200 Subject: [PATCH 131/147] Migrates ESLint configuration to new (9+) "flat format" --- .eslint.config.mjs | 36 ++++++++++++++++++++++++++++ .eslintrc.yml | 45 ----------------------------------- .github/workflows/linting.yml | 6 ++--- 3 files changed, 38 insertions(+), 49 deletions(-) create mode 100644 .eslint.config.mjs delete mode 100644 .eslintrc.yml diff --git a/.eslint.config.mjs b/.eslint.config.mjs new file mode 100644 index 0000000..6e914ca --- /dev/null +++ b/.eslint.config.mjs @@ -0,0 +1,36 @@ +// Thunderbird User.JS ESLint configuration file + +import js from "@eslint/js"; + +export default [ + js.configs.recommended, + { + rules: { + // Expect only double-quoted strings. + quotes: ["error", "double"], + + // Expect a semicolon after each statement. + semi: ["error", "always", {"omitLastInOneLineBlock": false}], + + // As project code style, don't allow tabulation nor trailing whitespaces. + "no-tabs": "error", + "no-trailing-spaces": "error", + + // Don't allow whitespace before semicolons. + "semi-spacing": ["error", {"before": false}], + + // Don't allow irregular whitespace characters in our sheet. + "no-irregular-whitespace": ["error", {"skipStrings": false, "skipComments": false}], + }, + languageOptions: { + // From + globals: { + pref: "readonly", + user_pref: "readonly", + sticky: "readonly", + locked: "readonly", + sticky_pref: "readonly", + }, + }, + }, +]; diff --git a/.eslintrc.yml b/.eslintrc.yml deleted file mode 100644 index b170078..0000000 --- a/.eslintrc.yml +++ /dev/null @@ -1,45 +0,0 @@ -%YAML 1.2 ---- - -root: true - -extends: 'eslint:recommended' - -globals: - # From - pref: true - user_pref: true - sticky: true - locked: true - sticky_pref: true - -rules: - # Expect a semicolon after each statement. - semi: - - "error" - - "always" - - - omitLastInOneLineBlock: false - - # As internal code style, don't allow tabulation. - no-tabs: "error" - # ... nor trailing spaces ! - no-trailing-spaces: "error" - - # Expect only double-quoted strings. - quotes: - - "error" - - "double" - - # Don't allow whitespace before semicolons. - semi-spacing: - - "error" - - - before: false - - # Don't allow irregular whitespace characters in our sheet. - no-irregular-whitespace: - - "error" - - - skipStrings: false - skipComments: false diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 64dc95e..317cacb 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -7,13 +7,11 @@ jobs: build: name: Run ESLint on user.js runs-on: ubuntu-latest - env: - ESLINT_USE_FLAT_CONFIG: false steps: - uses: actions/checkout@v3 - uses: actions/setup-node@v3 - - run: npm install -g eslint - - run: eslint user.js + - run: npm install eslint @eslint/js + - run: npx eslint -c .eslint.config.mjs user.js From ebeb8cf3fb3dcee12c4746c39f636931fdc5ca51 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Wed, 24 Apr 2024 23:32:01 +0200 Subject: [PATCH 132/147] Updates GitHub Actions to v4 to address Node.js 16 deprecation --- .github/workflows/linting.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 317cacb..5a88a69 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -9,9 +9,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - - uses: actions/setup-node@v3 + - uses: actions/setup-node@v4 - run: npm install eslint @eslint/js - run: npx eslint -c .eslint.config.mjs user.js From c6fef1356e83a09c184bf08fd9d89f1611e7233a Mon Sep 17 00:00:00 2001 From: boredsquirrel <113100745+boredsquirrel@users.noreply.github.com> Date: Tue, 9 Jul 2024 18:53:26 +0000 Subject: [PATCH 133/147] Enables project notes (start page) (#52) This is to show (by default) update notifications, and allow users to check changelog. Co-authored-by: Samuel FORESTIER --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index d06861d..8191527 100644 --- a/user.js +++ b/user.js @@ -82,7 +82,7 @@ user_pref("browser.aboutConfig.showWarning", false); user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); /* 0102: set START page [SETUP-CHROME] * [SETTING] General > Thunderbird Start Page ***/ -user_pref("mailnews.start_page.enabled", false); + // user_pref("mailnews.start_page.enabled", false); /* 0104: set NEWTAB page * true=? (default), false=blank page ***/ user_pref("browser.newtabpage.enabled", false); From 48529d1963e3cd6fba62f420e25a0aa3aa33697a Mon Sep 17 00:00:00 2001 From: boredsquirrel <113100745+boredsquirrel@users.noreply.github.com> Date: Tue, 9 Jul 2024 19:36:44 +0000 Subject: [PATCH 134/147] Enables sending HTML emails and "resume from crash" (#49) This patch re-allows users to send HTML emails (when needed). It also re-enables "resume from crash" (`browser.sessionstore.resume_from_crash`) and resets `calendar.extract.service.enabled` (already disabled by default). Co-authored-by: Samuel FORESTIER --- user.js | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/user.js b/user.js index 8191527..79792a0 100644 --- a/user.js +++ b/user.js @@ -850,7 +850,7 @@ user_pref("permissions.memory_only", true); // [HIDDEN PREF] /* 5005: disable intermediate certificate caching [FF41+] [RESTART] * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. * Saved logins and passwords are not available. Reset the pref and restart to return them ***/ - // user_pref("security.nocertdb", true); + // user_pref("security.nocertdb", true); /* 5006: disable favicons in history and bookmarks * [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your * actual history (and bookmarks) already do. Your history is more detailed, so @@ -861,7 +861,7 @@ user_pref("browser.chrome.site_icons", false); user_pref("browser.sessionstore.max_tabs_undo", 0); /* 5008: disable resuming session from crash * [TEST] about:crashparent ***/ -user_pref("browser.sessionstore.resume_from_crash", false); + // user_pref("browser.sessionstore.resume_from_crash", false); /* 5009: disable "open with" in download dialog [FF50+] * Application data isolation [1] * [1] https://bugzilla.mozilla.org/1281959 ***/ @@ -1261,16 +1261,16 @@ user_pref("mail.sanitize_date_header", true); * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=667133 ***/ // user_pref("mail.SpellCheckBeforeSend", false); /* 9212: Compose email in plaintext unless expressly overridden - * [SETUP-FEATURE] Sometimes HTML is useful especially when used with Markdown Here + * Sometimes HTML is useful especially when used with Markdown Here * [SETTING] Account Settings > Composition & Addressing > Composition > Compose messages in HTML format * [NOTE] Holding down shift when you click on "Write" will bypass * [1] http://kb.mozillazine.org/Plain_text_e-mail_%28Thunderbird%29 * [2] https://support.mozilla.org/en-US/questions/1004181 * [3] https://markdown-here.com ***/ -user_pref("mail.html_compose", false); + // user_pref("mail.html_compose", false); user_pref("mail.identity.default.compose_html", false); /* 9213: Send only plaintext email by default - * [SETUP-FEATURE] Only use HTML email if you need it, see [1] + * You should only use HTML email if you need it (see [1]) * [SETTING] Composition > Composition > Sending Format * Email that is HTML should also have plaintext multipart for plain text users. * 0=auto (default, send only plain text if the message is free of any rich formatting @@ -1279,8 +1279,8 @@ user_pref("mail.identity.default.compose_html", false); * 2=HTML (only send a HTML part) * 3=both (send both the HTML part and the plain text alternative part) * [1] https://drewdevault.com/2016/04/11/Please-use-text-plain-for-emails.html ***/ -user_pref("mail.default_send_format", 1); -/* 9214: What classes can process incoming data. + // user_pref("mail.default_send_format", 0); +/* 9214: What classes can process incoming data. [SETUP-FEATURE] * (0=All classes (default), 1=Don't display HTML, 2=Don't display HTML and inline images, * 3=Don't display HTML, inline images and some other uncommon types, 100=Use a hard coded list) * In the past this has mitigated a vulnerability CVE-2008-0304 (rare) @@ -1389,7 +1389,7 @@ user_pref("mail.chat.notification_info", 2); * [SETTING] Calendar > Calendar > Timezone ***/ user_pref("calendar.timezone.local", "UTC"); // [DEFAULT: ""] /* 9313: Disable calendar service performing event "extraction" from email content ***/ -user_pref("calendar.extract.service.enabled", false); // [DEFAULT: false] + // user_pref("calendar.extract.service.enabled", false); // [DEFAULT: false] /** RSS ***/ /** These features don't actually do anything as they aren't implemented From 824edabe6303d6b85a32fcba96901706ed4c5922 Mon Sep 17 00:00:00 2001 From: boredsquirrel <113100745+boredsquirrel@users.noreply.github.com> Date: Tue, 9 Jul 2024 19:47:44 +0000 Subject: [PATCH 135/147] Enforces secure auto-configuration and fetching from Exchange (#50) This patch enforces `mailnews.auto_config.fetchFromISP.sslOnly` and resets `mailnews.auto_config.fetchFromExchange.enabled` to allow fetching from Exchange servers when auto-configuration is enabled. It also resets two auto-configuration URL preferences as doing so prevented users from re-enabling this feature. Co-authored-by: Samuel FORESTIER --- user.js | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index 79792a0..82aacbc 100644 --- a/user.js +++ b/user.js @@ -1152,15 +1152,17 @@ user_pref("_user.js.parrot", "9100 syntax error: this parrot is blind!"); * Such settings require a query to Mozilla which could have privacy implications * if the user wishes to keep the existence of the mail provider private. * We also enforce (valid) SSL/TLS connections if auto-configuration happens to be enabled. + * If auto-configuration is re-enabled, fetching from Exchange will be allowed by default. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Autoconfiguration ***/ user_pref("mailnews.auto_config.guess.enabled", false); user_pref("mailnews.auto_config.fetchFromISP.enabled", false); user_pref("mailnews.auto_config.fetchFromISP.sendEmailAddress", false); -user_pref("mailnews.auto_config.fetchFromExchange.enabled", false); +user_pref("mailnews.auto_config.fetchFromISP.sslOnly", true); + // user_pref("mailnews.auto_config.fetchFromExchange.enabled", false); user_pref("mailnews.auto_config.guess.sslOnly", true); user_pref("mailnews.auto_config.guess.requireGoodCert", true); // [DEFAULT: true] -user_pref("mailnews.auto_config_url", ""); -user_pref("mailnews.auto_config.addons_url",""); + // user_pref("mailnews.auto_config_url", "https://live.thunderbird.net/autoconfig/v1.1/"); + // user_pref("mailnews.auto_config.addons_url","https://live.thunderbird.net/autoconfig/addons.json"); /* 9102: Disable account provisioning [SETUP-INSTALL] * This option allows users to create a new email account through partner providers. * [1] https://developer.mozilla.org/en-US/docs/Mozilla/Thunderbird/Account_Provisioner ***/ From 55cf3041a7473deaf8da64486e134ff34c6d7aa8 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 22 Aug 2024 14:36:25 +0200 Subject: [PATCH 136/147] Adds preferences from TB 128 ESR mailnews.js --- user.js | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 82aacbc..efd7bec 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 21 April 2024 -* version: v115.0 +* date: 21 August 2024 +* version: v128.0-beta1 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) @@ -1169,6 +1169,12 @@ user_pref("mailnews.auto_config.guess.requireGoodCert", true); // [DEFAULT: true user_pref("mail.provider.enabled", false); /** UI (User Interface) ***/ +/* 9110: Control how email addresses are displayed + * It's safer to always show actual email address, as name could be spoofed to one of your contacts + * 0=name + email (default) + * 1=email + * 2=name ***/ + // user_pref("mail.addressDisplayFormat", 0); /* 9111: Show full email instead of just name from address book * true=Show just the display name for people in the address book (default) * false=Show both the email address and display name. ***/ From 100b5537e92264fbfbdf93276f362b29b843afdf Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 22 Aug 2024 14:37:54 +0200 Subject: [PATCH 137/147] Resets `mail.showCondensedAddresses` (9111) as it's disabled by default --- user.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index efd7bec..5d65bb8 100644 --- a/user.js +++ b/user.js @@ -1176,9 +1176,9 @@ user_pref("mail.provider.enabled", false); * 2=name ***/ // user_pref("mail.addressDisplayFormat", 0); /* 9111: Show full email instead of just name from address book - * true=Show just the display name for people in the address book (default) - * false=Show both the email address and display name. ***/ -user_pref("mail.showCondensedAddresses", false); + * true=Show just the display name for people in the address book + * false=Show both the email address and display name. (default) ***/ + // user_pref("mail.showCondensedAddresses", false); /* 9112: Disable "Filelink for Large Attachments" feature * [1] https://support.thunderbird.net/kb/filelink-large-attachments ***/ user_pref("mail.cloud_files.enabled", false); From 5d33d6b50e8a3ec0bae6dd76fa074f0c2211eb74 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 22 Aug 2024 16:23:59 +0200 Subject: [PATCH 138/147] Fixes ESLint configuration filename in GitHub pull request template --- .github/PULL_REQUEST_TEMPLATE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index d99ccb7..3be10e7 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -25,4 +25,4 @@ - [ ] My changes looks good ; - [ ] I agree that my code may be modified in the future ; -- [ ] My code follows the code style of this project (see `.eslintrc.yml`). +- [ ] My code follows the code style of this project (see `.eslint.config.mjs`). From b814b88b93700335279a73b9186010f1f06f5c25 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 22 Aug 2024 18:21:57 +0200 Subject: [PATCH 139/147] Applies Arkenfox v115.1..v128.0 migration --- user.js | 538 ++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 325 insertions(+), 213 deletions(-) diff --git a/user.js b/user.js index 5d65bb8..92d0d2f 100644 --- a/user.js +++ b/user.js @@ -1,6 +1,6 @@ /****** * name: thunderbird user.js -* date: 21 August 2024 +* date: 31 August 2024 * version: v128.0-beta1 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) @@ -27,16 +27,21 @@ [SETUP-CHROME] changes how Thunderbird itself behaves (i.e. not directly website related) * RELEASES: https://github.com/HorlogeSkynet/thunderbird-user.js/releases - * It is best to use the release that is optimized for and matches your Thunderbird version - * ESR102 - - If you are not using thunderbird-user.js v102-1... (not a definitive list) - - 2815: clearOnShutdown cookies + offlineApps should be false - - 9999: switch the appropriate deprecated section(s) back on + + * Use the thunderbird-user.js release that matches your Thunderbird version + - DON'T wait for thunderbird-user.js to update Thunderbird, nothing major changes these days + * Each release + - run prefsCleaner to reset prefs made inactive, including deprecated (9999) + * If you use a previous ESR + - It is recommended to not use the updater, or you will get a later version which may cause issues. + So you should manually append your overrides (and keep a copy), and manually update when you + change ESR releases (thunderbird-user.js is already past that release) + - If you decide to keep updating, then the onus is on you - also see section 9999 * INDEX: 0100: STARTUP - 0200: GEOLOCATION / LANGUAGE / LOCALE + 0200: GEOLOCATION 0300: QUIETER BIRD 0400: SAFE BROWSING 0600: BLOCK IMPLICIT OUTBOUND @@ -45,7 +50,6 @@ 0900: PASSWORDS 1000: DISK AVOIDANCE 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) - 1400: FONTS 1600: REFERERS 1700: CONTAINERS 2000: PLUGINS / MEDIA / WEBRTC @@ -53,7 +57,8 @@ 2600: MISCELLANEOUS 2700: ETP (ENHANCED TRACKING PROTECTION) 2800: SHUTDOWN & SANITIZING - 4500: RFP (RESIST FINGERPRINTING) + 4000: FPP (fingerprintingProtection) + 4500: OPTIONAL RFP (resistFingerprinting) 5000: OPTIONAL OPSEC 5500: OPTIONAL HARDENING 6000: DON'T TOUCH @@ -64,7 +69,7 @@ 9200: EMAIL COMPOSITION (ENCODING / FORMAT / VIEW) 9300: OTHER THUNDERBIRD COMPONENTS (CHAT / CALENDAR / RSS) 9400: THUNDERBIRD ENCRYPTION (OPENPGP / GNUPG) - 9999: DEPRECATED / REMOVED / LEGACY / RENAMED + 9999: DEPRECATED / RENAMED ******/ @@ -87,27 +92,12 @@ user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); * true=? (default), false=blank page ***/ user_pref("browser.newtabpage.enabled", false); -/*** [SECTION 0200]: GEOLOCATION / LANGUAGE / LOCALE ***/ +/*** [SECTION 0200]: GEOLOCATION ***/ user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!"); -/* 0201: use Mozilla geolocation service instead of Google if permission is granted [FF74+] - * Optionally enable logging to the console (defaults to false) ***/ -user_pref("geo.provider.network.url", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"); - // user_pref("geo.provider.network.logging.enabled", true); // [HIDDEN PREF] /* 0202: disable using the OS's geolocation service ***/ user_pref("geo.provider.ms-windows-location", false); // [WINDOWS] user_pref("geo.provider.use_corelocation", false); // [MAC] -user_pref("geo.provider.use_gpsd", false); // [LINUX] user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX] -/* 0210: set preferred language for displaying pages - * [SETTING] General > Language & Appearance > Language > Choose the language used to display... - * [TEST] https://addons.mozilla.org/about ***/ -user_pref("intl.accept_languages", "en-US, en"); -/* 0210b: Set dictionary to US ***/ -user_pref("spellchecker.dictionary", "en-US"); -/* 0211: use en-US locale regardless of the system or region locale - * [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages [1] - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 ***/ -user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] /*** [SECTION 0300]: QUIETER BIRD ***/ user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!"); @@ -116,6 +106,13 @@ user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF] /* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/ user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); +/* 0322: disable personalized Extension Recommendations in about:addons and AMO [FF65+] + * [NOTE] This pref has no effect when Health Reports (0331) are disabled + * [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/ +user_pref("browser.discovery.enabled", false); +/* 0323: disable shopping experience [FF116+] + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1840156#c0 ***/ +user_pref("browser.shopping.experience2023.enabled", false); // [DEFAULT: false] /** TELEMETRY ***/ /* 0330: disable new data submission [FF41+] @@ -148,9 +145,6 @@ user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+] user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF] user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF] user_pref("toolkit.coverage.endpoint.base", ""); -/* 0334: disable PingCentre telemetry (used in several System Add-ons) [FF57+] - * Defense-in-depth: currently covered by 0331 ***/ -user_pref("browser.ping-centre.telemetry", false); /** STUDIES ***/ /* 0340: disable Studies @@ -263,7 +257,7 @@ user_pref("network.prefetch-next", false); /* 0602: disable DNS prefetching * [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/ user_pref("network.dns.disablePrefetch", true); - // user_pref("network.dns.disablePrefetchFromHTTPS", true); // [DEFAULT: true] +user_pref("network.dns.disablePrefetchFromHTTPS", true); /* 0603: disable predictor / prefetching ***/ user_pref("network.predictor.enabled", false); user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false] @@ -286,15 +280,15 @@ user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost user_pref("network.proxy.socks_remote_dns", true); /* 0703: disable using UNC (Uniform Naming Convention) paths [FF61+] * [SETUP-CHROME] Can break extensions for profiles on network shares - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/26424 ***/ + * [1] https://bugzilla.mozilla.org/1413868 ***/ user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] /* 0704: disable GIO as a potential proxy bypass vector [FF60+] * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, - * dav, cdda, gphoto2, trash, etc. By default only sftp is accepted (FF87+) + * dav, cdda, gphoto2, trash, etc. From FF87-117, by default only sftp was accepted * [1] https://bugzilla.mozilla.org/1433507 * [2] https://en.wikipedia.org/wiki/GVfs * [3] https://en.wikipedia.org/wiki/GIO_(software) ***/ -user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] +user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] [DEFAULT: "" FF118+] /* 0705: disable proxy direct failover for system requests [FF91+] * [WARNING] Default true is a security feature against malicious extensions [1] * [SETUP-CHROME] If you use a proxy and you trust your extensions @@ -306,41 +300,59 @@ user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] * [SETUP-CHROME] If you use a proxy and you understand the security impact * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 ***/ // user_pref("network.proxy.allow_bypass", false); -/* 0710: disable DNS-over-HTTPS (DoH) rollout [FF60+] - * 0=default, 2=increased (TRR (Trusted Recursive Resolver) first), 3=max (TRR only), 5=off +/* 0710: enable DNS-over-HTTPS (DoH) [FF60+] + * 0=default, 2=increased (TRR (Trusted Recursive Resolver) first), 3=max (TRR only), 5=off (no rollout) * see "doh-rollout.home-region": USA 2019, Canada 2021, Russia/Ukraine 2022 [3] - * [SETTING] General > Network & Disk Space > Connection > Settings... > Enable DNS over HTTPS + * [SETTING] Privacy & Security>DNS over HTTPS * [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ * [2] https://wiki.mozilla.org/Security/DOH-resolver-policy - // * [3] https://support.mozilla.org/en-US/kb/firefox-dns-over-https + * [3] https://support.mozilla.org/kb/firefox-dns-over-https * [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/ - // user_pref("network.trr.mode", 5); -/* 0706: disable proxy direct failover for system requests [FF91+] - * [WARNING] Default true is a security feature against malicious extensions [1] - * [SETUP-CHROME] If you use a proxy and you trust your extensions - * [1] https://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ ***/ - // user_pref("network.proxy.failover_direct", false); + // user_pref("network.trr.mode", 3); +/* 0712: set DoH provider + * The custom uri is the value shown when you "Choose provider>Custom>" + * [NOTE] If you USE custom then "network.trr.uri" should be set the same + * [SETTING] Privacy & Security>DNS over HTTPS>Increased/Max>Choose provider ***/ + // user_pref("network.trr.uri", "https://example.dns"); + // user_pref("network.trr.custom_uri", "https://example.dns"); /*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); -/* 0802: disable location bar domain guessing - * domain guessing intercepts DNS "hostname not found errors" and resends a - * request (e.g. by adding www or .com). This is inconsistent use (e.g. FQDNs), does not work - * via Proxy Servers (different error), is a flawed use of DNS (TLDs: why treat .com - * as the 411 for DNS errors?), privacy issues (why connect to sites you didn't - * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack), - * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/ -user_pref("browser.fixup.alternate.enabled", false); // [DEFAULT: false FF104+] -/* 0804: disable live search suggestions - * [NOTE] Both must be true for the location bar to work +/* 0801: disable location bar making speculative connections [FF56+] + * [1] https://bugzilla.mozilla.org/1348275 ***/ +user_pref("browser.urlbar.speculativeConnect.enabled", false); +/* 0802: disable location bar contextual suggestions + * [NOTE] The UI is controlled by the .enabled pref + * [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/ +user_pref("browser.urlbar.quicksuggest.enabled", false); // [FF92+] +user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+] +user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false); // [FF92+] +/* 0803: disable live search suggestions + * [NOTE] Both must be true for live search to work in the location bar * [SETUP-CHROME] Override this if you trust and use a privacy respecting search engine ***/ user_pref("browser.search.suggest.enabled", false); +user_pref("browser.urlbar.suggest.searches", false); +/* 0805: disable urlbar trending search suggestions [FF118+] ***/ +user_pref("browser.urlbar.trending.featureGate", false); +/* 0806: disable urlbar suggestions ***/ +user_pref("browser.urlbar.addons.featureGate", false); // [FF115+] +user_pref("browser.urlbar.mdn.featureGate", false); // [FF117+] [HIDDEN PREF] +user_pref("browser.urlbar.weather.featureGate", false); // [FF108+] [DEFAULT: false] +user_pref("browser.urlbar.yelp.featureGate", false); // [FF124+] [DEFAULT: false] +/* 0807: disable urlbar clipboard suggestions [FF118+] ***/ +user_pref("browser.urlbar.clipboard.featureGate", false); +/* 0808: disable recent searches [FF120+] + * [NOTE] Recent searches are cleared with history (2811) + * [1] https://support.mozilla.org/kb/search-suggestions-firefox ***/ + // user_pref("browser.urlbar.recentsearches.featureGate", false); /* 0810: disable search and form history - * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] * [NOTE] We also clear formdata on exit (2811) + * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html * [2] https://bugzilla.mozilla.org/381681 ***/ user_pref("browser.formfill.enable", false); +/* 0815: disable tab-to-search [FF85+] ***/ +user_pref("browser.urlbar.suggest.engines", false); /* 0820: disable coloring of visited links * Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing @@ -352,6 +364,9 @@ user_pref("browser.formfill.enable", false); * [4] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use) * [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/ user_pref("layout.css.visited_links_enabled", false); +/* 0830: enable separate default search engine in Private Windows and its UI setting ***/ +user_pref("browser.search.separatePrivateDefault", true); // [FF70+] +user_pref("browser.search.separatePrivateDefault.ui.enabled", true); // [FF71+] /*** [SECTION 0900]: PASSWORDS [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas @@ -387,8 +402,8 @@ user_pref("network.auth.subresource-http-auth-allow", 1); /*** [SECTION 1000]: DISK AVOIDANCE ***/ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); /* 1001: disable disk cache - * [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this - * [NOTE] We also clear cache on exit (2811) ***/ + * [NOTE] We also clear cache on exit (2811) + * [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this ***/ user_pref("browser.cache.disk.enable", false); /* 1002: disable media cache from writing to disk in Private Browsing * [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/ @@ -398,6 +413,14 @@ user_pref("media.memory_cache_max_size", 65536); * define on which sites to save extra session data such as form content, cookies and POST data * 0=everywhere, 1=unencrypted sites, 2=nowhere ***/ user_pref("browser.sessionstore.privacy_level", 2); +/* 1005: disable automatic Thunderbird start and session restore after reboot [FF62+] [WINDOWS] + * [1] https://bugzilla.mozilla.org/603903 ***/ +user_pref("toolkit.winRegisterApplicationRestart", false); +/* 1006: disable favicons in shortcuts [WINDOWS] + * URL shortcuts use a cached randomly named .ico file which is stored in your + * profile/shortcutCache directory. The .ico remains after the shortcut is deleted + * If set to false then the shortcuts use a generic Firefox icon ***/ +user_pref("browser.shell.shortcutFavicons", false); /* 1901: disable disk cache for messages not in offline store */ user_pref("mail.imap.use_disk_cache2", false); @@ -416,7 +439,7 @@ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); * but the problem is that the browser can't know that. Setting this pref to true is the only way for the * browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server * [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site? - * [STATS] SSL Labs (Feb 2023) reports over 99.3% of top sites have secure renegotiation [4] + * [STATS] SSL Labs (May 2024) reports over 99.7% of top sites have secure renegotiation [4] * [1] https://wiki.mozilla.org/Security:Renegotiation * [2] https://datatracker.ietf.org/doc/html/rfc5746 * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 @@ -453,12 +476,6 @@ user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] user_pref("security.OCSP.require", true); /** CERTS / HPKP (HTTP Public Key Pinning) ***/ -/* 1221: disable Windows 8.1's Microsoft Family Safety cert [FF50+] [WINDOWS] - * 0=disable detecting Family Safety mode and importing the root - * 1=only attempt to detect Family Safety mode (don't import the root) - * 2=detect Family Safety mode and import the root - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 ***/ -user_pref("security.family_safety.mode", 0); /* 1223: enable strict PKP (Public Key Pinning) * 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE @@ -468,7 +485,7 @@ user_pref("security.cert_pinning.enforcement_level", 2); * 0 = disabled * 1 = consult CRLite but only collect telemetry * 2 = consult CRLite and enforce both "Revoked" and "Not Revoked" results - * 3 = consult CRLite and enforce "Not Revoked" results, but defer to OCSP for "Revoked" (FF99+, default FF100+) + * 3 = consult CRLite and enforce "Not Revoked" results, but defer to OCSP for "Revoked" (default) * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985,1753071 * [2] https://blog.mozilla.org/security/tag/crlite/ ***/ user_pref("security.remote_settings.crlite_filters.enabled", true); @@ -481,7 +498,7 @@ user_pref("security.pki.crlite_mode", 2); /** MIXED CONTENT ***/ /* 1241: disable insecure passive content (such as images) on https pages ***/ user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244) -/* 1244: enable HTTPS-Only mode in all windows [FF76+] +/* 1244: enable HTTPS-Only mode in all windows * When the top-level is HTTPS, insecure subresources are also upgraded (silent fail) * [TEST] http://example.com [upgrade] * [TEST] http://httpforever.com/ | http://http.rip [no upgrade] ***/ @@ -512,18 +529,6 @@ user_pref("security.warn_entering_weak", true); user_pref("security.warn_leaving_secure", true); user_pref("security.warn_viewing_mixed", true); -/*** [SECTION 1400]: FONTS ***/ -user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!"); -/* 1402: limit font visibility (Windows, Mac, some Linux) [FF94+] - * Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts [1], bundled fonts are auto-allowed - * In normal windows: uses the first applicable: RFP (4506) over TP over Standard - * In Private Browsing windows: uses the most restrictive between normal and private - * 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts - * [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc ***/ - // user_pref("layout.css.font-visibility.private", 1); - // user_pref("layout.css.font-visibility.standard", 1); - // user_pref("layout.css.font-visibility.trackingprotection", 1); - /*** [SECTION 1600]: REFERERS full URI: https://example.com:8888/foo/bar.html?id=1234 scheme+host+port+path: https://example.com:8888/foo/bar.html @@ -541,6 +546,12 @@ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); * https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/ user_pref("privacy.userContext.enabled", true); user_pref("privacy.userContext.ui.enabled", true); +/* 1703: set external links to open in site-specific containers [FF123+] + * [SETUP-WEB] Depending on your container extension(s) and their settings + * true=Firefox will not choose a container (so your extension can) + * false=Firefox will choose the container/no-container (default) + * [1] https://bugzilla.mozilla.org/1874599 ***/ + // user_pref("browser.link.force_default_user_context_id_for_external_opens", true); /*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); @@ -548,7 +559,7 @@ user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); /* 2003: force a single network interface for ICE candidates generation [FF42+] * When using a system-wide proxy, it uses the proxy interface - * [1] https://developer.mozilla.org/en-US/docs/Web/API/RTCIceCandidate + * [1] https://developer.mozilla.org/docs/Web/API/RTCIceCandidate * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/ user_pref("media.peerconnection.ice.default_address_only", true); /* 2004: force exclusion of private IPs from ICE candidates [FF51+] @@ -566,12 +577,9 @@ user_pref("dom.disable_window_move_resize", true); /*** [SECTION 2600]: MISCELLANEOUS ***/ user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); -/* 2601: prevent accessibility services from accessing your browser [RESTART] - * [1] https://support.mozilla.org/kb/accessibility-services ***/ -user_pref("accessibility.force_disabled", 1); -/* 2603: remove temp files opened with an external application - * [1] https://bugzilla.mozilla.org/302433 ***/ -user_pref("browser.helperApps.deleteTempFileOnExit", true); +/* 2603: remove temp files opened from non-PB windows with an external application + * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=302433,1738574 ***/ +user_pref("browser.download.start_downloads_in_tmp_dir", true); // [FF102+] /* 2606: disable UITour backend so there is no chance that a remote page can use it ***/ user_pref("browser.uitour.enabled", false); user_pref("browser.uitour.url", ""); // Defense-in-depth @@ -603,14 +611,15 @@ user_pref("network.IDN_show_punycode", true); * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/ user_pref("pdfjs.disabled", false); // [DEFAULT: false] user_pref("pdfjs.enableScripting", false); // [FF86+] -/* 2623: disable permissions delegation [FF73+] - * Currently applies to cross-origin geolocation, camera, mic and screen-sharing - * permissions, and fullscreen requests. Disabling delegation means any prompts - * for these will show/use their correct 3rd party origin - * [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion ***/ -user_pref("permissions.delegation.enabled", false); /* 2624: disable middle click on new tab button opening URLs or searches using clipboard [FF115+] */ user_pref("browser.tabs.searchclipboardfor.middleclick", false); // [DEFAULT: false NON-LINUX] +/* 2630: disable content analysis by DLP (Data Loss Prevention) agents + * DLP agents are background processes on managed computers that allow enterprises to monitor locally running + * applications for data exfiltration events, which they can allow/block based on customer defined DLP policies. + * 0=Block all requests, 1=Warn on all requests (which lets the user decide), 2=Allow all requests + * [1] https://github.com/chromium/content_analysis_sdk */ +user_pref("browser.contentanalysis.enabled", false); // [FF121+] [DEFAULT: false] +user_pref("browser.contentanalysis.default_result", 0); // [FF127+] [DEFAULT: 0] /** DOWNLOADS ***/ /* 2651: enable user interaction for security by always asking where to download @@ -622,13 +631,13 @@ user_pref("browser.download.manager.addToRecentDocs", false); user_pref("browser.download.always_ask_before_handling_new_types", true); /** EXTENSIONS ***/ -/* 2660: lock down allowed extension directories - * [SETUP-CHROME] This will break extensions, language packs, themes and any other - * XPI files which are installed outside of profile and application directories - * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ - * [1] https://archive.is/DYjAM (archived) ***/ +/* 2660: limit allowed extension directories + * 1=profile, 2=user, 4=application, 8=system, 16=temporary, 31=all + * The pref value represents the sum: e.g. 5 would be profile and application directories + * [SETUP-CHROME] Breaks usage of files which are installed outside allowed directories + * [1] https://archive.is/DYjAM ***/ user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] -user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] + // user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] /* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ // user_pref("extensions.webextensions.restrictedDomains", ""); @@ -640,86 +649,132 @@ user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin * Opener and redirect heuristics are granted for 30 days, see [3] * [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/ * [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12 - * [3] https://developer.mozilla.org/en-US/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ + * [3] https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ // user_pref("privacy.antitracking.enableWebcompat", false); -/* 2710: enable state partitioning of service workers [FF96+] ***/ -user_pref("privacy.partition.serviceWorkers", true); // [DEFAULT: true FF105+] -/* 2720: enable APS (Always Partitioning Storage) ***/ -user_pref("privacy.partition.always_partition_third_party_non_cookie_storage", true); // [FF104+] [DEFAULT: true FF109+] -user_pref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", false); // [FF105+] [DEFAULT: false FF109+] /*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); -/* 2810: enable Thunderbird to clear items on shutdown ***/ +/* 2810: enable Thunderbird to clear items on shutdown + * [NOTE] In FF129+ clearing "siteSettings" on shutdown (2811), or manually via site data (2820) and + * via history (2830), will no longer remove sanitize on shutdown "cookie and site data" site exceptions (2815) ***/ user_pref("privacy.sanitize.sanitizeOnShutdown", true); -/** SANITIZE ON SHUTDOWN: IGNORES "ALLOW" SITE EXCEPTIONS ***/ +/** SANITIZE ON SHUTDOWN: IGNORES "ALLOW" SITE EXCEPTIONS | v2 migration is FF128+ ***/ /* 2811: set/enforce what items to clear on shutdown (if 2810 is true) [SETUP-CHROME] - * [NOTE] If "history" is true, downloads will also be cleared - * [NOTE] "sessions": Active Logins: refers to HTTP Basic Authentication [1], not logins via cookies - * [1] https://en.wikipedia.org/wiki/Basic_access_authentication ***/ + * [NOTE] If "history" is true, downloads will also be cleared ***/ user_pref("privacy.clearOnShutdown.cache", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown_v2.cache", true); // [FF128+] [DEFAULT: true] user_pref("privacy.clearOnShutdown.downloads", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.formdata", true); // [DEFAULT: true] user_pref("privacy.clearOnShutdown.history", true); // [DEFAULT: true] -user_pref("privacy.clearOnShutdown.sessions", true); // [DEFAULT: true] +user_pref("privacy.clearOnShutdown_v2.historyFormDataAndDownloads", true); // [FF128+] [DEFAULT: true] // user_pref("privacy.clearOnShutdown.siteSettings", false); // [DEFAULT: false] + // user_pref("privacy.clearOnShutdown_v2.siteSettings", false); // [FF128+] [DEFAULT: false] /* 2812: set Session Restore to clear on shutdown (if 2810 is true) [FF34+] * [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811) * [NOTE] If true, this prevents resuming from crashes (also see 5008) ***/ // user_pref("privacy.clearOnShutdown.openWindows", true); -/** SANITIZE ON SHUTDOWN: RESPECTS "ALLOW" SITE EXCEPTIONS FF103+ ***/ +/** SANITIZE ON SHUTDOWN: RESPECTS "ALLOW" SITE EXCEPTIONS FF103+ | v2 migration is FF128+ ***/ /* 2815: set "Cookies" and "Site Data" to clear on shutdown (if 2810 is true) [SETUP-CHROME] - * [NOTE] Exceptions: A "cookie" block permission also controls "offlineApps" (see note below). - * serviceWorkers require an "Allow" permission. For cross-domain logins, add exceptions for - * both sites e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on) + * [NOTE] Exceptions: A "cookie" permission also controls "offlineApps" (see note below). For cross-domain logins, + * add exceptions for both sites e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on) * [NOTE] "offlineApps": Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache) + * [NOTE] "sessions": Active Logins (has no site exceptions): refers to HTTP Basic Authentication [1], not logins via cookies * [WARNING] Be selective with what sites you "Allow", as they also disable partitioning (1767271) * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow (when on the website in question) - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ + * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings + * [1] https://en.wikipedia.org/wiki/Basic_access_authentication ***/ user_pref("privacy.clearOnShutdown.cookies", true); // Cookies user_pref("privacy.clearOnShutdown.offlineApps", true); // Site Data +user_pref("privacy.clearOnShutdown.sessions", true); // Active Logins [DEFAULT: true] +user_pref("privacy.clearOnShutdown_v2.cookiesAndStorage", true); // Cookies, Site Data, Active Logins [FF128+] -/** SANITIZE MANUAL: IGNORES "ALLOW" SITE EXCEPTIONS ***/ -/* 2820: reset default items to clear with Ctrl-Shift-Del [SETUP-CHROME] - * This dialog can also be accessed from the menu History>Clear Recent History +/** SANITIZE SITE DATA: IGNORES "ALLOW" SITE EXCEPTIONS ***/ +/* 2820: set manual "Clear Data" items [SETUP-CHROME] [FF128+] + * Thunderbird remembers your last choices. This will reset them when you start Thunderbird + * [SETTING] Privacy & Security>Browser Privacy>Cookies and Site Data>Clear Data ***/ +user_pref("privacy.clearSiteData.cache", true); +user_pref("privacy.clearSiteData.cookiesAndStorage", false); // keep false until it respects "allow" site exceptions +user_pref("privacy.clearSiteData.historyFormDataAndDownloads", true); + // user_pref("privacy.clearSiteData.siteSettings", false); + +/** SANITIZE HISTORY: IGNORES "ALLOW" SITE EXCEPTIONS | clearHistory migration is FF128+ ***/ +/* 2830: set manual "Clear History" items, also via Ctrl-Shift-Del [SETUP-CHROME] * Thunderbird remembers your last choices. This will reset them when you start Thunderbird * [NOTE] Regardless of what you set "downloads" to, as soon as the dialog * for "Clear Recent History" is opened, it is synced to the same as "history" ***/ user_pref("privacy.cpd.cache", true); // [DEFAULT: true] +user_pref("privacy.clearHistory.cache", true); user_pref("privacy.cpd.formdata", true); // [DEFAULT: true] user_pref("privacy.cpd.history", true); // [DEFAULT: true] + // user_pref("privacy.cpd.downloads", true); // not used, see note above +user_pref("privacy.clearHistory.historyFormDataAndDownloads", true); +user_pref("privacy.cpd.cookies", false); user_pref("privacy.cpd.sessions", true); // [DEFAULT: true] user_pref("privacy.cpd.offlineApps", true); // [DEFAULT: false] -user_pref("privacy.cpd.cookies", true); - // user_pref("privacy.cpd.downloads", true); // not used, see note above +user_pref("privacy.clearHistory.cookiesAndStorage", false); // user_pref("privacy.cpd.openWindows", false); // Session Restore // user_pref("privacy.cpd.passwords", false); // user_pref("privacy.cpd.siteSettings", false); -/* 2822: reset default "Time range to clear" for "Clear Recent History" (2820) + // user_pref("privacy.clearHistory.siteSettings", false); + +/** SANITIZE MANUAL: TIMERANGE ***/ +/* 2840: set "Time range to clear" for "Clear Data" (2820) and "Clear History" (2830) * Thunderbird remembers your last choice. This will reset the value when you start Thunderbird * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today * [NOTE] Values 5 (last 5 minutes) and 6 (last 24 hours) are not listed in the dropdown, * which will display a blank value, and are not guaranteed to work ***/ user_pref("privacy.sanitize.timeSpan", 0); -/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING) - RFP covers a wide range of ongoing fingerprinting solutions. - It is an all-or-nothing buy in: you cannot pick and choose what parts you want +/*** [SECTION 4000]: FPP (fingerprintingProtection) + RFP (4501) overrides FPP + In FF118+ FPP is on by default in private windows (4001) and in FF119+ is controlled + by ETP (2701). FPP will also use Remote Services in future to relax FPP protections + on a per site basis for compatibility (4004). + https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargetsDefault.inc + + 1826408 - restrict fonts to system (kBaseFonts + kLangPackFonts) (Windows, Mac, some Linux) + https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc + 1858181 - subtly randomize canvas per eTLD+1, per session and per window-mode (FF120+) +***/ +user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!"); +/* 4001: enable FPP in PB mode [FF114+] + * [NOTE] In FF119+, FPP for all modes (7016) is enabled with ETP Strict (2701) ***/ + // user_pref("privacy.fingerprintingProtection.pbmode", true); // [DEFAULT: true FF118+] +/* 4002: set global FPP overrides [FF114+] + * uses "RFPTargets" [1] which despite the name these are not used by RFP + * e.g. "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC" = all targets but allow prefers-color-scheme and do not change timezone + * e.g. "-AllTargets,+CanvasRandomization,+JSDateTimeUTC" = no targets but do use FPP canvas and change timezone + * [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults + * [WARNING] Not recommended. Either use RFP or FPP at defaults + * [1] https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargets.inc ***/ + // user_pref("privacy.fingerprintingProtection.overrides", ""); +/* 4003: set granular FPP overrides + * JSON format: e.g."[{\"firstPartyDomain\": \"netflix.com\", \"overrides\": \"-CanvasRandomization,-FrameRate,\"}]" + * [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults ***/ + // user_pref("privacy.fingerprintingProtection.granularOverrides", ""); +/* 4004: disable remote FPP overrides [FF127+] ***/ + // user_pref("privacy.fingerprintingProtection.remoteOverrides.enabled", false); + +/*** [SECTION 4500]: OPTIONAL RFP (resistFingerprinting) + RFP overrides FPP (4000) + + FF128+ Arkenfox by default uses FPP (automatically enabled with ETP Strict). For most people + this is all you need. To use RFP instead, add RFP (4501) to your overrides, and optionally + add letterboxing (4504), spoof_english (4506), and webgl (4520). + RFP is an all-or-nothing buy in: you cannot pick and choose what parts you want [TEST] https://arkenfox.github.io/TZP/tzp.html [WARNING] DO NOT USE extensions to alter RFP protected metrics 418986 - limit window.screen & CSS media queries (FF41) 1281949 - spoof screen orientation (FF50) - 1330890 - spoof timezone as UTC0 (FF55) 1360039 - spoof navigator.hardwareConcurrency as 2 (FF55) 1217238 - reduce precision of time exposed by javascript (FF55) FF56 - 1369303 - spoof/disable performance API 1333651 - spoof User Agent & Navigator API - version: android version spoofed as ESR + version: android version spoofed as ESR (FF119 or lower) OS: JS spoofed as Windows 10, OS 10.15, Android 10, or Linux | HTTP Headers spoofed as Windows or Android 1369319 - disable device sensor API 1369357 - disable site specific zoom @@ -730,13 +785,12 @@ user_pref("privacy.sanitize.timeSpan", 0); 1369309 - spoof media statistics 1382499 - reduce screen co-ordinate fingerprinting in Touch API 1217290 & 1409677 - enable some fingerprinting resistance for WebGL - 1382545 - reduce fingerprinting in Animation API 1354633 - limit MediaError.message to a whitelist FF58+ 1372073 - spoof/block fingerprinting in MediaDevices API (FF59) Spoof: enumerate devices as one "Internal Camera" and one "Internal Microphone" Block: suppresses the ondevicechange event - 1039069 - warn when language prefs are not set to "en*" (also see 0210, 0211) (FF59) + 1039069 - warn when language prefs are not set to "en*" (FF59) 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59) Spoofing mimics the content language of the document. Currently it only supports en-US. Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected. @@ -755,20 +809,22 @@ user_pref("privacy.sanitize.timeSpan", 0); 1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80) 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82) 531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1) - 1756280 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF100) + 1756280 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF100-115) 1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms) (FF102) 1422237 - return "srgb" with color-gamut (FF110) 1794628 - return "none" with inverted-colors (FF114) + 1554751 - return devicePixelRatio as 2 (previously FF41+ was 1) (FF127) + 1787790 - normalize system fonts (FF128) + 1835987 - spoof timezone as Atlantic/Reykjavik (previously FF55+ was UTC) (FF128) ***/ user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); -/* 4501: enable privacy.resistFingerprinting - * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a site exception via the urlbar - * RFP also has a few side effects: mainly timezone is UTC0, and websites will prefer light theme +/* 4501: enable RFP * [NOTE] pbmode applies if true and the original pref is false - * [1] https://bugzilla.mozilla.org/418986 ***/ -user_pref("privacy.resistFingerprinting", true); // [FF41+] + * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a canvas site exception via the urlbar. + * RFP also has a few side effects: mainly that timezone is GMT, and websites will prefer light theme ***/ + // user_pref("privacy.resistFingerprinting", true); // [FF41+] // user_pref("privacy.resistFingerprinting.pbmode", true); // [FF114+] -/* 4502: set new window size rounding max values [FF55+] +/* 4502: set RFP new window size max rounded values [FF55+] * [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen * [1] https://bugzilla.mozilla.org/1330882 ***/ user_pref("privacy.window.maxInnerWidth", 1600); @@ -776,8 +832,8 @@ user_pref("privacy.window.maxInnerHeight", 900); /* 4503: disable mozAddonManager Web API [FF57+] * [NOTE] To allow extensions to work on AMO, you also need 2662 and 4505 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ -user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF FF57-108] -/* 4504: enable RFP letterboxing [FF67+] +user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); +/* 4504: enable letterboxing [FF67+] * Dynamically resizes the inner window by applying margins in stepped ranges [2] * If you use the dimension pref, then it will only apply those resolutions. * The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000") @@ -786,24 +842,19 @@ user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDE * [WARNING] DO NOT USE: the dimension pref is only meant for testing * [1] https://bugzilla.mozilla.org/1407366 * [2] https://hg.mozilla.org/mozilla-central/rev/6d2d7856e468#l2.32 ***/ -user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] + // user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF] -/* 4505: experimental RFP [FF91+] - * List of domains exempted from RFP (comma-separated). - * [WARNING] DO NOT USE unless testing, see [1] comment 12 - * [1] https://bugzilla.mozilla.org/1635603 ***/ +/* 4505: disable RFP by domain (comma-separated) [FF91+] ***/ // user_pref("privacy.resistFingerprinting.exemptedDomains", "addons.thunderbird.net"); -/* 4506: set RFP's font visibility level (1402) [FF94+] ***/ - // user_pref("layout.css.font-visibility.resistFingerprinting", 1); // [DEFAULT: 1] +/* 4506: disable RFP spoof english prompt [FF59+] + * 0=prompt, 1=disabled, 2=enabled + * [NOTE] When changing from value 2, preferred languages ('intl.accept_languages') is not reset. + * [SETUP-WEB] when enabled, sets 'en-US, en' for displaying pages and 'en-US' as locale. + * [SETTING] General>Language>Choose your preferred language for displaying pages>Choose>Request English... ***/ +user_pref("privacy.spoof_english", 1); /* 4510: disable using system colors * [SETTING] General > Language and Appearance > Fonts and Colors > Colors... > Use system colors ***/ user_pref("browser.display.use_system_colors", false); // [DEFAULT: false NON-WINDOWS] -/* 4511: enforce non-native widget theme - * Security: removes/reduces system API calls, e.g. win32k API [1] - * Fingerprinting: provides a uniform look and feel across platforms [2] - * [1] https://bugzilla.mozilla.org/1381938 - * [2] https://bugzilla.mozilla.org/1411425 ***/ -user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true] /* 4512: enforce links targeting new