diff --git a/.gitattributes b/.gitattributes index f80aa4c..d6d1095 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,16 +1,14 @@ -* text=auto +## * text=auto -*.js text -*.md text -*.yml text -*.txt text -*.sh text -## *.bat text eol=crlf -*.bat -text +*.js text=auto +*.md text=auto +*.yml text=auto +*.txt text=auto +*.sh text=auto +*.bat eol=crlf *.png binary .gitattributes export-ignore *.yml export-ignore -/wikipiki export-ignore -/.github export-ignore +wikipiki export-ignore diff --git a/.github/ISSUE_TEMPLATE/tools.md b/.github/ISSUE_TEMPLATE/tools.md deleted file mode 100644 index f98aa59..0000000 --- a/.github/ISSUE_TEMPLATE/tools.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -name: Tools -about: Report issues with the updaters, the troubleshooter, or any other tools. -title: '' -labels: '' -assignees: '' - ---- - - diff --git a/.github/ISSUE_TEMPLATE/troubleshooting-help.md b/.github/ISSUE_TEMPLATE/troubleshooting-help.md deleted file mode 100644 index b8c876b..0000000 --- a/.github/ISSUE_TEMPLATE/troubleshooting-help.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -name: Troubleshooting help -about: Ask for help to solve problems with user.js -title: 'follow instructions or this will be closed as invalid' -labels: '' -assignees: '' - ---- - - - - -🟥 https://github.com/arkenfox/user.js/wiki/5.2-Troubleshooting -- [ ] I have read the troubleshooting guide, done the checks and confirmed this is caused by arkenfox - - _unchecked issues ~~may~~ will be closed as invalid_ - -🟪 REQUIRED INFO - - Browser version & OS: - - Steps to Reproduce (STR): - - Expected result: - - Actual result: - - Console errors and warnings: - - Anything else you deem worth mentioning: - ---- diff --git a/.github/ISSUE_TEMPLATE/user-js.md b/.github/ISSUE_TEMPLATE/user-js.md deleted file mode 100644 index 7955d27..0000000 --- a/.github/ISSUE_TEMPLATE/user-js.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -name: user.js -about: Suggest changes to user.js -title: '' -labels: '' -assignees: '' - ---- - -We value feedback in general, but we value feedback from informed users more. There is no need for you to be an expert to participate (most of us aren't), but we hope that you at least understand our decisions before questioning them. We discuss all changes openly, and we do not make changes lightly. So, if you don't understand why we decided to add/remove/change a certain pref, search the repo. The answer is most certainly here. - -If some change we made took you by surprise (in the wrong way), remember that keeping track of changes is your responsibility. Watch the repo, read the [changelogs](https://github.com/arkenfox/user.js/issues?utf8=✓&q=is%3Aissue+label%3Achangelog), compare [releases](https://github.com/arkenfox/user.js/releases) as you update your copy of user.js, or use any other method you prefer. - -Clear all of this when you're ready to type. - diff --git a/LICENSE.txt b/LICENSE.txt index 0eed2c7..a18c4e2 100644 --- a/LICENSE.txt +++ b/LICENSE.txt @@ -1,6 +1,6 @@ MIT License -Copyright (c) 2020 arkenfox +Copyright (c) 2017 ghacksuserjs Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/README.md b/README.md index 1a27d8a..90bdea3 100644 --- a/README.md +++ b/README.md @@ -1,26 +1,21 @@ -### 🟪 user.js -A `user.js` is a configuration file that can control Firefox settings - for a more technical breakdown and explanation, you can read more in the [wiki](https://github.com/arkenfox/user.js/wiki/2.1-User.js) +### ![](https://github.com/ghacksuserjs/ghacks-user.js/blob/master/wikipiki/bullet01.png) user.js +A `user.js` is a configuration file that can control hundreds of Firefox settings. For a more technical breakdown and explanation, you can read more on the [overview](https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.1-Overview) wiki page. -### 🟩 the arkenfox user.js +### ![](https://github.com/ghacksuserjs/ghacks-user.js/blob/master/wikipiki/bullet01.png) ghacks user.js +The `ghacks user.js` is a **template**, which, as provided, aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen). -[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) +Everyone, experts included, should at least read the [implementation](https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.3-Implementation) wiki page, as it contains important information regarding a few `ghacks user.js` settings. -The `arkenfox user.js` is a **template** which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen). +Sitemap: [Releases](https://github.com/ghacksuserjs/ghacks-user.js/releases), [changelogs](https://github.com/ghacksuserjs/ghacks-user.js/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Achangelog), [Wiki](https://github.com/ghacksuserjs/ghacks-user.js/wiki), [stickies](https://github.com/ghacksuserjs/ghacks-user.js/issues?q=is%3Aissue+is%3Aopen+label%3A%22sticky+topic%22). [diffs](https://github.com/ghacksuserjs/ghacks-user.js/issues?q=is%3Aissue+label%3Adiffs) -Everyone, experts included, should at least read the [wiki](https://github.com/arkenfox/user.js/wiki), as it contains important information regarding a few `user.js` settings. There is also an [interactive current release](https://arkenfox.github.io/gui/), thanks to [icpantsparti2](https://github.com/icpantsparti2). +### ![](https://github.com/ghacksuserjs/ghacks-user.js/blob/master/wikipiki/bullet01.png) acknowledgments +Literally thousands of sources, references and suggestions. That said... -Note that we do *not* recommend connecting over Tor on Firefox. Use the [Tor Browser](https://www.torproject.org/projects/torbrowser.html.en) if your [threat model](https://2019.www.torproject.org/about/torusers.html) calls for it, or for accessing hidden services. +* Martin Brinkmann at [ghacks](https://www.ghacks.net/) 1 +* The ghacks community and commentators +* [12bytes](http://12bytes.org/tech/firefox/firefoxgecko-configuration-guide-for-privacy-and-performance-buffs) + * The 12bytes article now uses this user.js and supplements it with an additonal JS hosted right [here](https://github.com/atomGit/Firefox-user.js) at github -Also be aware that the `arkenfox user.js` is made specifically for desktop Firefox. Using it as-is in other Gecko-based browsers can be counterproductive, especially in the Tor Browser. +1 The ghacks user.js was an independent project by [Thorin-Oakenpants](https://github.com/Thorin-Oakenpants) started in early 2015 and was [first published](https://www.ghacks.net/2015/08/18/a-comprehensive-list-of-firefox-privacy-and-security-settings/) at ghacks in August 2015. With Martin Brinkmann's blessing, it will keep the ghacks name. -### 🟧 sitemap - - - [releases](https://github.com/arkenfox/user.js/releases) - - [changelogs](https://github.com/arkenfox/user.js/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Achangelog) - - [wiki](https://github.com/arkenfox/user.js/wiki) - - [stickies](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+is%3Aopen+label%3A%22sticky+topic%22) - - [diffs](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+label%3Adiffs) - - [common questions and answers](https://github.com/arkenfox/user.js/issues?q=is%3Aissue+label%3Aanswered) - -### 🟥 acknowledgments -Literally thousands of sources, references and suggestions. Many thanks, and much appreciated. +### ![](https://github.com/ghacksuserjs/ghacks-user.js/blob/master/wikipiki/bullet01.png) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) diff --git a/_config.yml b/_config.yml index 839cbe3..1885487 100644 --- a/_config.yml +++ b/_config.yml @@ -1,3 +1 @@ -theme: jekyll-theme-midnight -title: user.js -description: An ongoing comprehensive user.js template for configuring and hardening Firefox privacy, security and anti-fingerprinting +theme: jekyll-theme-midnight \ No newline at end of file diff --git a/prefsCleaner.bat b/prefsCleaner.bat index 62ca5f0..33146df 100644 --- a/prefsCleaner.bat +++ b/prefsCleaner.bat @@ -1,21 +1,18 @@ -@ECHO OFF & SETLOCAL DisableDelayedExpansion +@ECHO OFF TITLE prefs.js cleaner REM ### prefs.js cleaner for Windows REM ## author: @claustromaniac -REM ## version: 2.8 - -CD /D "%~dp0" - -IF /I "%~1"=="-unattended" (SET _ua=1) +REM ## version: 1.2 +SETLOCAL EnableDelayedExpansion :begin ECHO: ECHO: ECHO ######################################## ECHO #### prefs.js cleaner for Windows #### ECHO #### by claustromaniac #### -ECHO #### v2.8 #### +ECHO #### v1.2 #### ECHO ######################################## ECHO: CALL :message "This script should be run from your Firefox profile directory." @@ -24,27 +21,20 @@ CALL :message "This will allow inactive preferences to be reset to their default ECHO This Firefox profile shouldn't be in use during the process. CALL :message "" TIMEOUT 1 /nobreak >nul - -IF NOT DEFINED _ua ( - CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" - CLS - IF ERRORLEVEL 3 (EXIT /B) - IF ERRORLEVEL 2 (GOTO :showhelp) -) +CHOICE /C SHE /N /M "Start [S] Help [H] Exit [E]" +CLS +IF ERRORLEVEL 3 (EXIT /B) +IF ERRORLEVEL 2 (GOTO :showhelp) IF NOT EXIST "user.js" (CALL :abort "user.js not found in the current directory." 30) IF NOT EXIST "prefs.js" (CALL :abort "prefs.js not found in the current directory." 30) -CALL :strlenCheck CALL :FFcheck - CALL :message "Backing up prefs.js..." -FOR /F "delims=" %%# IN ('powershell -command get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# -COPY /B /V /Y prefs.js "prefs-backup-%ldt%.js" - +COPY /B /V /Y prefs.js "prefs-backup-!date:/=-!_!time::=.!.js" CALL :message "Cleaning prefs.js..." CALL :cleanup -CALL :message "All done!" +CLS +CALL :message "All done^!" TIMEOUT 5 >nul -ENDLOCAL EXIT /B REM ########## Abort Function ########### @@ -54,24 +44,11 @@ TIMEOUT %~2 >nul EXIT REM ########## Message Function ######### :message +SETLOCAL DisableDelayedExpansion ECHO: ECHO: %~1 ECHO: -GOTO :EOF -REM ### string length Check Function #### -:strlenCheck -SET /a cnt=0 -setlocal ENABLEDELAYEDEXPANSION -FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO ( - ECHO:%%H >nul - SET /a cnt += 1 - IF /I "%%G" NEQ "!cnt!" ( - ECHO: - CALL :message "ERROR: line !cnt! in prefs.js is too long." - (CALL :abort "Aborting ..." 30) - ) -) -endlocal +ENDLOCAL GOTO :EOF REM ####### Firefox Check Function ###### :FFcheck @@ -80,7 +57,7 @@ IF NOT ERRORLEVEL 1 ( CLS CALL :message "Firefox is still running." ECHO If you're not currently using this profile you can continue, otherwise - CALL :message "close Firefox first!" + CALL :message "close Firefox first^!" ECHO: PAUSE CLS @@ -90,20 +67,23 @@ IF NOT ERRORLEVEL 1 ( GOTO :EOF REM ######### Cleanup Function ########## :cleanup -FOR /F tokens^=2^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^[^\"']*user_pref[ ]*\([ ]*[\"'][^\"']*[\"'][ ]*," user.js') DO ( - IF NOT ""=="%%G" (SET "[%%G]=1") -) +SETLOCAL DisableDelayedExpansion ( FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" prefs.js') DO ( - IF ""=="%%H" ( - ECHO: - ) ELSE ( - FOR /F tokens^=1^,2^ delims^=^"^' %%I IN ("%%H") DO ( - IF NOT DEFINED [%%J] (ECHO:%%H) + SET "_line=%%H" + SETLOCAL EnableDelayedExpansion + IF /I "user_pref"=="!_line:~0,9!" ( + FOR /F tokens^=2^ delims^=^" %%I IN ("!_line:.=\.!") DO ( + FINDSTR /R /C:"user_pref[ ]*\([ ]*[\"']%%I[\"'][ ]*," user.js >nul + IF ERRORLEVEL 1 (ECHO:!_line!) ) + ) ELSE ( + ECHO:!_line! ) + ENDLOCAL ) )>tempcleanedprefs +ENDLOCAL MOVE /Y tempcleanedprefs prefs.js GOTO :EOF REM ############### Help ################## @@ -124,7 +104,7 @@ ECHO add-ons disabled. Then, restart it again normally, and see if the CALL :message " problems were solved." ECHO: CALL :message "If you are able to identify the cause of your issues, please bring it up" -ECHO on arkenfox user.js GitHub repository. +ECHO on ghacks-user.js GitHub repository. ECHO: ECHO: PAUSE diff --git a/prefsCleaner.sh b/prefsCleaner.sh deleted file mode 100755 index b9739b2..0000000 --- a/prefsCleaner.sh +++ /dev/null @@ -1,185 +0,0 @@ -#!/usr/bin/env bash - -## prefs.js cleaner for Linux/Mac -## author: @claustromaniac -## version: 2.1 - -## special thanks to @overdodactyl and @earthlng for a few snippets that I stol..*cough* borrowed from the updater.sh - -## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_prefsCleaner() ) - -readonly CURRDIR=$(pwd) - -## get the full path of this script (readlink for Linux, greadlink for Mac with coreutils installed) -SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null) - -## fallback for Macs without coreutils -[ -z "$SCRIPT_FILE" ] && SCRIPT_FILE=${BASH_SOURCE[0]} - - -AUTOUPDATE=true -QUICKSTART=false - -## download method priority: curl -> wget -DOWNLOAD_METHOD='' -if command -v curl >/dev/null; then - DOWNLOAD_METHOD='curl --max-redirs 3 -so' -elif command -v wget >/dev/null; then - DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O' -else - AUTOUPDATE=false - echo -e "No curl or wget detected.\nAutomatic self-update disabled!" -fi - -fQuit() { - ## change directory back to the original working directory - cd "${CURRDIR}" - [ "$1" -eq 0 ] && echo -e "\n$2" || echo -e "\n$2" >&2 - exit $1 -} - -fUsage() { - echo -e "\nUsage: $0 [-ds]" - echo -e " -Optional Arguments: - -s Start immediately - -d Don't auto-update prefsCleaner.sh" -} - -download_file() { # expects URL as argument ($1) - declare -r tf=$(mktemp) - - $DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error -} - -fFF_check() { - # there are many ways to see if firefox is running or not, some more reliable than others - # this isn't elegant and might not be future-proof but should at least be compatible with any environment - while [ -e lock ]; do - echo -e "\nThis Firefox profile seems to be in use. Close Firefox and try again.\n" >&2 - read -r -p "Press any key to continue." - done -} - -## returns the version number of a prefsCleaner.sh file -get_prefsCleaner_version() { - echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")" -} - -## updates the prefsCleaner.sh file based on the latest public version -update_prefsCleaner() { - declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/prefsCleaner.sh')" - [ -z "$tmpfile" ] && echo -e "Error! Could not download prefsCleaner.sh" && return 1 # check if download failed - - [[ $(get_prefsCleaner_version "$SCRIPT_FILE") == $(get_prefsCleaner_version "$tmpfile") ]] && return 0 - - mv "$tmpfile" "$SCRIPT_FILE" - chmod u+x "$SCRIPT_FILE" - "$SCRIPT_FILE" "$@" -d - exit 0 -} - -fClean() { - # the magic happens here - prefs="@@" - prefexp="user_pref[ ]*\([ ]*[\"']([^\"']+)[\"'][ ]*," - while read -r line; do - if [[ "$line" =~ $prefexp && $prefs != *"@@${BASH_REMATCH[1]}@@"* ]]; then - prefs="${prefs}${BASH_REMATCH[1]}@@" - fi - done <<< "$(grep -E "$prefexp" user.js)" - - while IFS='' read -r line || [[ -n "$line" ]]; do - if [[ "$line" =~ ^$prefexp ]]; then - if [[ $prefs != *"@@${BASH_REMATCH[1]}@@"* ]]; then - echo "$line" - fi - else - echo "$line" - fi - done < "$1" > prefs.js -} - -fStart() { - if [ ! -e user.js ]; then - fQuit 1 "user.js not found in the current directory." - elif [ ! -e prefs.js ]; then - fQuit 1 "prefs.js not found in the current directory." - fi - - fFF_check - mkdir -p prefsjs_backups - bakfile="prefsjs_backups/prefs.js.backup.$(date +"%Y-%m-%d_%H%M")" - mv prefs.js "${bakfile}" || fQuit 1 "Operation aborted.\nReason: Could not create backup file $bakfile" - echo -e "\nprefs.js backed up: $bakfile" - echo "Cleaning prefs.js..." - fClean "$bakfile" - fQuit 0 "All done!" -} - - -while getopts "sd" opt; do - case $opt in - s) - QUICKSTART=true - ;; - d) - AUTOUPDATE=false - ;; - esac -done - -## change directory to the Firefox profile directory -cd "$(dirname "${SCRIPT_FILE}")" - -# Check if running as root and if any files have the owner as root/wheel. -if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then - fQuit 1 "You shouldn't run this with elevated privileges (such as with doas/sudo)." -elif [ -n "$(find ./ -user 0)" ]; then - printf 'It looks like this script was previously run with elevated privileges, -you will need to change ownership of the following files to your user:\n' - find . -user 0 - fQuit 1 -fi - -[ "$AUTOUPDATE" = true ] && update_prefsCleaner "$@" - -echo -e "\n\n" -echo " ╔══════════════════════════╗" -echo " ║ prefs.js cleaner ║" -echo " ║ by claustromaniac ║" -echo " ║ v2.1 ║" -echo " ╚══════════════════════════╝" -echo -e "\nThis script should be run from your Firefox profile directory.\n" -echo "It will remove any entries from prefs.js that also exist in user.js." -echo "This will allow inactive preferences to be reset to their default values." -echo -e "\nThis Firefox profile shouldn't be in use during the process.\n" - -[ "$QUICKSTART" = true ] && fStart - -echo -e "\nIn order to proceed, select a command below by entering its corresponding number.\n" - -select option in Start Help Exit; do - case $option in - Start) - fStart - ;; - Help) - fUsage - echo -e "\nThis script creates a backup of your prefs.js file before doing anything." - echo -e "It should be safe, but you can follow these steps if something goes wrong:\n" - echo "1. Make sure Firefox is closed." - echo "2. Delete prefs.js in your profile folder." - echo "3. Delete Invalidprefs.js if you have one in the same folder." - echo "4. Rename or copy your latest backup to prefs.js." - echo "5. Run Firefox and see if you notice anything wrong with it." - echo "6. If you do notice something wrong, especially with your extensions, and/or with the UI, go to about:support, and restart Firefox with add-ons disabled. Then, restart it again normally, and see if the problems were solved." - echo -e "If you are able to identify the cause of your issues, please bring it up on the arkenfox user.js GitHub repository.\n" - ;; - Exit) - fQuit 0 - ;; - esac -done - -fQuit 0 diff --git a/scratchpad-scripts/arkenfox-cleanup.js b/scratchpad-scripts/arkenfox-cleanup.js deleted file mode 100644 index 3434fc7..0000000 --- a/scratchpad-scripts/arkenfox-cleanup.js +++ /dev/null @@ -1,166 +0,0 @@ -/*** - This will reset the preferences that since FF91 have been - - removed from the arkenfox user.js - - deprecated by Mozilla but listed in the arkenfox user.js in the past - - There is an archived version at https://github.com/arkenfox/user.js/issues/123 - if you want the full list since jesus - - Last updated: 21-April-2025 - - Instructions: - - [optional] close Firefox and backup your profile - - [optional] disable your network connection [1] - - start Firefox - - load about:config and press Ctrl+Shift+K to open the Web Console for about:config - - using about:config is important, so the script has the right permissions - - paste this script - - if you edited the list of prefs in the script, make sure the last pref does not have a trailing comma - - hit enter - - check the Info output to see which prefs were reset - - restart - - some prefs require a restart - - a restart will reapply your user.js - - [optional] re-enable your network connection - - [1] Blocking Firefox from the internet ensures it cannot act on your reset preferences in the - period before you restart it, such as app and extension auto-updating, or downloading unwanted - components (GMP etc). It depends on what you're resetting and how long before you restart. - -***/ - -(() => { - - if ('undefined' === typeof(Services)) return alert('about:config needs to be the active tab!'); - - const aPREFS = [ - /* DEPRECATED */ - /* 129-140 */ - 'media.ondevicechange.enabled', // 137 - 'webchannel.allowObject.urlWhitelist', // 132 - /* 116-128 */ - 'browser.contentanalysis.default_allow', // 127 - 'browser.messaging-system.whatsNewPanel.enabled', // 126 - 'browser.ping-centre.telemetry', // 123 - 'dom.webnotifications.serviceworker.enabled', // 117 - 'javascript.use_us_english_locale', // 119 - 'layout.css.font-visibility.private', // 118 - 'layout.css.font-visibility.resistFingerprinting', // 116 - 'layout.css.font-visibility.standard', // 118 - 'layout.css.font-visibility.trackingprotection', // 118 - 'network.dns.skipTRR-when-parental-control-enabled', // 119 - 'permissions.delegation.enabled', // 118 - 'security.family_safety.mode', // 117 - 'widget.non-native-theme.enabled', // 127 - /* 103-115 */ - 'browser.cache.offline.enable', // 115 - 'extensions.formautofill.heuristics.enabled', // 114 - 'network.cookie.lifetimePolicy', // 103 [technically removed in 104] - 'privacy.clearsitedata.cache.enabled', // 114 - 'privacy.resistFingerprinting.testGranularityMask', // 114 - 'security.pki.sha1_enforcement_level', // 103 - /* 92-102 */ - 'browser.urlbar.suggest.quicksuggest', // 95 - 'dom.securecontext.whitelist_onions', // 97 - 'dom.storage.next_gen', // 102 - 'network.http.spdy.enabled', // 100 - 'network.http.spdy.enabled.deps', - 'network.http.spdy.enabled.http2', - 'network.http.spdy.websockets', - 'layout.css.font-visibility.level', // 94 - 'security.ask_for_password', // 102 - 'security.csp.enable', // 99 - 'security.password_lifetime', // 102 - 'security.ssl3.rsa_des_ede3_sha', // 93 - - /* REMOVED */ - /* 129-140 */ - 'dom.securecontext.allowlist_onions', - 'network.http.referer.hideOnionSource', - 'privacy.clearOnShutdown.cache', - 'privacy.clearOnShutdown.cookies', - 'privacy.clearOnShutdown.downloads', - 'privacy.clearOnShutdown.formdata', - 'privacy.clearOnShutdown.history', - 'privacy.clearOnShutdown.offlineApps', - 'privacy.clearOnShutdown.sessions', - 'privacy.cpd.cache', - 'privacy.cpd.cookies', - 'privacy.cpd.formdata', - 'privacy.cpd.history', - 'privacy.cpd.offlineApps', - 'privacy.cpd.sessions', - /* 116-128 */ - 'browser.fixup.alternate.enabled', - 'browser.taskbar.previews.enable', - 'browser.urlbar.dnsResolveSingleWordsAfterSearch', - 'geo.provider.network.url', - 'geo.provider.network.logging.enabled', - 'geo.provider.use_gpsd', - 'media.gmp-widevinecdm.enabled', - 'network.protocol-handler.external.ms-windows-store', - 'privacy.partition.always_partition_third_party_non_cookie_storage', - 'privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage', - 'privacy.partition.serviceWorkers', - /* 103-115 */ - 'beacon.enabled', - 'browser.startup.blankWindow', - 'browser.newtab.preload', - 'browser.newtabpage.activity-stream.feeds.discoverystreamfeed', - 'browser.newtabpage.activity-stream.feeds.snippets', - 'browser.region.network.url', - 'browser.region.update.enabled', - 'browser.search.region', - 'browser.ssl_override_behavior', - 'browser.tabs.warnOnClose', - 'devtools.chrome.enabled', - 'dom.disable_beforeunload', - 'dom.disable_open_during_load', - 'dom.netinfo.enabled', - 'dom.vr.enabled', - 'extensions.formautofill.addresses.supported', - 'extensions.formautofill.available', - 'extensions.formautofill.creditCards.available', - 'extensions.formautofill.creditCards.supported', - 'middlemouse.contentLoadURL', - 'network.http.altsvc.oe', - /* 92-102 */ - 'browser.urlbar.trimURLs', - 'dom.caches.enabled', - 'dom.storageManager.enabled', - 'dom.storage_access.enabled', - 'dom.targetBlankNoOpener.enabled', - 'network.cookie.thirdparty.sessionOnly', - 'network.cookie.thirdparty.nonsecureSessionOnly', - 'privacy.firstparty.isolate.block_post_message', - 'privacy.firstparty.isolate.restrict_opener_access', - 'privacy.firstparty.isolate.use_site', - 'privacy.window.name.update.enabled', - 'security.insecure_connection_text.enabled', - - /* IMPORTANT: last active pref must not have a trailing comma */ - /* reset parrot: check your open about:config after running the script */ - '_user.js.parrot' - ]; - - console.clear(); - - let c = 0; - for (const sPname of aPREFS) { - if (Services.prefs.prefHasUserValue(sPname)) { - Services.prefs.clearUserPref(sPname); - if (!Services.prefs.prefHasUserValue(sPname)) { - console.info('reset', sPname); - c++; - } else console.warn('failed to reset', sPname); - } - } - - focus(); - - const d = (c==1) ? ' pref' : ' prefs'; - alert(c ? 'successfully reset ' + c + d + "\n\nfor details check the console" : 'nothing to reset'); - - return 'all done'; - -})(); diff --git a/scratchpad-scripts/ghacks-clear-57-[changes-only].js b/scratchpad-scripts/ghacks-clear-57-[changes-only].js new file mode 100644 index 0000000..47b80d9 --- /dev/null +++ b/scratchpad-scripts/ghacks-clear-57-[changes-only].js @@ -0,0 +1,61 @@ +/*** + + For instructions see: + https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] + +***/ + +(function() { + let ops = [ + /* --- 57-alpha --- */ + /* commented out */ + 'browser.storageManager.enabled', + 'dom.storageManager.enabled', + /* removed from the user.js */ + 'browser.search.geoip.timeout', + 'geo.wifi.xhr.timeout', + 'gfx.layerscope.enabled', + 'media.webspeech.recognition.enable', + /* moved to RFP ALTERNATIVES */ + 'dom.w3c_touch_events.enabled', + 'media.video_stats.enabled', + /* moved to DEPRECATED/REMOVED */ + 'browser.bookmarks.showRecentlyBookmarked', + 'browser.casting.enabled', + 'devtools.webide.autoinstallFxdtAdapters', + 'media.eme.chromium-api.enabled', + 'social.directories', + 'social.enabled', + 'social.remote-install.enabled', + 'social.share.activationPanelEnabled', + 'social.shareDirectory', + 'social.toast-notifications.enabled', + 'social.whitelist', + /* reset parrot: check your open about:config after running the script */ + '_user.js.parrot' + ] + + if("undefined" === typeof(Services)) { + alert("about:config needs to be the active tab!"); + return; + } + + let c = 0; + for (let i = 0, len = ops.length; i < len; i++) { + if (Services.prefs.prefHasUserValue(ops[i])) { + Services.prefs.clearUserPref(ops[i]); + if (!Services.prefs.prefHasUserValue(ops[i])) { + console.log("reset", ops[i]); + c++; + } else { console.log("failed to reset", ops[i]); } + } + } + + focus(); + + let d = (c==1) ? " pref" : " prefs"; + if (c > 0) { + alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); + } else { alert("nothing to reset"); } + +})(); diff --git a/scratchpad-scripts/ghacks-clear-all-up-to-57-[RFP-alternatives].js b/scratchpad-scripts/ghacks-clear-all-up-to-57-[RFP-alternatives].js new file mode 100644 index 0000000..8979edd --- /dev/null +++ b/scratchpad-scripts/ghacks-clear-all-up-to-57-[RFP-alternatives].js @@ -0,0 +1,60 @@ +/*** + + This will reset the preferences that are under sections 4600 & 4700 in the ghacks user.js + up to and including release 57-alpha. These are the prefs that are no longer necessary, + or they conlfict with, privacy.resistFingerprinting if you have that enabled. + + For instructions see: + https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] + +***/ + +(function() { + let ops = [ + /* section 4600 */ + 'dom.maxHardwareConcurrency', + 'dom.enable_resource_timing', + 'dom.enable_performance', + 'device.sensors.enabled', + 'browser.zoom.siteSpecific', + 'dom.gamepad.enabled', + 'dom.netinfo.enabled', + 'media.webspeech.synth.enabled', + 'geo.enabled', + 'media.video_stats.enabled', + 'dom.w3c_touch_events.enabled', + /* section 4700 */ + 'general.useragent.override', + 'general.buildID.override', + 'general.appname.override', + 'general.appversion.override', + 'general.platform.override', + 'general.oscpu.override', + /* reset parrot: check your open about:config after running the script */ + '_user.js.parrot' + ] + + if("undefined" === typeof(Services)) { + alert("about:config needs to be the active tab!"); + return; + } + + let c = 0; + for (let i = 0, len = ops.length; i < len; i++) { + if (Services.prefs.prefHasUserValue(ops[i])) { + Services.prefs.clearUserPref(ops[i]); + if (!Services.prefs.prefHasUserValue(ops[i])) { + console.log("reset", ops[i]); + c++; + } else { console.log("failed to reset", ops[i]); } + } + } + + focus(); + + let d = (c==1) ? " pref" : " prefs"; + if (c > 0) { + alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); + } else { alert("nothing to reset"); } + +})(); diff --git a/scratchpad-scripts/ghacks-clear-all-up-to-57-[deprecated].js b/scratchpad-scripts/ghacks-clear-all-up-to-57-[deprecated].js new file mode 100644 index 0000000..39efa9e --- /dev/null +++ b/scratchpad-scripts/ghacks-clear-all-up-to-57-[deprecated].js @@ -0,0 +1,167 @@ +/*** + + This will reset the preferences that have been