windows to open in a new tab instead * 1=most recent window or tab, 2=new window, 3=new tab * Stops malicious window sizes and some screen resolution leaks. @@ -818,8 +869,7 @@ user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3] * [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js * [2] https://searchfox.org/comm-esr102/source/mail/app/profile/all-thunderbird.js#730 ***/ user_pref("browser.link.open_newwindow.restriction", 0); -/* 4520: disable WebGL (Web Graphics Library) - * [SETUP-WEB] If you need it then override it. RFP still randomizes canvas for naive scripts ***/ +/* 4520: disable WebGL (Web Graphics Library) ***/ user_pref("webgl.disabled", true); /*** [SECTION 5000]: OPTIONAL OPSEC @@ -866,6 +916,26 @@ user_pref("browser.sessionstore.max_tabs_undo", 0); * Application data isolation [1] * [1] https://bugzilla.mozilla.org/1281959 ***/ // user_pref("browser.download.forbid_open_with", true); +/* 5010: disable location bar suggestion types ***/ +user_pref("browser.urlbar.suggest.history", false); +user_pref("browser.urlbar.suggest.bookmark", false); +user_pref("browser.urlbar.suggest.openpage", false); +user_pref("browser.urlbar.suggest.topsites", false); // [FF78+] +/* 5011: disable location bar dropdown + * This value controls the total number of entries to appear in the location bar dropdown ***/ +user_pref("browser.urlbar.maxRichResults", 0); +/* 5012: disable location bar autofill + * [1] https://support.mozilla.org/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/ +user_pref("browser.urlbar.autoFill", false); +/* 5013: disable browsing and download history + * [NOTE] We also clear history and downloads on exit (2811) + * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/ +user_pref("places.history.enabled", false); +/* 5014: disable Windows jumplist [WINDOWS] ***/ +user_pref("browser.taskbar.lists.enabled", false); +user_pref("browser.taskbar.lists.frequent.enabled", false); +user_pref("browser.taskbar.lists.recent.enabled", false); +user_pref("browser.taskbar.lists.tasks.enabled", false); /* 5013: disable browsing and download history * [NOTE] We also clear history and downloads on exit (2811) ***/ user_pref("places.history.enabled", false); @@ -876,8 +946,8 @@ user_pref("places.history.enabled", false); * If .supportedCountries includes your region (browser.search.region) and .supported * is "detect" (default), then the UI will show. Stored data is not secure, uses JSON * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ - user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] - user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] +user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] +user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] /* 5018: limit events that can cause a pop-up ***/ user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); /* 5019: disable page thumbnail collection ***/ @@ -911,7 +981,7 @@ user_pref("gfx.font_rendering.graphite.enabled", false); * [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js * [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ user_pref("javascript.options.asmjs", false); -/* 5505: disable Ion and baseline JIT to harden against JS exploits +/* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART] * [NOTE] When both Ion and JIT are disabled, and trustedprincipals * is enabled, then Ion can still be used by extensions (1599226) * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit @@ -923,7 +993,7 @@ user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN * Vulnerabilities [1] have increasingly been found, including those known and fixed * in native programs years ago [2]. WASM has powerful low-level access, making * certain attacks (brute-force) and vulnerabilities more possible - * [STATS] ~0.2% of websites, about half of which are for crytomining / malvertising [2][3] + * [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3] * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ @@ -939,8 +1009,8 @@ user_pref("browser.eme.ui.enabled", false); /* 5509: disable IPv6 if using a VPN * This is an application level fallback. Disabling IPv6 is best done at an OS/network * level, and/or configured properly in system wide VPN setups. - * If you see PR_CONNECT_RESET_ERROR, this pref *might* be the cause * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" + * [SETUP-WEB] PR_CONNECT_RESET_ERROR * [TEST] https://ipleak.org/ * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/ // user_pref("network.dns.disableIPv6", true); @@ -948,6 +1018,11 @@ user_pref("browser.eme.ui.enabled", false); * 0=always (default), 1=only if base domains match, 2=only if hosts match * [NOTE] Will cause breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram ***/ user_pref("network.http.referer.XOriginPolicy", 2); +/* 5511: set DoH bootstrap address [FF89+] + * Thunderbird uses the system DNS to initially resolve the IP address of your DoH server. + * When set to a valid, working value that matches your "network.trr.uri" (0712) Thunderbird + * won't use the system DNS. If the IP doesn't match then DoH won't work ***/ + // user_pref("network.trr.bootstrapAddr", "10.0.0.1"); // [HIDDEN PREF] /* 5590: show a prompt when opening a link in external applications ***/ user_pref("security.external_protocol_requires_permission", true); @@ -967,10 +1042,10 @@ user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), and enabling FPI * disables those. FPI is no longer maintained except at Tor Project for Tor Browser's config ***/ user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false] -/* 6009: enforce SmartBlock shims [FF81+] +/* 6009: enforce SmartBlock shims (about:compat) [FF81+] * In FF96+ these are listed in about:compat * [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/ -user_pref("extensions.webcompat.enable_shims", true); // [DEFAULT: true] +user_pref("extensions.webcompat.enable_shims", true); // [HIDDEN PREF] [DEFAULT: true] /* 6010: enforce no TLS 1.0/1.1 downgrades * [TEST] https://tls-v1-1.badssl.com:1010/ ***/ user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false] @@ -981,21 +1056,16 @@ user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] /* 6012: enforce Quarantined Domains [FF115+] * [WHY] https://support.mozilla.org/kb/quarantined-domains */ user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true] -/* 6050: prefsCleaner: reset previously active items removed from arkenfox FF102+ ***/ - // user_pref("beacon.enabled", ""); - // user_pref("browser.region.network.url", ""); - // user_pref("browser.region.update.enabled", ""); - // user_pref("browser.ssl_override_behavior", ""); - // user_pref("devtools.chrome.enabled", ""); - // user_pref("dom.disable_beforeunload", ""); - // user_pref("dom.disable_open_during_load", ""); - // user_pref("extensions.formautofill.available", ""); - // user_pref("extensions.formautofill.addresses.supported", ""); - // user_pref("extensions.formautofill.creditCards.available", ""); - // user_pref("extensions.formautofill.creditCards.supported", ""); - // user_pref("middlemouse.contentLoadURL", ""); -/* 6051: prefsCleaner: reset previously active items removed from arkenfox FF115+ ***/ +/* 6050: prefsCleaner: previously active items removed from arkenfox 115-127 ***/ + // user_pref("accessibility.force_disabled", ""); + // user_pref("browser.urlbar.dnsResolveSingleWordsAfterSearch", ""); + // user_pref("geo.provider.network.url", ""); + // user_pref("geo.provider.network.logging.enabled", ""); + // user_pref("geo.provider.use_gpsd", ""); // user_pref("network.protocol-handler.external.ms-windows-store", ""); + // user_pref("privacy.partition.always_partition_third_party_non_cookie_storage", ""); + // user_pref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", ""); + // user_pref("privacy.partition.serviceWorkers", ""); /*** [SECTION 7000]: DON'T BOTHER Thunderbird-User.JS maintainer here : @@ -1012,8 +1082,8 @@ user_pref("full-screen-api.enabled", false); /* 7003: disable non-modern cipher suites [1] * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks * [1] https://browserleaks.com/ssl ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // [DEFAULT: false FF109+] - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT: false FF109+] + // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS @@ -1065,12 +1135,14 @@ user_pref("dom.event.clipboardevents.enabled", false); * [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/ // user_pref("privacy.donottrackheader.enabled", true); /* 7016: customize ETP settings + * [NOTE] FPP (fingerprintingProtection) is ignored when RFP (4501) is enabled * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ - // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5 FF103+] + // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5] + // user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+] // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] - // user_pref("privacy.partition.network_state.ocsp_cache", true); - // user_pref("privacy.query_stripping.enabled", true); // [FF101+] [ETP FF102+] + // user_pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT: true FF123+] + // user_pref("privacy.query_stripping.enabled", true); // [FF101+] // user_pref("privacy.trackingprotection.enabled", true); // user_pref("privacy.trackingprotection.socialtracking.enabled", true); // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] @@ -1078,13 +1150,12 @@ user_pref("dom.event.clipboardevents.enabled", false); /* 7017: disable service workers * [WHY] Already isolated with TCP (2701) behind a pref (2710) ***/ // user_pref("dom.serviceWorkers.enabled", false); -/* 7018: disable Web Notifications +/* 7018: disable Web Notifications [FF22+] * [WHY] Web Notifications are behind a prompt (7002) * [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ ***/ - // user_pref("dom.webnotifications.enabled", false); // [FF22+] - // user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+] + // user_pref("dom.webnotifications.enabled", false); /* 7019: disable Push Notifications [FF44+] - * [WHY] Push requires subscription + * [WHY] Website "push" requires subscription, and the API is required for CRLite (1224) * [NOTE] To remove all subscriptions, reset "dom.push.userAgentID" * [1] https://support.mozilla.org/kb/push-notifications-firefox ***/ // user_pref("dom.push.enabled", false); @@ -1095,6 +1166,10 @@ user_pref("dom.event.clipboardevents.enabled", false); * [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ * [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 ***/ user_pref("media.peerconnection.enabled", false); +/* 7021: enable GPC (Global Privacy Control) in non-PB windows + * [WHY] Passive and active fingerprinting. Mostly redundant with Tracking Protection + * in ETP Strict (2701) and sanitizing on close (2800s) ***/ + // user_pref("privacy.globalprivacycontrol.enabled", true); /*** [SECTION 8000]: DON'T BOTHER: FINGERPRINTING [WHY] They are insufficient to help anti-fingerprinting and do more harm than good @@ -1129,7 +1204,10 @@ user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan /*** [SECTION 9000]: NON-PROJECT RELATED ***/ user_pref("_user.js.parrot", "9000 syntax error: the parrot's cashed in 'is chips!"); /* 9001: disable welcome notices ***/ -user_pref("browser.startup.homepage_override.mstone", "ignore"); +user_pref("browser.startup.homepage_override.mstone", "ignore"); // [HIDDEN PREF] +/* 9002: disable extensions/features recommendations as you browse [FF67+] ***/ +user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false); +user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false); /* 9090: disable return receipt sending unconditionally ***/ // user_pref("mail.mdn.report.enabled", false); /* 9099: e-mail custom headers (examples) ***/ @@ -1268,6 +1346,8 @@ user_pref("mail.sanitize_date_header", true); /* 9210: Check spelling before sending * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=667133 ***/ // user_pref("mail.SpellCheckBeforeSend", false); +/* 9211: Set dictionary to US ***/ +user_pref("spellchecker.dictionary", "en-US"); /* 9212: Compose email in plaintext unless expressly overridden * Sometimes HTML is useful especially when used with Markdown Here * [SETTING] Account Settings > Composition & Addressing > Composition > Compose messages in HTML format @@ -1455,39 +1535,71 @@ user_pref("_user.js.parrot", "9400 syntax error: this parrot is talking in codes * [1] https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards#Allow_the_use_of_external_GnuPG ***/ user_pref("mail.openpgp.allow_external_gnupg", true); // [HIDDEN PREF] -/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED - Documentation denoted as [-]. Items deprecated prior to FF91 have been archived at [1] - [1] https://github.com/arkenfox/user.js/issues/123 -***/ +/*** [SECTION 9999]: DEPRECATED / RENAMED ***/ user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); -/* ESR102.x still uses all the following prefs +/* ESR115.x still uses all the following prefs // [NOTE] replace the * with a slash in the line above to re-enable active ones -// FF103 -// 2801: delete cookies and site data on exit - replaced by sanitizeOnShutdown* (2810) - // 0=keep until they expire (default), 2=keep until you close Thunderbird - // [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1681493,1681495,1681498,1759665,1764761 -user_pref("network.cookie.lifetimePolicy", 2); -// 6012: disable SHA-1 certificates - // [-] https://bugzilla.mozilla.org/1766687 - // user_pref("security.pki.sha1_enforcement_level", 1); // [DEFAULT: 1] -// FF114 -// 2816: set cache to clear on exit [FF96+] - // [NOTE] We already disable disk cache (1001) and clear on exit (2811) which is more robust - // [1] https://bugzilla.mozilla.org/1671182 - // [-] https://bugzilla.mozilla.org/1821651 - // user_pref("privacy.clearsitedata.cache.enabled", true); -// 4505: experimental RFP [FF91+] - // [-] https://bugzilla.mozilla.org/1824235 - // user_pref("privacy.resistFingerprinting.testGranularityMask", 0); -// 5017: disable Form Autofill heuristics - // Heuristics controls Form Autofill on forms without @autocomplete attributes - // [-] https://bugzilla.mozilla.org/1829670 - // user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+] -// FF115 - // 7001: disable offline cache (appCache) - // [NOTE] appCache storage capability was removed in FF90 - // [-] https://bugzilla.mozilla.org/1677718 - // user_pref("browser.cache.offline.enable", false); +// FF116 +// 4506: set RFP's font visibility level (1402) [FF94+] + // [-] https://bugzilla.mozilla.org/1838415 + // user_pref("layout.css.font-visibility.resistFingerprinting", 1); // [DEFAULT: 1] +// FF117 +// 1221: disable Windows Microsoft Family Safety cert [FF50+] [WINDOWS] + // 0=disable detecting Family Safety mode and importing the root + // 1=only attempt to detect Family Safety mode (don't import the root) + // 2=detect Family Safety mode and import the root + // [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21686 + // [-] https://bugzilla.mozilla.org/1844908 +user_pref("security.family_safety.mode", 0); +// 7018: disable service worker Web Notifications [FF44+] + // [WHY] Web Notifications are behind a prompt (7002) + // [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ + // [-] https://bugzilla.mozilla.org/1842457 + // user_pref("dom.webnotifications.serviceworker.enabled", false); +// FF118 +// 1402: limit font visibility (Windows, Mac, some Linux) [FF94+] + // Uses hardcoded lists with two parts: kBaseFonts + kLangPackFonts [1], bundled fonts are auto-allowed + // In normal windows: uses the first applicable: RFP over TP over Standard + // In Private Browsing windows: uses the most restrictive between normal and private + // 1=only base system fonts, 2=also fonts from optional language packs, 3=also user-installed fonts + // [1] https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc + // [-] https://bugzilla.mozilla.org/1847599 + // user_pref("layout.css.font-visibility.private", 1); + // user_pref("layout.css.font-visibility.standard", 1); + // user_pref("layout.css.font-visibility.trackingprotection", 1); +// 2623: disable permissions delegation [FF73+] + // Currently applies to cross-origin geolocation, camera, mic and screen-sharing + // permissions, and fullscreen requests. Disabling delegation means any prompts + // for these will show/use their correct 3rd party origin + // [1] https://groups.google.com/forum/#!topic/mozilla.dev.platform/BdFOMAuCGW8/discussion + // [-] https://bugzilla.mozilla.org/1697151 + // user_pref("permissions.delegation.enabled", false); +// FF119 +// 0211: use en-US locale regardless of the system or region locale + // [SETUP-WEB] May break some input methods e.g xim/ibus for CJK languages [1] + // [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=867501,1629630 + // [-] https://bugzilla.mozilla.org/1846224 + // user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF] +// FF123 +// 0334: disable PingCentre telemetry (used in several System Add-ons) [FF57+] + // Defense-in-depth: currently covered by 0331 + // [-] https://bugzilla.mozilla.org/1868988 +user_pref("browser.ping-centre.telemetry", false); +// FF126 +// 9003: disable What's New toolbar icon [FF69+] + // [-] https://bugzilla.mozilla.org/1724300 +user_pref("browser.messaging-system.whatsNewPanel.enabled", false); +// FF127 + // 2630: disable content analysis by DLP (Data Loss Prevention) agents - replaced by default_result + // [-] https://bugzilla.mozilla.org/1880314 +user_pref("browser.contentanalysis.default_allow", false); +// 4511: enforce non-native widget theme + // Security: removes/reduces system API calls, e.g. win32k API [1] + // Fingerprinting: provides a uniform look and feel across platforms [2] + // [1] https://bugzilla.mozilla.org/1381938 + // [2] https://bugzilla.mozilla.org/1411425 + // [-] https://bugzilla.mozilla.org/1848899 +user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true] // ***/ /* END: internal custom pref to test for syntax errors ***/ From 6183dda54a15677a2cb97ffe971e6a7d88d2a6e3 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 31 Aug 2024 16:03:00 +0200 Subject: [PATCH 140/147] Vendors Arkenfox updater/prefsCleaner scripts Also see related : arkenfox/user.js#910 > closes #1, #10, #29, #35 and #41 --- prefsCleaner.bat | 134 ++++++++++++++++ prefsCleaner.sh | 186 +++++++++++++++++++++ updater.bat | 324 +++++++++++++++++++++++++++++++++++++ updater.sh | 408 +++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 1052 insertions(+) create mode 100644 prefsCleaner.bat create mode 100755 prefsCleaner.sh create mode 100644 updater.bat create mode 100755 updater.sh diff --git a/prefsCleaner.bat b/prefsCleaner.bat new file mode 100644 index 0000000..06d78b6 --- /dev/null +++ b/prefsCleaner.bat @@ -0,0 +1,134 @@ +@ECHO OFF & SETLOCAL DisableDelayedExpansion +TITLE prefs.js cleaner + +REM ## prefs.js cleaner for Windows +REM ## /!\ This script is a vendored/adapted version of Arkenfox own prefsCleaner.bat /!\ +REM ## author: @claustromaniac +REM ## version: 2.7 + +CD /D "%~dp0" + +IF /I "%~1"=="-unattended" (SET _ua=1) + +:begin +ECHO: +ECHO: +ECHO ######################################## +ECHO #### prefs.js cleaner for Windows #### +ECHO #### by claustromaniac #### +ECHO #### v2.7 #### +ECHO ######################################## +ECHO: +CALL :message "This script should be run from your Thunderbird profile directory." +ECHO It will remove any entries from prefs.js that also exist in user.js. +CALL :message "This will allow inactive preferences to be reset to their default values." +ECHO This Thunderbird profile shouldn't be in use during the process. +CALL :message "" +TIMEOUT 1 /nobreak >nul + +IF NOT DEFINED _ua ( + CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" + CLS + IF ERRORLEVEL 3 (EXIT /B) + IF ERRORLEVEL 2 (GOTO :showhelp) +) +IF NOT EXIST "user.js" (CALL :abort "user.js not found in the current directory." 30) +IF NOT EXIST "prefs.js" (CALL :abort "prefs.js not found in the current directory." 30) +CALL :strlenCheck +CALL :FFcheck + +CALL :message "Backing up prefs.js..." +FOR /F "delims=" %%# IN ('powershell get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# +COPY /B /V /Y prefs.js "prefs-backup-%ldt%.js" + +CALL :message "Cleaning prefs.js..." +CALL :cleanup +CALL :message "All done!" +TIMEOUT 5 >nul +ENDLOCAL +EXIT /B + +REM ########## Abort Function ########### +:abort +CALL :message %1 +TIMEOUT %~2 >nul +EXIT +REM ########## Message Function ######### +:message +ECHO: +ECHO: %~1 +ECHO: +GOTO :EOF +REM ### string length Check Function #### +:strlenCheck +SET /a cnt=0 +setlocal ENABLEDELAYEDEXPANSION +FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO ( + ECHO:%%H >nul + SET /a cnt += 1 + IF /I "%%G" NEQ "!cnt!" ( + ECHO: + CALL :message "ERROR: line !cnt! in prefs.js is too long." + (CALL :abort "Aborting ..." 30) + ) +) +endlocal +GOTO :EOF +REM ####### Thunderbird Check Function ###### +:FFcheck +TASKLIST /FI "IMAGENAME eq thunderbird.exe" 2>NUL | FIND /I /N "thunderbird.exe">NUL +IF NOT ERRORLEVEL 1 ( + CLS + CALL :message "Thunderbird is still running." + ECHO If you're not currently using this profile you can continue, otherwise + CALL :message "close Thunderbird first!" + ECHO: + PAUSE + CLS + CALL :message "Resuming..." + TIMEOUT 5 /nobreak >nul +) +GOTO :EOF +REM ######### Cleanup Function ########## +:cleanup +FOR /F tokens^=2^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^[^\"']*user_pref[ ]*\([ ]*[\"'][^\"']*[\"'][ ]*," user.js') DO ( + IF NOT ""=="%%G" (SET "[%%G]=1") +) +( + FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO ( + IF ""=="%%H" ( + ECHO: + ) ELSE ( + FOR /F tokens^=1^,2^ delims^=^"^' %%I IN ("%%H") DO ( + IF NOT DEFINED [%%J] (ECHO:%%H) + ) + ) + ) +)>tempcleanedprefs +MOVE /Y tempcleanedprefs prefs.js +GOTO :EOF +REM ############### Help ################## +:showhelp +MODE 80,34 +CLS +CALL :message "This script creates a backup of your prefs.js file before doing anything." +ECHO It should be safe, but you can follow these steps if something goes wrong: +ECHO: +CALL :message " 1. Make sure Thunderbird is closed." +ECHO 2. Delete prefs.js in your profile folder. +CALL :message " 3. Delete Invalidprefs.js if you have one in the same folder." +ECHO 4. Rename or copy your latest backup to prefs.js. +CALL :message " 5. Run Thunderbird and see if you notice anything wrong with it." +ECHO 6. If you do notice something wrong, especially with your extensions, +CALL :message " and/or with the UI, go to about:support, and restart Thunderbird with" +ECHO add-ons disabled. Then, restart it again normally, and see if the +CALL :message " problems were solved." +ECHO: +CALL :message "If you are able to identify the cause of your issues, please bring it up" +ECHO on thunderbird user.js GitHub repository. +ECHO: +ECHO: +PAUSE +CLS +GOTO :begin +REM ##################################### diff --git a/prefsCleaner.sh b/prefsCleaner.sh new file mode 100755 index 0000000..47e3df3 --- /dev/null +++ b/prefsCleaner.sh @@ -0,0 +1,186 @@ +#!/usr/bin/env bash + +## prefs.js cleaner for Linux/Mac +## /!\ This script is a vendored/adapted version of Arkenfox own prefsCleaner.sh /!\ +## author: @claustromaniac +## version: 2.1 + +## special thanks to @overdodactyl and @earthlng for a few snippets that I stol..*cough* borrowed from the updater.sh + +## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_prefsCleaner() ) + +readonly CURRDIR=$(pwd) + +## get the full path of this script (readlink for Linux, greadlink for Mac with coreutils installed) +SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null) + +## fallback for Macs without coreutils +[ -z "$SCRIPT_FILE" ] && SCRIPT_FILE=${BASH_SOURCE[0]} + + +AUTOUPDATE=true +QUICKSTART=false + +## download method priority: curl -> wget +DOWNLOAD_METHOD='' +if command -v curl >/dev/null; then + DOWNLOAD_METHOD='curl --max-redirs 3 -so' +elif command -v wget >/dev/null; then + DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O' +else + AUTOUPDATE=false + echo -e "No curl or wget detected.\nAutomatic self-update disabled!" +fi + +fQuit() { + ## change directory back to the original working directory + cd "${CURRDIR}" + [ "$1" -eq 0 ] && echo -e "\n$2" || echo -e "\n$2" >&2 + exit $1 +} + +fUsage() { + echo -e "\nUsage: $0 [-ds]" + echo -e " +Optional Arguments: + -s Start immediately + -d Don't auto-update prefsCleaner.sh" +} + +download_file() { # expects URL as argument ($1) + declare -r tf=$(mktemp) + + $DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error +} + +fFF_check() { + # there are many ways to see if thunderbird is running or not, some more reliable than others + # this isn't elegant and might not be future-proof but should at least be compatible with any environment + while [ -e lock ]; do + echo -e "\nThis Thunderbird profile seems to be in use. Close Thunderbird and try again.\n" >&2 + read -r -p "Press any key to continue." + done +} + +## returns the version number of a prefsCleaner.sh file +get_prefsCleaner_version() { + echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")" +} + +## updates the prefsCleaner.sh file based on the latest public version +update_prefsCleaner() { + declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/prefsCleaner.sh')" + [ -z "$tmpfile" ] && echo -e "Error! Could not download prefsCleaner.sh" && return 1 # check if download failed + + [[ $(get_prefsCleaner_version "$SCRIPT_FILE") == $(get_prefsCleaner_version "$tmpfile") ]] && return 0 + + mv "$tmpfile" "$SCRIPT_FILE" + chmod u+x "$SCRIPT_FILE" + "$SCRIPT_FILE" "$@" -d + exit 0 +} + +fClean() { + # the magic happens here + prefs="@@" + prefexp="user_pref[ ]*\([ ]*[\"']([^\"']+)[\"'][ ]*," + while read -r line; do + if [[ "$line" =~ $prefexp && $prefs != *"@@${BASH_REMATCH[1]}@@"* ]]; then + prefs="${prefs}${BASH_REMATCH[1]}@@" + fi + done <<< "$(grep -E "$prefexp" user.js)" + + while IFS='' read -r line || [[ -n "$line" ]]; do + if [[ "$line" =~ ^$prefexp ]]; then + if [[ $prefs != *"@@${BASH_REMATCH[1]}@@"* ]]; then + echo "$line" + fi + else + echo "$line" + fi + done < "$1" > prefs.js +} + +fStart() { + if [ ! -e user.js ]; then + fQuit 1 "user.js not found in the current directory." + elif [ ! -e prefs.js ]; then + fQuit 1 "prefs.js not found in the current directory." + fi + + fFF_check + mkdir -p prefsjs_backups + bakfile="prefsjs_backups/prefs.js.backup.$(date +"%Y-%m-%d_%H%M")" + mv prefs.js "${bakfile}" || fQuit 1 "Operation aborted.\nReason: Could not create backup file $bakfile" + echo -e "\nprefs.js backed up: $bakfile" + echo "Cleaning prefs.js..." + fClean "$bakfile" + fQuit 0 "All done!" +} + + +while getopts "sd" opt; do + case $opt in + s) + QUICKSTART=true + ;; + d) + AUTOUPDATE=false + ;; + esac +done + +## change directory to the Thunderbird profile directory +cd "$(dirname "${SCRIPT_FILE}")" + +# Check if running as root and if any files have the owner as root/wheel. +if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then + fQuit 1 "You shouldn't run this with elevated privileges (such as with doas/sudo)." +elif [ -n "$(find ./ -user 0)" ]; then + printf 'It looks like this script was previously run with elevated privileges, +you will need to change ownership of the following files to your user:\n' + find . -user 0 + fQuit 1 +fi + +[ "$AUTOUPDATE" = true ] && update_prefsCleaner "$@" + +echo -e "\n\n" +echo " ╔══════════════════════════╗" +echo " ║ prefs.js cleaner ║" +echo " ║ by claustromaniac ║" +echo " ║ v2.1 ║" +echo " ╚══════════════════════════╝" +echo -e "\nThis script should be run from your Thunderbird profile directory.\n" +echo "It will remove any entries from prefs.js that also exist in user.js." +echo "This will allow inactive preferences to be reset to their default values." +echo -e "\nThis Thunderbird profile shouldn't be in use during the process.\n" + +[ "$QUICKSTART" = true ] && fStart + +echo -e "\nIn order to proceed, select a command below by entering its corresponding number.\n" + +select option in Start Help Exit; do + case $option in + Start) + fStart + ;; + Help) + fUsage + echo -e "\nThis script creates a backup of your prefs.js file before doing anything." + echo -e "It should be safe, but you can follow these steps if something goes wrong:\n" + echo "1. Make sure Thunderbird is closed." + echo "2. Delete prefs.js in your profile folder." + echo "3. Delete Invalidprefs.js if you have one in the same folder." + echo "4. Rename or copy your latest backup to prefs.js." + echo "5. Run Thunderbird and see if you notice anything wrong with it." + echo "6. If you do notice something wrong, especially with your extensions, and/or with the UI, go to about:support, and restart Thunderbird with add-ons disabled. Then, restart it again normally, and see if the problems were solved." + echo -e "If you are able to identify the cause of your issues, please bring it up on the thunderbird user.js GitHub repository.\n" + ;; + Exit) + fQuit 0 + ;; + esac +done + +fQuit 0 diff --git a/updater.bat b/updater.bat new file mode 100644 index 0000000..80fa7ab --- /dev/null +++ b/updater.bat @@ -0,0 +1,324 @@ +@ECHO OFF & SETLOCAL EnableDelayedExpansion +TITLE thunderbird user.js updater + +REM ## thunderbird user.js updater for Windows +REM ## /!\ This script is a vendored/adapted version of Arkenfox own updater.bat /!\ +REM ## author: @claustromaniac +REM ## version: 4.19 +REM ## instructions: https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-windows + +SET v=4.19 + +VERIFY ON +CD /D "%~dp0" +SET _myname=%~n0 +SET _myparams=%* + +:parse +IF "%~1"=="" (GOTO endparse) +IF /I "%~1"=="-unattended" (SET _ua=1) +IF /I "%~1"=="-log" (SET _log=1) +IF /I "%~1"=="-logp" (SET _log=1 & SET _logp=1) +IF /I "%~1"=="-multioverrides" (SET _multi=1) +IF /I "%~1"=="-merge" (SET _merge=1) +IF /I "%~1"=="-updatebatch" (SET _updateb=1) +IF /I "%~1"=="-singlebackup" (SET _singlebackup=1) +IF /I "%~1"=="-esr" (SET _esr=1) +SHIFT +GOTO parse +:endparse + +FOR /F %%i IN ('PowerShell -Command "[Enum]::GetNames([Net.SecurityProtocolType]) -contains 'Tls12'"') DO ( + IF "%%i" == "False" ( + CALL :message "Your PowerShell version doesn't support TLS1.2 ^!" + ECHO: Instructions to update PowerShell are on the arkenfox wiki + PAUSE + EXIT + ) +) + +IF DEFINED _updateb ( + REM The normal flow here goes from phase 1 to phase 2 and then phase 3. + IF NOT "!_myname:~0,9!"=="[updated]" ( + IF EXIST "[updated]!_myname!.bat" ( + REM ## Phase 3 ##: The new script, with the original name, will: + REM * Delete the [updated]*.bat and *.bat.old scripts + REM * Begin the normal routine + FC "[updated]!_myname!.bat" "!_myname!.bat.old" >nul + IF NOT "!errorlevel!"=="0" ( + CALL :message "Script updated to version !v!" + TIMEOUT 3 >nul + ) + REN "[updated]!_myname!.bat" "[updated]!_myname!.bat.old" + DEL /F "!_myname!.bat.old" "[updated]!_myname!.bat.old" + GOTO begin + ) + REM ## Phase 1 ## + REM * Download new batch and name it [updated]*.bat + REM * Start that script in a new CMD window + REM * Exit + CALL :message "Updating script..." + REM Uncomment the next line and comment out the PowerShell call for testing. + REM COPY /B /Y "!_myname!.bat" "[updated]!_myname!.bat" >nul + CALL :psdownload https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/updater.bat "[updated]!_myname!.bat" + IF EXIST "[updated]!_myname!.bat" ( + START /min CMD /C "[updated]!_myname!.bat" !_myparams! + ) ELSE ( + CALL :message "Failed. Make sure PowerShell is allowed internet access." + TIMEOUT 120 >nul + ) + ) ELSE ( + IF "!_myname!"=="[updated]" ( + CALL :message "The [updated] label is reserved. Rename this script and try again." + TIMEOUT 300 >nul + ) ELSE ( + REM ## Phase 2 ##: The [updated]*.bat script will: + REM * Rename the old script and make a copy of itself with the original name. + REM * Run that copy in a new CMD instance + REM * Exit + IF EXIST "!_myname:~9!.bat" ( REN "!_myname:~9!.bat" "!_myname:~9!.bat.old" ) + COPY /B /Y "!_myname!.bat" "!_myname:~9!.bat" + START CMD /C "!_myname:~9!.bat" !_myparams! + ) + ) + EXIT /B +) + +:begin +CLS +ECHO: +ECHO: +ECHO: ######################################## +ECHO: #### user.js Updater for Windows #### +ECHO: #### by claustromaniac #### +ECHO: #### v!v! #### +ECHO: ######################################## +ECHO: +SET /A "_line=0" +IF NOT EXIST user.js ( + CALL :message "user.js not detected in the current directory." +) ELSE ( + FOR /F "skip=1 tokens=1,* delims=:" %%G IN (user.js) DO ( + SET /A "_line+=1" + IF !_line! GEQ 4 (GOTO exitloop) + IF !_line! EQU 1 (SET _name=%%H) + IF !_line! EQU 2 (SET _date=%%H) + IF !_line! EQU 3 (SET _version=%%G) + ) + :exitloop + IF NOT "!_name!"=="" ( + SET "_tempvar=" + IF /I NOT "!_name!"=="!_name:ghacks=!" SET _tempvar=1 + IF /I NOT "!_name!"=="!_name:arkenfox=!" SET _tempvar=1 + IF !_tempvar! EQU 1 ( + CALL :message "!_name! !_version:~2!,!_date!" + ) ELSE (CALL :message "Current user.js version not recognised.") + ) ELSE (CALL :message "Current user.js version not recognised.") +) +ECHO: +IF NOT DEFINED _ua ( + CALL :message "This batch should be run from your Thunderbird profile directory." + ECHO: It will download the latest version of thunderbird user.js from github and then + CALL :message "append any of your own changes from user-overrides.js to it." + CALL :message "Visit the wiki for more detailed information." + ECHO: + TIMEOUT 1 /nobreak >nul + CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" + CLS + IF ERRORLEVEL 3 (EXIT /B) + IF ERRORLEVEL 2 (GOTO :showhelp) +) +IF DEFINED _log ( + CALL :log >>user.js-update-log.txt 2>&1 + IF DEFINED _logp (START user.js-update-log.txt) + EXIT /B + :log + SET _log=2 + ECHO:################################################################## + ECHO: %date%, %time% +) +IF EXIST user.js.new (DEL /F "user.js.new") +CALL :message "Retrieving latest user.js file from github repository..." +CALL :psdownload https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/user.js "user.js.new" +IF EXIST user.js.new ( + IF DEFINED _esr ( + CALL :message "Activating ESR section..." + CALL :activate user.js.new ".x still uses all the following prefs" + ) + IF DEFINED _multi ( + FORFILES /P user.js-overrides /M *.js >nul 2>&1 + IF NOT ERRORLEVEL 1 ( + IF DEFINED _merge ( + CALL :message "Merging..." + COPY /B /Y user.js-overrides\*.js user-overrides-merged.js + CALL :merge user-overrides-merged.js + COPY /B /Y user.js.new+user-overrides-merged.js user.js.new + CALL :merge user.js.new + ) ELSE ( + CALL :message "Appending..." + COPY /B /Y user.js.new+"user.js-overrides\*.js" user.js.new + ) + ) ELSE (CALL :message "No override files found.") + ) ELSE ( + IF EXIST "user-overrides.js" ( + COPY /B /Y user.js.new+"user-overrides.js" "user.js.new" + IF DEFINED _merge ( + CALL :message "Merging user-overrides.js..." + CALL :merge user.js.new + ) ELSE ( + CALL :message "user-overrides.js appended." + ) + ) ELSE (CALL :message "user-overrides.js not found.") + ) + IF EXIST user.js ( + FC user.js.new user.js >nul && SET "_changed=false" || SET "_changed=true" + ) + IF "!