deprecated by Mozilla + and used in the ghacks user.js up to and including release 57-alpha + + It is in reverse order, so feel free to remove sections that do not apply + + For instructions see: + https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] + +***/ + +(function() { + let ops = [ + /* deprecated */ + + /* ESR52.x users can remove sections 53-57 but it is not + crucial as your user.js will reinstate them */ + /* 57 */ + 'social.whitelist', + 'social.toast-notifications.enabled', + 'social.shareDirectory', + 'social.remote-install.enabled', + 'social.directories', + 'social.share.activationPanelEnabled', + 'social.enabled', + 'media.eme.chromium-api.enabled', + 'devtools.webide.autoinstallFxdtAdapters', + 'browser.casting.enabled', + 'browser.bookmarks.showRecentlyBookmarked', + /* 56 */ + 'extensions.screenshots.system-disabled', + 'extensions.formautofill.experimental', + /* 55 */ + 'geo.security.allowinsecure', + 'browser.selfsupport.enabled', + 'browser.selfsupport.url', + 'browser.newtabpage.directory.ping', + 'browser.formfill.saveHttpsForms', + 'browser.formautofill.enabled', + 'dom.enable_user_timing', + 'dom.keyboardevent.code.enabled', + 'browser.tabs.animate', + 'browser.fullscreen.animate', + /* 54 */ + 'browser.safebrowsing.reportMalwareMistakeURL', + 'browser.safebrowsing.reportPhishMistakeURL', + 'media.eme.apiVisible', + 'dom.archivereader.enabled', + /* 53 */ + 'security.tls.unrestricted_rc4_fallback', + 'plugin.scan.Acrobat', + 'plugin.scan.Quicktime', + 'plugin.scan.WindowsMediaPlayer', + 'media.getusermedia.screensharing.allow_on_old_platforms', + 'dom.beforeAfterKeyboardEvent.enabled', + /* End of ESR52.x section */ + + /* 52 */ + 'network.http.sendSecureXSiteReferrer', + 'media.gmp-eme-adobe.enabled', + 'media.gmp-eme-adobe.visible', + 'media.gmp-eme-adobe.autoupdate', + 'dom.telephony.enabled', + 'dom.battery.enabled', + /* 51 */ + 'media.block-play-until-visible', + 'dom.vr.oculus050.enabled', + 'network.http.spdy.enabled.v3-1', + /* 50 */ + 'browser.usedOnWindows10.introURL', + 'plugins.update.notifyUser', + 'browser.safebrowsing.enabled', + 'security.ssl3.ecdhe_ecdsa_rc4_128_sha', + 'security.ssl3.ecdhe_rsa_rc4_128_sha', + 'security.ssl3.rsa_rc4_128_md5', + 'security.ssl3.rsa_rc4_128_sha', + 'plugins.update.url', + /* 49 */ + 'loop.enabled', + 'loop.server', + 'loop.feedback.formURL', + 'loop.feedback.manualFormURL', + 'loop.facebook.appId', + 'loop.facebook.enabled', + 'loop.facebook.fallbackUrl', + 'loop.facebook.shareUrl', + 'loop.logDomains', + 'dom.disable_window_open_feature.scrollbars', + 'dom.push.udp.wakeupEnabled', + /* 48 */ + 'browser.urlbar.unifiedcomplete', + /* 47 */ + 'toolkit.telemetry.unifiedIsOptIn', + 'datareporting.healthreport.about.reportUrlUnified', + 'browser.history.allowPopState', + 'browser.history.allowPushState', + 'browser.history.allowReplaceState', + /* 46 */ + 'datareporting.healthreport.service.enabled', + 'datareporting.healthreport.documentServerURI', + 'datareporting.policy.dataSubmissionEnabled.v2', + 'browser.safebrowsing.appRepURL', + 'browser.polaris.enabled', + 'browser.pocket.enabled', + 'browser.pocket.api', + 'browser.pocket.site', + 'browser.pocket.oAuthConsumerKey', + /* 45 */ + 'browser.sessionstore.privacy_level_deferred', + /* 44 */ + 'browser.safebrowsing.provider.google.appRepURL', + 'security.tls.insecure_fallback_hosts.use_static_list', + 'dom.workers.sharedWorkers.enabled', + 'dom.disable_image_src_set', + /* 43 */ + 'browser.safebrowsing.gethashURL', + 'browser.safebrowsing.updateURL', + 'browser.safebrowsing.malware.reportURL', + 'browser.trackingprotection.gethashURL', + 'browser.trackingprotection.updateURL', + 'pfs.datasource.url', + 'browser.search.showOneOffButtons', + /* 42 and earlier */ + 'privacy.clearOnShutdown.passwords', // 42 + 'full-screen-api.approval-required', // 42 + 'browser.safebrowsing.reportErrorURL', // 41 + 'browser.safebrowsing.reportGenericURL', // 41 + 'browser.safebrowsing.reportMalwareErrorURL', // 41 + 'browser.safebrowsing.reportMalwareURL', // 41 + 'browser.safebrowsing.reportURL', // 41 + 'plugins.enumerable_names', // 41 + 'network.http.spdy.enabled.http2draft', // 41 + 'camera.control.autofocus_moving_callback.enabled', // 37 + 'privacy.donottrackheader.value', // 36 + 'network.websocket.enabled', // 35 + 'dom.network.enabled', // 31 + 'pageThumbs.enabled', // 25 + + /* reset parrot: check your open about:config after running the script */ + '_user.js.parrot' + ] + + if("undefined" === typeof(Services)) { + alert("about:config needs to be the active tab!"); + return; + } + + let c = 0; + for (let i = 0, len = ops.length; i < len; i++) { + if (Services.prefs.prefHasUserValue(ops[i])) { + Services.prefs.clearUserPref(ops[i]); + if (!Services.prefs.prefHasUserValue(ops[i])) { + console.log("reset", ops[i]); + c++; + } else { console.log("failed to reset", ops[i]); } + } + } + + focus(); + + let d = (c==1) ? " pref" : " prefs"; + if (c > 0) { + alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); + } else { alert("nothing to reset"); } + +})(); diff --git a/scratchpad-scripts/ghacks-clear-all-up-to-57-[removed].js b/scratchpad-scripts/ghacks-clear-all-up-to-57-[removed].js new file mode 100644 index 0000000..3adc242 --- /dev/null +++ b/scratchpad-scripts/ghacks-clear-all-up-to-57-[removed].js @@ -0,0 +1,63 @@ +/*** + + This will reset the preferences that have been removed completely + from the ghacks user.js up to and including release 57-alpha + + For instructions see: + https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] + +***/ + +(function() { + let ops = [ + /* removed in ghacks user.js v52-57 */ + /* 52-alpha */ + 'browser.search.reset.enabled', + 'browser.search.reset.whitelist', + /* 54-alpha */ + 'browser.migrate.automigrate.enabled', + 'services.sync.enabled', + 'webextensions.storage.sync.enabled', + 'webextensions.storage.sync.serverURL', + /* 55-alpha */ + 'dom.keyboardevent.dispatch_during_composition', // default is false anyway + 'dom.vr.oculus.enabled', // covered by dom.vr.enabled + 'dom.vr.openvr.enabled', // ditto + 'dom.vr.osvr.enabled', // ditto + 'extensions.pocket.api', // covered by extensions.pocket.enabled + 'extensions.pocket.oAuthConsumerKey', // ditto + 'extensions.pocket.site', // ditto + /* 56-alpha: none */ + /* 57-alpha */ + 'geo.wifi.xhr.timeout', // covered by geo.enabled + 'browser.search.geoip.timeout', // ditto + 'media.webspeech.recognition.enable', // default is false anyway + 'gfx.layerscope.enabled', // default is false anyway + /* reset parrot: check your open about:config after running the script */ + '_user.js.parrot' + ] + + if("undefined" === typeof(Services)) { + alert("about:config needs to be the active tab!"); + return; + } + + let c = 0; + for (let i = 0, len = ops.length; i < len; i++) { + if (Services.prefs.prefHasUserValue(ops[i])) { + Services.prefs.clearUserPref(ops[i]); + if (!Services.prefs.prefHasUserValue(ops[i])) { + console.log("reset", ops[i]); + c++; + } else { console.log("failed to reset", ops[i]); } + } + } + + focus(); + + let d = (c==1) ? " pref" : " prefs"; + if (c > 0) { + alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); + } else { alert("nothing to reset"); } + +})(); diff --git a/scratchpad-scripts/ghacks-clear-all-up-to-57-[the-rest-active].js b/scratchpad-scripts/ghacks-clear-all-up-to-57-[the-rest-active].js new file mode 100644 index 0000000..bea6d38 --- /dev/null +++ b/scratchpad-scripts/ghacks-clear-all-up-to-57-[the-rest-active].js @@ -0,0 +1,409 @@ +/*** + + This will reset EVERYTHING that is ACTIVE in the ghacks user.js + release 57-alpha master, but excludes the following: + - prefs removed since publishing on github + - e10s section 1100 + - privacy.resistFingerprinting alternatives sections 4600 & 4700 + - deprecated section 9999 + + It does not matter if you clear everything, as a restart will reapply your user.js + Total 477 prefs from 57-alpha master: 118 inactive, 359 active + These have been broken into two scripts for convenience + + For instructions see: + https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] + +***/ + +(function() { + let ops = [ + /* 359 ACTIVE prefs in 57-alpha master */ + 'accessibility.force_disabled', + 'alerts.showFavicons', + 'app.update.auto', + 'app.update.service.enabled', + 'app.update.silent', + 'app.update.staging.enabled', + 'beacon.enabled', + 'breakpad.reportURL', + 'browser.aboutHomeSnippets.updateUrl', + 'browser.backspace_action', + 'browser.bookmarks.max_backups', + 'browser.cache.disk.capacity', + 'browser.cache.disk.enable', + 'browser.cache.disk.smart_size.enabled', + 'browser.cache.disk.smart_size.first_run', + 'browser.cache.disk_cache_ssl', + 'browser.cache.frecency_experiment', + 'browser.cache.offline.enable', + 'browser.crashReports.unsubmittedCheck.autoSubmit', + 'browser.crashReports.unsubmittedCheck.enabled', + 'browser.ctrlTab.previews', + 'browser.display.use_document_fonts', + 'browser.download.folderList', + 'browser.download.forbid_open_with', + 'browser.download.hide_plugins_without_extensions', + 'browser.download.manager.addToRecentDocs', + 'browser.download.useDownloadDir', + 'browser.eme.ui.enabled', + 'browser.fixup.alternate.enabled', + 'browser.fixup.hide_user_pass', + 'browser.formfill.enable', + 'browser.helperApps.deleteTempFileOnExit', + 'browser.laterrun.enabled', + 'browser.library.activity-stream.enabled', + 'browser.link.open_newwindow', + 'browser.link.open_newwindow.restriction', + 'browser.newtab.preload', + 'browser.newtabpage.activity-stream.enabled', + 'browser.newtabpage.directory.source', + 'browser.newtabpage.enabled', + 'browser.newtabpage.enhanced', + 'browser.newtabpage.introShown', + 'browser.offline-apps.notify', + 'browser.onboarding.enabled', + 'browser.pagethumbnails.capturing_disabled', + 'browser.ping-centre.telemetry', + 'browser.rights.3.shown', + 'browser.safebrowsing.downloads.remote.enabled', + 'browser.safebrowsing.downloads.remote.url', + 'browser.safebrowsing.provider.google.reportMalwareMistakeURL', + 'browser.safebrowsing.provider.google.reportPhishMistakeURL', + 'browser.safebrowsing.provider.google.reportURL', + 'browser.safebrowsing.provider.google4.reportMalwareMistakeURL', + 'browser.safebrowsing.provider.google4.reportPhishMistakeURL', + 'browser.safebrowsing.provider.google4.reportURL', + 'browser.safebrowsing.reportPhishURL', + 'browser.search.countryCode', + 'browser.search.geoip.url', + 'browser.search.geoSpecificDefaults', + 'browser.search.geoSpecificDefaults.url', + 'browser.search.region', + 'browser.search.suggest.enabled', + 'browser.search.update', + 'browser.send_pings', + 'browser.send_pings.require_same_host', + 'browser.sessionhistory.max_entries', + 'browser.sessionstore.interval', + 'browser.sessionstore.max_tabs_undo', + 'browser.sessionstore.max_windows_undo', + 'browser.sessionstore.privacy_level', + 'browser.sessionstore.resume_from_crash', + 'browser.shell.checkDefaultBrowser', + 'browser.shell.shortcutFavicons', + 'browser.slowStartup.maxSamples', + 'browser.slowStartup.notificationDisabled', + 'browser.slowStartup.samples', + 'browser.ssl_override_behavior', + 'browser.startup.homepage_override.mstone', + 'browser.tabs.closeWindowWithLastTab', + 'browser.tabs.crashReporting.sendReport', + 'browser.tabs.insertRelatedAfterCurrent', + 'browser.tabs.loadDivertedInBackground', + 'browser.tabs.loadInBackground', + 'browser.tabs.selectOwnerOnClose', + 'browser.tabs.warnOnClose', + 'browser.tabs.warnOnCloseOtherTabs', + 'browser.tabs.warnOnOpen', + 'browser.taskbar.lists.enabled', + 'browser.taskbar.lists.frequent.enabled', + 'browser.taskbar.lists.recent.enabled', + 'browser.taskbar.lists.tasks.enabled', + 'browser.taskbar.previews.enable', + 'browser.uitour.enabled', + 'browser.uitour.url', + 'browser.urlbar.autoFill', + 'browser.urlbar.autoFill.typed', + 'browser.urlbar.clickSelectsAll', + 'browser.urlbar.decodeURLsOnCopy', + 'browser.urlbar.doubleClickSelectsAll', + 'browser.urlbar.filter.javascript', + 'browser.urlbar.maxHistoricalSearchSuggestions', + 'browser.urlbar.oneOffSearches', + 'browser.urlbar.speculativeConnect.enabled', + // 'browser.urlbar.suggest.bookmark', // this may not get reset by your user.js - see issue #308 + // 'browser.urlbar.suggest.history', // ditto + // 'browser.urlbar.suggest.openpage', // ditto + 'browser.urlbar.suggest.searches', + 'browser.urlbar.trimURLs', + 'browser.urlbar.usepreloadedtopurls.enabled', + 'browser.urlbar.userMadeSearchSuggestionsChoice', + 'browser.xul.error_pages.expert_bad_cert', + 'camera.control.face_detection.enabled', + 'canvas.capturestream.enabled', + 'captivedetect.canonicalURL', + 'datareporting.healthreport.about.reportUrl', + 'datareporting.healthreport.uploadEnabled', + 'datareporting.policy.dataSubmissionEnabled', + 'device.storage.enabled', + 'devtools.chrome.enabled', + 'devtools.debugger.remote-enabled', + 'devtools.webide.autoinstallADBHelper', + 'devtools.webide.enabled', + 'dom.allow_cut_copy', + 'dom.allow_scripts_to_close_windows', + 'dom.caches.enabled', + 'dom.disable_beforeunload', + 'dom.disable_window_flip', + 'dom.disable_window_move_resize', + 'dom.disable_window_open_feature.close', + 'dom.disable_window_open_feature.location', + 'dom.disable_window_open_feature.menubar', + 'dom.disable_window_open_feature.minimizable', + 'dom.disable_window_open_feature.personalbar', + 'dom.disable_window_open_feature.resizable', + 'dom.disable_window_open_feature.status', + 'dom.disable_window_open_feature.titlebar', + 'dom.disable_window_open_feature.toolbar', + 'dom.disable_window_status_change', + 'dom.event.clipboardevents.enabled', + 'dom.flyweb.enabled', + 'dom.idle-observers-api.enabled', + 'dom.imagecapture.enabled', + 'dom.IntersectionObserver.enabled', + 'dom.ipc.plugins.flash.subprocess.crashreporter.enabled', + 'dom.ipc.plugins.reportCrashURL', + 'dom.popup_allowed_events', + 'dom.popup_maximum', + 'dom.push.connection.enabled', + 'dom.push.enabled', + 'dom.push.serverURL', + 'dom.push.userAgentID', + 'dom.serviceWorkers.enabled', + 'dom.vibrator.enabled', + 'dom.webaudio.enabled', + 'dom.webnotifications.enabled', + 'dom.webnotifications.serviceworker.enabled', + 'dom.workers.enabled', + 'experiments.activeExperiment', + 'experiments.enabled', + 'experiments.manifest.uri', + 'experiments.supported', + 'extensions.autoDisableScopes', + 'extensions.blocklist.enabled', + 'extensions.blocklist.url', + 'extensions.enabledScopes', + 'extensions.formautofill.addresses.enabled', + 'extensions.formautofill.available', + 'extensions.formautofill.creditCards.enabled', + 'extensions.formautofill.heuristics.enabled', + 'extensions.getAddons.cache.enabled', + 'extensions.getAddons.showPane', + 'extensions.pocket.enabled', + 'extensions.shield-recipe-client.api_url', + 'extensions.shield-recipe-client.enabled', + 'extensions.update.autoUpdateDefault', + 'extensions.webcompat-reporter.enabled', + 'extensions.webextensions.keepStorageOnUninstall', + 'extensions.webextensions.keepUuidOnUninstall', + 'extensions.webservice.discoverURL', + 'font.blacklist.underline_offset', + 'full-screen-api.enabled', + 'general.useragent.compatMode.firefox', + 'general.useragent.locale', + 'general.warnOnAboutConfig', + 'geo.wifi.uri', + 'gfx.downloadable_fonts.enabled', + 'gfx.downloadable_fonts.woff2.enabled', + 'gfx.font_rendering.graphite.enabled', + 'gfx.font_rendering.opentype_svg.enabled', + 'gfx.offscreencanvas.enabled', + 'intl.accept_languages', + 'intl.locale.matchOS', + 'intl.regional_prefs.use_os_locales', + 'javascript.options.asmjs', + 'javascript.options.wasm', + 'javascript.use_us_english_locale', + 'keyword.enabled', + 'layers.acceleration.disabled', + 'layout.css.font-loading-api.enabled', + 'layout.css.visited_links_enabled', + 'layout.spellcheckDefault', + 'lightweightThemes.update.enabled', + 'mathml.disabled', + 'media.autoplay.enabled', + 'media.block-autoplay-until-in-foreground', + 'media.eme.enabled', + 'media.getusermedia.audiocapture.enabled', + 'media.getusermedia.browser.enabled', + 'media.getusermedia.screensharing.allowed_domains', + 'media.getusermedia.screensharing.enabled', + 'media.gmp-gmpopenh264.autoupdate', + 'media.gmp-gmpopenh264.enabled', + 'media.gmp-manager.updateEnabled', + 'media.gmp-manager.url', + 'media.gmp-manager.url.override', + 'media.gmp-provider.enabled', + 'media.gmp-widevinecdm.autoupdate', + 'media.gmp-widevinecdm.enabled', + 'media.gmp-widevinecdm.visible', + 'media.gmp.trial-create.enabled', + 'media.navigator.enabled', + 'media.navigator.video.enabled', + 'media.ondevicechange.enabled', + 'media.peerconnection.enabled', + 'media.peerconnection.ice.default_address_only', + 'media.peerconnection.ice.no_host', + 'media.peerconnection.ice.tcp', + 'media.peerconnection.identity.enabled', + 'media.peerconnection.identity.timeout', + 'media.peerconnection.turn.disable', + 'media.peerconnection.use_document_iceservers', + 'media.peerconnection.video.enabled', + 'middlemouse.contentLoadURL', + 'network.allow-experiments', + 'network.auth.subresource-img-cross-origin-http-auth-allow', + 'network.captive-portal-service.enabled', + 'network.cookie.cookieBehavior', + 'network.cookie.leave-secure-alone', + 'network.cookie.thirdparty.sessionOnly', + 'network.dns.blockDotOnion', + 'network.dns.disablePrefetch', + 'network.dns.disablePrefetchFromHTTPS', + 'network.http.altsvc.enabled', + 'network.http.altsvc.oe', + 'network.http.redirection-limit', + 'network.http.referer.hideOnionSource', + 'network.http.referer.spoofSource', + 'network.http.referer.trimmingPolicy', + 'network.http.referer.userControlPolicy', + 'network.http.referer.XOriginPolicy', + 'network.http.referer.XOriginTrimmingPolicy', + 'network.http.sendRefererHeader', + 'network.http.spdy.enabled', + 'network.http.spdy.enabled.deps', + 'network.http.spdy.enabled.http2', + 'network.http.speculative-parallel-limit', + 'network.IDN_show_punycode', + 'network.jar.block-remote-files', + 'network.jar.open-unsafe-types', + 'network.manage-offline-status', + 'network.predictor.enable-prefetch', + 'network.predictor.enabled', + 'network.prefetch-next', + 'network.protocol-handler.external.ms-windows-store', + 'network.proxy.autoconfig_url.include_path', + 'network.proxy.socks_remote_dns', + 'network.stricttransportsecurity.preloadlist', + 'offline-apps.allow_by_default', + 'pdfjs.disabled', + 'pdfjs.enableWebGL', + 'permissions.manager.defaultsUrl', + 'plugin.default.state', + 'plugin.defaultXpi.state', + 'plugin.scan.plid.all', + 'plugin.sessionPermissionNow.intervalInMinutes', + 'plugins.click_to_play', + 'privacy.clearOnShutdown.cache', + 'privacy.clearOnShutdown.cookies', + 'privacy.clearOnShutdown.downloads', + 'privacy.clearOnShutdown.formdata', + 'privacy.clearOnShutdown.history', + 'privacy.clearOnShutdown.offlineApps', + 'privacy.clearOnShutdown.sessions', + 'privacy.clearOnShutdown.siteSettings', + 'privacy.cpd.cache', + 'privacy.cpd.cookies', + 'privacy.cpd.formdata', + 'privacy.cpd.history', + 'privacy.cpd.offlineApps', + 'privacy.cpd.passwords', + 'privacy.cpd.sessions', + 'privacy.cpd.siteSettings', + 'privacy.donottrackheader.enabled', + 'privacy.firstparty.isolate', + 'privacy.firstparty.isolate.restrict_opener_access', + 'privacy.resistFingerprinting', + 'privacy.sanitize.sanitizeOnShutdown', + 'privacy.sanitize.timeSpan', + 'privacy.trackingprotection.ui.enabled', + 'security.ask_for_password', + 'security.block_script_with_wrong_mime', + 'security.cert_pinning.enforcement_level', + 'security.csp.enable', + 'security.csp.experimentalEnabled', + 'security.data_uri.block_toplevel_data_uri_navigations', + 'security.dialog_enable_delay', + 'security.family_safety.mode', + 'security.fileuri.strict_origin_policy', + 'security.insecure_field_warning.contextual.enabled', + 'security.insecure_password.ui.enabled', + 'security.mixed_content.block_active_content', + 'security.mixed_content.send_hsts_priming', + 'security.mixed_content.use_hsts', + 'security.OCSP.enabled', + 'security.OCSP.require', + 'security.password_lifetime', + 'security.pki.sha1_enforcement_level', + 'security.sri.enable', + 'security.ssl.disable_session_identifiers', + 'security.ssl.enable_ocsp_stapling', + 'security.ssl.errorReporting.automatic', + 'security.ssl.errorReporting.enabled', + 'security.ssl.errorReporting.url', + 'security.ssl.treat_unsafe_negotiation_as_broken', + 'security.tls.enable_0rtt_data', + 'security.tls.version.fallback-limit', + 'security.tls.version.max', + 'security.tls.version.min', + 'security.xpconnect.plugin.unrestricted', + 'services.blocklist.signing.enforced', + 'services.blocklist.update_enabled', + 'signon.autofillForms', + 'signon.autofillForms.http', + 'signon.formlessCapture.enabled', + 'signon.storeWhenAutocompleteOff', + 'startup.homepage_override_url', + 'startup.homepage_welcome_url', + 'startup.homepage_welcome_url.additional', + 'toolkit.telemetry.archive.enabled', + 'toolkit.telemetry.bhrPing.enabled', + 'toolkit.telemetry.cachedClientID', + 'toolkit.telemetry.enabled', + 'toolkit.telemetry.firstShutdownPing.enabled', + 'toolkit.telemetry.newProfilePing.enabled', + 'toolkit.telemetry.server', + 'toolkit.telemetry.shutdownPingSender.enabled', + 'toolkit.telemetry.unified', + 'toolkit.telemetry.updatePing.enabled', + 'ui.submenuDelay', + 'ui.use_standins_for_native_colors', + 'view_source.tab', + 'webchannel.allowObject.urlWhitelist', + 'webgl.disable-extensions', + 'webgl.disable-fail-if-major-performance-caveat', + 'webgl.disabled', + 'webgl.dxgl.enabled', + 'webgl.enable-debug-renderer-info', + 'webgl.enable-webgl2', + 'webgl.min_capability_mode', + + /* reset parrot: check your open about:config after running the script */ + '_user.js.parrot' + ] + + if("undefined" === typeof(Services)) { + alert("about:config needs to be the active tab!"); + return; + } + + let c = 0; + for (let i = 0, len = ops.length; i < len; i++) { + if (Services.prefs.prefHasUserValue(ops[i])) { + Services.prefs.clearUserPref(ops[i]); + if (!Services.prefs.prefHasUserValue(ops[i])) { + console.log("reset", ops[i]); + c++; + } else { console.log("failed to reset", ops[i]); } + } + } + + focus(); + + let d = (c==1) ? " pref" : " prefs"; + if (c > 0) { + alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); + } else { alert("nothing to reset"); } + +})(); diff --git a/scratchpad-scripts/ghacks-clear-all-up-to-57-[the-rest-inactive].js b/scratchpad-scripts/ghacks-clear-all-up-to-57-[the-rest-inactive].js new file mode 100644 index 0000000..8b62def --- /dev/null +++ b/scratchpad-scripts/ghacks-clear-all-up-to-57-[the-rest-inactive].js @@ -0,0 +1,167 @@ +/*** + + This will reset EVERYTHING that is INACTIVE in the ghacks user.js + release 57-alpha master, but excludes the following: + - prefs removed since publishing on github + - e10s section 1100 + - privacy.resistFingerprinting alternatives sections 4600 & 4700 + - deprecated section 9999 + + It does not matter if you clear everything, as a restart will reapply your user.js + Total 477 prefs from 57-alpha master: 118 inactive, 359 active + These have been broken into two scripts for convenience + + For instructions see: + https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.1-Resetting-Inactive-Prefs-[Scripts] + +***/ + +(function() { + let ops = [ + /* 118 INACTIVE prefs in 57-alpha master */ + 'accessibility.typeaheadfind', + 'app.update.enabled', + 'browser.cache.memory.capacity', + 'browser.cache.memory.enable', + 'browser.chrome.favicons', + 'browser.chrome.site_icons', + 'browser.download.autohideButton', + 'browser.privatebrowsing.autostart', + 'browser.safebrowsing.allowOverride', + 'browser.safebrowsing.blockedURIs.enabled', + 'browser.safebrowsing.downloads.enabled', + 'browser.safebrowsing.downloads.remote.block_dangerous', + 'browser.safebrowsing.downloads.remote.block_dangerous_host', + 'browser.safebrowsing.downloads.remote.block_potentially_unwanted', + 'browser.safebrowsing.downloads.remote.block_uncommon', + 'browser.safebrowsing.malware.enabled', + 'browser.safebrowsing.phishing.enabled', + 'browser.safebrowsing.provider.google.gethashURL', + 'browser.safebrowsing.provider.google.updateURL', + 'browser.safebrowsing.provider.google4.gethashURL', + 'browser.safebrowsing.provider.google4.updateURL', + 'browser.safebrowsing.provider.mozilla.gethashURL', + 'browser.safebrowsing.provider.mozilla.updateURL', + 'browser.sessionhistory.max_total_viewers', + 'browser.startup.page', + 'browser.stopReloadAnimation.enabled', + 'browser.storageManager.enabled', + 'browser.tabs.loadBookmarksInTabs', + 'browser.urlbar.autocomplete.enabled', + 'browser.urlbar.maxRichResults', + 'clipboard.autocopy', + 'dom.event.contextmenu.enabled', + 'dom.indexedDB.enabled', + 'dom.presentation.controller.enabled', + 'dom.presentation.discoverable', + 'dom.presentation.discovery.enabled', + 'dom.presentation.enabled', + 'dom.presentation.receiver.enabled', + 'dom.presentation.session_transport.data_channel.enable', + 'dom.storage.enabled', + 'dom.storageManager.enabled', + 'dom.vr.enabled', + 'extensions.screenshots.disabled', + 'extensions.systemAddon.update.url', + 'extensions.update.enabled', + 'font.name.monospace.x-unicode', + 'font.name.monospace.x-western', + 'font.name.sans-serif.x-unicode', + 'font.name.sans-serif.x-western', + 'font.name.serif.x-unicode', + 'font.name.serif.x-western', + 'font.system.whitelist', + 'full-screen-api.warning.delay', + 'full-screen-api.warning.timeout', + 'general.autoScroll', + 'geo.wifi.logging.enabled', + 'gfx.direct2d.disabled', + 'javascript.options.baselinejit', + 'javascript.options.ion', + 'media.flac.enabled', + 'media.mediasource.enabled', + 'media.mediasource.mp4.enabled', + 'media.mediasource.webm.audio.enabled', + 'media.mediasource.webm.enabled', + 'media.mp4.enabled', + 'media.ogg.enabled', + 'media.ogg.flac.enabled', + 'media.opus.enabled', + 'media.raw.enabled', + 'media.wave.enabled', + 'media.webm.enabled', + 'media.wmf.amd.vp9.enabled', + 'media.wmf.enabled', + 'media.wmf.vp9.enabled', + 'network.cookie.lifetime.days', + 'network.cookie.lifetimePolicy', + 'network.dns.disableIPv6', + 'network.dnsCacheEntries', + 'network.dnsCacheExpiration', + 'network.http.fast-fallback-to-IPv4', + 'offline-apps.quota.warn', + 'permissions.memory_only', + 'places.history.enabled', + 'plugin.state.flash', + 'privacy.clearOnShutdown.openWindows', + 'privacy.cpd.downloads', + 'privacy.cpd.openWindows', + 'privacy.resistFingerprinting.block_mozAddonManager', + 'privacy.trackingprotection.annotate_channels', + 'privacy.trackingprotection.enabled', + 'privacy.trackingprotection.lower_network_priority', + 'privacy.trackingprotection.pbmode.enabled', + 'privacy.usercontext.about_newtab_segregation.enabled', + 'privacy.userContext.enabled', + 'privacy.userContext.longPressBehavior', + 'privacy.userContext.ui.enabled', + 'privacy.window.maxInnerHeight', + 'privacy.window.maxInnerWidth', + 'reader.parse-on-load.enabled', + 'security.mixed_content.block_display_content', + 'security.nocertdb', + 'security.ssl.require_safe_negotiation', + 'security.ssl3.dhe_rsa_aes_128_sha', + 'security.ssl3.dhe_rsa_aes_256_sha', + 'security.ssl3.ecdhe_ecdsa_aes_128_sha', + 'security.ssl3.ecdhe_rsa_aes_128_sha', + 'security.ssl3.rsa_aes_128_sha', + 'security.ssl3.rsa_aes_256_sha', + 'security.ssl3.rsa_des_ede3_sha', + 'services.blocklist.addons.collection', + 'services.blocklist.gfx.collection', + 'services.blocklist.onecrl.collection', + 'services.blocklist.plugins.collection', + 'signon.rememberSignons', + 'svg.disabled', + 'toolkit.cosmeticAnimations.enabled', + 'urlclassifier.trackingTable', + 'xpinstall.signatures.required', + /* reset parrot: check your open about:config after running the script */ + '_user.js.parrot' + ] + + if("undefined" === typeof(Services)) { + alert("about:config needs to be the active tab!"); + return; + } + + let c = 0; + for (let i = 0, len = ops.length; i < len; i++) { + if (Services.prefs.prefHasUserValue(ops[i])) { + Services.prefs.clearUserPref(ops[i]); + if (!Services.prefs.prefHasUserValue(ops[i])) { + console.log("reset", ops[i]); + c++; + } else { console.log("failed to reset", ops[i]); } + } + } + + focus(); + + let d = (c==1) ? " pref" : " prefs"; + if (c > 0) { + alert("successfully reset " + c + d + "\n\nfor details check the Browser Console (Ctrl+Shift+J)"); + } else { alert("nothing to reset"); } + +})(); diff --git a/scratchpad-scripts/troubleshooter.js b/scratchpad-scripts/troubleshooter.js index bd86786..3c8d96a 100644 --- a/scratchpad-scripts/troubleshooter.js +++ b/scratchpad-scripts/troubleshooter.js @@ -1,10 +1,65 @@ -/*** arkenfox user.js troubleshooter.js v1.6.3 ***/ + +/*** ghacks-user.js troubleshooter.js v1.4 ***/ (function() { - if ("undefined" === typeof(Services)) return alert('about:config needs to be the active tab!'); + if("undefined" === typeof(Services)) { + alert("about:config needs to be the active tab!"); + return; + } - const aPREFS = [ + function getMyList(arr) { + let aRet = []; + let dummy = 0; + for (let i = 0, len = arr.length; i < len; i++) { + if (Services.prefs.prefHasUserValue(arr[i])) { + dummy = Services.prefs.getPrefType(arr[i]); + switch (dummy) { + case 32: // string (see https://dxr.mozilla.org/mozilla-central/source/modules/libpref/nsIPrefBranch.idl#31) + dummy = Services.prefs.getCharPref(arr[i]); + aRet.push({'name':arr[i],'value': dummy,'type':32}); + break; + case 64: // int + dummy = Services.prefs.getIntPref(arr[i]); + aRet.push({'name':arr[i],'value': dummy,'type':64}); + break; + case 128: // boolean + dummy = Services.prefs.getBoolPref(arr[i]); + aRet.push({'name':arr[i],'value': dummy,'type':128}); + break; + default: + console.log("error detecting pref-type for '"+arr[i]+"' !"); + } + } + } + return aRet; + } + + function reapply(arr) { + for (let i = 0, len = arr.length; i < len; i++) { + switch (arr[i].type) { + case 32: // string + Services.prefs.setCharPref(arr[i].name, arr[i].value); + break; + case 64: // int + Services.prefs.setIntPref(arr[i].name, arr[i].value); + break; + case 128: // boolean + Services.prefs.setBoolPref(arr[i].name, arr[i].value); + break; + default: + console.log("error re-appyling value for '"+arr[i].name+"' !"); // should never happen + } + } + } + + function myreset(arr) { + for (let i = 0, len = arr.length; i < len; i++) { + Services.prefs.clearUserPref(arr[i].name); + } + } + + let ops = [ /* known culprits */ 'network.cookie.cookieBehavior', @@ -16,7 +71,9 @@ /* Storage + Cache */ 'browser.cache.offline.enable', + 'dom.indexedDB.enabled', 'dom.storage.enabled', + 'browser.storageManager.enabled', 'dom.storageManager.enabled', /* Workers, Web + Push Notifications */ @@ -25,12 +82,14 @@ 'dom.push.enabled', 'dom.push.serverURL', 'dom.serviceWorkers.enabled', + 'dom.workers.enabled', 'dom.webnotifications.enabled', 'dom.webnotifications.serviceworker.enabled', /* Fonts */ 'browser.display.use_document_fonts', 'font.blacklist.underline_offset', + 'gfx.downloadable_fonts.woff2.enabled', 'gfx.font_rendering.graphite.enabled', 'gfx.font_rendering.opentype_svg.enabled', 'layout.css.font-loading-api.enabled', @@ -43,10 +102,12 @@ 'dom.IntersectionObserver.enabled', 'dom.popup_allowed_events', 'full-screen-api.enabled', + 'geo.wifi.uri', 'intl.accept_languages', 'javascript.options.asmjs', 'javascript.options.wasm', 'permissions.default.shortcuts', + 'security.csp.experimentalEnabled', /* Hardware */ 'dom.vr.enabled', @@ -54,8 +115,15 @@ /* Audio + Video */ 'dom.webaudio.enabled', - 'media.autoplay.default', // FF63+ - 'media.autoplay.blocking_policy', // FF78+ + 'media.autoplay.enabled', + 'media.flac.enabled', + 'media.mp4.enabled', + 'media.ogg.enabled', + 'media.opus.enabled', + 'media.raw.enabled', + 'media.wave.enabled', + 'media.webm.enabled', + 'media.wmf.enabled', /* Forms */ 'browser.formfill.enable', @@ -65,6 +133,7 @@ /* HTTPS */ 'security.cert_pinning.enforcement_level', 'security.family_safety.mode', + 'security.mixed_content.use_hsts', 'security.OCSP.require', 'security.pki.sha1_enforcement_level', 'security.ssl.require_safe_negotiation', @@ -82,129 +151,82 @@ /* Plugins + Flash */ 'plugin.default.state', + 'plugin.defaultXpi.state', + 'plugin.sessionPermissionNow.intervalInMinutes', 'plugin.state.flash', /* unlikely to cause problems */ + 'browser.tabs.remote.allowLinkedWebInFileUriProcess', 'dom.popup_maximum', - 'geo.provider.network.url', 'layout.css.visited_links_enabled', 'mathml.disabled', - 'network.auth.subresource-http-auth-allow', + 'network.auth.subresource-img-cross-origin-http-auth-allow', 'network.http.redirection-limit', 'network.protocol-handler.external.ms-windows-store', 'privacy.trackingprotection.enabled', 'security.data_uri.block_toplevel_data_uri_navigations', - 'privacy.window.name.update.enabled', // FF82+ + + /* FF User-Interface */ + 'browser.search.suggest.enabled', + 'browser.urlbar.autoFill', + 'browser.urlbar.autoFill.typed', + 'browser.urlbar.oneOffSearches', + 'browser.urlbar.suggest.searches', + 'keyword.enabled', 'last.one.without.comma' ] - // any runtime-set pref that everyone will have and that can be safely reset - const oFILLER = { type: 64, name: 'app.update.lastUpdateTime.browser-cleanup-thumbnails', value: 1580000000 }; - function getMyList(arr) { - const aRet = []; - for (const sPname of arr) { - if (Services.prefs.prefHasUserValue(sPname)) { - const ptype = Services.prefs.getPrefType(sPname); - switch (ptype) { - case 32: // string (see https://dxr.mozilla.org/mozilla-central/source/modules/libpref/nsIPrefBranch.idl#31) - aRet.push({'type':ptype,'name':sPname,'value':Services.prefs.getCharPref(sPname)}); - break; - case 64: // int - aRet.push({'type':ptype,'name':sPname,'value':Services.prefs.getIntPref(sPname)}); - break; - case 128: // boolean - aRet.push({'type':ptype,'name':sPname,'value':Services.prefs.getBoolPref(sPname)}); - break; - default: - console.log("error detecting pref-type for '"+sPname+"' !"); - } - } - } - return aRet; - } + // reset prefs that set the same value as FFs default value + let aTEMP = getMyList(ops); + myreset(aTEMP); + reapply(aTEMP); - function reapply(arr) { - for (const oPref of arr) { - switch (oPref.type) { - case 32: // string - Services.prefs.setCharPref(oPref.name, oPref.value); - break; - case 64: // int - Services.prefs.setIntPref(oPref.name, oPref.value); - break; - case 128: // boolean - Services.prefs.setBoolPref(oPref.name, oPref.value); - break; - default: - console.log("error re-appyling value for '"+oPref.name+"' !"); // should never happen - } - } - } - - function myreset(arr) { - for (const oPref of arr) Services.prefs.clearUserPref(oPref.name); - } - - function resetAllMatchingDefault(arr) { - const aTmp = getMyList(arr); - myreset(aTmp); - reapply(aTmp); - } - - function _main(aALL) { - const _h = (arr) => Math.ceil(arr.length/2); - - let aTmp = aALL, aDbg = aALL; - reapply(aALL); - myreset(aTmp.slice(0, _h(aTmp))); - while (aTmp.length) { - alert('NOW TEST AGAIN !'); - if (confirm('if the problem still exists click OK, otherwise click Cancel.')) { - aTmp = aTmp.slice(_h(aTmp)); - } else { - aTmp = aTmp.slice(0, _h(aTmp)); - aDbg = aTmp; // update narrowed down list - if (aDbg.length == 1) break; - } - reapply(aALL); - myreset(aTmp.slice(0, _h(aTmp))); // reset half of the remaining prefs - } - reapply(aALL); - - if (aDbg.length == 1) return alert("narrowed it down to:\n\n"+aDbg[0].name+"\n"); - if (aDbg.length == aALL.length) { - const msg = "Failed to narrow it down beyond the initial "+aALL.length+" prefs. The problem is most likely caused by at least 2 prefs!\n\n" + - "Either those prefs are too far apart in the list or there are exactly 2 culprits and they just happen to be at the wrong place.\n\n" + - "In case it's the latter, the script can add a dummy pref and you can try again - Try again?"; - if (confirm(msg)) return _main([...aALL, oFILLER]); - } else if (aDbg.length > 10 && confirm("Narrowed it down to "+aDbg.length+" prefs. Try narrowing it down further?")) { - return _main(aDbg.reverse()); - } - - alert("Narrowed it down to "+ aDbg.length.toString() +" prefs, check the console ..."); - console.log('The problem is caused by 2 or more of these prefs:'); - for (const oPref of aDbg) console.log(oPref.name); - } - - - resetAllMatchingDefault(aPREFS); // reset user-set prefs matching FFs default value - - const aBAK = getMyList(aPREFS); - //console.log(aBAK.length, "user-set prefs from our list detected and their values stored."); - - const sMsg = "all detected prefs reset.\n\n" + - "!! KEEP THIS PROMPT OPEN AND TEST THE SITE IN ANOTHER TAB !!\n\n" + - "IF the problem still exists, this script can't help you - click Cancel to re-apply your values and exit.\n\n" + - "Click OK if your problem is fixed."; + const aBACKUP = getMyList(ops); + //console.log(aBACKUP.length, "user-set prefs from our list detected and their values stored."); + let myArr = aBACKUP; + let found = false; + let aDbg = []; focus(); - myreset(aBAK); - if (!confirm(sMsg)) { - reapply(aBAK); + myreset(aBACKUP); // reset all detected prefs + if (confirm("all detected prefs reset.\n\n!! KEEP THIS PROMPT OPEN AND TEST THE SITE IN ANOTHER TAB !!\n\nIF the problem still exists, this script can't help you - click cancel to re-apply your values and exit.\n\nClick OK if your problem is fixed.")) { + aDbg = myArr; + reapply(aBACKUP); + myreset(myArr.slice(0, parseInt(myArr.length/2))); + while (myArr.length >= 2) { + alert("NOW TEST AGAIN !"); + if (confirm("if the problem still exists click OK, otherwise click cancel.")) { + myArr = myArr.slice(parseInt(myArr.length/2)); + if (myArr.length == 1) { + alert("The problem is caused by more than 1 pref !\n\nNarrowed it down to "+ aDbg.length.toString() +" prefs, check the console ..."); + break; + } + } else { + myArr = myArr.slice(0, parseInt(myArr.length/2)); + aDbg = myArr; + if (myArr.length == 1) { found = true; break; } + } + reapply(aBACKUP); + myreset(myArr.slice(0, parseInt(myArr.length/2))); // reset half of the remaining prefs + } + reapply(aBACKUP); + } + else { + reapply(aBACKUP); return; } - _main(aBAK); + + if (found) { + alert("narrowed it down to:\n\n"+myArr[0].name+"\n"); + myreset(myArr); // reset the culprit + } + else { + console.log("the problem is caused by a combination of the following prefs:"); + for (let i = 0, len = aDbg.length; i < len; i++) { + console.log(aDbg[i].name); + } + } })(); diff --git a/updater.bat b/updater.bat index bc1078a..6e06a61 100644 --- a/updater.bat +++ b/updater.bat @@ -1,18 +1,13 @@ @ECHO OFF & SETLOCAL EnableDelayedExpansion -TITLE arkenfox user.js updater +TITLE ghacks user.js updater -REM ## arkenfox user.js updater for Windows +REM ## ghacks-user.js updater for Windows REM ## author: @claustromaniac -REM ## version: 4.20 -REM ## instructions: https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-windows +REM ## version: 4.3 +REM ## instructions: https://github.com/ghacksuserjs/ghacks-user.js/wiki/3.3-Updater-Scripts -SET v=4.19 - -VERIFY ON -CD /D "%~dp0" SET _myname=%~n0 SET _myparams=%* - :parse IF "%~1"=="" (GOTO endparse) IF /I "%~1"=="-unattended" (SET _ua=1) @@ -22,34 +17,21 @@ IF /I "%~1"=="-multioverrides" (SET _multi=1) IF /I "%~1"=="-merge" (SET _merge=1) IF /I "%~1"=="-updatebatch" (SET _updateb=1) IF /I "%~1"=="-singlebackup" (SET _singlebackup=1) -IF /I "%~1"=="-esr" (SET _esr=1) SHIFT GOTO parse :endparse - -FOR /F %%i IN ('PowerShell -Command "[Enum]::GetNames([Net.SecurityProtocolType]) -contains 'Tls12'"') DO ( - IF "%%i" == "False" ( - CALL :message "Your PowerShell version doesn't support TLS1.2 ^!" - ECHO: Instructions to update PowerShell are on the arkenfox wiki - PAUSE - EXIT - ) -) - IF DEFINED _updateb ( REM The normal flow here goes from phase 1 to phase 2 and then phase 3. IF NOT "!_myname:~0,9!"=="[updated]" ( IF EXIST "[updated]!_myname!.bat" ( REM ## Phase 3 ##: The new script, with the original name, will: - REM * Delete the [updated]*.bat and *.bat.old scripts + REM * Delete the [updated]*.bat script REM * Begin the normal routine - FC "[updated]!_myname!.bat" "!_myname!.bat.old" >nul - IF NOT "!errorlevel!"=="0" ( - CALL :message "Script updated to version !v!" - TIMEOUT 3 >nul - ) REN "[updated]!_myname!.bat" "[updated]!_myname!.bat.old" - DEL /F "!_myname!.bat.old" "[updated]!_myname!.bat.old" + DEL /F "[updated]!_myname!.bat.old" + CALL :message "Script updated^!" + TIMEOUT 3 >nul + CLS GOTO begin ) REM ## Phase 1 ## @@ -57,14 +39,18 @@ IF DEFINED _updateb ( REM * Start that script in a new CMD window REM * Exit CALL :message "Updating script..." - REM Uncomment the next line and comment out the PowerShell call for testing. - REM COPY /B /Y "!_myname!.bat" "[updated]!_myname!.bat" >nul - CALL :psdownload https://raw.githubusercontent.com/arkenfox/user.js/master/updater.bat "[updated]!_myname!.bat" + REM Uncomment the next line and comment the powershell call for testing. + REM COPY /B /V /Y "!_myname!.bat" "[updated]!_myname!.bat" + ( + powershell -Command "(New-Object Net.WebClient).DownloadFile('https://github.com/ghacksuserjs/ghacks-user.js/raw/master/updater.bat', '[updated]!_myname!.bat')" + ) >nul 2>&1 IF EXIST "[updated]!_myname!.bat" ( START /min CMD /C "[updated]!_myname!.bat" !_myparams! + EXIT /B ) ELSE ( CALL :message "Failed. Make sure PowerShell is allowed internet access." TIMEOUT 120 >nul + EXIT /B ) ) ELSE ( IF "!_myname!"=="[updated]" ( @@ -72,25 +58,26 @@ IF DEFINED _updateb ( TIMEOUT 300 >nul ) ELSE ( REM ## Phase 2 ##: The [updated]*.bat script will: - REM * Rename the old script and make a copy of itself with the original name. - REM * Run that copy in a new CMD instance + REM * Copy itself overwriting the original batch + REM * Start that script in a new CMD instance REM * Exit - IF EXIST "!_myname:~9!.bat" ( REN "!_myname:~9!.bat" "!_myname:~9!.bat.old" ) - COPY /B /Y "!_myname!.bat" "!_myname:~9!.bat" + IF EXIST "!_myname:~9!.bat" ( + REN "!_myname:~9!.bat" "!_myname:~9!.bat.old" + DEL /F "!_myname:~9!.bat.old" + ) + COPY /B /V /Y "!_myname!.bat" "!_myname:~9!.bat" START CMD /C "!_myname:~9!.bat" !_myparams! ) + EXIT /B ) - EXIT /B ) - :begin -CLS ECHO: ECHO: ECHO: ######################################## ECHO: #### user.js Updater for Windows #### ECHO: #### by claustromaniac #### -ECHO: #### v!v! #### +ECHO: #### v4.3 #### ECHO: ######################################## ECHO: SET /A "_line=0" @@ -106,10 +93,7 @@ IF NOT EXIST user.js ( ) :exitloop IF NOT "!_name!"=="" ( - SET "_tempvar=" - IF /I NOT "!_name!"=="!_name:ghacks=!" SET _tempvar=1 - IF /I NOT "!_name!"=="!_name:arkenfox=!" SET _tempvar=1 - IF !_tempvar! EQU 1 ( + IF /I NOT "!_name!"=="!_name:ghacks=!" ( CALL :message "!_name! !_version:~2!,!_date!" ) ELSE (CALL :message "Current user.js version not recognised.") ) ELSE (CALL :message "Current user.js version not recognised.") @@ -117,7 +101,7 @@ IF NOT EXIST user.js ( ECHO: IF NOT DEFINED _ua ( CALL :message "This batch should be run from your Firefox profile directory." - ECHO: It will download the latest version of arkenfox user.js from github and then + ECHO: It will download the latest version of ghacks user.js from github and then CALL :message "append any of your own changes from user-overrides.js to it." CALL :message "Visit the wiki for more detailed information." ECHO: @@ -134,33 +118,32 @@ IF DEFINED _log ( :log SET _log=2 ECHO:################################################################## - ECHO: %date%, %time% + CALL :message "%date%, %time%" ) IF EXIST user.js.new (DEL /F "user.js.new") CALL :message "Retrieving latest user.js file from github repository..." -CALL :psdownload https://raw.githubusercontent.com/arkenfox/user.js/master/user.js "user.js.new" +( + powershell -Command "(New-Object Net.WebClient).DownloadFile('https://github.com/ghacksuserjs/ghacks-user.js/raw/master/user.js', 'user.js.new')" +) >nul 2>&1 IF EXIST user.js.new ( - IF DEFINED _esr ( - CALL :message "Activating ESR section..." - CALL :activate user.js.new ".x still uses all the following prefs" - ) IF DEFINED _multi ( FORFILES /P user.js-overrides /M *.js >nul 2>&1 IF NOT ERRORLEVEL 1 ( IF DEFINED _merge ( CALL :message "Merging..." - COPY /B /Y user.js-overrides\*.js user-overrides-merged.js + COPY /B /V /Y user.js-overrides\*.js user-overrides-merged.js CALL :merge user-overrides-merged.js - COPY /B /Y user.js.new+user-overrides-merged.js user.js.new + COPY /B /V /Y user.js.new+user-overrides-merged.js user.js.new CALL :merge user.js.new ) ELSE ( CALL :message "Appending..." - COPY /B /Y user.js.new+"user.js-overrides\*.js" user.js.new + COPY /B /V /Y user.js.new+"user.js-overrides\*.js" user.js.new ) ) ELSE (CALL :message "No override files found.") + ECHO: ) ELSE ( IF EXIST "user-overrides.js" ( - COPY /B /Y user.js.new+"user-overrides.js" "user.js.new" + COPY /B /V /Y user.js.new+"user-overrides.js" "user.js.new" IF DEFINED _merge ( CALL :message "Merging user-overrides.js..." CALL :merge user.js.new @@ -168,6 +151,7 @@ IF EXIST user.js.new ( CALL :message "user-overrides.js appended." ) ) ELSE (CALL :message "user-overrides.js not found.") + ECHO: ) IF EXIST user.js ( FC user.js.new user.js >nul && SET "_changed=false" || SET "_changed=true" @@ -177,8 +161,7 @@ IF EXIST user.js.new ( IF DEFINED _singlebackup ( MOVE /Y user.js user.js.bak >nul ) ELSE ( - FOR /F "delims=" %%# IN ('powershell -command get-date -format "{yyyyMMdd_HHmmss}"') DO @SET ldt=%%# - MOVE /Y user.js "user-backup-!ldt!.js" >nul + MOVE /Y user.js "user-backup-!date:/=-!_!time::=.!.js" >nul ) REN user.js.new user.js CALL :message "Update complete." @@ -189,27 +172,19 @@ IF EXIST user.js.new ( ) ELSE ( REN user.js.new user.js CALL :message "Update complete." - SET "_changed=true" ) ) + ECHO: ) ELSE ( CALL :message "Update failed. Make sure PowerShell is allowed internet access." - ECHO: No changes were made. + ECHO: No changes were made. ) IF NOT DEFINED _log ( - IF NOT DEFINED _ua ( - IF EXIST prefsCleaner.bat ( - IF "!_changed!"=="true" ( - CALL :message "Would you like to run the prefsCleaner now?" - CHOICE /C YN /N /M "(Y/N) " - IF "1"=="!errorlevel!" ( START "" cmd.exe /C "prefsCleaner.bat" ) - ) ELSE (PAUSE) - ) ELSE (PAUSE) - ) + IF NOT DEFINED _ua (PAUSE) ) EXIT /B -::::::::::::::: Message ::::::::::::::: +REM ########### Message Function ########### :message SETLOCAL DisableDelayedExpansion IF NOT "2"=="%_log%" (ECHO:) @@ -217,41 +192,11 @@ ECHO: %~1 IF NOT "2"=="%_log%" (ECHO:) ENDLOCAL GOTO :EOF - -::::::::::::::: Download ::::::::::::::: -:psdownload -( - PowerShell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('%~1', '%~2')" -) >nul 2>&1 -GOTO :EOF - -::::::::::::::: Activate Section ::::::::::::::: -:activate -:: arg1 = file -:: arg2 = line substring -SETLOCAL DisableDelayedExpansion -( - FOR /F "tokens=1,* delims=:" %%G IN ('FINDSTR /N "^" "%~1"') DO ( - SET "_temp=%%H" - SETLOCAL EnableDelayedExpansion - IF "!_temp:%~2=!"=="!_temp!" ( - ENDLOCAL & ECHO:%%H - ) ELSE ( - ECHO://!_temp:~2! - ENDLOCAL - ) - ) -)>updatertempfile -MOVE /Y updatertempfile "%~1" >nul -ENDLOCAL -GOTO :EOF - -::::::::::::::: Merge ::::::::::::::: +REM ############ Merge function ############ :merge SETLOCAL DisableDelayedExpansion -FOR /F tokens^=2^,^*^ delims^=^'^" %%G IN ('FINDSTR /R /C:"^user_pref[ ]*\([ ]*[\"'].*[\"'][ ]*,.*\)[ ]*;" "%~1"') DO (SET "[%%G]=%%H") -FOR /F tokens^=2^,^*^ delims^=^' %%G IN ('FINDSTR /R /C:"^//// --- comment-out --- '[^'][^']*'.*" "%~1"') DO (SET "__unset__%%G=1") ( + FOR /F tokens^=2^,^*^ delims^=^'^" %%G IN ('FINDSTR /B /R /C:"user_pref.*\)[ ]*;" "%~1"') DO (IF NOT "%%H"=="" (SET "%%G=%%H")) FOR /F "tokens=1,* delims=:" %%I IN ('FINDSTR /N "^" "%~1"') DO ( SET "_temp=%%J" SETLOCAL EnableDelayedExpansion @@ -264,15 +209,11 @@ FOR /F tokens^=2^,^*^ delims^=^' %%G IN ('FINDSTR /R /C:"^//// --- comment-out - ENDLOCAL FOR /F tokens^=2^ delims^=^'^" %%K IN ("%%J") DO ( IF NOT "_user.js.parrot"=="%%K" ( - IF DEFINED __unset__%%K ( - ECHO://%%J - ) ELSE ( - IF DEFINED [%%K] ( - SETLOCAL EnableDelayedExpansion - FOR /F "delims=" %%L IN ("![%%K]!") DO ( - ENDLOCAL & ECHO:user_pref("%%K"%%L - SET "[%%K]=" - ) + IF DEFINED %%K ( + SETLOCAL EnableDelayedExpansion + FOR /F "delims=" %%L IN ("!%%K!") DO ( + ENDLOCAL & ECHO:user_pref("%%K"%%L + SET "%%K=" ) ) ) ELSE (ECHO:%%J) @@ -284,14 +225,11 @@ FOR /F tokens^=2^,^*^ delims^=^' %%G IN ('FINDSTR /R /C:"^//// --- comment-out - MOVE /Y updatertempfile "%~1" >nul ENDLOCAL GOTO :EOF - -::::::::::::::: Help ::::::::::::::: +REM ############### Help ################## :showhelp -MODE 80,54 +MODE 80,46 CLS CALL :message "Available arguments (case-insensitive):" -CALL :message " -esr" -ECHO: Activate ESR related preferences CALL :message " -log" ECHO: Write the console output to a logfile (user.js-update-log.txt) CALL :message " -logP" @@ -315,9 +253,11 @@ ECHO: Run without user input. CALL :message " -singleBackup" ECHO: Use a single backup file and overwrite it on new updates, instead of ECHO: cumulative backups. This was the default behaviour before v4.3. -CALL :message " -updateBatch" +CALL :message " -updatebatch" ECHO: Update the script itself on execution, before the normal routine. CALL :message "" PAUSE +CLS MODE 80,25 GOTO :begin +REM ##################################### diff --git a/updater.sh b/updater.sh old mode 100755 new mode 100644 index 72c77fc..d9548ea --- a/updater.sh +++ b/updater.sh @@ -1,407 +1,58 @@ -#!/usr/bin/env bash +#!/bin/bash -## arkenfox user.js updater for macOS and Linux +### ghacks-user.js updater for Mac/Linux +## author: @overdodactyl +## version: 1.2 -## version: 4.0 -## Author: Pat Johnson (@overdodactyl) -## Additional contributors: @earthlng, @ema-pe, @claustromaniac, @infinitewarp +ghacksjs="https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/user.js" -## DON'T GO HIGHER THAN VERSION x.9 !! ( because of ASCII comparison in update_updater() ) +echo -e "\nThis script should be run from your Firefox profile directory.\n" -# Check if running as root -if [ "${EUID:-"$(id -u)"}" -eq 0 ]; then - printf "You shouldn't run this with elevated privileges (such as with doas/sudo).\n" - exit 1 -fi +currdir=$(pwd) -readonly CURRDIR=$(pwd) +## get the full path of this script (readlink for Linux, greadlink for Mac with coreutils installed) +sfp=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null) -SCRIPT_FILE=$(readlink -f "${BASH_SOURCE[0]}" 2>/dev/null || greadlink -f "${BASH_SOURCE[0]}" 2>/dev/null) -[ -z "$SCRIPT_FILE" ] && SCRIPT_FILE=${BASH_SOURCE[0]} -readonly SCRIPT_DIR=$(dirname "${SCRIPT_FILE}") +## fallback for Macs without coreutils +if [ -z "$sfp" ]; then sfp=${BASH_SOURCE[0]}; fi +## change directory to the Firefox profile directory +cd "$(dirname "${sfp}")" -######################### -# Base variables # -######################### +echo -e "Updating the user.js for Firefox profile:\n$(pwd)\n" -# Colors used for printing -RED='\033[0;31m' -BLUE='\033[0;34m' -BBLUE='\033[1;34m' -GREEN='\033[0;32m' -ORANGE='\033[0;33m' -CYAN='\033[0;36m' -NC='\033[0m' # No Color - -# Argument defaults -UPDATE='check' -CONFIRM='yes' -OVERRIDE='user-overrides.js' -BACKUP='multiple' -COMPARE=false -SKIPOVERRIDE=false -VIEW=false -PROFILE_PATH=false -ESR=false - -# Download method priority: curl -> wget -DOWNLOAD_METHOD='' -if command -v curl >/dev/null; then - DOWNLOAD_METHOD='curl --max-redirs 3 -so' -elif command -v wget >/dev/null; then - DOWNLOAD_METHOD='wget --max-redirect 3 --quiet -O' +if [ -e user.js ]; then + echo "Your current user.js file for this profile will be backed up and the latest ghacks version from github will take its place." + echo -e "\nIf currently using the ghacks user.js, please compare versions:" + echo " Available online: $(curl -s ${ghacksjs} | sed -n '4p')" + echo " Currently using: $(sed -n '4p' user.js)" else - echo -e "${RED}This script requires curl or wget.\nProcess aborted${NC}" - exit 1 + echo "A user.js file does not exist in this profile. If you continue, the latest ghacks version from github will be downloaded." fi +echo -e "\nIf a user-overrides.js file exists in this profile, it will be appended to the user.js.\n" -show_banner() { - echo -e "${BBLUE} - ############################################################################ - #### #### - #### arkenfox user.js #### - #### Hardening the Privacy and Security Settings of Firefox #### - #### Maintained by @Thorin-Oakenpants and @earthlng #### - #### Updater for macOS and Linux by @overdodactyl #### - #### #### - ############################################################################" - echo -e "${NC}\n" - echo -e "Documentation for this script is available here: ${CYAN}https://github.com/arkenfox/user.js/wiki/5.1-Updater-[Options]#-maclinux${NC}\n" -} +read -p "Continue Y/N? " -n 1 -r +echo -e "\n\n" -######################### -# Arguments # -######################### - -usage() { - echo - echo -e "${BLUE}Usage: $0 [-bcdehlnrsuv] [-p PROFILE] [-o OVERRIDE]${NC}" 1>&2 # Echo usage string to standard error - echo -e " -Optional Arguments: - -h Show this help message and exit. - -p PROFILE Path to your Firefox profile (if different than the dir of this script) - IMPORTANT: If the path contains spaces, wrap the entire argument in quotes. - -l Choose your Firefox profile from a list - -u Update updater.sh and execute silently. Do not seek confirmation. - -d Do not look for updates to updater.sh. - -s Silently update user.js. Do not seek confirmation. - -b Only keep one backup of each file. - -c Create a diff file comparing old and new user.js within userjs_diffs. - -o OVERRIDE Filename or path to overrides file (if different than user-overrides.js). - If used with -p, paths should be relative to PROFILE or absolute paths - If given a directory, all files inside will be appended recursively. - You can pass multiple files or directories by passing a comma separated list. - Note: If a directory is given, only files inside ending in the extension .js are appended - IMPORTANT: Do not add spaces between files/paths. Ex: -o file1.js,file2.js,dir1 - IMPORTANT: If any file/path contains spaces, wrap the entire argument in quotes. - Ex: -o \"override folder\" - -n Do not append any overrides, even if user-overrides.js exists. - -v Open the resulting user.js file. - -r Only download user.js to a temporary file and open it. - -e Activate ESR related preferences." - echo - exit 1 -} - -######################### -# File Handling # -######################### - -download_file() { # expects URL as argument ($1) - declare -r tf=$(mktemp) - - $DOWNLOAD_METHOD "${tf}" "$1" &>/dev/null && echo "$tf" || echo '' # return the temp-filename or empty string on error -} - -open_file() { # expects one argument: file_path - if [ "$(uname)" == 'Darwin' ]; then - open "$1" - elif [ "$(uname -s | cut -c -5)" == "Linux" ]; then - xdg-open "$1" - else - echo -e "${RED}Error: Sorry, opening files is not supported for your OS.${NC}" - fi -} - -readIniFile() { # expects one argument: absolute path of profiles.ini - declare -r inifile="$1" - - # tempIni will contain: [ProfileX], Name=, IsRelative= and Path= (and Default= if present) of the only (if) or the selected (else) profile - if [ "$(grep -c '^\[Profile' "${inifile}")" -eq "1" ]; then ### only 1 profile found - tempIni="$(grep '^\[Profile' -A 4 "${inifile}")" - else - echo -e "Profiles found:\n––––––––––––––––––––––––––––––" - ## cmd-substitution to strip trailing newlines and in quotes to keep internal ones: - echo "$(grep --color=never -E 'Default=[^1]|\[Profile[0-9]*\]|Name=|Path=|^$' "${inifile}")" - echo '––––––––––––––––––––––––––––––' - read -p 'Select the profile number ( 0 for Profile0, 1 for Profile1, etc ) : ' -r - echo -e "\n" - if [[ $REPLY =~ ^(0|[1-9][0-9]*)$ ]]; then - tempIni="$(grep "^\[Profile${REPLY}" -A 4 "${inifile}")" || { - echo -e "${RED}Profile${REPLY} does not exist!${NC}" && exit 1 - } - else - echo -e "${RED}Invalid selection!${NC}" && exit 1 - fi +if [[ $REPLY =~ ^[Yy]$ ]]; then + if [ -e user.js ]; then + # backup current user.js + bakfile="user.js.backup.