_changed!"=="true" ( + CALL :message "Backing up..." + IF DEFINED _singlebackup ( + MOVE /Y user.js user.js.bak >nul + ) ELSE ( + FOR /F "delims=" %%# IN ('powershell get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# + MOVE /Y user.js "user-backup-!ldt!.js" >nul + ) + REN user.js.new user.js + CALL :message "Update complete." + ) ELSE ( + IF "!_changed!"=="false" ( + DEL /F user.js.new >nul + CALL :message "Update completed without changes." + ) ELSE ( + REN user.js.new user.js + CALL :message "Update complete." + SET "_changed=true" + ) + ) +) ELSE ( + CALL :message "Update failed. Make sure PowerShell is allowed internet access." + ECHO: No changes were made. +) +IF NOT DEFINED _log ( + IF NOT DEFINED _ua ( + IF EXIST prefsCleaner.bat ( + IF "!_changed!"=="true" ( + CALL :message "Would you like to run the prefsCleaner now?" + CHOICE /C YN /N /M "(Y/N) " + IF "1"=="!errorlevel!" ( START "" cmd.exe /C "prefsCleaner.bat" ) + ) ELSE (PAUSE) + ) ELSE (PAUSE) + ) +) +EXIT /B + +::::::::::::::: Message ::::::::::::::: +:message +SETLOCAL DisableDelayedExpansion +IF NOT "2"=="%_log%" (ECHO:) +ECHO: %~1 +IF NOT "2"=="%_log%" (ECHO:) +ENDLOCAL +GOTO :EOF + +::::::::::::::: Download ::::::::::::::: +:psdownload +( + PowerShell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('%~1', '%~2')" +) >nul 2>&1 +GOTO :EOF + +::::::::::::::: Activate Section ::::::::::::::: +:activate +:: arg1 = file +:: arg2 = line substring +SETLOCAL DisableDelayedExpansion +( + FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" "%~1"') DO ( + SET "_temp=%%H" + SETLOCAL EnableDelayedExpansion + IF "!_temp:%~2=!"=="!_temp!" ( + ENDLOCAL & ECHO:%%H + ) ELSE ( + ECHO://!_temp:~2! + ENDLOCAL + ) + ) +)>updatertempfile +MOVE /Y updatertempfile "%~1" >nul +ENDLOCAL +GOTO :EOF + +::::::::::::::: Merge ::::::::::::::: +:merge +SETLOCAL DisableDelayedExpansion +FOR /F tokens^=2^,^*^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^user_pref[ ]*\([ ]*[\"'].*[\"'][ ]*,.*\)[ ]*;" "%~1"') DO (SET "[%%G]=%%H") +FOR /F tokens^=2^,^*^ delims^=^' %%G IN ('FINDSTR /R /C:"^//// --- comment-out --- '[^'][^']*'.*" "%~1"') DO (SET "__unset__%%G=1") +( + FOR /F "tokens=1,* delims=:" %%I IN ('FINDSTR /N "^" "%~1"') DO ( + SET "_temp=%%J" + SETLOCAL EnableDelayedExpansion + IF NOT "!_temp:~0,9!"=="user_pref" ( + ENDLOCAL & ECHO:%%J + ) ELSE ( + IF "!_temp:;=!"=="!_temp!" ( + ENDLOCAL & ECHO:%%J + ) ELSE ( + ENDLOCAL + FOR /F tokens^=2^ delims^=^'^" %%K IN ("%%J") DO ( + IF NOT "_user.js.parrot"=="%%K" ( + IF DEFINED __unset__%%K ( + ECHO://%%J + ) ELSE ( + IF DEFINED [%%K] ( + SETLOCAL EnableDelayedExpansion + FOR /F "delims=" %%L IN ("![%%K]!") DO ( + ENDLOCAL & ECHO:user_pref("%%K"%%L + SET "[%%K]=" + ) + ) + ) + ) ELSE (ECHO:%%J) + ) + ) + ) + ) +)>updatertempfile +MOVE /Y updatertempfile "%~1" >nul +ENDLOCAL +GOTO :EOF + +::::::::::::::: Help ::::::::::::::: +:showhelp +MODE 80,54 +CLS +CALL :message "Available arguments (case-insensitive):" +CALL :message " -esr" +ECHO: Activate ESR related preferences +CALL :message " -log" +ECHO: Write the console output to a logfile (user.js-update-log.txt) +CALL :message " -logP" +ECHO: Like -log, but also open the logfile after updating. +CALL :message " -merge" +ECHO: Merge overrides instead of appending them. Single-line comments and +ECHO: _user.js.parrot lines are appended normally. Overrides for inactive +ECHO: user.js prefs will be appended. When -Merge and -MultiOverrides are used +ECHO: together, a user-overrides-merged.js file is also generated in the root +ECHO: directory for quick reference. It contains only the merged data from +ECHO: override files and can be safely discarded after updating, or used as the +ECHO: new user-overrides.js. When there are conflicting records for the same +ECHO: pref, the value of the last one declared will be used. Visit the wiki +ECHO: for usage examples and more detailed information. +CALL :message " -multiOverrides" +ECHO: Use any and all .js files in a user.js-overrides sub-folder as overrides +ECHO: instead of the default user-overrides.js file. Files are appended in +ECHO: alphabetical order. +CALL :message " -unattended" +ECHO: Run without user input. +CALL :message " -singleBackup" +ECHO: Use a single backup file and overwrite it on new updates, instead of +ECHO: cumulative backups. This was the default behaviour before v4.3. +CALL :message " -updateBatch" +ECHO: Update the script itself on execution, before the normal routine. +CALL :message "" +PAUSE +MODE 80,25 +GOTO :begin diff --git a/updater.sh b/updater.sh new file mode 100755 index 0000000..4d7c202 --- /dev/null +++ b/updater.sh @@ -0,0 +1,408 @@ +#!/usr/bin/env bash + +## thunderbird user.js updater for macOS and Linux +## /!\ This script is a vendored/adapted version of Arkenfox own updater.sh /!\ + +## version: 4.0 +## Author: Pat Johnson (@overdodactyl) +## Additional contributors: @earthlng, @ema-pe, @claustromaniac, @infinitewarp + +## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_updater() ) + +# Check if running as root +if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then + printf "You shouldn't run this with elevated privileges (such as with doas/sudo).\n" + exit 1 +fi + +readonly CURRDIR=$(pwd) + +SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null) +[ -z "$SCRIPT_FILE" ] && SCRIPT_FILE=${BASH_SOURCE[0]} +readonly SCRIPT_DIR=$(dirname "${SCRIPT_FILE}") + + +######################### +# Base variables # +######################### + +# Colors used for printing +RED='\033[0;31m' +BLUE='\033[0;34m' +BBLUE='\033[1;34m' +GREEN='\033[0;32m' +ORANGE='\033[0;33m' +CYAN='\033[0;36m' +NC='\033[0m' # No Color + +# Argument defaults +UPDATE='check' +CONFIRM='yes' +OVERRIDE='user-overrides.js' +BACKUP='multiple' +COMPARE=false +SKIPOVERRIDE=false +VIEW=false +PROFILE_PATH=false +ESR=false + +# Download method priority: curl -> wget +DOWNLOAD_METHOD='' +if command -v curl >/dev/null; then + DOWNLOAD_METHOD='curl --max-redirs 3 -so' +elif command -v wget >/dev/null; then + DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O' +else + echo -e "${RED}This script requires curl or wget.\nProcess aborted${NC}" + exit 1 +fi + + +show_banner() { + echo -e "${BBLUE} + ############################################################################ + #### #### + #### thunderbird user.js #### + #### Hardening the Privacy and Security Settings of Thunderbird #### + #### Maintained by @Thorin-Oakenpants and @earthlng #### + #### Updater for macOS and Linux by @overdodactyl #### + #### #### + ############################################################################" + echo -e "${NC}\n" + echo -e "Documentation for this script is available here: ${CYAN}https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-maclinux${NC}\n" +} + +######################### +# Arguments # +######################### + +usage() { + echo + echo -e "${BLUE}Usage: $0 [-bcdehlnrsuv] [-p PROFILE] [-o OVERRIDE]${NC}" 1>&2 # Echo usage string to standard error + echo -e " +Optional Arguments: + -h Show this help message and exit. + -p PROFILE Path to your Thunderbird profile (if different than the dir of this script) + IMPORTANT: If the path contains spaces, wrap the entire argument in quotes. + -l Choose your Thunderbird profile from a list + -u Update updater.sh and execute silently. Do not seek confirmation. + -d Do not look for updates to updater.sh. + -s Silently update user.js. Do not seek confirmation. + -b Only keep one backup of each file. + -c Create a diff file comparing old and new user.js within userjs_diffs. + -o OVERRIDE Filename or path to overrides file (if different than user-overrides.js). + If used with -p, paths should be relative to PROFILE or absolute paths + If given a directory, all files inside will be appended recursively. + You can pass multiple files or directories by passing a comma separated list. + Note: If a directory is given, only files inside ending in the extension .js are appended + IMPORTANT: Do not add spaces between files/paths. Ex: -o file1.js,file2.js,dir1 + IMPORTANT: If any file/path contains spaces, wrap the entire argument in quotes. + Ex: -o \"override folder\" + -n Do not append any overrides, even if user-overrides.js exists. + -v Open the resulting user.js file. + -r Only download user.js to a temporary file and open it. + -e Activate ESR related preferences." + echo + exit 1 +} + +######################### +# File Handling # +######################### + +download_file() { # expects URL as argument ($1) + declare -r tf=$(mktemp) + + $DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error +} + +open_file() { # expects one argument: file_path + if [ "$(uname)" == 'Darwin' ]; then + open "$1" + elif [ "$(uname -s | cut -c -5)" == "Linux" ]; then + xdg-open "$1" + else + echo -e "${RED}Error: Sorry, opening files is not supported for your OS.${NC}" + fi +} + +readIniFile() { # expects one argument: absolute path of profiles.ini + declare -r inifile="$1" + + # tempIni will contain: [ProfileX], Name=, IsRelative= and Path= (and Default= if present) of the only (if) or the selected (else) profile + if [ "$(grep -c '^\[Profile' "${inifile}")" -eq "1" ]; then ### only 1 profile found + tempIni="$(grep '^\[Profile' -A 4 "${inifile}")" + else + echo -e "Profiles found:\n––––––––––––––––––––––––––––––" + ## cmd-substitution to strip trailing newlines and in quotes to keep internal ones: + echo "$(grep --color=never -E 'Default=[^1]|\[Profile[0-9]*\]|Name=|Path=|^$' "${inifile}")" + echo '––––––––––––––––––––––––––––––' + read -p 'Select the profile number ( 0 for Profile0, 1 for Profile1, etc ) : ' -r + echo -e "\n" + if [[ $REPLY =~ ^(0|[1-9][0-9]*)$ ]]; then + tempIni="$(grep "^\[Profile${REPLY}" -A 4 "${inifile}")" || { + echo -e "${RED}Profile${REPLY} does not exist!${NC}" && exit 1 + } + else + echo -e "${RED}Invalid selection!${NC}" && exit 1 + fi + fi + + # extracting 0 or 1 from the "IsRelative=" line + declare -r pathisrel=$(sed -n 's/^IsRelative=\([01]\)$/\1/p' <<< "${tempIni}") + + # extracting only the path itself, excluding "Path=" + PROFILE_PATH=$(sed -n 's/^Path=\(.*\)$/\1/p' <<< "${tempIni}") + # update global variable if path is relative + [[ ${pathisrel} == "1" ]] && PROFILE_PATH="$(dirname "${inifile}")/${PROFILE_PATH}" +} + +getProfilePath() { + declare -r f1=~/Library/Application\ Support/Thunderbird/profiles.ini + declare -r f2=~/.thunderbird/profiles.ini + + if [ "$PROFILE_PATH" = false ]; then + PROFILE_PATH="$SCRIPT_DIR" + elif [ "$PROFILE_PATH" = 'list' ]; then + if [[ -f "$f1" ]]; then + readIniFile "$f1" # updates PROFILE_PATH or exits on error + elif [[ -f "$f2" ]]; then + readIniFile "$f2" + else + echo -e "${RED}Error: Sorry, -l is not supported for your OS${NC}" + exit 1 + fi + #else + # PROFILE_PATH already set by user with -p + fi +} + +######################### +# Update updater.sh # +######################### + +# Returns the version number of a updater.sh file +get_updater_version() { + echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")" +} + +# Update updater.sh +# Default: Check for update, if available, ask user if they want to execute it +# Args: +# -d: New version will not be looked for and update will not occur +# -u: Check for update, if available, execute without asking +update_updater() { + [ "$UPDATE" = 'no' ] && return 0 # User signified not to check for updates + + declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/updater.sh')" + [ -z "${tmpfile}" ] && echo -e "${RED}Error! Could not download updater.sh${NC}" && return 1 # check if download failed + + if [[ $(get_updater_version "$SCRIPT_FILE") < $(get_updater_version "${tmpfile}") ]]; then + if [ "$UPDATE" = 'check' ]; then + echo -e "There is a newer version of updater.sh available. ${RED}Update and execute Y/N?${NC}" + read -p "" -n 1 -r + echo -e "\n\n" + [[ $REPLY =~ ^[Yy]$ ]] || return 0 # Update available, but user chooses not to update + fi + else + return 0 # No update available + fi + mv "${tmpfile}" "$SCRIPT_FILE" + chmod u+x "$SCRIPT_FILE" + "$SCRIPT_FILE" "$@" -d + exit 0 +} + +######################### +# Update user.js # +######################### + +# Returns version number of a user.js file +get_userjs_version() { + [ -e "$1" ] && echo "$(sed -n '4p' "$1")" || echo "Not detected." +} + +add_override() { + input=$1 + if [ -f "$input" ]; then + echo "" >> user.js + cat "$input" >> user.js + echo -e "Status: ${GREEN}Override file appended:${NC} ${input}" + elif [ -d "$input" ]; then + SAVEIFS=$IFS + IFS=$'\n\b' # Set IFS + FILES="${input}"/*.js + for f in $FILES + do + add_override "$f" + done + IFS=$SAVEIFS # restore $IFS + else + echo -e "${ORANGE}Warning: Could not find override file:${NC} ${input}" + fi +} + +remove_comments() { # expects 2 arguments: from-file and to-file + sed -e '/^\/\*.*\*\/[[:space:]]*$/d' -e '/^\/\*/,/\*\//d' -e 's|^[[:space:]]*//.*$||' -e '/^[[:space:]]*$/d' -e 's|);[[:space:]]*//.*|);|' "$1" > "$2" +} + +# Applies latest version of user.js and any custom overrides +update_userjs() { + declare -r newfile="$(download_file 'https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/user.js')" + [ -z "${newfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && return 1 # check if download failed + + echo -e "Please observe the following information: + Thunderbird profile: ${ORANGE}$(pwd)${NC} + Available online: ${ORANGE}$(get_userjs_version "$newfile")${NC} + Currently using: ${ORANGE}$(get_userjs_version user.js)${NC}\n\n" + + if [ "$CONFIRM" = 'yes' ]; then + echo -e "This script will update to the latest user.js file and append any custom configurations from user-overrides.js. ${RED}Continue Y/N? ${NC}" + read -p "" -n 1 -r + echo -e "\n" + if ! [[ $REPLY =~ ^[Yy]$ ]]; then + echo -e "${RED}Process aborted${NC}" + rm "$newfile" + return 1 + fi + fi + + # Copy a version of user.js to diffs folder for later comparison + if [ "$COMPARE" = true ]; then + mkdir -p userjs_diffs + cp user.js userjs_diffs/past_user.js &>/dev/null + fi + + # backup user.js + mkdir -p userjs_backups + local bakname="userjs_backups/user.js.backup.$(date +"%Y-%m-%d_%H%M")" + [ "$BACKUP" = 'single' ] && bakname='userjs_backups/user.js.backup' + cp user.js "$bakname" &>/dev/null + + mv "${newfile}" user.js + echo -e "Status: ${GREEN}user.js has been backed up and replaced with the latest version!${NC}" + + if [ "$ESR" = true ]; then + sed -e 's/\/\* \(ESR[0-9]\{2,\}\.x still uses all.*\)/\/\/ \1/' user.js > user.js.tmp && mv user.js.tmp user.js + echo -e "Status: ${GREEN}ESR related preferences have been activated!${NC}" + fi + + # apply overrides + if [ "$SKIPOVERRIDE" = false ]; then + while IFS=',' read -ra FILES; do + for FILE in "${FILES[@]}"; do + add_override "$FILE" + done + done <<< "$OVERRIDE" + fi + + # create diff + if [ "$COMPARE" = true ]; then + pastuserjs='userjs_diffs/past_user.js' + past_nocomments='userjs_diffs/past_userjs.txt' + current_nocomments='userjs_diffs/current_userjs.txt' + + remove_comments "$pastuserjs" "$past_nocomments" + remove_comments user.js "$current_nocomments" + + diffname="userjs_diffs/diff_$(date +"%Y-%m-%d_%H%M").txt" + diff=$(diff -w -B -U 0 "$past_nocomments" "$current_nocomments") + if [ -n "$diff" ]; then + echo "$diff" > "$diffname" + echo -e "Status: ${GREEN}A diff file was created:${NC} ${PWD}/${diffname}" + else + echo -e "Warning: ${ORANGE}Your new user.js file appears to be identical. No diff file was created.${NC}" + [ "$BACKUP" = 'multiple' ] && rm "$bakname" &>/dev/null + fi + rm "$past_nocomments" "$current_nocomments" "$pastuserjs" &>/dev/null + fi + + [ "$VIEW" = true ] && open_file "${PWD}/user.js" +} + +######################### +# Execute # +######################### + +if [ $# != 0 ]; then + # Display usage if first argument is -help or --help + if [ "$1" = '--help' ] || [ "$1" = '-help' ]; then + usage + else + while getopts ":hp:ludsno:bcvre" opt; do + case $opt in + h) + usage + ;; + p) + PROFILE_PATH=${OPTARG} + ;; + l) + PROFILE_PATH='list' + ;; + u) + UPDATE='yes' + ;; + d) + UPDATE='no' + ;; + s) + CONFIRM='no' + ;; + n) + SKIPOVERRIDE=true + ;; + o) + OVERRIDE=${OPTARG} + ;; + b) + BACKUP='single' + ;; + c) + COMPARE=true + ;; + v) + VIEW=true + ;; + e) + ESR=true + ;; + r) + tfile="$(download_file 'https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/user.js')" + [ -z "${tfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && exit 1 # check if download failed + mv "$tfile" "${tfile}.js" + echo -e "${ORANGE}Warning: user.js was saved to temporary file ${tfile}.js${NC}" + open_file "${tfile}.js" + exit 0 + ;; + \?) + echo -e "${RED}\n Error! Invalid option: -$OPTARG${NC}" >&2 + usage + ;; + :) + echo -e "${RED}Error! Option -$OPTARG requires an argument.${NC}" >&2 + exit 2 + ;; + esac + done + fi +fi + +show_banner +update_updater "$@" + +getProfilePath # updates PROFILE_PATH or exits on error +cd "$PROFILE_PATH" || exit 1 + +# Check if any files have the owner as root/wheel. +if [ -n "$(find ./ -user 0)" ]; then + printf 'It looks like this script was previously run with elevated privileges, +you will need to change ownership of the following files to your user:\n' + find . -user 0 + cd "$CURRDIR" + exit 1 +fi + +update_userjs + +cd "$CURRDIR" From b6d6d1564b636eb1142b0ce274b0511974915261 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Thu, 7 Nov 2024 21:24:00 +0100 Subject: [PATCH 141/147] Bumps to 128.0 --- user.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user.js b/user.js index 92d0d2f..e856462 100644 --- a/user.js +++ b/user.js @@ -1,7 +1,7 @@ /****** * name: thunderbird user.js -* date: 31 August 2024 -* version: v128.0-beta1 +* date: 7 November 2024 +* version: v128.0 * url: https://github.com/HorlogeSkynet/thunderbird-user.js * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE) From 8f7158ebe2f283aa516f1e27d9073b0fff09660b Mon Sep 17 00:00:00 2001 From: Phong Tran <540580+phongse@users.noreply.github.com> Date: Fri, 8 Nov 2024 19:50:17 +0100 Subject: [PATCH 142/147] Convert scripts to dos CRLF --- prefsCleaner.bat | 268 ++++++++++---------- updater.bat | 648 +++++++++++++++++++++++------------------------ 2 files changed, 458 insertions(+), 458 deletions(-) diff --git a/prefsCleaner.bat b/prefsCleaner.bat index 06d78b6..3c73271 100644 --- a/prefsCleaner.bat +++ b/prefsCleaner.bat @@ -1,134 +1,134 @@ -@ECHO OFF & SETLOCAL DisableDelayedExpansion -TITLE prefs.js cleaner - -REM ## prefs.js cleaner for Windows -REM ## /!\ This script is a vendored/adapted version of Arkenfox own prefsCleaner.bat /!\ -REM ## author: @claustromaniac -REM ## version: 2.7 - -CD /D "%~dp0" - -IF /I "%~1"=="-unattended" (SET _ua=1) - -:begin -ECHO: -ECHO: -ECHO ######################################## -ECHO #### prefs.js cleaner for Windows #### -ECHO #### by claustromaniac #### -ECHO #### v2.7 #### -ECHO ######################################## -ECHO: -CALL :message "This script should be run from your Thunderbird profile directory." -ECHO It will remove any entries from prefs.js that also exist in user.js. -CALL :message "This will allow inactive preferences to be reset to their default values." -ECHO This Thunderbird profile shouldn't be in use during the process. -CALL :message "" -TIMEOUT 1 /nobreak >nul - -IF NOT DEFINED _ua ( - CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" - CLS - IF ERRORLEVEL 3 (EXIT /B) - IF ERRORLEVEL 2 (GOTO :showhelp) -) -IF NOT EXIST "user.js" (CALL :abort "user.js not found in the current directory." 30) -IF NOT EXIST "prefs.js" (CALL :abort "prefs.js not found in the current directory." 30) -CALL :strlenCheck -CALL :FFcheck - -CALL :message "Backing up prefs.js..." -FOR /F "delims=" %%# IN ('powershell get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# -COPY /B /V /Y prefs.js "prefs-backup-%ldt%.js" - -CALL :message "Cleaning prefs.js..." -CALL :cleanup -CALL :message "All done!" -TIMEOUT 5 >nul -ENDLOCAL -EXIT /B - -REM ########## Abort Function ########### -:abort -CALL :message %1 -TIMEOUT %~2 >nul -EXIT -REM ########## Message Function ######### -:message -ECHO: -ECHO: %~1 -ECHO: -GOTO :EOF -REM ### string length Check Function #### -:strlenCheck -SET /a cnt=0 -setlocal ENABLEDELAYEDEXPANSION -FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO ( - ECHO:%%H >nul - SET /a cnt += 1 - IF /I "%%G" NEQ "!cnt!" ( - ECHO: - CALL :message "ERROR: line !cnt! in prefs.js is too long." - (CALL :abort "Aborting ..." 30) - ) -) -endlocal -GOTO :EOF -REM ####### Thunderbird Check Function ###### -:FFcheck -TASKLIST /FI "IMAGENAME eq thunderbird.exe" 2>NUL | FIND /I /N "thunderbird.exe">NUL -IF NOT ERRORLEVEL 1 ( - CLS - CALL :message "Thunderbird is still running." - ECHO If you're not currently using this profile you can continue, otherwise - CALL :message "close Thunderbird first!" - ECHO: - PAUSE - CLS - CALL :message "Resuming..." - TIMEOUT 5 /nobreak >nul -) -GOTO :EOF -REM ######### Cleanup Function ########## -:cleanup -FOR /F tokens^=2^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^[^\"']*user_pref[ ]*\([ ]*[\"'][^\"']*[\"'][ ]*," user.js') DO ( - IF NOT ""=="%%G" (SET "[%%G]=1") -) -( - FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO ( - IF ""=="%%H" ( - ECHO: - ) ELSE ( - FOR /F tokens^=1^,2^ delims^=^"^' %%I IN ("%%H") DO ( - IF NOT DEFINED [%%J] (ECHO:%%H) - ) - ) - ) -)>tempcleanedprefs -MOVE /Y tempcleanedprefs prefs.js -GOTO :EOF -REM ############### Help ################## -:showhelp -MODE 80,34 -CLS -CALL :message "This script creates a backup of your prefs.js file before doing anything." -ECHO It should be safe, but you can follow these steps if something goes wrong: -ECHO: -CALL :message " 1. Make sure Thunderbird is closed." -ECHO 2. Delete prefs.js in your profile folder. -CALL :message " 3. Delete Invalidprefs.js if you have one in the same folder." -ECHO 4. Rename or copy your latest backup to prefs.js. -CALL :message " 5. Run Thunderbird and see if you notice anything wrong with it." -ECHO 6. If you do notice something wrong, especially with your extensions, -CALL :message " and/or with the UI, go to about:support, and restart Thunderbird with" -ECHO add-ons disabled. Then, restart it again normally, and see if the -CALL :message " problems were solved." -ECHO: -CALL :message "If you are able to identify the cause of your issues, please bring it up" -ECHO on thunderbird user.js GitHub repository. -ECHO: -ECHO: -PAUSE -CLS -GOTO :begin -REM ##################################### +@ECHO OFF & SETLOCAL DisableDelayedExpansion +TITLE prefs.js cleaner + +REM ## prefs.js cleaner for Windows +REM ## /!\ This script is a vendored/adapted version of Arkenfox own prefsCleaner.bat /!\ +REM ## author: @claustromaniac +REM ## version: 2.7 + +CD /D "%~dp0" + +IF /I "%~1"=="-unattended" (SET _ua=1) + +:begin +ECHO: +ECHO: +ECHO ######################################## +ECHO #### prefs.js cleaner for Windows #### +ECHO #### by claustromaniac #### +ECHO #### v2.7 #### +ECHO ######################################## +ECHO: +CALL :message "This script should be run from your Thunderbird profile directory." +ECHO It will remove any entries from prefs.js that also exist in user.js. +CALL :message "This will allow inactive preferences to be reset to their default values." +ECHO This Thunderbird profile shouldn't be in use during the process. +CALL :message "" +TIMEOUT 1 /nobreak >nul + +IF NOT DEFINED _ua ( + CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" + CLS + IF ERRORLEVEL 3 (EXIT /B) + IF ERRORLEVEL 2 (GOTO :showhelp) +) +IF NOT EXIST "user.js" (CALL :abort "user.js not found in the current directory." 30) +IF NOT EXIST "prefs.js" (CALL :abort "prefs.js not found in the current directory." 30) +CALL :strlenCheck +CALL :FFcheck + +CALL :message "Backing up prefs.js..." +FOR /F "delims=" %%# IN ('powershell get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# +COPY /B /V /Y prefs.js "prefs-backup-%ldt%.js" + +CALL :message "Cleaning prefs.js..." +CALL :cleanup +CALL :message "All done!" +TIMEOUT 5 >nul +ENDLOCAL +EXIT /B + +REM ########## Abort Function ########### +:abort +CALL :message %1 +TIMEOUT %~2 >nul +EXIT +REM ########## Message Function ######### +:message +ECHO: +ECHO: %~1 +ECHO: +GOTO :EOF +REM ### string length Check Function #### +:strlenCheck +SET /a cnt=0 +setlocal ENABLEDELAYEDEXPANSION +FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO ( + ECHO:%%H >nul + SET /a cnt += 1 + IF /I "%%G" NEQ "!cnt!" ( + ECHO: + CALL :message "ERROR: line !cnt! in prefs.js is too long." + (CALL :abort "Aborting ..." 30) + ) +) +endlocal +GOTO :EOF +REM ####### Thunderbird Check Function ###### +:FFcheck +TASKLIST /FI "IMAGENAME eq thunderbird.exe" 2>NUL | FIND /I /N "thunderbird.exe">NUL +IF NOT ERRORLEVEL 1 ( + CLS + CALL :message "Thunderbird is still running." + ECHO If you're not currently using this profile you can continue, otherwise + CALL :message "close Thunderbird first!" + ECHO: + PAUSE + CLS + CALL :message "Resuming..." + TIMEOUT 5 /nobreak >nul +) +GOTO :EOF +REM ######### Cleanup Function ########## +:cleanup +FOR /F tokens^=2^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^[^\"']*user_pref[ ]*\([ ]*[\"'][^\"']*[\"'][ ]*," user.js') DO ( + IF NOT ""=="%%G" (SET "[%%G]=1") +) +( + FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO ( + IF ""=="%%H" ( + ECHO: + ) ELSE ( + FOR /F tokens^=1^,2^ delims^=^"^' %%I IN ("%%H") DO ( + IF NOT DEFINED [%%J] (ECHO:%%H) + ) + ) + ) +)>tempcleanedprefs +MOVE /Y tempcleanedprefs prefs.js +GOTO :EOF +REM ############### Help ################## +:showhelp +MODE 80,34 +CLS +CALL :message "This script creates a backup of your prefs.js file before doing anything." +ECHO It should be safe, but you can follow these steps if something goes wrong: +ECHO: +CALL :message " 1. Make sure Thunderbird is closed." +ECHO 2. Delete prefs.js in your profile folder. +CALL :message " 3. Delete Invalidprefs.js if you have one in the same folder." +ECHO 4. Rename or copy your latest backup to prefs.js. +CALL :message " 5. Run Thunderbird and see if you notice anything wrong with it." +ECHO 6. If you do notice something wrong, especially with your extensions, +CALL :message " and/or with the UI, go to about:support, and restart Thunderbird with" +ECHO add-ons disabled. Then, restart it again normally, and see if the +CALL :message " problems were solved." +ECHO: +CALL :message "If you are able to identify the cause of your issues, please bring it up" +ECHO on thunderbird user.js GitHub repository. +ECHO: +ECHO: +PAUSE +CLS +GOTO :begin +REM ##################################### diff --git a/updater.bat b/updater.bat index 80fa7ab..d34b9b0 100644 --- a/updater.bat +++ b/updater.bat @@ -1,324 +1,324 @@ -@ECHO OFF & SETLOCAL EnableDelayedExpansion -TITLE thunderbird user.js updater - -REM ## thunderbird user.js updater for Windows -REM ## /!\ This script is a vendored/adapted version of Arkenfox own updater.bat /!\ -REM ## author: @claustromaniac -REM ## version: 4.19 -REM ## instructions: https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-windows - -SET v=4.19 - -VERIFY ON -CD /D "%~dp0" -SET _myname=%~n0 -SET _myparams=%* - -:parse -IF "%~1"=="" (GOTO endparse) -IF /I "%~1"=="-unattended" (SET _ua=1) -IF /I "%~1"=="-log" (SET _log=1) -IF /I "%~1"=="-logp" (SET _log=1 & SET _logp=1) -IF /I "%~1"=="-multioverrides" (SET _multi=1) -IF /I "%~1"=="-merge" (SET _merge=1) -IF /I "%~1"=="-updatebatch" (SET _updateb=1) -IF /I "%~1"=="-singlebackup" (SET _singlebackup=1) -IF /I "%~1"=="-esr" (SET _esr=1) -SHIFT -GOTO parse -:endparse - -FOR /F %%i IN ('PowerShell -Command "[Enum]::GetNames([Net.SecurityProtocolType]) -contains 'Tls12'"') DO ( - IF "%%i" == "False" ( - CALL :message "Your PowerShell version doesn't support TLS1.2 ^!" - ECHO: Instructions to update PowerShell are on the arkenfox wiki - PAUSE - EXIT - ) -) - -IF DEFINED _updateb ( - REM The normal flow here goes from phase 1 to phase 2 and then phase 3. - IF NOT "!_myname:~0,9!"=="[updated]" ( - IF EXIST "[updated]!_myname!.bat" ( - REM ## Phase 3 ##: The new script, with the original name, will: - REM * Delete the [updated]*.bat and *.bat.old scripts - REM * Begin the normal routine - FC "[updated]!_myname!.bat" "!_myname!.bat.old" >nul - IF NOT "!errorlevel!"=="0" ( - CALL :message "Script updated to version !v!" - TIMEOUT 3 >nul - ) - REN "[updated]!_myname!.bat" "[updated]!_myname!.bat.old" - DEL /F "!_myname!.bat.old" "[updated]!_myname!.bat.old" - GOTO begin - ) - REM ## Phase 1 ## - REM * Download new batch and name it [updated]*.bat - REM * Start that script in a new CMD window - REM * Exit - CALL :message "Updating script..." - REM Uncomment the next line and comment out the PowerShell call for testing. - REM COPY /B /Y "!_myname!.bat" "[updated]!_myname!.bat" >nul - CALL :psdownload https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/updater.bat "[updated]!_myname!.bat" - IF EXIST "[updated]!_myname!.bat" ( - START /min CMD /C "[updated]!_myname!.bat" !_myparams! - ) ELSE ( - CALL :message "Failed. Make sure PowerShell is allowed internet access." - TIMEOUT 120 >nul - ) - ) ELSE ( - IF "!_myname!"=="[updated]" ( - CALL :message "The [updated] label is reserved. Rename this script and try again." - TIMEOUT 300 >nul - ) ELSE ( - REM ## Phase 2 ##: The [updated]*.bat script will: - REM * Rename the old script and make a copy of itself with the original name. - REM * Run that copy in a new CMD instance - REM * Exit - IF EXIST "!_myname:~9!.bat" ( REN "!_myname:~9!.bat" "!_myname:~9!.bat.old" ) - COPY /B /Y "!_myname!.bat" "!_myname:~9!.bat" - START CMD /C "!_myname:~9!.bat" !_myparams! - ) - ) - EXIT /B -) - -:begin -CLS -ECHO: -ECHO: -ECHO: ######################################## -ECHO: #### user.js Updater for Windows #### -ECHO: #### by claustromaniac #### -ECHO: #### v!v! #### -ECHO: ######################################## -ECHO: -SET /A "_line=0" -IF NOT EXIST user.js ( - CALL :message "user.js not detected in the current directory." -) ELSE ( - FOR /F "skip=1 tokens=1,* delims=:" %%G IN (user.js) DO ( - SET /A "_line+=1" - IF !_line! GEQ 4 (GOTO exitloop) - IF !_line! EQU 1 (SET _name=%%H) - IF !_line! EQU 2 (SET _date=%%H) - IF !_line! EQU 3 (SET _version=%%G) - ) - :exitloop - IF NOT "!_name!"=="" ( - SET "_tempvar=" - IF /I NOT "!_name!"=="!_name:ghacks=!" SET _tempvar=1 - IF /I NOT "!_name!"=="!_name:arkenfox=!" SET _tempvar=1 - IF !_tempvar! EQU 1 ( - CALL :message "!_name! !_version:~2!,!_date!" - ) ELSE (CALL :message "Current user.js version not recognised.") - ) ELSE (CALL :message "Current user.js version not recognised.") -) -ECHO: -IF NOT DEFINED _ua ( - CALL :message "This batch should be run from your Thunderbird profile directory." - ECHO: It will download the latest version of thunderbird user.js from github and then - CALL :message "append any of your own changes from user-overrides.js to it." - CALL :message "Visit the wiki for more detailed information." - ECHO: - TIMEOUT 1 /nobreak >nul - CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" - CLS - IF ERRORLEVEL 3 (EXIT /B) - IF ERRORLEVEL 2 (GOTO :showhelp) -) -IF DEFINED _log ( - CALL :log >>user.js-update-log.txt 2>&1 - IF DEFINED _logp (START user.js-update-log.txt) - EXIT /B - :log - SET _log=2 - ECHO:################################################################## - ECHO: %date%, %time% -) -IF EXIST user.js.new (DEL /F "user.js.new") -CALL :message "Retrieving latest user.js file from github repository..." -CALL :psdownload https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/user.js "user.js.new" -IF EXIST user.js.new ( - IF DEFINED _esr ( - CALL :message "Activating ESR section..." - CALL :activate user.js.new ".x still uses all the following prefs" - ) - IF DEFINED _multi ( - FORFILES /P user.js-overrides /M *.js >nul 2>&1 - IF NOT ERRORLEVEL 1 ( - IF DEFINED _merge ( - CALL :message "Merging..." - COPY /B /Y user.js-overrides\*.js user-overrides-merged.js - CALL :merge user-overrides-merged.js - COPY /B /Y user.js.new+user-overrides-merged.js user.js.new - CALL :merge user.js.new - ) ELSE ( - CALL :message "Appending..." - COPY /B /Y user.js.new+"user.js-overrides\*.js" user.js.new - ) - ) ELSE (CALL :message "No override files found.") - ) ELSE ( - IF EXIST "user-overrides.js" ( - COPY /B /Y user.js.new+"user-overrides.js" "user.js.new" - IF DEFINED _merge ( - CALL :message "Merging user-overrides.js..." - CALL :merge user.js.new - ) ELSE ( - CALL :message "user-overrides.js appended." - ) - ) ELSE (CALL :message "user-overrides.js not found.") - ) - IF EXIST user.js ( - FC user.js.new user.js >nul && SET "_changed=false" || SET "_changed=true" - ) - IF "!_changed!"=="true" ( - CALL :message "Backing up..." - IF DEFINED _singlebackup ( - MOVE /Y user.js user.js.bak >nul - ) ELSE ( - FOR /F "delims=" %%# IN ('powershell get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# - MOVE /Y user.js "user-backup-!ldt!.js" >nul - ) - REN user.js.new user.js - CALL :message "Update complete." - ) ELSE ( - IF "!_changed!"=="false" ( - DEL /F user.js.new >nul - CALL :message "Update completed without changes." - ) ELSE ( - REN user.js.new user.js - CALL :message "Update complete." - SET "_changed=true" - ) - ) -) ELSE ( - CALL :message "Update failed. Make sure PowerShell is allowed internet access." - ECHO: No changes were made. -) -IF NOT DEFINED _log ( - IF NOT DEFINED _ua ( - IF EXIST prefsCleaner.bat ( - IF "!_changed!"=="true" ( - CALL :message "Would you like to run the prefsCleaner now?" - CHOICE /C YN /N /M "(Y/N) " - IF "1"=="!errorlevel!" ( START "" cmd.exe /C "prefsCleaner.bat" ) - ) ELSE (PAUSE) - ) ELSE (PAUSE) - ) -) -EXIT /B - -::::::::::::::: Message ::::::::::::::: -:message -SETLOCAL DisableDelayedExpansion -IF NOT "2"=="%_log%" (ECHO:) -ECHO: %~1 -IF NOT "2"=="%_log%" (ECHO:) -ENDLOCAL -GOTO :EOF - -::::::::::::::: Download ::::::::::::::: -:psdownload -( - PowerShell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('%~1', '%~2')" -) >nul 2>&1 -GOTO :EOF - -::::::::::::::: Activate Section ::::::::::::::: -:activate -:: arg1 = file -:: arg2 = line substring -SETLOCAL DisableDelayedExpansion -( - FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" "%~1"') DO ( - SET "_temp=%%H" - SETLOCAL EnableDelayedExpansion - IF "!_temp:%~2=!"=="!_temp!" ( - ENDLOCAL & ECHO:%%H - ) ELSE ( - ECHO://!