$(date +"%Y-%m-%d_%H%M")" + mv user.js "${bakfile}" && echo "Your previous user.js file was backed up: ${bakfile}" fi - # extracting 0 or 1 from the "IsRelative=" line - declare -r pathisrel=$(sed -n 's/^IsRelative=\([01]\)$/\1/p' <<< "${tempIni}") + # download latest ghacks user.js + echo "downloading latest ghacks user.js file" + curl -O ${ghacksjs} && echo "ghacks user.js has been downloaded" - # extracting only the path itself, excluding "Path=" - PROFILE_PATH=$(sed -n 's/^Path=\(.*\)$/\1/p' <<< "${tempIni}") - # update global variable if path is relative - [[ ${pathisrel} == "1" ]] && PROFILE_PATH="$(dirname "${inifile}")/${PROFILE_PATH}" -} - -getProfilePath() { - declare -r f1=~/Library/Application\ Support/Firefox/profiles.ini - declare -r f2=~/.mozilla/firefox/profiles.ini - - if [ "$PROFILE_PATH" = false ]; then - PROFILE_PATH="$SCRIPT_DIR" - elif [ "$PROFILE_PATH" = 'list' ]; then - if [[ -f "$f1" ]]; then - readIniFile "$f1" # updates PROFILE_PATH or exits on error - elif [[ -f "$f2" ]]; then - readIniFile "$f2" - else - echo -e "${RED}Error: Sorry, -l is not supported for your OS${NC}" - exit 1 - fi - #else - # PROFILE_PATH already set by user with -p - fi -} - -######################### -# Update updater.sh # -######################### - -# Returns the version number of a updater.sh file -get_updater_version() { - echo "$(sed -n '5 s/.*[[:blank:]]\([[:digit:]]*\.[[:digit:]]*\)/\1/p' "$1")" -} - -# Update updater.sh -# Default: Check for update, if available, ask user if they want to execute it -# Args: -# -d: New version will not be looked for and update will not occur -# -u: Check for update, if available, execute without asking -update_updater() { - [ "$UPDATE" = 'no' ] && return 0 # User signified not to check for updates - - declare -r tmpfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/updater.sh')" - [ -z "${tmpfile}" ] && echo -e "${RED}Error! Could not download updater.sh${NC}" && return 1 # check if download failed - - if [[ $(get_updater_version "$SCRIPT_FILE") < $(get_updater_version "${tmpfile}") ]]; then - if [ "$UPDATE" = 'check' ]; then - echo -e "There is a newer version of updater.sh available. ${RED}Update and execute Y/N?${NC}" - read -p "" -n 1 -r - echo -e "\n\n" - [[ $REPLY =~ ^[Yy]$ ]] || return 0 # Update available, but user chooses not to update - fi - else - return 0 # No update available - fi - mv "${tmpfile}" "$SCRIPT_FILE" - chmod u+x "$SCRIPT_FILE" - "$SCRIPT_FILE" "$@" -d - exit 0 -} - -######################### -# Update user.js # -######################### - -# Returns version number of a user.js file -get_userjs_version() { - [ -e "$1" ] && echo "$(sed -n '4p' "$1")" || echo "Not detected." -} - -add_override() { - input=$1 - if [ -f "$input" ]; then - echo "" >> user.js - cat "$input" >> user.js - echo -e "Status: ${GREEN}Override file appended:${NC} ${input}" - elif [ -d "$input" ]; then - SAVEIFS=$IFS - IFS=$'\n\b' # Set IFS - FILES="${input}"/*.js - for f in $FILES - do - add_override "$f" - done - IFS=$SAVEIFS # restore $IFS - else - echo -e "${ORANGE}Warning: Could not find override file:${NC} ${input}" - fi -} - -remove_comments() { # expects 2 arguments: from-file and to-file - sed -e '/^\/\*.*\*\/[[:space:]]*$/d' -e '/^\/\*/,/\*\//d' -e 's|^[[:space:]]*//.*$||' -e '/^[[:space:]]*$/d' -e 's|);[[:space:]]*//.*|);|' "$1" > "$2" -} - -# Applies latest version of user.js and any custom overrides -update_userjs() { - declare -r newfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/user.js')" - [ -z "${newfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && return 1 # check if download failed - - echo -e "Please observe the following information: - Firefox profile: ${ORANGE}$(pwd)${NC} - Available online: ${ORANGE}$(get_userjs_version "$newfile")${NC} - Currently using: ${ORANGE}$(get_userjs_version user.js)${NC}\n\n" - - if [ "$CONFIRM" = 'yes' ]; then - echo -e "This script will update to the latest user.js file and append any custom configurations from user-overrides.js. ${RED}Continue Y/N? ${NC}" - read -p "" -n 1 -r - echo -e "\n" - if ! [[ $REPLY =~ ^[Yy]$ ]]; then - echo -e "${RED}Process aborted${NC}" - rm "$newfile" - return 1 - fi - fi - - # Copy a version of user.js to diffs folder for later comparison - if [ "$COMPARE" = true ]; then - mkdir -p userjs_diffs - cp user.js userjs_diffs/past_user.js &>/dev/null - fi - - # backup user.js - mkdir -p userjs_backups - local bakname="userjs_backups/user.js.backup.$(date +"%Y-%m-%d_%H%M")" - [ "$BACKUP" = 'single' ] && bakname='userjs_backups/user.js.backup' - cp user.js "$bakname" &>/dev/null - - mv "${newfile}" user.js - echo -e "Status: ${GREEN}user.js has been backed up and replaced with the latest version!${NC}" - - if [ "$ESR" = true ]; then - sed -e 's/\/\* \(ESR[0-9]\{2,\}\.x still uses all.*\)/\/\/ \1/' user.js > user.js.tmp && mv user.js.tmp user.js - echo -e "Status: ${GREEN}ESR related preferences have been activated!${NC}" - fi - - # apply overrides - if [ "$SKIPOVERRIDE" = false ]; then - while IFS=',' read -ra FILES; do - for FILE in "${FILES[@]}"; do - add_override "$FILE" - done - done <<< "$OVERRIDE" - fi - - # create diff - if [ "$COMPARE" = true ]; then - pastuserjs='userjs_diffs/past_user.js' - past_nocomments='userjs_diffs/past_userjs.txt' - current_nocomments='userjs_diffs/current_userjs.txt' - - remove_comments "$pastuserjs" "$past_nocomments" - remove_comments user.js "$current_nocomments" - - diffname="userjs_diffs/diff_$(date +"%Y-%m-%d_%H%M").txt" - diff=$(diff -w -B -U 0 "$past_nocomments" "$current_nocomments") - if [ -n "$diff" ]; then - echo "$diff" > "$diffname" - echo -e "Status: ${GREEN}A diff file was created:${NC} ${PWD}/${diffname}" - else - echo -e "Warning: ${ORANGE}Your new user.js file appears to be identical. No diff file was created.${NC}" - [ "$BACKUP" = 'multiple' ] && rm "$bakname" &>/dev/null - fi - rm "$past_nocomments" "$current_nocomments" "$pastuserjs" &>/dev/null - fi - - [ "$VIEW" = true ] && open_file "${PWD}/user.js" -} - -######################### -# Execute # -######################### - -if [ $# != 0 ]; then - # Display usage if first argument is -help or --help - if [ "$1" = '--help' ] || [ "$1" = '-help' ]; then - usage - else - while getopts ":hp:ludsno:bcvre" opt; do - case $opt in - h) - usage - ;; - p) - PROFILE_PATH=${OPTARG} - ;; - l) - PROFILE_PATH='list' - ;; - u) - UPDATE='yes' - ;; - d) - UPDATE='no' - ;; - s) - CONFIRM='no' - ;; - n) - SKIPOVERRIDE=true - ;; - o) - OVERRIDE=${OPTARG} - ;; - b) - BACKUP='single' - ;; - c) - COMPARE=true - ;; - v) - VIEW=true - ;; - e) - ESR=true - ;; - r) - tfile="$(download_file 'https://raw.githubusercontent.com/arkenfox/user.js/master/user.js')" - [ -z "${tfile}" ] && echo -e "${RED}Error! Could not download user.js${NC}" && exit 1 # check if download failed - mv "$tfile" "${tfile}.js" - echo -e "${ORANGE}Warning: user.js was saved to temporary file ${tfile}.js${NC}" - open_file "${tfile}.js" - exit 0 - ;; - \?) - echo -e "${RED}\n Error! Invalid option: -$OPTARG${NC}" >&2 - usage - ;; - :) - echo -e "${RED}Error! Option -$OPTARG requires an argument.${NC}" >&2 - exit 2 - ;; - esac - done + if [ -e user-overrides.js ]; then + echo "user-overrides.js file found" + cat user-overrides.js >> user.js && echo "user-overrides.js has been appended to user.js" fi +else + echo "Process aborted" fi -show_banner -update_updater "$@" - -getProfilePath # updates PROFILE_PATH or exits on error -cd "$PROFILE_PATH" || exit 1 - -# Check if any files have the owner as root/wheel. -if [ -n "$(find ./ -user 0)" ]; then - printf 'It looks like this script was previously run with elevated privileges, -you will need to change ownership of the following files to your user:\n' - find . -user 0 - cd "$CURRDIR" - exit 1 -fi - -update_userjs - -cd "$CURRDIR" +## change directory back to the original working directory +cd "${currdir}" diff --git a/user.js b/user.js index 08c51ca..83ef477 100644 --- a/user.js +++ b/user.js @@ -1,1248 +1,2130 @@ /****** -* name: arkenfox user.js -* date: 6 March 2025 -* version: 135 -* urls: https://github.com/arkenfox/user.js [repo] -* : https://arkenfox.github.io/gui/ [interactive] -* license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt +* name: ghacks user.js +* date: 3 February 2018 +* version 58: Pantslide +* "I took my pants, took em down, I climbed a mountain and I turned around" +* authors: v52+ github | v51- www.ghacks.net +* url: https://github.com/ghacksuserjs/ghacks-user.js +* license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt + +* releases: These are end-of-stable-life-cycle legacy archives. + *Always* use the master branch user.js for a current up-to-date version. + url: https://github.com/ghacksuserjs/ghacks-user.js/releases * README: - 1. Consider using Tor Browser if it meets your needs or fits your threat model - * https://2019.www.torproject.org/about/torusers.html - 2. Read the entire wiki - * https://github.com/arkenfox/user.js/wiki - 3. If you skipped step 2, return to step 2 - 4. Make changes in a user-overrides.js - * There are often trade-offs and conflicts between security vs privacy vs anti-tracking - and these need to be balanced against functionality & convenience & breakage - * Some site breakage and unintended consequences will happen. Everyone's experience will differ - e.g. some user data is erased on exit (section 2800), change this to suit your needs - * While not 100% definitive, search for "[SETUP" tags - 5. Some tag info - [SETUP-SECURITY] it's one item, read it - [SETUP-WEB] can cause some websites to break - [SETUP-CHROME] changes how Firefox itself behaves (i.e. not directly website related) - 6. Override Recipes: https://github.com/arkenfox/user.js/issues/1080 + 1. READ the full README + * https://github.com/ghacksuserjs/ghacks-user.js/blob/master/README.md + 2. READ this + * https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.3-Implementation + 3. If you skipped steps 1 and 2 above (shame on you), then here is the absolute minimum + * Auto-installing updates for Firefox and extensions are disabled (section 0302's) + * Some user data is erased on close (section 2800), namely history (browsing, form, download) + * Cookies are denied by default (2701), we use site exceptions. In Firefox 58 and lower, this breaks + extensions that use IndexedDB, so you need to allow exceptions for those as well: see [1] below + [1] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1.1-Setting-Extension-Permission-Exceptions + * EACH RELEASE check: + - 4600s: reset prefs made redundant due to privacy.resistFingerprinting (RPF) + or enable them as an alternative to RFP or for ESR users + - 9999s: reset deprecated prefs in about:config or enable relevant section(s) for ESR + * Site breakage WILL happen + - There are often trade-offs and conflicts between Security vs Privacy vs Anti-Fingerprinting + and these need to be balanced against Functionality & Convenience & Breakage + * You will need to make a few changes to suit your own needs + - Search this file for the "[SETUP]" tag to find SOME common items you could check + before using to avoid unexpected surprises + - Search this file for the "[WARNING]" tag to troubleshoot or prevent SOME common issues + 4. BACKUP your profile folder before implementing (and/or test in a new/cloned profile) + 5. KEEP UP TO DATE: https://github.com/ghacksuserjs/ghacks-user.js/wiki#small_orange_diamond-maintenance -* RELEASES: https://github.com/arkenfox/user.js/releases + ******/ - * Use the arkenfox release that matches your Firefox version - - DON'T wait for arkenfox to update Firefox, nothing major changes these days - * Each release - - run prefsCleaner to reset prefs made inactive, including deprecated (9999) - * ESR - - It is recommended to not use the updater, or you will get a later version which may cause issues. - So you should manually append your overrides (and keep a copy), and manually update when you - change ESR releases (arkenfox is already past that release) - - If you decide to keep updating, then the onus is on you - also see section 9999 - -* INDEX: - - 0100: STARTUP - 0200: GEOLOCATION - 0300: QUIETER FOX - 0400: SAFE BROWSING - 0600: BLOCK IMPLICIT OUTBOUND - 0700: DNS / DoH / PROXY / SOCKS - 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS - 0900: PASSWORDS - 1000: DISK AVOIDANCE - 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) - 1600: REFERERS - 1700: CONTAINERS - 2000: PLUGINS / MEDIA / WEBRTC - 2400: DOM (DOCUMENT OBJECT MODEL) - 2600: MISCELLANEOUS - 2700: ETP (ENHANCED TRACKING PROTECTION) - 2800: SHUTDOWN & SANITIZING - 4000: FPP (fingerprintingProtection) - 4500: OPTIONAL RFP (resistFingerprinting) - 5000: OPTIONAL OPSEC - 5500: OPTIONAL HARDENING - 6000: DON'T TOUCH - 7000: DON'T BOTHER - 8000: DON'T BOTHER: FINGERPRINTING - 8500: TELEMETRY - 9000: NON-PROJECT RELATED - 9999: DEPRECATED / RENAMED - -******/ - -/* START: internal custom pref to test for syntax errors - * [NOTE] Not all syntax errors cause parsing to abort i.e. reaching the last debug pref - * no longer necessarily means that all prefs have been applied. Check the console right - * after startup for any warnings/error messages related to non-applied prefs - * [1] https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/ +/* START: internal custom pref to test for syntax errors (thanks earthling) + * Yes, this next pref setting is redundant, but we like it! + * [1] https://en.wikipedia.org/wiki/Dead_parrot + * [2] https://en.wikipedia.org/wiki/Warrant_canary ***/ user_pref("_user.js.parrot", "START: Oh yes, the Norwegian Blue... what's wrong with it?"); /* 0000: disable about:config warning ***/ -user_pref("browser.aboutConfig.showWarning", false); +user_pref("general.warnOnAboutConfig", false); -/*** [SECTION 0100]: STARTUP ***/ +/* 0001: start Firefox in PB (Private Browsing) mode + * [SETTING-56+] Options>Privacy & Security>History>Custom Settings>Always use private browsing mode + * [SETTING-ESR] Options>Privacy>History>Custom Settings>Always use private browsing mode + * [NOTE] In this mode *all* windows are "private windows" and the PB mode icon is not displayed + * [NOTE] The P in PB mode is misleading: it means no "persistent" local storage of history, + * caches, searches or cookies (which you can achieve in normal mode). In fact, it limits or + * removes the ability to control these, and you need to quit Firefox to clear them. PB is best + * used as a one off window (File>New Private Window) to provide a temporary self-contained + * new instance. Closing all Private Windows clears all traces. Repeat as required. + * [WARNING] PB does not allow indexedDB which breaks many Extensions that use it + * including uBlock Origin, uMatrix, Violentmonkey and Stylus + * [1] https://wiki.mozilla.org/Private_Browsing ***/ + // user_pref("browser.privatebrowsing.autostart", true); + +/*** 0100: STARTUP ***/ user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!"); -/* 0102: set startup page [SETUP-CHROME] - * 0=blank, 1=home, 2=last visited page, 3=resume previous session - * [NOTE] Session Restore is cleared with history (2811+), and not used in Private Browsing mode - * [SETTING] General>Startup>Restore previous session ***/ -user_pref("browser.startup.page", 0); -/* 0103: set HOME+NEWWINDOW page - * about:home=Firefox Home (default, see 0105), custom URL, about:blank - * [SETTING] Home>New Windows and Tabs>Homepage and new windows ***/ -user_pref("browser.startup.homepage", "about:blank"); -/* 0104: set NEWTAB page - * true=Firefox Home (default, see 0105), false=blank page - * [SETTING] Home>New Windows and Tabs>New tabs ***/ -user_pref("browser.newtabpage.enabled", false); -/* 0105: disable sponsored content on Firefox Home (Activity Stream) - * [SETTING] Home>Firefox Home Content ***/ -user_pref("browser.newtabpage.activity-stream.showSponsored", false); // [FF58+] -user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false); // [FF83+] Shortcuts>Sponsored shortcuts -/* 0106: clear default topsites - * [NOTE] This does not block you from adding your own ***/ -user_pref("browser.newtabpage.activity-stream.default.sites", ""); +/* 0101: disable "slow startup" options + * warnings, disk history, welcomes, intros, EULA, default browser check ***/ +user_pref("browser.slowStartup.notificationDisabled", true); +user_pref("browser.slowStartup.maxSamples", 0); +user_pref("browser.slowStartup.samples", 0); +user_pref("browser.rights.3.shown", true); +user_pref("browser.startup.homepage_override.mstone", "ignore"); +user_pref("startup.homepage_welcome_url", ""); +user_pref("startup.homepage_welcome_url.additional", ""); +user_pref("startup.homepage_override_url", ""); // what's new page after updates +user_pref("browser.laterrun.enabled", false); +user_pref("browser.shell.checkDefaultBrowser", false); +/* 0102: set start page (0=blank, 1=home, 2=last visited page, 3=resume previous session) + * [SETTING] Options>General>Startup>When Firefox starts ***/ + // user_pref("browser.startup.page", 0); +/* 0103: set your "home" page (see 0102) ***/ + // user_pref("browser.startup.homepage", "https://www.example.com/"); -/*** [SECTION 0200]: GEOLOCATION ***/ +/*** 0200: GEOLOCATION ***/ user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!"); -/* 0202: disable using the OS's geolocation service ***/ -user_pref("geo.provider.ms-windows-location", false); // [WINDOWS] -user_pref("geo.provider.use_corelocation", false); // [MAC] -user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX] +/* 0202: disable GeoIP-based search results + * [NOTE] May not be hidden if Firefox has changed your settings due to your locale + * [1] https://trac.torproject.org/projects/tor/ticket/16254 + * [2] https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine ***/ +user_pref("browser.search.countryCode", "US"); // (hidden pref) +user_pref("browser.search.region", "US"); // (hidden pref) +user_pref("browser.search.geoip.url", ""); +/* 0203: disable using OS locale, force APP locale ***/ +user_pref("intl.locale.matchOS", false); +/* 0204: set APP locale ***/ +user_pref("general.useragent.locale", "en-US"); +/* 0205: set OS & APP locale (replaces 0203 + 0204) (FF59+) + * If set to empty, the OS locales are used. If not set at all, default locale is used ***/ +user_pref("intl.locale.requested", "en-US"); // (hidden pref) +/* 0206: disable geographically specific results/search engines e.g. "browser.search.*.US" + * i.e. ignore all of Mozilla's various search engines in multiple locales ***/ +user_pref("browser.search.geoSpecificDefaults", false); +user_pref("browser.search.geoSpecificDefaults.url", ""); +/* 0207: set language to match ***/ +user_pref("intl.accept_languages", "en-US, en"); +/* 0208: enforce US English locale regardless of the system locale + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=867501 ***/ +user_pref("javascript.use_us_english_locale", true); // (hidden pref) +/* 0209: use APP locale over OS locale in regional preferences (FF56+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1379420 [also 1364789] ***/ +user_pref("intl.regional_prefs.use_os_locales", false); +/* 0210: use Mozilla geolocation service instead of Google when geolocation is enabled + * Optionally enable logging to the console (defaults to false) ***/ +user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%"); + // user_pref("geo.wifi.logging.enabled", true); // (hidden pref) -/*** [SECTION 0300]: QUIETER FOX ***/ +/*** 0300: QUIET FOX + We choose to not disable auto-CHECKs (0301's) but to disable auto-INSTALLs (0302's). + There are many legitimate reasons to turn off auto-INSTALLS, including hijacked or + monetized extensions, time constraints, legacy issues, and fear of breakage/bugs. + It is still important to do updates for security reasons, please do so manually. ***/ user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!"); -/** RECOMMENDATIONS ***/ -/* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/ -user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF] -/* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/ -user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); -/* 0322: disable personalized Extension Recommendations in about:addons and AMO [FF65+] - * [NOTE] This pref has no effect when Health Reports (8501) are disabled - * [SETTING] Privacy & Security>Firefox Data Collection and Use>Allow personalized extension recommendations - * [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/ -user_pref("browser.discovery.enabled", false); -/* 0323: disable shopping experience [FF116+] - * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1840156#c0 ***/ -user_pref("browser.shopping.experience2023.enabled", false); // [DEFAULT: false] - -/** TELEMETRY ***/ -/* 0335: disable Firefox Home (Activity Stream) telemetry ***/ -user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false); -user_pref("browser.newtabpage.activity-stream.telemetry", false); - -/** STUDIES ***/ -/* 0340: disable Studies - * [SETTING] Privacy & Security>Firefox Data Collection and Use>Install and run studies ***/ -user_pref("app.shield.optoutstudies.enabled", false); -/* 0341: disable Normandy/Shield [FF60+] - * Shield is a telemetry system that can push and test "recipes" - * [1] https://mozilla.github.io/normandy/ ***/ -user_pref("app.normandy.enabled", false); -user_pref("app.normandy.api_url", ""); - -/** CRASH REPORTS ***/ -/* 0350: disable Crash Reports ***/ +/* 0301a: disable auto-update checks for Firefox + * [NOTE] Firefox currently checks every 12 hrs and allows 8 day notification dismissal + * [SETTING-56+] Options>General>Firefox Updates>Never check for updates + * [SETTING-ESR] Options>Advanced>Update>Never check for updates ***/ + // user_pref("app.update.enabled", false); +/* 0301b: disable auto-update checks for extensions + * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/ + // user_pref("extensions.update.enabled", false); +/* 0302a: disable auto update installing for Firefox (after the check in 0301a) + * [SETTING-56+] Options>General>Firefox Updates>Check for updates but let you choose... + * [SETTING-ESR] Options>Advanced>Update>Check for updates but let you choose... + * [NOTE] The UI checkbox also controls the behavior for checking, the pref only controls auto installing ***/ +user_pref("app.update.auto", false); +/* 0302b: disable auto update installing for extensions (after the check in 0301b) + * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/ +user_pref("extensions.update.autoUpdateDefault", false); +/* 0303: disable background update service [WINDOWS] + * [SETTING-56+] Options>General>Firefox Updates>Use a background service to install updates + * [SETTING-ESR] Options>Advanced>Update>Use a background service to install updates ***/ +user_pref("app.update.service.enabled", false); +/* 0304: disable background update staging ***/ +user_pref("app.update.staging.enabled", false); +/* 0305: enforce update information is displayed + * This is the update available, downloaded, error and success information ***/ +user_pref("app.update.silent", false); +/* 0306: disable extension metadata updating + * sends daily pings to Mozilla about extensions and recent startups ***/ +user_pref("extensions.getAddons.cache.enabled", false); +/* 0307: disable auto updating of personas (themes) ***/ +user_pref("lightweightThemes.update.enabled", false); +/* 0308: disable search update + * [SETTING-56+] Options>General>Firefox Update>Automatically update search engines + * [SETTING-ESR] Options>Advanced>Update>Automatically update: Search Engines ***/ +user_pref("browser.search.update", false); +/* 0309: disable sending Flash crash reports ***/ +user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false); +/* 0310: disable sending the URL of the website where a plugin crashed ***/ +user_pref("dom.ipc.plugins.reportCrashURL", false); +/* 0320: disable about:addons' Get Add-ons panel (uses Google-Analytics) ***/ +user_pref("extensions.getAddons.showPane", false); // hidden pref +user_pref("extensions.webservice.discoverURL", ""); +/* 0330: disable telemetry + * the pref (.unified) affects the behaviour of the pref (.enabled) + * IF unified=false then .enabled controls the telemetry module + * IF unified=true then .enabled ONLY controls whether to record extended data + * so make sure to have both set as false + * [NOTE] FF58+ `toolkit.telemetry.enabled` is now LOCKED to reflect prerelease + * or release builds (true and false respectively), see [2] + * [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html + * [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/ +user_pref("toolkit.telemetry.unified", false); +user_pref("toolkit.telemetry.enabled", false); // see [NOTE] above FF58+ +user_pref("toolkit.telemetry.server", ""); +user_pref("toolkit.telemetry.archive.enabled", false); +user_pref("toolkit.telemetry.cachedClientID", ""); +user_pref("toolkit.telemetry.newProfilePing.enabled", false); // (FF55+) +user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // (FF55+) +user_pref("toolkit.telemetry.updatePing.enabled", false); // (FF56+) +user_pref("toolkit.telemetry.bhrPing.enabled", false); // (FF57+) Background Hang Reporter +user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // (FF57+) +/* 0333a: disable health report ***/ +user_pref("datareporting.healthreport.uploadEnabled", false); +/* 0333b: disable about:healthreport page (which connects to Mozilla for locale/css+js+json) + * If you have disabled health reports, then this about page is useless - disable it + * If you want to see what health data is present, then this must be set at default ***/ +user_pref("datareporting.healthreport.about.reportUrl", "data:text/plain,"); +/* 0334: disable new data submission, master kill switch (FF41+) + * If disabled, no policy is shown or upload takes place, ever + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1195552 ***/ +user_pref("datareporting.policy.dataSubmissionEnabled", false); +/* 0350: disable crash reports ***/ user_pref("breakpad.reportURL", ""); -user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+] - // user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] [DEFAULT: false] -/* 0351: enforce no submission of backlogged Crash Reports [FF58+] - * [SETTING] Privacy & Security>Firefox Data Collection and Use>Send backlogged crash reports ***/ -user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [DEFAULT: false] +/* 0351: disable sending of crash reports (FF44+) ***/ +user_pref("browser.tabs.crashReporting.sendReport", false); +user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // (FF51+) +user_pref("browser.crashReports.unsubmittedCheck.autoSubmit", false); // (FF51-57) +user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // (FF58+) +/* 0360: disable new tab tile ads & preload & marketing junk ***/ +user_pref("browser.newtab.preload", false); +user_pref("browser.newtabpage.directory.source", "data:text/plain,"); +user_pref("browser.newtabpage.enabled", false); +user_pref("browser.newtabpage.enhanced", false); +user_pref("browser.newtabpage.introShown", true); +/* 0370: disable "Snippets" (Mozilla content shown on about:home screen) + * MUST use HTTPS - arbitrary content injected into this page via http opens up MiTM attacks + * [1] https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service ***/ +user_pref("browser.aboutHomeSnippets.updateUrl", "https://127.0.0.1"); -/** OTHER ***/ -/* 0360: disable Captive Portal detection - * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy ***/ -user_pref("captivedetect.canonicalURL", ""); -user_pref("network.captive-portal-service.enabled", false); // [FF52+] -/* 0361: disable Network Connectivity checks [FF65+] - * [1] https://bugzilla.mozilla.org/1460537 ***/ -user_pref("network.connectivity-service.enabled", false); +/*** 0400: BLOCKLISTS / SAFE BROWSING / TRACKING PROTECTION + This section has security & tracking protection implications vs privacy concerns vs effectiveness + vs 3rd party 'censorship'. We DO NOT advocate no protection. If you disable Tracking Protection (TP) + and/or Safe Browsing (SB), then SECTION 0400 REQUIRES YOU HAVE uBLOCK ORIGIN INSTALLED. -/*** [SECTION 0400]: SAFE BROWSING (SB) - SB has taken many steps to preserve privacy. If required, a full url is never sent - to Google, only a part-hash of the prefix, hidden with noise of other real part-hashes. - Firefox takes measures such as stripping out identifying parameters and since SBv4 (FF57+) - doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity) - - [1] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ - [2] https://wiki.mozilla.org/Security/Safe_Browsing - [3] https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work - [4] https://educatedguesswork.org/posts/safe-browsing-privacy/ + Safe Browsing is designed to protect users from malicious sites. Tracking Protection is designed + to lessen the impact of third parties on websites to reduce tracking and to speed up your browsing. + These do rely on 3rd parties (Google for SB and Disconnect for TP), but many steps, which are + continually being improved, have been taken to preserve privacy. Disable at your own risk. ***/ user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!"); -/* 0401: disable SB (Safe Browsing) - * [WARNING] Do this at your own risk! These are the master switches - * [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content ***/ +/** BLOCKLISTS ***/ +/* 0401: enable Firefox blocklist, but sanitize blocklist url + * [NOTE] It includes updates for "revoked certificates" + * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ + * [2] https://trac.torproject.org/projects/tor/ticket/16931 ***/ +user_pref("extensions.blocklist.enabled", true); +user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/"); +/* 0402: enable Kinto blocklist updates (FF50+) + * What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications + * As Firefox transitions to Kinto, the blocklists have been broken down into entries for certs to be + * revoked, extensions and plugins to be disabled, and gfx environments that cause problems or crashes ***/ +user_pref("services.blocklist.update_enabled", true); +user_pref("services.blocklist.signing.enforced", true); +/* 0403: disable individual unwanted/unneeded parts of the Kinto blocklists ***/ + // user_pref("services.blocklist.onecrl.collection", ""); // revoked certificates + // user_pref("services.blocklist.addons.collection", ""); + // user_pref("services.blocklist.plugins.collection", ""); + // user_pref("services.blocklist.gfx.collection", ""); +/** SAFE BROWSING (SB) + This sub-section has been redesigned to differentiate between "real-time"/"user initiated" + data being sent to Google from all other settings such as using local blocklists/whitelists and + updating those lists. There are NO privacy issues here. *IF* required, a full url is never sent + to Google, only a PART-hash of the prefix, and this is hidden with noise of other real PART-hashes. + Google also swear it is anonymized and only used to flag malicious sites/activity. Firefox + also takes measures such as striping out identifying parameters and storing safe browsing + cookies in a separate jar. (#Turn on browser.safebrowsing.debug to monitor this activity) + #Required reading [#] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ + [1] https://wiki.mozilla.org/Security/Safe_Browsing ***/ +/* 0410: disable "Block dangerous and deceptive content" (under Options>Security) + * This covers deceptive sites such as phishing and social engineering ***/ // user_pref("browser.safebrowsing.malware.enabled", false); - // user_pref("browser.safebrowsing.phishing.enabled", false); -/* 0402: disable SB checks for downloads (both local lookups + remote) - * This is the master switch for the safebrowsing.downloads* prefs (0403, 0404) - * [SETTING] Privacy & Security>Security>... "Block dangerous downloads" ***/ + // user_pref("browser.safebrowsing.phishing.enabled", false); // (FF50+) +/* 0411: disable "Block dangerous downloads" (under Options>Security) + * This covers malware and PUPs (potentially unwanted programs) ***/ // user_pref("browser.safebrowsing.downloads.enabled", false); -/* 0403: disable SB checks for downloads (remote) - * To verify the safety of certain executable files, Firefox may submit some information about the - * file, including the name, origin, size and a cryptographic hash of the contents, to the Google - * Safe Browsing service which helps Firefox determine whether or not the file should be blocked - * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override this ***/ -user_pref("browser.safebrowsing.downloads.remote.enabled", false); - // user_pref("browser.safebrowsing.downloads.remote.url", ""); // Defense-in-depth -/* 0404: disable SB checks for unwanted software - * [SETTING] Privacy & Security>Security>... "Warn you about unwanted and uncommon software" ***/ +/* 0412: disable "Warn me about unwanted and uncommon software" (under Options>Security) (FF48+) ***/ // user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); // user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); -/* 0405: disable "ignore this warning" on SB warnings [FF45+] - * If clicked, it bypasses the block for that session. This is a means for admins to enforce SB - * [TEST] see https://github.com/arkenfox/user.js/wiki/Appendix-A-Test-Sites#-mozilla - * [1] https://bugzilla.mozilla.org/1226490 ***/ + // user_pref("browser.safebrowsing.downloads.remote.block_dangerous", false); // (FF49+) + // user_pref("browser.safebrowsing.downloads.remote.block_dangerous_host", false); // (FF49+) +/* 0413: disable Google safebrowsing updates ***/ + // user_pref("browser.safebrowsing.provider.google.updateURL", ""); + // user_pref("browser.safebrowsing.provider.google.gethashURL", ""); + // user_pref("browser.safebrowsing.provider.google4.updateURL", ""); // (FF50+) + // user_pref("browser.safebrowsing.provider.google4.gethashURL", ""); // (FF50+) +/* 0414: disable binaries NOT in local lists being checked by Google (real-time checking) ***/ +user_pref("browser.safebrowsing.downloads.remote.enabled", false); +user_pref("browser.safebrowsing.downloads.remote.url", ""); +/* 0415: disable reporting URLs ***/ +user_pref("browser.safebrowsing.provider.google.reportURL", ""); +user_pref("browser.safebrowsing.reportPhishURL", ""); +user_pref("browser.safebrowsing.provider.google4.reportURL", ""); // (FF50+) +user_pref("browser.safebrowsing.provider.google.reportMalwareMistakeURL", ""); // (FF54+) +user_pref("browser.safebrowsing.provider.google.reportPhishMistakeURL", ""); // (FF54+) +user_pref("browser.safebrowsing.provider.google4.reportMalwareMistakeURL", ""); // (FF54+) +user_pref("browser.safebrowsing.provider.google4.reportPhishMistakeURL", ""); // (FF54+) +/* 0416: disable 'ignore this warning' on Safe Browsing warnings which when clicked + * bypasses the block for that session. This is a means for admins to enforce SB + * [TEST] see github wiki APPENDIX C: Test Sites: Section 5 + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1226490 ***/ // user_pref("browser.safebrowsing.allowOverride", false); +/* 0417: disable data sharing (FF58+) ***/ +user_pref("browser.safebrowsing.provider.google4.dataSharing.enabled", false); +user_pref("browser.safebrowsing.provider.google4.dataSharingURL", ""); +/** TRACKING PROTECTION (TP) + There are NO privacy concerns here, but we strongly recommend to use uBlock Origin as well, + as it offers more comprehensive and specialized lists. It also allows per domain control. ***/ +/* 0420: enable Tracking Protection in all windows + * [NOTE] TP sends DNT headers regardless of the DNT pref (see 1610) + * [1] https://wiki.mozilla.org/Security/Tracking_protection + * [2] https://support.mozilla.org/kb/tracking-protection-firefox ***/ + // user_pref("privacy.trackingprotection.pbmode.enabled", true); // default true + // user_pref("privacy.trackingprotection.enabled", true); // default false +/* 0421: enable more Tracking Protection choices under Options>Privacy>Use Tracking Protection + * Displays three choices: "Always", "Only in private windows", "Never" ***/ +user_pref("privacy.trackingprotection.ui.enabled", true); +/* 0422: enable "basic" or "strict" tracking protecting list - ONLY USE ONE! + * [SETTING-56+] Options>Privacy & Security>Tracking Protection>Change Block List + * [SETTING-ESR] Options>Privacy>Use Tracking Protection>Change Block List ***/ + // user_pref("urlclassifier.trackingTable", "test-track-simple,base-track-digest256"); // basic + // user_pref("urlclassifier.trackingTable", "test-track-simple,base-track-digest256,content-track-digest256"); // strict +/* 0423: disable Mozilla's blocklist for known Flash tracking/fingerprinting (FF48+) + * [1] https://www.ghacks.net/2016/07/18/firefox-48-blocklist-against-plugin-fingerprinting/ + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1237198 ***/ + // user_pref("browser.safebrowsing.blockedURIs.enabled", false); +/* 0424: disable Mozilla's tracking protection and Flash blocklist updates ***/ + // user_pref("browser.safebrowsing.provider.mozilla.gethashURL", ""); + // user_pref("browser.safebrowsing.provider.mozilla.updateURL", ""); +/* 0425: disable passive Tracking Protection (FF53+) + * Passive TP annotates channels to lower the priority of network loads for resources on the tracking protection list + * [NOTE] It has no effect if TP is enabled, but keep in mind that by default TP is only enabled in Private Windows + * This is included for people who want to completely disable Tracking Protection. + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1170190 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1141814 ***/ + // user_pref("privacy.trackingprotection.annotate_channels", false); + // user_pref("privacy.trackingprotection.lower_network_priority", false); -/*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/ +/*** 0500: SYSTEM EXTENSIONS / EXPERIMENTS + System extensions are a method for shipping extensions, considered to be + built-in features to Firefox, that are hidden from the about:addons UI. + To view your system extensions go to about:support, they are listed under "Firefox Features" + + Some system extensions have no on-off prefs. Instead you can manually remove them. Note that app + updates will restore them. They may also be updated and possibly restored automatically (see 0505) + * Portable: "...\App\Firefox64\browser\features\" (or "App\Firefox\etc" for 32bit) + * Windows: "...\Program Files\Mozilla\browser\features" (or "Program Files (X86)\etc" for 32bit) + * Mac: "...\Applications\Firefox\Contents\Resources\browser\features\" + [NOTE] On Mac you can right-click on the application and select "Show Package Contents" + * Linux: "/usr/lib/firefox/browser/features" (or similar) + + [1] https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html + [2] https://dxr.mozilla.org/mozilla-central/source/browser/extensions +***/ +user_pref("_user.js.parrot", "0500 syntax error: the parrot's cashed in 'is chips!"); +/* 0501: disable experiments + * [1] https://wiki.mozilla.org/Telemetry/Experiments ***/ +user_pref("experiments.enabled", false); +user_pref("experiments.manifest.uri", ""); +user_pref("experiments.supported", false); +user_pref("experiments.activeExperiment", false); +/* 0502: disable Mozilla permission to silently opt you into tests ***/ +user_pref("network.allow-experiments", false); +/* 0505: block URL used for system extension updates (FF44+) + * [NOTE] You will not get any system extension updates except when you update Firefox ***/ + // user_pref("extensions.systemAddon.update.url", ""); +/* 0506: disable PingCentre telemetry (used in several system extensions) (FF57+) + * Currently blocked by 'datareporting.healthreport.uploadEnabled' (see 0333) ***/ +user_pref("browser.ping-centre.telemetry", false); +/* 0510: disable Pocket (FF39+) + * Pocket is a third party (now owned by Mozilla) "save for later" cloud service + * [1] https://en.wikipedia.org/wiki/Pocket_(application) + * [2] https://www.gnu.gl/blog/Posts/multiple-vulnerabilities-in-pocket/ ***/ +user_pref("extensions.pocket.enabled", false); +/* 0511: disable FlyWeb (FF49+) + * Flyweb is a set of APIs for advertising and discovering local-area web servers + * [1] https://flyweb.github.io/ + * [2] https://wiki.mozilla.org/FlyWeb/Security_scenarios + * [3] https://www.ghacks.net/2016/07/26/firefox-flyweb/ ***/ +user_pref("dom.flyweb.enabled", false); +/* 0512: disable Shield (FF53+) + * Shield is an telemetry system (including Heartbeat) that can also push and test "recipes" + * [1] https://wiki.mozilla.org/Firefox/Shield + * [2] https://github.com/mozilla/normandy ***/ +user_pref("extensions.shield-recipe-client.enabled", false); +user_pref("extensions.shield-recipe-client.api_url", ""); +/* 0513: disable Follow On Search (FF53+) + * Just DELETE the XPI file in your system extensions directory + * [1] https://blog.mozilla.org/data/2017/06/05/measuring-search-in-firefox/ ***/ +/* 0514: disable Activity Stream (FF54+) + * Activity Stream replaces "New Tab" with one based on metadata and browsing behavior, + * and includes telemetry as well as web content such as snippets and "spotlight" + * [1] https://wiki.mozilla.org/Firefox/Activity_Stream + * [2] https://www.ghacks.net/2016/02/15/firefox-mockups-show-activity-stream-new-tab-page-and-share-updates/ ***/ +user_pref("browser.newtabpage.activity-stream.enabled", false); +user_pref("browser.library.activity-stream.enabled", false); // (FF57+) +/* 0515: disable Screenshots (FF55+) + * [1] https://github.com/mozilla-services/screenshots + * [2] https://www.ghacks.net/2017/05/28/firefox-screenshots-integrated-in-firefox-nightly/ ***/ + // user_pref("extensions.screenshots.disabled", true); +/* 0516: disable Onboarding (FF55+) + * Onboarding is an interactive tour/setup for new installs/profiles and features. Every time + * about:home or about:newtab is opened, the onboarding overlay is injected into that page + * [NOTE] Onboarding uses Google Analytics [2], and leaks resource://URIs [3] + * [1] https://wiki.mozilla.org/Firefox/Onboarding + * [2] https://github.com/mozilla/onboard/commit/db4d6c8726c89a5d6a241c1b1065827b525c5baf + * [3] https://bugzilla.mozilla.org/show_bug.cgi?id=863246#c154 ***/ +user_pref("browser.onboarding.enabled", false); +/* 0517: disable Form Autofill (FF55+) + * [SETTING-56+] Options>Privacy & Security>Forms & Passwords>Enable Profile Autofill + * [SETTING-ESR] Options>Privacy>Forms & Passwords>Enable Profile Autofill + * [NOTE] Stored data is NOT secure (uses a JSON file) + * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes + * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill + * [2] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/ ***/ +user_pref("extensions.formautofill.addresses.enabled", false); +user_pref("extensions.formautofill.available", "off"); // (FF56+) +user_pref("extensions.formautofill.creditCards.enabled", false); // (FF56+) +user_pref("extensions.formautofill.heuristics.enabled", false); +/* 0518: disable Web Compatibility Reporter (FF56+) + * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla ***/ +user_pref("extensions.webcompat-reporter.enabled", false); + +/*** 0600: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/ user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!"); /* 0601: disable link prefetching * [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/ user_pref("network.prefetch-next", false); /* 0602: disable DNS prefetching - * [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/ + * [1] https://www.ghacks.net/2013/04/27/firefox-prefetching-what-you-need-to-know/ + * [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/ user_pref("network.dns.disablePrefetch", true); -user_pref("network.dns.disablePrefetchFromHTTPS", true); -/* 0603: disable predictor / prefetching ***/ +user_pref("network.dns.disablePrefetchFromHTTPS", true); // (hidden pref) +/* 0603a: disable Seer/Necko + * [1] https://developer.mozilla.org/docs/Mozilla/Projects/Necko ***/ user_pref("network.predictor.enabled", false); -user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false] -/* 0604: disable link-mouseover opening connection to linked server - * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/ +/* 0603b: disable more Necko/Captive Portal + * [1] https://en.wikipedia.org/wiki/Captive_portal + * [2] https://wiki.mozilla.org/Necko/CaptivePortal + * [3] https://trac.torproject.org/projects/tor/ticket/21790 ***/ +user_pref("captivedetect.canonicalURL", ""); +user_pref("network.captive-portal-service.enabled", false); // (FF52+) +/* 0605: disable link-mouseover opening connection to linked server + * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests + * [2] https://www.ghacks.net/2015/08/16/block-firefox-from-connecting-to-sites-when-you-hover-over-links/ ***/ user_pref("network.http.speculative-parallel-limit", 0); -/* 0605: disable mousedown speculative connections on bookmarks and history [FF98+] ***/ -user_pref("browser.places.speculativeConnect.enabled", false); -/* 0610: enforce no "Hyperlink Auditing" (click tracking) - * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/ - // user_pref("browser.send_pings", false); // [DEFAULT: false] +/* 0606: disable pings (but enforce same host in case) + * [1] http://kb.mozillazine.org/Browser.send_pings + * [2] http://kb.mozillazine.org/Browser.send_pings.require_same_host ***/ +user_pref("browser.send_pings", false); +user_pref("browser.send_pings.require_same_host", true); +/* 0607: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS] + * [1] https://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ ***/ +user_pref("network.protocol-handler.external.ms-windows-store", false); +/* 0608: disable predictor / prefetching (FF48+) ***/ +user_pref("network.predictor.enable-prefetch", false); -/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS ***/ -user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!"); -/* 0702: set the proxy server to do any DNS lookups when using SOCKS - * e.g. in Tor, this stops your local DNS server from knowing your Tor destination - * as a remote Tor node will handle the DNS request - * [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/ -user_pref("network.proxy.socks_remote_dns", true); -/* 0703: disable using UNC (Uniform Naming Convention) paths [FF61+] - * [SETUP-CHROME] Can break extensions for profiles on network shares - * [1] https://bugzilla.mozilla.org/1413868 ***/ -user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF] -/* 0704: disable GIO as a potential proxy bypass vector - * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, - * dav, cdda, gphoto2, trash, etc. From FF87-117, by default only sftp was accepted - * [1] https://bugzilla.mozilla.org/1433507 - * [2] https://en.wikipedia.org/wiki/GVfs - * [3] https://en.wikipedia.org/wiki/GIO_(software) ***/ -user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] [DEFAULT: ""] -/* 0705: disable proxy direct failover for system requests [FF91+] - * [WARNING] Default true is a security feature against malicious extensions [1] - * [SETUP-CHROME] If you use a proxy and you trust your extensions - * [1] https://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ ***/ - // user_pref("network.proxy.failover_direct", false); -/* 0706: disable proxy bypass for system request failures [FF95+] - * RemoteSettings, UpdateService, Telemetry [1] - * [WARNING] If false, this will break the fallback for some security features - * [SETUP-CHROME] If you use a proxy and you understand the security impact - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 ***/ - // user_pref("network.proxy.allow_bypass", false); -/* 0710: enable DNS-over-HTTPS (DoH) [FF60+] - * 0=default, 2=increased (TRR (Trusted Recursive Resolver) first), 3=max (TRR only), 5=off (no rollout) - * see "doh-rollout.home-region": USA 2019, Canada 2021, Russia/Ukraine 2022 [3] - * [SETTING] Privacy & Security>DNS over HTTPS - * [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ - * [2] https://wiki.mozilla.org/Security/DOH-resolver-policy - * [3] https://support.mozilla.org/kb/firefox-dns-over-https - * [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/ - // user_pref("network.trr.mode", 3); -/* 0712: set DoH provider - * The custom uri is the value shown when you "Choose provider>Custom>" - * [NOTE] If you USE custom then "network.trr.uri" should be set the same - * [SETTING] Privacy & Security>DNS over HTTPS>Increased/Max>Choose provider ***/ - // user_pref("network.trr.uri", "https://example.dns"); - // user_pref("network.trr.custom_uri", "https://example.dns"); - -/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/ +/*** 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS [SETUP] + If you are in a private environment (no unwanted eyeballs) and your device is private + (restricted access), and the device is secure when unattended (locked, encrypted, forensic + hardened), then items 0850 and above can be relaxed in return for more convenience and + functionality. Likewise, you may want to check the items cleared on shutdown in section 2800. + [NOTE] The urlbar is also commonly referred to as the location bar and address bar + #Required reading [#] https://xkcd.com/538/ + ***/ user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!"); -/* 0801: disable location bar making speculative connections [FF56+] - * [1] https://bugzilla.mozilla.org/1348275 ***/ -user_pref("browser.urlbar.speculativeConnect.enabled", false); -/* 0802: disable location bar contextual suggestions - * [NOTE] The UI is controlled by the .enabled pref - * [SETTING] Search>Address Bar>Suggestions from... - * [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/ -user_pref("browser.urlbar.quicksuggest.enabled", false); // [FF92+] -user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+] -user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false); // [FF92+] -/* 0803: disable live search suggestions - * [NOTE] Both must be true for live search to work in the location bar - * [SETUP-CHROME] Override these if you trust and use a privacy respecting search engine - * [SETTING] Search>Show search suggestions | Show search suggestions in address bar results ***/ +/* 0801: disable location bar using search - PRIVACY + * don't leak typos to a search engine, give an error message instead ***/ +user_pref("keyword.enabled", false); +/* 0802: disable location bar domain guessing - PRIVACY/SECURITY + * domain guessing intercepts DNS "hostname not found errors" and resends a + * request (e.g. by adding www or .com). This is inconsistent use (e.g. FQDNs), does not work + * via Proxy Servers (different error), is a flawed use of DNS (TLDs: why treat .com + * as the 411 for DNS errors?), privacy issues (why connect to sites you didn't + * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack), + * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/ +user_pref("browser.fixup.alternate.enabled", false); +/* 0803: display all parts of the url in the location bar - helps SECURITY ***/ +user_pref("browser.urlbar.trimURLs", false); +/* 0804: limit history leaks via enumeration (PER TAB: back/forward) - PRIVACY + * This is a PER TAB session history. You still have a full history stored under all history + * default=50, minimum=1=currentpage, 2 is the recommended minimum as some pages + * use it as a means of referral (e.g. hotlinking), 4 or 6 or 10 may be more practical ***/ +user_pref("browser.sessionhistory.max_entries", 10); +/* 0805: disable CSS querying page history - CSS history leak - PRIVACY + * [NOTE] This has NEVER been fully "resolved": in Mozilla/docs it is stated it's + * only in 'certain circumstances', also see latest comments in [2] + * [TEST] http://lcamtuf.coredump.cx/yahh/ (see github wiki APPENDIX C on how to use) + * [1] https://dbaron.org/mozilla/visited-privacy + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=147777 + * [3] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector ***/ +user_pref("layout.css.visited_links_enabled", false); +/* 0806: disable displaying javascript in history URLs - SECURITY ***/ +user_pref("browser.urlbar.filter.javascript", true); +/* 0807: disable search bar LIVE search suggestions - PRIVACY + * [SETTING] Options>Search>Provide search suggestions ***/ user_pref("browser.search.suggest.enabled", false); +/* 0808: disable location bar LIVE search suggestions (requires 0807 = true) - PRIVACY + * Also disable the location bar prompt to enable/disable or learn more about it. + * [SETTING] Options>Search>Show search suggestions in address bar results ***/ user_pref("browser.urlbar.suggest.searches", false); -/* 0805: disable urlbar trending search suggestions [FF118+] - * [SETTING] Search>Search Suggestions>Show trending search suggestions (FF119) ***/ -user_pref("browser.urlbar.trending.featureGate", false); -/* 0806: disable urlbar suggestions ***/ -user_pref("browser.urlbar.addons.featureGate", false); // [FF115+] -user_pref("browser.urlbar.fakespot.featureGate", false); // [FF130+] [DEFAULT: false] -user_pref("browser.urlbar.mdn.featureGate", false); // [FF117+] [HIDDEN PREF] -user_pref("browser.urlbar.pocket.featureGate", false); // [FF116+] [DEFAULT: false] -user_pref("browser.urlbar.weather.featureGate", false); // [FF108+] [DEFAULT: false] -user_pref("browser.urlbar.yelp.featureGate", false); // [FF124+] -/* 0807: disable urlbar clipboard suggestions [FF118+] ***/ - // user_pref("browser.urlbar.clipboard.featureGate", false); -/* 0808: disable recent searches [FF120+] - * [NOTE] Recent searches are cleared with history (2811+) - * [1] https://support.mozilla.org/kb/search-suggestions-firefox ***/ - // user_pref("browser.urlbar.recentsearches.featureGate", false); -/* 0810: disable search and form history - * [NOTE] We also clear formdata on exit (2811+) - * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2] - * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history - * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html - * [2] https://bugzilla.mozilla.org/381681 ***/ +user_pref("browser.urlbar.userMadeSearchSuggestionsChoice", true); // (FF41+) +/* 0809: disable location bar suggesting "preloaded" top websites (FF54+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1211726 ***/ +user_pref("browser.urlbar.usepreloadedtopurls.enabled", false); +/* 0810: disable location bar making speculative connections (FF56+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1348275 ***/ +user_pref("browser.urlbar.speculativeConnect.enabled", false); +/* 0850a: disable location bar autocomplete and suggestion types + * If you enforce any of the suggestion types, you MUST enforce 'autocomplete' + * - If *ALL* of the suggestion types are false, 'autocomplete' must also be false + * - If *ANY* of the suggestion types are true, 'autocomplete' must also be true + * [SETTING-56+] Options>Privacy & Security>Address Bar>When using the address bar, suggest + * [SETTING-ESR] Options>Privacy>Location Bar>When using the location bar, suggest + * [WARNING] If all three suggestion types are false, search engine keywords are disabled ***/ +user_pref("browser.urlbar.autocomplete.enabled", false); +user_pref("browser.urlbar.suggest.history", false); +user_pref("browser.urlbar.suggest.bookmark", false); +user_pref("browser.urlbar.suggest.openpage", false); +/* 0850c: disable location bar dropdown + * This value controls the total number of entries to appear in the location bar dropdown + * [NOTE] Items (bookmarks/history/openpages) with a high "frecency"/"bonus" will always + * be displayed (no we do not know how these are calculated or what the threshold is), + * and this does not affect the search by search engine suggestion (see 0808) + * [USAGE] This setting is only useful if you want to enable search engine keywords + * (i.e. at least one of 0850a suggestion types must be true) but you want to *limit* suggestions shown ***/ + // user_pref("browser.urlbar.maxRichResults", 0); +/* 0850d: disable location bar autofill + * [1] http://kb.mozillazine.org/Inline_autocomplete ***/ +user_pref("browser.urlbar.autoFill", false); +user_pref("browser.urlbar.autoFill.typed", false); +/* 0850e: disable location bar one-off searches (FF51+) + * [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ ***/ +user_pref("browser.urlbar.oneOffSearches", false); +/* 0850f: disable location bar suggesting local search history (FF57+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1181644 ***/ +user_pref("browser.urlbar.maxHistoricalSearchSuggestions", 0); // max. number of search suggestions +/* 0860: disable search and form history + * [SETTING-56+] Options>Privacy & Security>History>Custom Settings>Remember search and form history + * [SETTING-ESR] Options>Privacy>History>Custom Settings>Remember search and form history + * [NOTE] You can clear formdata on exiting Firefox (see 2803) ***/ user_pref("browser.formfill.enable", false); -/* 0815: disable tab-to-search [FF85+] - * Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search - * [SETTING] Search>Address Bar>When using the address bar, suggest>Search engines ***/ - // user_pref("browser.urlbar.suggest.engines", false); -/* 0820: disable coloring of visited links - * [SETUP-HARDEN] Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive - * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing - * attacks. Don't forget clearing history on exit (2811+). However, social engineering [2#limits][4][5] - * and advanced targeted timing attacks could still produce usable results - * [1] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector - * [2] https://dbaron.org/mozilla/visited-privacy - * [3] https://bugzilla.mozilla.org/1632765 - * [4] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use) - * [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/ - // user_pref("layout.css.visited_links_enabled", false); -/* 0830: enable separate default search engine in Private Windows and its UI setting - * [SETTING] Search>Default Search Engine>Choose a different default search engine for Private Windows only ***/ -user_pref("browser.search.separatePrivateDefault", true); // [FF70+] -user_pref("browser.search.separatePrivateDefault.ui.enabled", true); // [FF71+] +/* 0862: disable browsing and download history + * [SETTING-56+] Options>Privacy & Security>History>Custom Settings>Remember my browsing and download history + * [SETTING-ESR] Options>Privacy>History>Custom Settings>Remember my browsing and download history + * [NOTE] You can clear history and downloads on exiting Firefox (see 2803) ***/ + // user_pref("places.history.enabled", false); +/* 0870: disable Windows jumplist [WINDOWS] ***/ +user_pref("browser.taskbar.lists.enabled", false); +user_pref("browser.taskbar.lists.frequent.enabled", false); +user_pref("browser.taskbar.lists.recent.enabled", false); +user_pref("browser.taskbar.lists.tasks.enabled", false); +/* 0871: disable Windows taskbar preview [WINDOWS] ***/ +user_pref("browser.taskbar.previews.enable", false); -/*** [SECTION 0900]: PASSWORDS - [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas -***/ +/*** 0900: PASSWORDS ***/ user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!"); -/* 0903: disable auto-filling username & password form fields - * can leak in cross-site forms *and* be spoofed - * [NOTE] Username & password is still available when you enter the field - * [SETTING] Privacy & Security>Logins and Passwords>Autofill logins and passwords - * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ - * [2] https://homes.esat.kuleuven.be/~asenol/leaky-forms/ ***/ +/* 0901: disable saving passwords + * [SETTING-56+] Options>Privacy & Security>Forms & Passwords>Remember logins and passwords for sites + * [SETTING-ESR] Options>Security>Logins>Remember logins for sites + * [NOTE] This does not clear any passwords already saved ***/ + // user_pref("signon.rememberSignons", false); +/* 0902: use a master password (recommended if you save passwords) + * There are no preferences for this. It is all handled internally. + * [SETTING-56+] Options>Privacy & Security>Forms & Passwords>Use a master password + * [SETTING-ESR] Options>Security>Logins>Use a master password + * [1] https://support.mozilla.org/kb/use-master-password-protect-stored-logins ***/ +/* 0903: set how often Firefox should ask for the master password + * 0=the first time (default), 1=every time it's needed, 2=every n minutes (as per the next pref) ***/ +user_pref("security.ask_for_password", 2); +/* 0904: set how often in minutes Firefox should ask for the master password (see pref above) + * in minutes, default is 30 ***/ +user_pref("security.password_lifetime", 5); +/* 0905: disable auto-filling username & password form fields - SECURITY + * can leak in cross-site forms AND be spoofed + * [NOTE] Password will still be auto-filled after a user name is manually entered + * [1] http://kb.mozillazine.org/Signon.autofillForms ***/ user_pref("signon.autofillForms", false); -/* 0904: disable formless login capture for Password Manager [FF51+] ***/ +/* 0906: disable websites' autocomplete="off" (FF30+) + * Don't let sites dictate use of saved logins and passwords. Increase security through + * stronger password use. The trade-off is the convenience. Some sites should never be + * saved (such as banking sites). Set at true, informed users can make their own choice. ***/ +user_pref("signon.storeWhenAutocompleteOff", true); +/* 0907: display warnings for logins on non-secure (non HTTPS) pages + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1217156 ***/ +user_pref("security.insecure_password.ui.enabled", true); +/* 0908: remove user & password info when attempting to fix an entered URL (i.e. 0802 is true) + * e.g. //user:password@foo -> //user@(prefix)foo(suffix) NOT //user:password@(prefix)foo(suffix) ***/ +user_pref("browser.fixup.hide_user_pass", true); +/* 0909: disable formless login capture for Password Manager (FF51+) ***/ user_pref("signon.formlessCapture.enabled", false); -/* 0905: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+] - * hardens against potential credentials phishing - * 0 = don't allow sub-resources to open HTTP authentication credentials dialogs - * 1 = don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs - * 2 = allow sub-resources to open HTTP authentication credentials dialogs (default) ***/ -user_pref("network.auth.subresource-http-auth-allow", 1); -/* 0906: enforce no automatic authentication on Microsoft sites [FF91+] [WINDOWS 10+] - * [SETTING] Privacy & Security>Logins and Passwords>Allow Windows single sign-on for... - * [1] https://support.mozilla.org/kb/windows-sso ***/ - // user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false] -/* 0907: enforce no automatic authentication on Microsoft sites [FF131+] [MAC] - * On macOS, SSO only works on corporate devices ***/ - // user_pref("network.http.microsoft-entra-sso.enabled", false); // [DEFAULT: false] +/* 0910: disable autofilling saved passwords on HTTP pages and show warning (FF52+) + * [1] https://www.fxsitecompat.com/en-CA/docs/2017/insecure-login-forms-now-disable-autofill-show-warning-beneath-input-control/ + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1217152 + * [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1319119 ***/ +user_pref("signon.autofillForms.http", false); +user_pref("security.insecure_field_warning.contextual.enabled", true); +/* 0911: prevent cross-origin images from triggering an HTTP-Authentication prompt (FF55+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1357835 ***/ +user_pref("network.auth.subresource-img-cross-origin-http-auth-allow", false); -/*** [SECTION 1000]: DISK AVOIDANCE ***/ +/*** 1000: CACHE [SETUP] ***/ user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!"); -/* 1001: disable disk cache - * [NOTE] We also clear cache on exit (2811+) - * [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this ***/ +/** CACHE ***/ +/* 1001: disable disk cache ***/ user_pref("browser.cache.disk.enable", false); -/* 1002: set media cache in Private Browsing to in-memory and increase its maximum size - * [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/ -user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+] -user_pref("media.memory_cache_max_size", 65536); -/* 1003: disable storing extra session data [SETUP-CHROME] - * define on which sites to save extra session data such as form content, cookies and POST data +user_pref("browser.cache.disk.capacity", 0); +user_pref("browser.cache.disk.smart_size.enabled", false); +user_pref("browser.cache.disk.smart_size.first_run", false); +/* 1002: disable disk cache for SSL pages + * [1] http://kb.mozillazine.org/Browser.cache.disk_cache_ssl ***/ +user_pref("browser.cache.disk_cache_ssl", false); +/* 1003: disable memory cache + * [NOTE] Not recommended due to performance issues ***/ + // user_pref("browser.cache.memory.enable", false); + // user_pref("browser.cache.memory.capacity", 0); // (hidden pref) +/* 1005: disable fastback cache + * To improve performance when pressing back/forward Firefox stores visited pages + * so they don't have to be re-parsed. This is not the same as memory cache. + * 0=none, -1=auto (that's minus 1), or for other values see [1] + * [NOTE] Not recommended unless you know what you're doing + * [1] http://kb.mozillazine.org/Browser.sessionhistory.max_total_viewers ***/ + // user_pref("browser.sessionhistory.max_total_viewers", 0); +/* 1006: disable permissions manager from writing to disk [RESTART] + * [NOTE] This means any permission changes are session only + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=967812 ***/ + // user_pref("permissions.memory_only", true); // (hidden pref) +/* 1007: disable randomized FF HTTP cache decay experiments + * [1] https://trac.torproject.org/projects/tor/ticket/13575 ***/ +user_pref("browser.cache.frecency_experiment", -1); +/* 1008: set DNS cache and expiration time (default 400 and 60, same as TBB) ***/ + // user_pref("network.dnsCacheEntries", 400); + // user_pref("network.dnsCacheExpiration", 60); +/** SESSIONS & SESSION RESTORE ***/ +/* 1020: disable the Session Restore service completely + * [WARNING] [SETUP] This also disables the "Recently Closed Tabs" feature + * It does not affect "Recently Closed Windows" or any history. ***/ +user_pref("browser.sessionstore.max_tabs_undo", 0); +user_pref("browser.sessionstore.max_windows_undo", 0); +/* 1021: disable storing extra session data + * extra session data contains contents of forms, scrollbar positions, cookies and POST data + * define on which sites to save extra session data: * 0=everywhere, 1=unencrypted sites, 2=nowhere ***/ user_pref("browser.sessionstore.privacy_level", 2); -/* 1005: disable automatic Firefox start and session restore after reboot [FF62+] [WINDOWS] - * [1] https://bugzilla.mozilla.org/603903 ***/ -user_pref("toolkit.winRegisterApplicationRestart", false); -/* 1006: disable favicons in shortcuts [WINDOWS] +/* 1022: disable resuming session from crash [SETUP] ***/ +user_pref("browser.sessionstore.resume_from_crash", false); +/* 1023: set the minimum interval between session save operations - increasing it + * can help on older machines and some websites, as well as reducing writes, see [1] + * Default is 15000 (15 secs). Try 30000 (30sec), 60000 (1min) etc + * [WARNING] This can also affect entries in the "Recently Closed Tabs" feature: + * i.e. the longer the interval the more chance a quick tab open/close won't be captured. + * This longer interval *may* affect history but we cannot replicate any history not recorded + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1304389 ***/ +user_pref("browser.sessionstore.interval", 30000); +/** FAVICONS ***/ +/* 1030: disable favicons in shortcuts * URL shortcuts use a cached randomly named .ico file which is stored in your - * profile/shortcutCache directory. The .ico remains after the shortcut is deleted + * profile/shortcutCache directory. The .ico remains after the shortcut is deleted. * If set to false then the shortcuts use a generic Firefox icon ***/ user_pref("browser.shell.shortcutFavicons", false); +/* 1031: disable favicons in tabs and new bookmarks + * bookmark favicons are stored as data blobs in places.sqlite>moz_favicons ***/ + // user_pref("browser.chrome.site_icons", false); + // user_pref("browser.chrome.favicons", false); +/* 1032: disable favicons in web notifications ***/ +user_pref("alerts.showFavicons", false); + +/*** 1200: HTTPS ( SSL/TLS / OCSP / CERTS / HSTS / HPKP / CIPHERS ) + Note that your cipher and other settings can be used server side as a fingerprint attack + vector, see [1] (It's quite technical but the first part is easy to understand + and you can stop reading when you reach the second section titled "Enter Bro") + + Option 1: Use Firefox defaults for the 1260's items (item 1260 default for SHA-1, is local + only anyway). There is nothing *weak* about Firefox's defaults, but Mozilla (and + other browsers) will always lag for fear of breakage and upset end-users + Option 2: Disable the ciphers in 1261, 1262 and 1263. These shouldn't break anything. + Optionally, disable the ciphers in 1264. -/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP) - Your cipher and other settings can be used in server side fingerprinting - [TEST] https://www.ssllabs.com/ssltest/viewMyClient.html - [TEST] https://browserleaks.com/ssl - [TEST] https://ja3er.com/ [1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/ -***/ + ***/ user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!"); /** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/ -/* 1201: require safe negotiation - * Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a - * MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations - * but the problem is that the browser can't know that. Setting this pref to true is the only way for the - * browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server - * [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site? - * [STATS] SSL Labs (May 2024) reports over 99.7% of top sites have secure renegotiation [4] - * [1] https://wiki.mozilla.org/Security:Renegotiation - * [2] https://datatracker.ietf.org/doc/html/rfc5746 - * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 - * [4] https://www.ssllabs.com/ssl-pulse/ ***/ -user_pref("security.ssl.require_safe_negotiation", true); -/* 1206: disable TLS1.3 0-RTT (round-trip time) [FF51+] - * This data is not forward secret, as it is encrypted solely under keys derived using - * the offered PSK. There are no guarantees of non-replay between connections +/* 1201: disable old SSL/TLS - vulnerable to a MiTM attack + * [WARNING] Tested Feb 2017 - still breaks too many sites + * [1] https://wiki.mozilla.org/Security:Renegotiation ***/ + // user_pref("security.ssl.require_safe_negotiation", true); +/* 1202: control TLS versions with min and max + * 1=min version of TLS 1.0, 2=min version of TLS 1.1, 3=min version of TLS 1.2 etc + * [NOTE] Jul-2017: Telemetry indicates approx 2% of TLS web traffic uses 1.0 or 1.1 + * [WARNING] If you get an "SSL_ERROR_NO_CYPHER_OVERLAP" error, temporarily + * set a lower value for 'security.tls.version.min' in about:config + * [1] http://kb.mozillazine.org/Security.tls.version.* + * [2] https://www.ssl.com/how-to/turn-off-ssl-3-0-and-tls-1-0-in-your-browser/ + * [2] archived: https://archive.is/hY2Mm ***/ +user_pref("security.tls.version.min", 3); +user_pref("security.tls.version.fallback-limit", 3); +user_pref("security.tls.version.max", 4); // 4 = allow up to and including TLS 1.3 +/* 1203: disable SSL session tracking (FF36+) + * SSL Session IDs speed up HTTPS connections (no need to renegotiate) and last for 48hrs. + * Since the ID is unique, web servers can (and do) use it for tracking. If set to true, + * this disables sending SSL Session IDs and TLS Session Tickets to prevent session tracking + * [1] https://tools.ietf.org/html/rfc5077 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=967977 ***/ +user_pref("security.ssl.disable_session_identifiers", true); // (hidden pref) +/* 1204: disable SSL Error Reporting + * [1] https://firefox-source-docs.mozilla.org/browser/base/sslerrorreport/preferences.html ***/ +user_pref("security.ssl.errorReporting.automatic", false); +user_pref("security.ssl.errorReporting.enabled", false); +user_pref("security.ssl.errorReporting.url", ""); +/* 1205: disable TLS1.3 0-RTT (round-trip time) (FF51+) * [1] https://github.com/tlswg/tls13-spec/issues/1001 - * [2] https://www.rfc-editor.org/rfc/rfc9001.html#name-replay-attacks-with-0-rtt - * [3] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/ -user_pref("security.tls.enable_0rtt_data", false); - + * [2] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/ +user_pref("security.tls.enable_0rtt_data", false); // (FF55+ default true) /** OCSP (Online Certificate Status Protocol) - [1] https://scotthelme.co.uk/revocation-is-broken/ - [2] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ -***/ -/* 1211: enforce OCSP fetching to confirm current validity of certificates + #Required reading [#] https://scotthelme.co.uk/revocation-is-broken/ ***/ +/* 1210: enable OCSP Stapling + * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ ***/ +user_pref("security.ssl.enable_ocsp_stapling", true); +/* 1211: control when to use OCSP fetching (to confirm current validity of certificates) * 0=disabled, 1=enabled (default), 2=enabled for EV certificates only * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority) * It's a trade-off between security (checking) and privacy (leaking info to the CA) * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling - * [SETTING] Privacy & Security>Security>Certificates>Query OCSP responder servers... * [1] https://en.wikipedia.org/wiki/Ocsp ***/ -user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1] +user_pref("security.OCSP.enabled", 1); /* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail - * [SETUP-WEB] SEC_ERROR_OCSP_SERVER_ERROR | SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST * When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail) * Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail) * It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it * could have been revoked) and/or you could be under attack (e.g. malicious blocking of OCSP servers) * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ - * [2] https://www.imperialviolet.org/2014/04/19/revchecking.html - * [3] https://letsencrypt.org/2024/12/05/ending-ocsp/ ***/ + * [2] https://www.imperialviolet.org/2014/04/19/revchecking.html ***/ user_pref("security.OCSP.require", true); - -/** CERTS / HPKP (HTTP Public Key Pinning) ***/ -/* 1223: enable strict PKP (Public Key Pinning) - * 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict - * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE ***/ +/** CERTS / HSTS (HTTP Strict Transport Security) / HPKP (HTTP Public Key Pinning) ***/ +/* 1220: disable Windows 8.1's Microsoft Family Safety cert [WINDOWS] (FF50+) + * 0=disable detecting Family Safety mode and importing the root + * 1=only attempt to detect Family Safety mode (don't import the root) + * 2=detect Family Safety mode and import the root + * [1] https://trac.torproject.org/projects/tor/ticket/21686 ***/ +user_pref("security.family_safety.mode", 0); +/* 1221: disable intermediate certificate caching (fingerprinting attack vector) [RESTART] + * [NOTE] This may be better handled under FPI (ticket 1323644, part of Tor Uplift) + * [WARNING] This affects login/cert/key dbs. The effect is all credentials are session-only. + * Saved logins and passwords are not available. Reset the pref and restart to return them. + * [TEST] https://fiprinca.0x90.eu/poc/ + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1334485 - related bug + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1216882 - related bug (see comment 9) ***/ + // user_pref("security.nocertdb", true); // (hidden pref) +/* 1222: enforce strict pinning + * PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict + * [WARNING] If you rely on an AV (antivirus) to protect your web browsing + * by inspecting ALL your web traffic, then leave at current default=1 + * [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/ user_pref("security.cert_pinning.enforcement_level", 2); -/* 1224: enable CRLite [FF73+] - * 0 = disabled - * 1 = consult CRLite but only collect telemetry - * 2 = consult CRLite and enforce both "Revoked" and "Not Revoked" results - * 3 = consult CRLite and enforce "Not Revoked" results, but defer to OCSP for "Revoked" (default) - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985,1753071 - * [2] https://blog.mozilla.org/security/tag/crlite/ ***/ -user_pref("security.remote_settings.crlite_filters.enabled", true); // [DEFAULT: true FF137+] -user_pref("security.pki.crlite_mode", 2); - +/* 1223: enforce HSTS preload list (default is true) + * The list is compiled into Firefox and used to always load those domains over HTTPS + * [1] https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ + * [2] https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List ***/ +user_pref("network.stricttransportsecurity.preloadlist", true); /** MIXED CONTENT ***/ -/* 1241: disable insecure passive content (such as images) on https pages ***/ - // user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244) -/* 1244: enable HTTPS-Only mode in all windows - * When the top-level is HTTPS, insecure subresources are also upgraded (silent fail) - * [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (after "Continue to HTTP Site") - * [SETTING] Privacy & Security>HTTPS-Only Mode (and manage exceptions) - * [TEST] http://example.com [upgrade] - * [TEST] http://httpforever.com/ | http://http.rip [no upgrade] ***/ -user_pref("dom.security.https_only_mode", true); // [FF76+] - // user_pref("dom.security.https_only_mode_pbm", true); // [FF80+] -/* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/ - // user_pref("dom.security.https_only_mode.upgrade_local", true); -/* 1246: disable HTTP background requests [FF82+] - * When attempting to upgrade, if the server doesn't respond within 3 seconds, Firefox sends - * a top-level HTTP request without path in order to check if the server supports HTTPS or not - * This is done to avoid waiting for a timeout which takes 90 seconds - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/ -user_pref("dom.security.https_only_mode_send_http_background_request", false); - +/* 1240: disable insecure active content on https pages - mixed content + * [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/ +user_pref("security.mixed_content.block_active_content", true); +/* 1241: disable insecure passive content (such as images) on https pages - mixed context ***/ +user_pref("security.mixed_content.block_display_content", true); +/* 1242: enable Mixed-Content-Blocker to use the HSTS cache but disable the HSTS Priming requests (FF51+) + * Allow resources from domains with an existing HSTS cache record or in the HSTS preload list + * to be upgraded to HTTPS internally but disable sending out HSTS Priming requests, because + * those may cause noticeable delays e.g. requests time out or are not handled well by servers + * [NOTE] If you want to use the priming requests make sure 'use_hsts' is also true + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1246540#c145 ***/ +user_pref("security.mixed_content.use_hsts", true); +user_pref("security.mixed_content.send_hsts_priming", false); +/** CIPHERS [see the section 1200 intro] ***/ +/* 1260: disable or limit SHA-1 + * 0=all SHA1 certs are allowed + * 1=all SHA1 certs are blocked (including perfectly valid ones from 2015 and earlier) + * 2=deprecated option that now maps to 1 + * 3=only allowed for locally-added roots (e.g. anti-virus) + * 4=only allowed for locally-added roots or for certs in 2015 and earlier + * [WARNING] When disabled, some man-in-the-middle devices (e.g. security scanners and + * antivirus products, may fail to connect to HTTPS sites. SHA-1 is *almost* obsolete. + * [1] https://blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ ***/ +user_pref("security.pki.sha1_enforcement_level", 1); +/* 1261: disable 3DES (effective key size < 128) + * [1] https://en.wikipedia.org/wiki/3des#Security + * [2] http://en.citizendium.org/wiki/Meet-in-the-middle_attack + * [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/ + // user_pref("security.ssl3.rsa_des_ede3_sha", false); +/* 1262: disable 128 bits ***/ + // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); + // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); +/* 1263: disable DHE (Diffie-Hellman Key Exchange) + * [WARNING] May break obscure sites, but not major sites, which should support ECDH over DHE + * [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/ + // user_pref("security.ssl3.dhe_rsa_aes_128_sha", false); + // user_pref("security.ssl3.dhe_rsa_aes_256_sha", false); +/* 1264: disable the remaining non-modern cipher suites as of FF52 + * [NOTE] Commented out because it still breaks too many sites ***/ + // user_pref("security.ssl3.rsa_aes_128_sha", false); + // user_pref("security.ssl3.rsa_aes_256_sha", false); /** UI (User Interface) ***/ -/* 1270: display warning on the padlock for "broken security" (if 1201 is false) - * Bug: warning padlock not indicated for subresources on a secure page! [2] - * [1] https://wiki.mozilla.org/Security:Renegotiation - * [2] https://bugzilla.mozilla.org/1353705 ***/ +/* 1270: display warning (red padlock) for "broken security" + * [1] https://wiki.mozilla.org/Security:Renegotiation ***/ user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); +/* 1271: control "Add Security Exception" dialog on SSL warnings + * 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default) + * [1] https://github.com/pyllyukko/user.js/issues/210 ***/ +user_pref("browser.ssl_override_behavior", 1); /* 1272: display advanced information on Insecure Connection warning pages * only works when it's possible to add an exception * i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/) * [TEST] https://expired.badssl.com/ ***/ user_pref("browser.xul.error_pages.expert_bad_cert", true); +/* 1273: display HTTP sites as insecure (FF59+) ***/ +user_pref("security.insecure_connection_icon.enabled", true); // all windows + // user_pref("security.insecure_connection_icon.pbmode.enabled", true); // private windows only -/*** [SECTION 1600]: REFERERS - full URI: https://example.com:8888/foo/bar.html?id=1234 - scheme+host+port+path: https://example.com:8888/foo/bar.html - scheme+host+port: https://example.com:8888 - [1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ -***/ +/*** 1400: FONTS ***/ +user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!"); +/* 1401: disable websites choosing fonts (0=block, 1=allow) + * If you disallow fonts, this drastically limits/reduces font + * enumeration (by JS) which is a high entropy fingerprinting vector. + * [SETTING-56+] Options>General>Language and Appearance>Advanced>Allow pages to choose... + * [SETTING-ESR] Options>Content>Font & Colors>Advanced>Allow pages to choose... + * [SETUP] Disabling fonts can uglify the web a fair bit. ***/ +user_pref("browser.display.use_document_fonts", 0); +/* 1402: set more legible default fonts [SETUP] + * [SETTING-56+] Options>General>Language and Appearance>Fonts & Colors>Advanced>Serif|Sans-serif|Monospace + * [SETTING-ESR] Options>Fonts & Colors>Advanced>Serif|Sans-serif|Monospace + * [NOTE] Example below for Windows/Western only ***/ + // user_pref("font.name.serif.x-unicode", "Georgia"); + // user_pref("font.name.serif.x-western", "Georgia"); // default Times New Roman + // user_pref("font.name.sans-serif.x-unicode", "Arial"); + // user_pref("font.name.sans-serif.x-western", "Arial"); // default Arial + // user_pref("font.name.monospace.x-unicode", "Lucida Console"); + // user_pref("font.name.monospace.x-western", "Lucida Console"); // default Courier New +/* 1403: enable icon fonts (glyphs) (FF41+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=789788 ***/ +user_pref("gfx.downloadable_fonts.enabled", true); +/* 1404: disable rendering of SVG OpenType fonts + * [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/ +user_pref("gfx.font_rendering.opentype_svg.enabled", false); +/* 1405: disable WOFF2 (Web Open Font Format) (FF35+) ***/ +user_pref("gfx.downloadable_fonts.woff2.enabled", false); +/* 1406: disable CSS Font Loading API + * [SETUP] Disabling fonts can uglify the web a fair bit. ***/ +user_pref("layout.css.font-loading-api.enabled", false); +/* 1407: disable special underline handling for a few fonts which you will probably never use [RESTART] + * Any of these fonts on your system can be enumerated for fingerprinting. Requires restart. + * [1] http://kb.mozillazine.org/Font.blacklist.underline_offset ***/ +user_pref("font.blacklist.underline_offset", ""); +/* 1408: disable graphite which FF49 turned back on by default + * In the past it had security issues. Update: This continues to be the case, see [1] + * [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 ***/ +user_pref("gfx.font_rendering.graphite.enabled", false); +/* 1409: limit system font exposure to a whitelist (FF52+) [SETUP] [RESTART] + * If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed. + * [NOTE] Creating your own probably highly-unique whitelist will raise your entropy. If + * you block sites choosing fonts in 1401, this preference is irrelevant. In future, + * privacy.resistFingerprinting (see 4500) may cover this, and 1401 can be relaxed. + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1121643 ***/ + // user_pref("font.system.whitelist", ""); // (hidden pref) + +/*** 1600: HEADERS / REFERERS [SETUP] + Except for DNT (Do Not Track), referers are best controlled by an extension. + It is important to realize that it is *cross domain* referers that need + controlling, and this is best handled by EITHER 1603 or 1604, not both. + + Option 1: Recommended: Use an extension to block all referers, and then whitelist + sites on a granular, per domain level. + Option 2: As per the original settings below: Set XOriginPolicy (1603) to 1 (less breakage) + or 2 (more breakage) and leave XOriginTrimmingPolicy (1604) at default 0 + Option 3: Set XOriginPolicy (1603) to default 0 and set XOriginTrimmingPolicy (1604) to 2 + + full URI: https://example.com:8888/foo/bar.html?id=1234 + scheme+host+path+port: https://example.com:8888/foo/bar.html + scheme+host+port: https://example.com:8888 + + #Required reading [#] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/ + ***/ user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!"); -/* 1602: control the amount of cross-origin information to send [FF52+] - * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/ -user_pref("network.http.referer.XOriginTrimmingPolicy", 2); +/* 1601: ALL: control when images/links send a referer + * 0=never, 1=send only when links are clicked, 2=for links and images (default) + * [NOTE] Recommended left at default. Focus on XSS and granular cross origin referer control ***/ +user_pref("network.http.sendRefererHeader", 2); +/* 1602: ALL: control the amount of information to send + * 0=send full URI (default), 1=scheme+host+path+port, 2=scheme+host+port + * [NOTE] Cross origin requests can be fine tuned in 1603 + 1604. Limiting same origin requests + * is rather pointless. Recommended left at default for zero same origin breakage ***/ +user_pref("network.http.referer.trimmingPolicy", 0); +/* 1603: CROSS ORIGIN: control when to send a referer [SETUP] + * 0=always (default), 1=only if base domains match, 2=only if hosts match + * [NOTE] 1=less breakage, possible leakage 2=less leakage, more breakage + * [WARNING] Reset to default 0 if you have issues accessing your modem/router ***/ +user_pref("network.http.referer.XOriginPolicy", 1); +/* 1604: CROSS ORIGIN: control the amount of information to send (FF52+) + * 0=send full URI (default) 1=scheme+host+path+port 2=scheme+host+port ***/ +user_pref("network.http.referer.XOriginTrimmingPolicy", 0); +/* 1605: ALL: disable spoofing a referer + * Spoofing increases your exposure to cross-site request forgeries ***/ +user_pref("network.http.referer.spoofSource", false); +/* 1606: ALL: set the default Referrer Policy (FF53+) + * 0=no-referer 1=same-origin 2=strict-origin-when-cross-origin + * 3=no-referrer-when-downgrade (default) + * [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy + * [1] https://www.w3.org/TR/referrer-policy/ + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1304623 ***/ +user_pref("network.http.referer.userControlPolicy", 3); +/* 1607: TOR: hide (not spoof) referrer when leaving a .onion domain (FF54+) + * [NOTE] Firefox cannot access .onion sites by default. We recommend you use + * TBB (Tor Browser Bundle) which is specifically designed for the dark web + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1305144 ***/ +user_pref("network.http.referer.hideOnionSource", true); +/* 1610: ALL: disable the DNT HTTP header, which is essentially USELESS + * It is voluntary and most ad networks do not honor it. DNT is *NOT* how you stop being data mined. + * Don't encourage a setting that gives any legitimacy to 3rd parties being in control of your privacy. + * Sending a DNT header *highly likely* raises entropy, especially in standard windows. + * [SETTING-56+] Options>Privacy & Security>Tracking Protecting>Send websites a "Do Not Track"... + * [SETTING-ESR] Options>Privacy>Use Tracking Protecting>manage your Do Not Track settings + * [NOTE] DNT is enforced with TP (see 0420) regardless of this pref (e.g. in default PB Mode) + * [NOTE] If you use NoScript MAKE SURE to set the pref noscript.doNotTrack.enabled to match ***/ +user_pref("privacy.donottrackheader.enabled", false); -/*** [SECTION 1700]: CONTAINERS ***/ +/*** 1700: CONTAINERS [SETUP] + [1] https://support.mozilla.org/kb/containers-experiment + [2] https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers + [3] https://github.com/mozilla/testpilot-containers +***/ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!"); -/* 1701: enable Container Tabs and its UI setting [FF50+] - * [SETTING] General>Tabs>Enable Container Tabs - * https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/ -user_pref("privacy.userContext.enabled", true); -user_pref("privacy.userContext.ui.enabled", true); -/* 1702: set behavior on "+ Tab" button to display container menu on left click [FF74+] - * [NOTE] The menu is always shown on long press and right click - * [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/ - // user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true); -/* 1703: set external links to open in site-specific containers [FF123+] - * [SETUP-WEB] Depending on your container extension(s) and their settings - * true=Firefox will not choose a container (so your extension can) - * false=Firefox will choose the container/no-container (default) - * [1] https://bugzilla.mozilla.org/1874599 ***/ - // user_pref("browser.link.force_default_user_context_id_for_external_opens", true); +/* 1701: enable Container Tabs setting in preferences (see 1702) (FF50+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1279029 ***/ + // user_pref("privacy.userContext.ui.enabled", true); +/* 1702: enable Container Tabs (FF50+) + * [SETTING-56+] Options>Privacy & Security>Tabs>Enable Container Tabs + * [SETTING-ESR] Options>Privacy>Container Tabs>Enable Container Tabs ***/ + // user_pref("privacy.userContext.enabled", true); +/* 1703: enable a private container for thumbnail loads (FF51+) ***/ + // user_pref("privacy.usercontext.about_newtab_segregation.enabled", true); +/* 1704: set long press behaviour on "+ Tab" button to display container menu (FF53+) + * 0=disables long press, 1=when clicked, the menu is shown + * 2=the menu is shown after X milliseconds + * [NOTE] The menu does not contain a non-container tab option + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1328756 ***/ + // user_pref("privacy.userContext.longPressBehavior", 2); -/*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/ -user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); -/* 2002: force WebRTC inside the proxy [FF70+] ***/ -user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); -/* 2003: force a single network interface for ICE candidates generation [FF42+] - * When using a system-wide proxy, it uses the proxy interface - * [1] https://developer.mozilla.org/docs/Web/API/RTCIceCandidate - * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/ -user_pref("media.peerconnection.ice.default_address_only", true); -/* 2004: force exclusion of private IPs from ICE candidates [FF51+] - * [SETUP-HARDEN] This will protect your private IP even in TRUSTED scenarios after you - * grant device access, but often results in breakage on video-conferencing platforms ***/ - // user_pref("media.peerconnection.ice.no_host", true); -/* 2020: disable GMP (Gecko Media Plugins) +/*** 1800: PLUGINS ***/ +user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies!"); +/* 1801: set default plugin state (i.e. new plugins on discovery) to never activate + * 0=disabled, 1=ask to activate, 2=active - you can override individual plugins ***/ +user_pref("plugin.default.state", 0); +user_pref("plugin.defaultXpi.state", 0); +/* 1802: enable click to play and set to 0 minutes ***/ +user_pref("plugins.click_to_play", true); +user_pref("plugin.sessionPermissionNow.intervalInMinutes", 0); +/* 1803: set a plugin state: 0=deactivated 1=ask 2=enabled (Flash example) + * you can set all these plugin.state's via Add-ons>Plugins or search for plugin.state in about:config + * [NOTE] You can still over-ride individual sites e.g. youtube via site permissions + * [1] https://www.ghacks.net/2013/07/09/how-to-make-sure-that-a-firefox-plugin-never-activates-again/ ***/ + // user_pref("plugin.state.flash", 0); +/* 1804: disable plugins using external/untrusted scripts with XPCOM or XPConnect ***/ +user_pref("security.xpconnect.plugin.unrestricted", false); +/* 1805: disable scanning for plugins [WINDOWS] + * [1] http://kb.mozillazine.org/Plugin_scanning + * plid.all = whether to scan the directories specified in the Windows registry for PLIDs. + * Used to detect RealPlayer, Java, Antivirus etc, but since FF52 only covers Flash ***/ +user_pref("plugin.scan.plid.all", false); +/* 1820: disable all GMP (Gecko Media Plugins) [SETUP] * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/ - // user_pref("media.gmp-provider.enabled", false); +user_pref("media.gmp-provider.enabled", false); +user_pref("media.gmp.trial-create.enabled", false); +user_pref("media.gmp-manager.url", "data:text/plain,"); +user_pref("media.gmp-manager.url.override", "data:text/plain,"); // (hidden pref) +user_pref("media.gmp-manager.updateEnabled", false); // disable local fallback (hidden pref) +/* 1825: disable widevine CDM (Content Decryption Module) [SETUP] ***/ +user_pref("media.gmp-widevinecdm.visible", false); +user_pref("media.gmp-widevinecdm.enabled", false); +user_pref("media.gmp-widevinecdm.autoupdate", false); +/* 1830: disable all DRM content (EME: Encryption Media Extension) [SETUP] + * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ +user_pref("media.eme.enabled", false); // Options>Content>Play DRM Content +user_pref("browser.eme.ui.enabled", false); // hides "Play DRM Content" checkbox [RESTART] +/* 1840: disable the OpenH264 Video Codec by Cisco to "Never Activate" + * This is the bundled codec used for video chat in WebRTC ***/ +user_pref("media.gmp-gmpopenh264.enabled", false); // (hidden pref) +user_pref("media.gmp-gmpopenh264.autoupdate", false); -/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/ -user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); -/* 2402: prevent scripts from moving and resizing open windows ***/ +/*** 2000: MEDIA / CAMERA / MIC ***/ +user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!"); +/* 2001: disable WebRTC (Web Real-Time Communication) + * [1] https://www.privacytools.io/#webrtc ***/ +user_pref("media.peerconnection.enabled", false); +user_pref("media.peerconnection.use_document_iceservers", false); +user_pref("media.peerconnection.video.enabled", false); +user_pref("media.peerconnection.identity.enabled", false); +user_pref("media.peerconnection.identity.timeout", 1); +user_pref("media.peerconnection.turn.disable", true); +user_pref("media.peerconnection.ice.tcp", false); +user_pref("media.navigator.video.enabled", false); // video capability for WebRTC +/* 2002: limit WebRTC IP leaks if using WebRTC + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1189041 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1297416 + * [3] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/ +user_pref("media.peerconnection.ice.default_address_only", true); // (FF42-FF50) +user_pref("media.peerconnection.ice.no_host", true); // (FF51+) +/* 2010: disable WebGL (Web Graphics Library), force bare minimum feature set if used & disable WebGL extensions + * [1] https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/ + * [2] https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern ***/ +user_pref("webgl.disabled", true); +user_pref("pdfjs.enableWebGL", false); +user_pref("webgl.min_capability_mode", true); +user_pref("webgl.disable-extensions", true); +user_pref("webgl.disable-fail-if-major-performance-caveat", true); +/* 2011: disable WebGL debug info being available to websites + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1171228 + * [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info ***/ +user_pref("webgl.enable-debug-renderer-info", false); +/* 2012: disable two more webgl preferences (FF51+) ***/ +user_pref("webgl.dxgl.enabled", false); // [WINDOWS] +user_pref("webgl.enable-webgl2", false); +/* 2022: disable screensharing ***/ +user_pref("media.getusermedia.screensharing.enabled", false); +user_pref("media.getusermedia.screensharing.allowed_domains", ""); +user_pref("media.getusermedia.browser.enabled", false); +user_pref("media.getusermedia.audiocapture.enabled", false); +/* 2023: disable camera stuff ***/ +user_pref("camera.control.face_detection.enabled", false); +/* 2024: set a default permission for Camera/Microphone (FF58+) + * 0=always ask (default), 1=allow, 2=block + * [SETTING] to add site exceptions: Page Info>Permissions>Use the Camera/Microphone + * [SETTING] to manage site exceptions: Options>Privacy>Permissions>Camera/Microphone>Settings ***/ + // user_pref("permissions.default.camera", 2); + // user_pref("permissions.default.microphone", 2); +/* 2026: disable canvas capture stream + * [1] https://developer.mozilla.org/docs/Web/API/HTMLCanvasElement/captureStream ***/ +user_pref("canvas.capturestream.enabled", false); +/* 2027: disable camera image capture + * [1] https://trac.torproject.org/projects/tor/ticket/16339 ***/ +user_pref("dom.imagecapture.enabled", false); +/* 2028: disable offscreen canvas + * [1] https://developer.mozilla.org/docs/Web/API/OffscreenCanvas ***/ +user_pref("gfx.offscreencanvas.enabled", false); +/* 2030: disable auto-play of HTML5 media + * [WARNING] This may break video playback on various sites ***/ +user_pref("media.autoplay.enabled", false); +/* 2031: disable audio auto-play in non-active tabs (FF51+) + * [1] https://www.ghacks.net/2016/11/14/firefox-51-blocks-automatic-audio-playback-in-non-active-tabs/ ***/ +user_pref("media.block-autoplay-until-in-foreground", true); + +/*** 2200: UI MEDDLING + see http://kb.mozillazine.org/Prevent_websites_from_disabling_new_window_features ***/ +user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!"); +/* 2201: disable website control over browser right-click context menu + * [NOTE] Shift-Right-Click will always bring up the browser right-click context menu ***/ + // user_pref("dom.event.contextmenu.enabled", false); +/* 2202: disable [new window] scripts hiding or disabling the following ***/ +user_pref("dom.disable_window_open_feature.location", true); +user_pref("dom.disable_window_open_feature.menubar", true); +user_pref("dom.disable_window_open_feature.resizable", true); +user_pref("dom.disable_window_open_feature.status", true); +user_pref("dom.disable_window_open_feature.toolbar", true); +/* 2203: disable [popup window] scripts hiding or disabling the following ***/ +user_pref("dom.disable_window_flip", true); // window z-order user_pref("dom.disable_window_move_resize", true); - -/*** [SECTION 2600]: MISCELLANEOUS ***/ -user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); -/* 2603: remove temp files opened from non-PB windows with an external application - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=302433,1738574 ***/ -user_pref("browser.download.start_downloads_in_tmp_dir", true); // [FF102+] -user_pref("browser.helperApps.deleteTempFileOnExit", true); -/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/ -user_pref("browser.uitour.enabled", false); - // user_pref("browser.uitour.url", ""); // Defense-in-depth -/* 2608: reset remote debugging to disabled - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/ -user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false] -/* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+] - * 0 (default) or 1=allow, 2=block - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Override Keyboard Shortcuts ***/ - // user_pref("permissions.default.shortcuts", 2); -/* 2616: remove special permissions for certain mozilla domains [FF35+] - * [1] resource://app/defaults/permissions ***/ -user_pref("permissions.manager.defaultsUrl", ""); -/* 2619: use Punycode in Internationalized Domain Names to eliminate possible spoofing - * [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded - * [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com) - * [1] https://wiki.mozilla.org/IDN_Display_Algorithm - * [2] https://en.wikipedia.org/wiki/IDN_homograph_attack - * [3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox - * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/ -user_pref("network.IDN_show_punycode", true); -/* 2620: enforce PDFJS, disable PDFJS scripting - * This setting controls if the option "Display in Firefox" is available in the setting below - * and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With") - * [WHY] pdfjs is lightweight, open source, and secure: the last exploit was June 2015 [1] - * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). - * It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. - * [NOTE] JS can still force a pdf to open in-browser by bundling its own code - * [SETUP-CHROME] You may prefer a different pdf reader for security/workflow reasons - * [SETTING] General>Applications>Portable Document Format (PDF) - * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/ -user_pref("pdfjs.disabled", false); // [DEFAULT: false] -user_pref("pdfjs.enableScripting", false); // [FF86+] -/* 2624: disable middle click on new tab button opening URLs or searches using clipboard [FF115+] */ -user_pref("browser.tabs.searchclipboardfor.middleclick", false); // [DEFAULT: false NON-LINUX] -/* 2630: disable content analysis by DLP (Data Loss Prevention) agents - * DLP agents are background processes on managed computers that allow enterprises to monitor locally running - * applications for data exfiltration events, which they can allow/block based on customer defined DLP policies. - * 0=Block all requests, 1=Warn on all requests (which lets the user decide), 2=Allow all requests - * [1] https://github.com/chromium/content_analysis_sdk */ -user_pref("browser.contentanalysis.enabled", false); // [FF121+] [DEFAULT: false] -user_pref("browser.contentanalysis.default_result", 0); // [FF127+] [DEFAULT: 0] - -/** DOWNLOADS ***/ -/* 2651: enable user interaction for security by always asking where to download - * [SETUP-CHROME] On Android this blocks longtapping and saving images - * [SETTING] General>Downloads>Always ask you where to save files ***/ -user_pref("browser.download.useDownloadDir", false); -/* 2652: disable downloads panel opening on every download [FF96+] ***/ -user_pref("browser.download.alwaysOpenPanel", false); -/* 2653: disable adding downloads to the system's "recent documents" list ***/ -user_pref("browser.download.manager.addToRecentDocs", false); -/* 2654: enable user interaction for security by always asking how to handle new mimetypes [FF101+] - * [SETTING] General>Files and Applications>What should Firefox do with other files ***/ -user_pref("browser.download.always_ask_before_handling_new_types", true); - -/** EXTENSIONS ***/ -/* 2660: limit allowed extension directories - * 1=profile, 2=user, 4=application, 8=system, 16=temporary, 31=all - * The pref value represents the sum: e.g. 5 would be profile and application directories - * [SETUP-CHROME] Breaks usage of files which are installed outside allowed directories - * [1] https://archive.is/DYjAM ***/ -user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF] - // user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15] -/* 2661: disable bypassing 3rd party extension install prompts [FF82+] - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1659530,1681331 ***/ -user_pref("extensions.postDownloadThirdPartyPrompt", false); -/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+] - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ - // user_pref("extensions.webextensions.restrictedDomains", ""); - -/*** [SECTION 2700]: ETP (ENHANCED TRACKING PROTECTION) ***/ -user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); -/* 2701: enable ETP Strict Mode [FF86+] - * ETP Strict Mode enables Total Cookie Protection (TCP) - * [NOTE] Adding site exceptions disables all ETP protections for that site and increases the risk of - * cross-site state tracking e.g. exceptions for SiteA and SiteB means PartyC on both sites is shared - * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/ - * [SETTING] to add site exceptions: Urlbar>ETP Shield - * [SETTING] to manage site exceptions: Options>Privacy & Security>Enhanced Tracking Protection>Manage Exceptions ***/ -user_pref("browser.contentblocking.category", "strict"); // [HIDDEN PREF] -/* 2702: disable ETP web compat features [FF93+] - * [SETUP-HARDEN] Includes skip lists, heuristics (SmartBlock) and automatic grants - * Opener and redirect heuristics are granted for 30 days, see [3] - * [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/ - * [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12 - * [3] https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/ - // user_pref("privacy.antitracking.enableWebcompat", false); - -/*** [SECTION 2800]: SHUTDOWN & SANITIZING ***/ -user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); -/* 2810: enable Firefox to clear items on shutdown - * [NOTE] In FF129+ clearing "siteSettings" on shutdown (2811+), or manually via site data (2820+) and - * via history (2830), will no longer remove sanitize on shutdown "cookie and site data" site exceptions (2815) - * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes | Settings ***/ -user_pref("privacy.sanitize.sanitizeOnShutdown", true); - -/** SANITIZE ON SHUTDOWN: IGNORES "ALLOW" SITE EXCEPTIONS ***/ -/* 2811: set/enforce clearOnShutdown items (if 2810 is true) [SETUP-CHROME] [FF128+] ***/ -user_pref("privacy.clearOnShutdown_v2.cache", true); // [DEFAULT: true] -user_pref("privacy.clearOnShutdown_v2.historyFormDataAndDownloads", true); // [DEFAULT: true] - // user_pref("privacy.clearOnShutdown_v2.siteSettings", false); // [DEFAULT: false] -/* 2812: set/enforce clearOnShutdown items [FF136+] ***/ -user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", true); // [DEFAULT: true] -user_pref("privacy.clearOnShutdown_v2.downloads", true); -user_pref("privacy.clearOnShutdown_v2.formdata", true); -/* 2813: set Session Restore to clear on shutdown (if 2810 is true) [FF34+] - * [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811+) - * [NOTE] If true, this prevents resuming from crashes (also see 5008) ***/ - // user_pref("privacy.clearOnShutdown.openWindows", true); - -/** SANITIZE ON SHUTDOWN: RESPECTS "ALLOW" SITE EXCEPTIONS ***/ -/* 2815: set "Cookies" and "Site Data" to clear on shutdown (if 2810 is true) [SETUP-CHROME] [FF128+] - * [NOTE] Exceptions: For cross-domain logins, add exceptions for both sites - * e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on) - * [WARNING] Be selective with what sites you "Allow", as they also disable partitioning (1767271) - * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow (when on the website in question) - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ -user_pref("privacy.clearOnShutdown_v2.cookiesAndStorage", true); - -/** SANITIZE SITE DATA: IGNORES "ALLOW" SITE EXCEPTIONS ***/ -/* 2820: set manual "Clear Data" items [SETUP-CHROME] [FF128+] - * Firefox remembers your last choices. This will reset them when you start Firefox - * [SETTING] Privacy & Security>Browser Privacy>Cookies and Site Data>Clear Data ***/ -user_pref("privacy.clearSiteData.cache", true); -user_pref("privacy.clearSiteData.cookiesAndStorage", false); // keep false until it respects "allow" site exceptions -user_pref("privacy.clearSiteData.historyFormDataAndDownloads", true); - // user_pref("privacy.clearSiteData.siteSettings", false); -/* 2821: set manual "Clear Data" items [FF136+] ***/ -user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", true); -user_pref("privacy.clearSiteData.formdata", true); - -/** SANITIZE HISTORY: IGNORES "ALLOW" SITE EXCEPTIONS ***/ -/* 2830: set manual "Clear History" items, also via Ctrl-Shift-Del [SETUP-CHROME] [FF128+] - * Firefox remembers your last choices. This will reset them when you start Firefox - * [SETTING] Privacy & Security>History>Custom Settings>Clear History ***/ -user_pref("privacy.clearHistory.cache", true); // [DEFAULT: true] -user_pref("privacy.clearHistory.cookiesAndStorage", false); -user_pref("privacy.clearHistory.historyFormDataAndDownloads", true); // [DEFAULT: true] - // user_pref("privacy.clearHistory.siteSettings", false); // [DEFAULT: false] -/* 2831: set manual "Clear History" items [FF136+] ***/ -user_pref("privacy.clearHistory.browsingHistoryAndDownloads", true); // [DEFAULT: true] -user_pref("privacy.clearHistory.formdata", true); - -/** SANITIZE MANUAL: TIMERANGE ***/ -/* 2840: set "Time range to clear" for "Clear Data" (2820+) and "Clear History" (2830+) - * Firefox remembers your last choice. This will reset the value when you start Firefox - * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today - * [NOTE] Values 5 (last 5 minutes) and 6 (last 24 hours) are not listed in the dropdown, - * which will display a blank value, and are not guaranteed to work ***/ -user_pref("privacy.sanitize.timeSpan", 0); - -/*** [SECTION 4000]: FPP (fingerprintingProtection) - RFP (4501) overrides FPP - - In FF118+ FPP is on by default in private windows (4001) and in FF119+ is controlled - by ETP (2701). FPP will also use Remote Services in future to relax FPP protections - on a per site basis for compatibility (4004). - - https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargetsDefault.inc - - [NOTE] RFPTargets + granular overrides are somewhat experimental and may produce unexpected results - - e.g. FrameRate can only be controlled per process, not per origin - - 1826408 - restrict fonts to system (kBaseFonts + kLangPackFonts) (Windows, Mac, some Linux) - https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc - 1858181 - subtly randomize canvas per eTLD+1, per session and per window-mode (FF120+) -***/ -user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!"); -/* 4001: enable FPP in PB mode [FF114+] - * [NOTE] In FF119+, FPP for all modes (7016) is enabled with ETP Strict (2701) ***/ - // user_pref("privacy.fingerprintingProtection.pbmode", true); // [DEFAULT: true] -/* 4002: set global FPP overrides [FF114+] - * uses "RFPTargets" [1] which despite the name these are not used by RFP - * e.g. "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC" = all targets but allow prefers-color-scheme and do not change timezone - * e.g. "-AllTargets,+CanvasRandomization,+JSDateTimeUTC" = no targets but do use FPP canvas and change timezone - * [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults - * [1] https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargets.inc ***/ - // user_pref("privacy.fingerprintingProtection.overrides", ""); -/* 4003: set granular FPP overrides - * JSON format: e.g."