_temp:~2! - ENDLOCAL - ) - ) -)>updatertempfile -MOVE /Y updatertempfile "%~1" >nul -ENDLOCAL -GOTO :EOF - -::::::::::::::: Merge ::::::::::::::: -:merge -SETLOCAL DisableDelayedExpansion -FOR /F tokens^=2^,^*^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^user_pref[ ]*\([ ]*[\"'].*[\"'][ ]*,.*\)[ ]*;" "%~1"') DO (SET "[%%G]=%%H") -FOR /F tokens^=2^,^*^ delims^=^' %%G IN ('FINDSTR /R /C:"^//// --- comment-out --- '[^'][^']*'.*" "%~1"') DO (SET "__unset__%%G=1") -( - FOR /F "tokens=1,* delims=:" %%I IN ('FINDSTR /N "^" "%~1"') DO ( - SET "_temp=%%J" - SETLOCAL EnableDelayedExpansion - IF NOT "!_temp:~0,9!"=="user_pref" ( - ENDLOCAL & ECHO:%%J - ) ELSE ( - IF "!_temp:;=!"=="!_temp!" ( - ENDLOCAL & ECHO:%%J - ) ELSE ( - ENDLOCAL - FOR /F tokens^=2^ delims^=^'^" %%K IN ("%%J") DO ( - IF NOT "_user.js.parrot"=="%%K" ( - IF DEFINED __unset__%%K ( - ECHO://%%J - ) ELSE ( - IF DEFINED [%%K] ( - SETLOCAL EnableDelayedExpansion - FOR /F "delims=" %%L IN ("![%%K]!") DO ( - ENDLOCAL & ECHO:user_pref("%%K"%%L - SET "[%%K]=" - ) - ) - ) - ) ELSE (ECHO:%%J) - ) - ) - ) - ) -)>updatertempfile -MOVE /Y updatertempfile "%~1" >nul -ENDLOCAL -GOTO :EOF - -::::::::::::::: Help ::::::::::::::: -:showhelp -MODE 80,54 -CLS -CALL :message "Available arguments (case-insensitive):" -CALL :message " -esr" -ECHO: Activate ESR related preferences -CALL :message " -log" -ECHO: Write the console output to a logfile (user.js-update-log.txt) -CALL :message " -logP" -ECHO: Like -log, but also open the logfile after updating. -CALL :message " -merge" -ECHO: Merge overrides instead of appending them. Single-line comments and -ECHO: _user.js.parrot lines are appended normally. Overrides for inactive -ECHO: user.js prefs will be appended. When -Merge and -MultiOverrides are used -ECHO: together, a user-overrides-merged.js file is also generated in the root -ECHO: directory for quick reference. It contains only the merged data from -ECHO: override files and can be safely discarded after updating, or used as the -ECHO: new user-overrides.js. When there are conflicting records for the same -ECHO: pref, the value of the last one declared will be used. Visit the wiki -ECHO: for usage examples and more detailed information. -CALL :message " -multiOverrides" -ECHO: Use any and all .js files in a user.js-overrides sub-folder as overrides -ECHO: instead of the default user-overrides.js file. Files are appended in -ECHO: alphabetical order. -CALL :message " -unattended" -ECHO: Run without user input. -CALL :message " -singleBackup" -ECHO: Use a single backup file and overwrite it on new updates, instead of -ECHO: cumulative backups. This was the default behaviour before v4.3. -CALL :message " -updateBatch" -ECHO: Update the script itself on execution, before the normal routine. -CALL :message "" -PAUSE -MODE 80,25 -GOTO :begin +@ECHO OFF & SETLOCAL EnableDelayedExpansion +TITLE thunderbird user.js updater + +REM ## thunderbird user.js updater for Windows +REM ## /!\ This script is a vendored/adapted version of Arkenfox own updater.bat /!\ +REM ## author: @claustromaniac +REM ## version: 4.19 +REM ## instructions: https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-windows + +SET v=4.19 + +VERIFY ON +CD /D "%~dp0" +SET _myname=%~n0 +SET _myparams=%* + +:parse +IF "%~1"=="" (GOTO endparse) +IF /I "%~1"=="-unattended" (SET _ua=1) +IF /I "%~1"=="-log" (SET _log=1) +IF /I "%~1"=="-logp" (SET _log=1 & SET _logp=1) +IF /I "%~1"=="-multioverrides" (SET _multi=1) +IF /I "%~1"=="-merge" (SET _merge=1) +IF /I "%~1"=="-updatebatch" (SET _updateb=1) +IF /I "%~1"=="-singlebackup" (SET _singlebackup=1) +IF /I "%~1"=="-esr" (SET _esr=1) +SHIFT +GOTO parse +:endparse + +FOR /F %%i IN ('PowerShell -Command "[Enum]::GetNames([Net.SecurityProtocolType]) -contains 'Tls12'"') DO ( + IF "%%i" == "False" ( + CALL :message "Your PowerShell version doesn't support TLS1.2 ^!" + ECHO: Instructions to update PowerShell are on the arkenfox wiki + PAUSE + EXIT + ) +) + +IF DEFINED _updateb ( + REM The normal flow here goes from phase 1 to phase 2 and then phase 3. + IF NOT "!_myname:~0,9!"=="[updated]" ( + IF EXIST "[updated]!_myname!.bat" ( + REM ## Phase 3 ##: The new script, with the original name, will: + REM * Delete the [updated]*.bat and *.bat.old scripts + REM * Begin the normal routine + FC "[updated]!_myname!.bat" "!_myname!.bat.old" >nul + IF NOT "!errorlevel!"=="0" ( + CALL :message "Script updated to version !v!" + TIMEOUT 3 >nul + ) + REN "[updated]!_myname!.bat" "[updated]!_myname!.bat.old" + DEL /F "!_myname!.bat.old" "[updated]!_myname!.bat.old" + GOTO begin + ) + REM ## Phase 1 ## + REM * Download new batch and name it [updated]*.bat + REM * Start that script in a new CMD window + REM * Exit + CALL :message "Updating script..." + REM Uncomment the next line and comment out the PowerShell call for testing. + REM COPY /B /Y "!_myname!.bat" "[updated]!_myname!.bat" >nul + CALL :psdownload https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/updater.bat "[updated]!_myname!.bat" + IF EXIST "[updated]!_myname!.bat" ( + START /min CMD /C "[updated]!_myname!.bat" !_myparams! + ) ELSE ( + CALL :message "Failed. Make sure PowerShell is allowed internet access." + TIMEOUT 120 >nul + ) + ) ELSE ( + IF "!_myname!"=="[updated]" ( + CALL :message "The [updated] label is reserved. Rename this script and try again." + TIMEOUT 300 >nul + ) ELSE ( + REM ## Phase 2 ##: The [updated]*.bat script will: + REM * Rename the old script and make a copy of itself with the original name. + REM * Run that copy in a new CMD instance + REM * Exit + IF EXIST "!_myname:~9!.bat" ( REN "!_myname:~9!.bat" "!_myname:~9!.bat.old" ) + COPY /B /Y "!_myname!.bat" "!_myname:~9!.bat" + START CMD /C "!_myname:~9!.bat" !_myparams! + ) + ) + EXIT /B +) + +:begin +CLS +ECHO: +ECHO: +ECHO: ######################################## +ECHO: #### user.js Updater for Windows #### +ECHO: #### by claustromaniac #### +ECHO: #### v!v! #### +ECHO: ######################################## +ECHO: +SET /A "_line=0" +IF NOT EXIST user.js ( + CALL :message "user.js not detected in the current directory." +) ELSE ( + FOR /F "skip=1 tokens=1,* delims=:" %%G IN (user.js) DO ( + SET /A "_line+=1" + IF !_line! GEQ 4 (GOTO exitloop) + IF !_line! EQU 1 (SET _name=%%H) + IF !_line! EQU 2 (SET _date=%%H) + IF !_line! EQU 3 (SET _version=%%G) + ) + :exitloop + IF NOT "!_name!"=="" ( + SET "_tempvar=" + IF /I NOT "!_name!"=="!_name:ghacks=!" SET _tempvar=1 + IF /I NOT "!_name!"=="!_name:arkenfox=!" SET _tempvar=1 + IF !_tempvar! EQU 1 ( + CALL :message "!_name! !_version:~2!,!_date!" + ) ELSE (CALL :message "Current user.js version not recognised.") + ) ELSE (CALL :message "Current user.js version not recognised.") +) +ECHO: +IF NOT DEFINED _ua ( + CALL :message "This batch should be run from your Thunderbird profile directory." + ECHO: It will download the latest version of thunderbird user.js from github and then + CALL :message "append any of your own changes from user-overrides.js to it." + CALL :message "Visit the wiki for more detailed information." + ECHO: + TIMEOUT 1 /nobreak >nul + CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" + CLS + IF ERRORLEVEL 3 (EXIT /B) + IF ERRORLEVEL 2 (GOTO :showhelp) +) +IF DEFINED _log ( + CALL :log >>user.js-update-log.txt 2>&1 + IF DEFINED _logp (START user.js-update-log.txt) + EXIT /B + :log + SET _log=2 + ECHO:################################################################## + ECHO: %date%, %time% +) +IF EXIST user.js.new (DEL /F "user.js.new") +CALL :message "Retrieving latest user.js file from github repository..." +CALL :psdownload https://raw.githubusercontent.com/HorlogeSkynet/thunderbird-user.js/master/user.js "user.js.new" +IF EXIST user.js.new ( + IF DEFINED _esr ( + CALL :message "Activating ESR section..." + CALL :activate user.js.new ".x still uses all the following prefs" + ) + IF DEFINED _multi ( + FORFILES /P user.js-overrides /M *.js >nul 2>&1 + IF NOT ERRORLEVEL 1 ( + IF DEFINED _merge ( + CALL :message "Merging..." + COPY /B /Y user.js-overrides\*.js user-overrides-merged.js + CALL :merge user-overrides-merged.js + COPY /B /Y user.js.new+user-overrides-merged.js user.js.new + CALL :merge user.js.new + ) ELSE ( + CALL :message "Appending..." + COPY /B /Y user.js.new+"user.js-overrides\*.js" user.js.new + ) + ) ELSE (CALL :message "No override files found.") + ) ELSE ( + IF EXIST "user-overrides.js" ( + COPY /B /Y user.js.new+"user-overrides.js" "user.js.new" + IF DEFINED _merge ( + CALL :message "Merging user-overrides.js..." + CALL :merge user.js.new + ) ELSE ( + CALL :message "user-overrides.js appended." + ) + ) ELSE (CALL :message "user-overrides.js not found.") + ) + IF EXIST user.js ( + FC user.js.new user.js >nul && SET "_changed=false" || SET "_changed=true" + ) + IF "!_changed!"=="true" ( + CALL :message "Backing up..." + IF DEFINED _singlebackup ( + MOVE /Y user.js user.js.bak >nul + ) ELSE ( + FOR /F "delims=" %%# IN ('powershell get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# + MOVE /Y user.js "user-backup-!ldt!.js" >nul + ) + REN user.js.new user.js + CALL :message "Update complete." + ) ELSE ( + IF "!_changed!"=="false" ( + DEL /F user.js.new >nul + CALL :message "Update completed without changes." + ) ELSE ( + REN user.js.new user.js + CALL :message "Update complete." + SET "_changed=true" + ) + ) +) ELSE ( + CALL :message "Update failed. Make sure PowerShell is allowed internet access." + ECHO: No changes were made. +) +IF NOT DEFINED _log ( + IF NOT DEFINED _ua ( + IF EXIST prefsCleaner.bat ( + IF "!_changed!"=="true" ( + CALL :message "Would you like to run the prefsCleaner now?" + CHOICE /C YN /N /M "(Y/N) " + IF "1"=="!errorlevel!" ( START "" cmd.exe /C "prefsCleaner.bat" ) + ) ELSE (PAUSE) + ) ELSE (PAUSE) + ) +) +EXIT /B + +::::::::::::::: Message ::::::::::::::: +:message +SETLOCAL DisableDelayedExpansion +IF NOT "2"=="%_log%" (ECHO:) +ECHO: %~1 +IF NOT "2"=="%_log%" (ECHO:) +ENDLOCAL +GOTO :EOF + +::::::::::::::: Download ::::::::::::::: +:psdownload +( + PowerShell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('%~1', '%~2')" +) >nul 2>&1 +GOTO :EOF + +::::::::::::::: Activate Section ::::::::::::::: +:activate +:: arg1 = file +:: arg2 = line substring +SETLOCAL DisableDelayedExpansion +( + FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" "%~1"') DO ( + SET "_temp=%%H" + SETLOCAL EnableDelayedExpansion + IF "!_temp:%~2=!"=="!_temp!" ( + ENDLOCAL & ECHO:%%H + ) ELSE ( + ECHO://!_temp:~2! + ENDLOCAL + ) + ) +)>updatertempfile +MOVE /Y updatertempfile "%~1" >nul +ENDLOCAL +GOTO :EOF + +::::::::::::::: Merge ::::::::::::::: +:merge +SETLOCAL DisableDelayedExpansion +FOR /F tokens^=2^,^*^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^user_pref[ ]*\([ ]*[\"'].*[\"'][ ]*,.*\)[ ]*;" "%~1"') DO (SET "[%%G]=%%H") +FOR /F tokens^=2^,^*^ delims^=^' %%G IN ('FINDSTR /R /C:"^//// --- comment-out --- '[^'][^']*'.*" "%~1"') DO (SET "__unset__%%G=1") +( + FOR /F "tokens=1,* delims=:" %%I IN ('FINDSTR /N "^" "%~1"') DO ( + SET "_temp=%%J" + SETLOCAL EnableDelayedExpansion + IF NOT "!_temp:~0,9!"=="user_pref" ( + ENDLOCAL & ECHO:%%J + ) ELSE ( + IF "!_temp:;=!"=="!_temp!" ( + ENDLOCAL & ECHO:%%J + ) ELSE ( + ENDLOCAL + FOR /F tokens^=2^ delims^=^'^" %%K IN ("%%J") DO ( + IF NOT "_user.js.parrot"=="%%K" ( + IF DEFINED __unset__%%K ( + ECHO://%%J + ) ELSE ( + IF DEFINED [%%K] ( + SETLOCAL EnableDelayedExpansion + FOR /F "delims=" %%L IN ("![%%K]!") DO ( + ENDLOCAL & ECHO:user_pref("%%K"%%L + SET "[%%K]=" + ) + ) + ) + ) ELSE (ECHO:%%J) + ) + ) + ) + ) +)>updatertempfile +MOVE /Y updatertempfile "%~1" >nul +ENDLOCAL +GOTO :EOF + +::::::::::::::: Help ::::::::::::::: +:showhelp +MODE 80,54 +CLS +CALL :message "Available arguments (case-insensitive):" +CALL :message " -esr" +ECHO: Activate ESR related preferences +CALL :message " -log" +ECHO: Write the console output to a logfile (user.js-update-log.txt) +CALL :message " -logP" +ECHO: Like -log, but also open the logfile after updating. +CALL :message " -merge" +ECHO: Merge overrides instead of appending them. Single-line comments and +ECHO: _user.js.parrot lines are appended normally. Overrides for inactive +ECHO: user.js prefs will be appended. When -Merge and -MultiOverrides are used +ECHO: together, a user-overrides-merged.js file is also generated in the root +ECHO: directory for quick reference. It contains only the merged data from +ECHO: override files and can be safely discarded after updating, or used as the +ECHO: new user-overrides.js. When there are conflicting records for the same +ECHO: pref, the value of the last one declared will be used. Visit the wiki +ECHO: for usage examples and more detailed information. +CALL :message " -multiOverrides" +ECHO: Use any and all .js files in a user.js-overrides sub-folder as overrides +ECHO: instead of the default user-overrides.js file. Files are appended in +ECHO: alphabetical order. +CALL :message " -unattended" +ECHO: Run without user input. +CALL :message " -singleBackup" +ECHO: Use a single backup file and overwrite it on new updates, instead of +ECHO: cumulative backups. This was the default behaviour before v4.3. +CALL :message " -updateBatch" +ECHO: Update the script itself on execution, before the normal routine. +CALL :message "" +PAUSE +MODE 80,25 +GOTO :begin From 4d986fffc661f92890a7aed5b397aa710ac7c5c9 Mon Sep 17 00:00:00 2001 From: Phong Tran <540580+phongse@users.noreply.github.com> Date: Fri, 8 Nov 2024 20:01:48 +0100 Subject: [PATCH 143/147] Add `thunderbird` as recognized version --- updater.bat | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/updater.bat b/updater.bat index d34b9b0..19d33f7 100644 --- a/updater.bat +++ b/updater.bat @@ -103,13 +103,12 @@ IF NOT EXIST user.js ( IF !_line! GEQ 4 (GOTO exitloop) IF !_line! EQU 1 (SET _name=%%H) IF !_line! EQU 2 (SET _date=%%H) - IF !_line! EQU 3 (SET _version=%%G) + IF !_line! EQU 3 (SET _version=%%H) ) :exitloop IF NOT "!_name!"=="" ( SET "_tempvar=" - IF /I NOT "!_name!"=="!_name:ghacks=!" SET _tempvar=1 - IF /I NOT "!_name!"=="!_name:arkenfox=!" SET _tempvar=1 + IF /I NOT "!_name!"=="!_name:thunderbird=!" SET _tempvar=1 IF !_tempvar! EQU 1 ( CALL :message "!_name! !_version:~2!,!_date!" ) ELSE (CALL :message "Current user.js version not recognised.") From 8e9bc01c00e089c4e4c90feaec88993081b02c2a Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 9 Nov 2024 16:30:25 +0100 Subject: [PATCH 144/147] Adds (adapted) upstream .gitattributes --- .gitattributes | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .gitattributes diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..d69203d --- /dev/null +++ b/.gitattributes @@ -0,0 +1,15 @@ +* text=auto + +*.js text +*.md text +*.yml text +*.sh text +## *.bat text eol=crlf +*.bat -text + +*.png binary + +.gitattributes export-ignore +*.yml export-ignore +/wiki export-ignore +/.github export-ignore From eec031aa69400f7341cf39d2d0c4e554c8973893 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sat, 16 Nov 2024 12:13:33 +0100 Subject: [PATCH 145/147] Prevents MUA information leakage through User-Agent header > closes #60 --- user.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/user.js b/user.js index e856462..a99cf42 100644 --- a/user.js +++ b/user.js @@ -1300,9 +1300,10 @@ user_pref("mailnews.display.date_senders_timezone", false); * "Received" header. Set the following preference. New messages will show the time the message * was received, rather than when it was sent. ***/ // user_pref("mailnews.use_received_date", true); -/* 9126: Send minimal User-Agent in outgoing email messages (default) */ -user_pref("mailnews.headers.sendUserAgent", true); -user_pref("mailnews.headers.useMinimalUserAgent", true); +/* 9126: Prevent any MUA information leakage through User-Agent header in outgoing email messages + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1114475 ***/ +user_pref("mailnews.headers.sendUserAgent", false); + // user_pref("mailnews.headers.useMinimalUserAgent", true); /** ADDRESS BOOK ***/ /* 9130: Address book collection [SETUP-FEATURE] From 7f756582828045fa33155130bde3a859be0efb55 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 5 Jan 2025 15:01:24 +0100 Subject: [PATCH 146/147] Adds `SETUP-CHROME` tag to 5590 (see #31) Co-Authored-By: Daniel Rudolf --- user.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user.js b/user.js index a99cf42..fba8c5c 100644 --- a/user.js +++ b/user.js @@ -1023,7 +1023,7 @@ user_pref("network.http.referer.XOriginPolicy", 2); * When set to a valid, working value that matches your "network.trr.uri" (0712) Thunderbird * won't use the system DNS. If the IP doesn't match then DoH won't work ***/ // user_pref("network.trr.bootstrapAddr", "10.0.0.1"); // [HIDDEN PREF] -/* 5590: show a prompt when opening a link in external applications ***/ +/* 5590: show a prompt when opening a link in external applications [SETUP-CHROME] ***/ user_pref("security.external_protocol_requires_permission", true); /*** [SECTION 6000]: DON'T TOUCH ***/ From 2b839ae6cac30129c5bd0bf0d816824957095868 Mon Sep 17 00:00:00 2001 From: Samuel FORESTIER Date: Sun, 5 Jan 2025 15:01:56 +0100 Subject: [PATCH 147/147] [META] Updates copyrights for 2025 --- LICENSE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE b/LICENSE index 721b1eb..119d843 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2019-2024 HorlogeSkynet +Copyright (c) 2019-2025 HorlogeSkynet Copyright (c) 2019 dngray Copyright (c) 2019 arkenfox [prev. ghacksuserjs]