[{\"firstPartyDomain\": \"netflix.com\", \"overrides\": \"-CanvasRandomization,-FrameRate,\"}]" - * [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults ***/ - // user_pref("privacy.fingerprintingProtection.granularOverrides", ""); -/* 4004: disable remote FPP overrides [FF127+] ***/ - // user_pref("privacy.fingerprintingProtection.remoteOverrides.enabled", false); - -/*** [SECTION 4500]: OPTIONAL RFP (resistFingerprinting) - RFP overrides FPP (4000) - - FF128+ Arkenfox by default uses FPP (automatically enabled with ETP Strict). For most people - this is all you need. To use RFP instead, add RFP (4501) to your overrides, and optionally - add letterboxing (4504), spoof_english (4506), and webgl (4520). - - RFP is an all-or-nothing buy in: you cannot pick and choose what parts you want - - [WARNING] DO NOT USE extensions to alter RFP protected metrics - - 418986 - limit window.screen & CSS media queries (FF41) - 1360039 - spoof navigator.hardwareConcurrency as 2 (FF55) - FF56 - 1333651 - spoof User Agent & Navigator API - JS: spoofed as Windows 10, OS 10.15, Android 10, or Linux - HTTP Header: spoofed as Windows 10 or Android 10.15 until FF136 then matches JS spoof - 1369319 - disable device sensor API - 1369357 - disable site specific zoom - 1337161 - hide gamepads from content - 1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true - 1333641 - reduce fingerprinting in WebSpeech API - FF57 - 1369309 - spoof media statistics - 1382499 - reduce screen co-ordinate fingerprinting in Touch API - 1217290 & 1409677 - enable some fingerprinting resistance for WebGL - 1354633 - limit MediaError.message to a whitelist - FF58+ - 1372073 - spoof/block fingerprinting in MediaDevices API (FF59) - Spoof: enumerate devices as one "Internal Camera" and one "Internal Microphone" - Block: suppresses the ondevicechange event - 1039069 - warn when language prefs are not set to "en*" (FF59) - 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59) - Spoofing mimics the content language of the document. Currently it only supports en-US. - Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected. - 1337157 - disable WebGL debug renderer info (FF60) - 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62) - 1479239 - return "no-preference" with prefers-reduced-motion (FF63) - 1363508 & 1826051 - spoof/suppress Pointer Events (FF64, FF132) - 1492766 - spoof pointerEvent.pointerid (FF65) - 1485266 - disable exposure of system colors to CSS or canvas (FF67) - 1494034 - return "light" with prefers-color-scheme (FF67) - 1564422 - spoof audioContext outputLatency (FF70) - 1595823 - return audioContext sampleRate as 44100 (FF72) - 1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74) - 1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78) - 1506364 - return "no-preference" with prefers-contrast (FF80) - 1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80) - 1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82) - 531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1) - 1756280 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF100-115) - 1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms) (FF102) - 1422237 - return "srgb" with color-gamut (FF110) - 1794628 - return "none" with inverted-colors (FF114) - 1787790 - normalize system fonts (FF128) - 1835987 - spoof timezone as Atlantic/Reykjavik (previously FF55+ was UTC) (FF128) - 1834307 - always use smooth scrolling (FF132) - 1918202 - spoof screen orientation based on spoofed screen size and platform (FF132) - previously it always returned landscape-primary and an angle of 0 (FF50+) - 1390465 - load all subtitles in WebVTT (Video Text Tracks) (FF133) - 1873382 - make spoofed devicePixelRatio and CSS media queries match (FF133) - previously FF41+ devicePixelRatio was hardcoded as 1 and FF127+ as 2 - previously FF41+ CSS media queries were spoofed as zoom level at a devicePixelRatio of 1 -***/ -user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); -/* 4501: enable RFP - * [NOTE] pbmode applies if true and the original pref is false - * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a canvas site exception via the urlbar. - * RFP also has a few side effects: mainly that timezone is GMT, and websites will prefer light theme ***/ - // user_pref("privacy.resistFingerprinting", true); // [FF41+] - // user_pref("privacy.resistFingerprinting.pbmode", true); // [FF114+] -/* 4502: set RFP new window size max rounded values [FF55+] - * [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen - * [1] https://bugzilla.mozilla.org/1330882 ***/ -user_pref("privacy.window.maxInnerWidth", 1600); -user_pref("privacy.window.maxInnerHeight", 900); -/* 4503: disable mozAddonManager Web API [FF57+] - * [NOTE] To allow extensions to work on AMO, you also need 2662 - * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/ -user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); -/* 4504: enable letterboxing [FF67+] - * Dynamically resizes the inner window by applying margins in stepped ranges [2] - * If you use the dimension pref, then it will only apply those resolutions. - * The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000") - * [SETUP-WEB] This is independent of RFP (4501). If you're not using RFP, or you are but - * dislike the margins, then flip this pref, keeping in mind that it is effectively fingerprintable - * [WARNING] DO NOT USE: the dimension pref is only meant for testing - * [1] https://bugzilla.mozilla.org/1407366 - * [2] https://hg.mozilla.org/mozilla-central/rev/7211cb4f58ff#l5.13 ***/ - // user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF] - // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF] -/* 4505: disable RFP by domain [FF91+] - * [NOTE] Working examples: "arkenfox.github.io", "*github.io" - * Non-working examples: "https://arkenfox.github.io", "github.io", "*arkenfox.github.io" ***/ - // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid"); -/* 4506: disable RFP spoof english prompt [FF59+] - * 0=prompt, 1=disabled, 2=enabled - * [NOTE] When changing from value 2, preferred languages ('intl.accept_languages') is not reset. - * [SETUP-WEB] when enabled, sets 'en-US, en' for displaying pages and 'en-US' as locale. - * [SETTING] General>Language>Choose your preferred language for displaying pages>Choose>Request English... ***/ -user_pref("privacy.spoof_english", 1); -/* 4510: disable using system colors - * [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/ -user_pref("browser.display.use_system_colors", false); // [DEFAULT: false NON-WINDOWS] -/* 4511: disable using system accent colors ***/ -user_pref("widget.non-native-theme.use-theme-accent", false); // [DEFAULT: false WINDOWS] -/* 4512: enforce links targeting new windows to open in a new tab instead - * 1=most recent window or tab, 2=new window, 3=new tab - * Stops malicious window sizes and some screen resolution leaks. - * You can still right-click a link and open in a new window - * [SETTING] General>Tabs>Open links in tabs instead of new windows - * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/ -user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3] -/* 4513: set all open window methods to abide by "browser.link.open_newwindow" (4512) - * [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js ***/ +user_pref("dom.disable_window_open_feature.close", true); +user_pref("dom.disable_window_open_feature.minimizable", true); +user_pref("dom.disable_window_open_feature.personalbar", true); // bookmarks toolbar +user_pref("dom.disable_window_open_feature.titlebar", true); +user_pref("dom.disable_window_status_change", true); +user_pref("dom.allow_scripts_to_close_windows", false); +/* 2204: disable links opening in a new window + * This is to stop malicious window sizes and screen res leaks etc in conjunction + * with 2203 dom.disable_window_move_resize=true | 2418 full-screen-api.enabled=false + * [NOTE] You can still right click a link and select open in a new window + * [TEST] https://people.torproject.org/~gk/misc/entire_desktop.html + * [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/ user_pref("browser.link.open_newwindow.restriction", 0); -/* 4520: disable WebGL (Web Graphics Library) ***/ - // user_pref("webgl.disabled", true); +/* 2205: disable "Confirm you want to leave" dialog on page close + * Does not prevent JS leaks of the page close event. + * [1] https://developer.mozilla.org/docs/Web/Events/beforeunload + * [2] https://support.mozilla.org/questions/1043508 ***/ +user_pref("dom.disable_beforeunload", true); -/*** [SECTION 5000]: OPTIONAL OPSEC - Disk avoidance, application data isolation, eyeballs... -***/ -user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow"); -/* 5001: start Firefox in PB (Private Browsing) mode - * [NOTE] In this mode all windows are "private windows" and the PB mode icon is not displayed - * [NOTE] The P in PB mode can be misleading: it means no "persistent" disk state such as history, - * caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode). - * In fact, PB mode limits or removes the ability to control some of these, and you need to quit - * Firefox to clear them. PB is best used as a one off window (Menu>New Private Window) to provide - * a temporary self-contained new session. Close all private windows to clear the PB session. - * [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode - * [1] https://wiki.mozilla.org/Private_Browsing - * [2] https://support.mozilla.org/kb/common-myths-about-private-browsing ***/ - // user_pref("browser.privatebrowsing.autostart", true); -/* 5002: disable memory cache - * capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/ - // user_pref("browser.cache.memory.enable", false); - // user_pref("browser.cache.memory.capacity", 0); -/* 5003: disable saving passwords - * [NOTE] This does not clear any passwords already saved - * [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/ - // user_pref("signon.rememberSignons", false); -/* 5004: disable permissions manager from writing to disk [FF41+] [RESTART] - * [NOTE] This means any permission changes are session only - * [1] https://bugzilla.mozilla.org/967812 ***/ - // user_pref("permissions.memory_only", true); // [HIDDEN PREF] -/* 5005: disable intermediate certificate caching [FF41+] [RESTART] - * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only. - * Saved logins and passwords are not available. Reset the pref and restart to return them ***/ - // user_pref("security.nocertdb", true); -/* 5006: disable favicons in history and bookmarks - * [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your - * actual history (and bookmarks) already do. Your history is more detailed, so - * control that instead; e.g. disable history, clear history on exit, use PB mode - * [NOTE] favicons.sqlite is sanitized on Firefox close ***/ - // user_pref("browser.chrome.site_icons", false); -/* 5007: exclude "Undo Closed Tabs" in Session Restore ***/ - // user_pref("browser.sessionstore.max_tabs_undo", 0); -/* 5008: disable resuming session from crash - * [TEST] about:crashparent ***/ - // user_pref("browser.sessionstore.resume_from_crash", false); -/* 5009: disable "open with" in download dialog [FF50+] - * Application data isolation [1] - * [1] https://bugzilla.mozilla.org/1281959 ***/ - // user_pref("browser.download.forbid_open_with", true); -/* 5010: disable location bar suggestion types - * [SETTING] Search>Address Bar>When using the address bar, suggest ***/ - // user_pref("browser.urlbar.suggest.history", false); - // user_pref("browser.urlbar.suggest.bookmark", false); - // user_pref("browser.urlbar.suggest.openpage", false); - // user_pref("browser.urlbar.suggest.topsites", false); // [FF78+] -/* 5011: disable location bar dropdown - * This value controls the total number of entries to appear in the location bar dropdown ***/ - // user_pref("browser.urlbar.maxRichResults", 0); -/* 5012: disable location bar autofill - * [1] https://support.mozilla.org/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/ - // user_pref("browser.urlbar.autoFill", false); -/* 5013: disable browsing and download history - * [NOTE] We also clear history and downloads on exit (2811+) - * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/ - // user_pref("places.history.enabled", false); -/* 5014: disable Windows jumplist [WINDOWS] ***/ - // user_pref("browser.taskbar.lists.enabled", false); - // user_pref("browser.taskbar.lists.frequent.enabled", false); - // user_pref("browser.taskbar.lists.recent.enabled", false); - // user_pref("browser.taskbar.lists.tasks.enabled", false); -/* 5016: discourage downloading to desktop - * 0=desktop, 1=downloads (default), 2=custom - * [SETTING] To set your custom default "downloads": General>Downloads>Save files to ***/ - // user_pref("browser.download.folderList", 2); -/* 5017: disable Form Autofill - * If .supportedCountries includes your region (browser.search.region) and .supported - * is "detect" (default), then the UI will show. Stored data is not secure, uses JSON - * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses - * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/ - // user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+] - // user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+] -/* 5018: limit events that can cause a pop-up ***/ - // user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); -/* 5019: disable page thumbnail collection ***/ - // user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF] -/* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/ - // user_pref("alerts.useSystemBackend.windows.notificationserver.enabled", false); -/* 5021: disable location bar using search - * Don't leak URL typos to a search engine, give an error message instead - * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com" - * [NOTE] This does not affect explicit user action such as using search buttons in the - * dropdown, or using keyword search shortcuts you configure in options (e.g. "d" for DuckDuckGo) ***/ - // user_pref("keyword.enabled", false); +/*** 2300: WEB WORKERS [SETUP] + A worker is a JS "background task" running in a global context, i.e. it is different from + the current window. Workers can spawn new workers (must be the same origin & scheme), + including service and shared workers. Shared workers can be utilized by multiple scripts and + communicate between browsing contexts (windows/tabs/iframes) and can even control your cache. -/*** [SECTION 5500]: OPTIONAL HARDENING - Not recommended. Overriding these can cause breakage and performance issues, - they are mostly fingerprintable, and the threat model is practically nonexistent -***/ -user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!"); -/* 5501: disable MathML (Mathematical Markup Language) [FF51+] - * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mathml ***/ - // user_pref("mathml.disabled", true); // 1173199 -/* 5502: disable in-content SVG (Scalable Vector Graphics) [FF53+] - * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+svg ***/ - // user_pref("svg.disabled", true); // 1216893 -/* 5503: disable graphite - * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+graphite - * [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/ - // user_pref("gfx.font_rendering.graphite.enabled", false); -/* 5504: disable asm.js [FF22+] - * [1] http://asmjs.org/ - * [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js - * [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/ - // user_pref("javascript.options.asmjs", false); -/* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART] - * [NOTE] When both Ion and JIT are disabled, and trustedprincipals - * is enabled, then Ion can still be used by extensions (1599226) - * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit - * [2] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ ***/ + [WARNING] Disabling workers *will* break sites (e.g. Google Street View, Twitter). + [UPDATE] uMatrix 1.2.0+ allows a per-scope control for workers (2301) and service workers (2302) + #Required reading [#] https://github.com/gorhill/uMatrix/releases/tag/1.2.0 + + [1] Web Workers: https://developer.mozilla.org/docs/Web/API/Web_Workers_API + [2] Worker: https://developer.mozilla.org/docs/Web/API/Worker + [3] Service Worker: https://developer.mozilla.org/docs/Web/API/Service_Worker_API + [4] SharedWorker: https://developer.mozilla.org/docs/Web/API/SharedWorker + [5] ChromeWorker: https://developer.mozilla.org/docs/Web/API/ChromeWorker + [6] Notifications: https://support.mozilla.org/questions/1165867#answer-981820 + ***/ +user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!"); +/* 2301: disable workers + * [NOTE] CVE-2016-5259, CVE-2016-2812, CVE-2016-1949, CVE-2016-5287 (fixed) ***/ +user_pref("dom.workers.enabled", false); +/* 2302: disable service workers + * Service workers essentially act as proxy servers that sit between web apps, and the browser + * and network, are event driven, and can control the web page/site it is associated with, + * intercepting and modifying navigation and resource requests, and caching resources. + * [NOTE] Service worker APIs are hidden (in Firefox) and cannot be used when in PB mode. + * [NOTE] Service workers only run over HTTPS. Service Workers have no DOM access. ***/ +user_pref("dom.serviceWorkers.enabled", false); +/* 2304: disable web notifications + * [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/ +user_pref("dom.webnotifications.enabled", false); // (FF22+) +user_pref("dom.webnotifications.serviceworker.enabled", false); // (FF44+) +/* 2305: set a default permission for Notifications (see 2304) (FF58+) + * [SETTING] to add site exceptions: Page Info>Permissions>Receive Notifications + * [SETTING] to manage site exceptions: Options>Privacy>Permissions>Notifications>Settings ***/ + // user_pref("permissions.default.desktop-notification", 2); // 0=always ask (default), 1=allow, 2=block +/* 2306: disable push notifications (FF44+) + * web apps can receive messages pushed to them from a server, whether or + * not the web app is in the foreground, or even currently loaded + * [1] https://developer.mozilla.org/docs/Web/API/Push_API ***/ +user_pref("dom.push.enabled", false); +user_pref("dom.push.connection.enabled", false); +user_pref("dom.push.serverURL", ""); +user_pref("dom.push.userAgentID", ""); + +/*** 2400: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT ***/ +user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!"); +/* 2402: disable website access to clipboard events/content + * [WARNING] This will break some sites functionality such as pasting into facebook, wordpress + * this applies to onCut, onCopy, onPaste events - i.e. you have to interact with + * the website for it to look at the clipboard + * [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ ***/ +user_pref("dom.event.clipboardevents.enabled", false); +/* 2403: disable clipboard commands (cut/copy) from "non-privileged" content (FF41+) + * this disables document.execCommand("cut"/"copy") to protect your clipboard + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1170911 ***/ +user_pref("dom.allow_cut_copy", false); // (hidden pref) +/* 2414: disable shaking the screen ***/ +user_pref("dom.vibrator.enabled", false); +/* 2415: set max popups from a single non-click event - default is 20! ***/ +user_pref("dom.popup_maximum", 3); +/* 2415b: limit events that can cause a popup + * default is "change click dblclick mouseup pointerup notificationclick reset submit touchend" + * [1] http://kb.mozillazine.org/Dom.popup_allowed_events ***/ +user_pref("dom.popup_allowed_events", "click dblclick"); +/* 2416: disable idle observation ***/ +user_pref("dom.idle-observers-api.enabled", false); +/* 2418: disable full-screen API + * false=block, true=ask ***/ +user_pref("full-screen-api.enabled", false); +/* 2420: disable asm.js (http://asmjs.org/) (FF22+) + * [1] https://www.mozilla.org/security/advisories/mfsa2015-29/ + * [2] https://www.mozilla.org/security/advisories/mfsa2015-50/ + * [3] https://www.mozilla.org/security/advisories/mfsa2017-01/#CVE-2017-5375 + * [4] https://www.mozilla.org/security/advisories/mfsa2017-05/#CVE-2017-5400 ***/ +user_pref("javascript.options.asmjs", false); +/* 2421: disable Ion and baseline JIT to help harden JS against exploits such as CVE-2015-0817 + * [WARNING] Causes the odd site issue and there is also a performance loss + * [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 ***/ // user_pref("javascript.options.ion", false); // user_pref("javascript.options.baselinejit", false); - // user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF] -/* 5506: disable WebAssembly [FF52+] - * Vulnerabilities [1] have increasingly been found, including those known and fixed - * in native programs years ago [2]. WASM has powerful low-level access, making - * certain attacks (brute-force) and vulnerabilities more possible - * [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3] - * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm - * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly - * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/ - // user_pref("javascript.options.wasm", false); -/* 5507: disable rendering of SVG OpenType fonts ***/ - // user_pref("gfx.font_rendering.opentype_svg.enabled", false); -/* 5508: disable all DRM content (EME: Encryption Media Extension) - * Optionally hide the UI setting which also disables the DRM prompt - * [SETTING] General>DRM Content>Play DRM-controlled content - * [TEST] https://bitmovin.com/demos/drm - * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/ - // user_pref("media.eme.enabled", false); - // user_pref("browser.eme.ui.enabled", false); -/* 5509: disable IPv6 if using a VPN - * This is an application level fallback. Disabling IPv6 is best done at an OS/network - * level, and/or configured properly in system wide VPN setups. - * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT" - * [SETUP-WEB] PR_CONNECT_RESET_ERROR - * [TEST] https://ipleak.org/ - * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/ +/* 2422: disable WebAssembly for now (FF52+) + * [1] https://developer.mozilla.org/docs/WebAssembly ***/ +user_pref("javascript.options.wasm", false); +/* 2426: disable Intersection Observer API (FF53+) + * Almost a year to complete, three versions late to stable (as default false), + * number #1 cause of crashes in nightly numerous times, and is (primarily) an + * ad network API for "ad viewability checks" down to a pixel level + * [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API + * [2] https://w3c.github.io/IntersectionObserver/ + * [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1243846 ***/ +user_pref("dom.IntersectionObserver.enabled", false); +/* 2427: disable Shared Memory (Spectre mitigation) + * [1] https://github.com/tc39/ecmascript_sharedmem/blob/master/TUTORIAL.md + * [2] https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ ***/ +user_pref("javascript.options.shared_memory", false); + +/*** 2500: HARDWARE FINGERPRINTING ***/ +user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!"); +/* 2504: disable virtual reality devices + * [WARNING] [SETUP] Optional protection depending on your connected devices + * [1] https://developer.mozilla.org/docs/Web/API/WebVR_API ***/ + // user_pref("dom.vr.enabled", false); +/* 2505: disable media device enumeration (FF29+) + * [NOTE] media.peerconnection.enabled should also be set to false (see 2001) + * [1] https://wiki.mozilla.org/Media/getUserMedia + * [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/enumerateDevices ***/ +user_pref("media.navigator.enabled", false); +/* 2508: disable hardware acceleration to reduce graphics fingerprinting + * [SETTING] Options>General>Performance>Custom>Use hardware acceleration when available + * [WARNING] [SETUP] Affects text rendering (fonts will look different), impacts video performance, + * and parts of Quantum that utilize the GPU will also be affected as they are rolled out + * [1] https://wiki.mozilla.org/Platform/GFX/HardwareAcceleration ***/ + // user_pref("gfx.direct2d.disabled", true); // [WINDOWS] +user_pref("layers.acceleration.disabled", true); +/* 2510: disable Web Audio API (FF51+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1288359 ***/ +user_pref("dom.webaudio.enabled", false); +/* 2511: disable MediaDevices change detection (FF51+) (enabled by default starting FF52+) + * [1] https://developer.mozilla.org/docs/Web/Events/devicechange + * [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/ondevicechange ***/ +user_pref("media.ondevicechange.enabled", false); + +/*** 2600: MISC - LEAKS / FINGERPRINTING / PRIVACY / SECURITY ***/ +user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!"); +/* 2601: disable sending additional analytics to web servers + * [1] https://developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/ +user_pref("beacon.enabled", false); +/* 2602: discourage downloading to desktop (0=desktop 1=downloads 2=last used) + * [NOTE] To set your default "downloads": Options>General>Downloads>Save files to ***/ +user_pref("browser.download.folderList", 2); +/* 2603: enforce user interaction for security by always asking the user where to download ***/ +user_pref("browser.download.useDownloadDir", false); +/* 2604: remove temp files opened with an external application + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=302433 ***/ +user_pref("browser.helperApps.deleteTempFileOnExit", true); +/* 2605: disable adding downloads to the system's "recent documents" list ***/ +user_pref("browser.download.manager.addToRecentDocs", false); +/* 2606: disable hiding mime types (Options>Applications) not associated with a plugin ***/ +user_pref("browser.download.hide_plugins_without_extensions", false); +/* 2607: disable page thumbnail collection + * look in profile/thumbnails directory - you may want to clean that out ***/ +user_pref("browser.pagethumbnails.capturing_disabled", true); // (hidden pref) +/* 2608: disable JAR from opening Unsafe File Types ***/ +user_pref("network.jar.open-unsafe-types", false); +/* 2609: disable exposure of system colors to CSS or canvas (FF44+) + * [NOTE] see [2] bug may cause black on black for elements with undefined colors + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=232227 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1330876 ***/ +user_pref("ui.use_standins_for_native_colors", true); // (hidden pref) +/* 2610: remove special permissions for certain mozilla domains (FF35+) + * [1] resource://app/defaults/permissions ***/ +user_pref("permissions.manager.defaultsUrl", ""); +/* 2611: disable WebIDE to prevent remote debugging and extension downloads + * [1] https://trac.torproject.org/projects/tor/ticket/16222 ***/ +user_pref("devtools.webide.autoinstallADBHelper", false); +user_pref("devtools.debugger.remote-enabled", false); +user_pref("devtools.webide.enabled", false); +/* 2614: disable HTTP2 (which was based on SPDY which is now deprecated) + * HTTP2 raises concerns with "multiplexing" and "server push", does nothing to enhance + * privacy, and in fact opens up a number of server-side fingerprinting opportunities + * [1] https://http2.github.io/faq/ + * [2] http://blog.scottlogic.com/2014/11/07/http-2-a-quick-look.html + * [3] https://queue.acm.org/detail.cfm?id=2716278 + * [4] https://github.com/ghacksuserjs/ghacks-user.js/issues/107 ***/ +user_pref("network.http.spdy.enabled", false); +user_pref("network.http.spdy.enabled.deps", false); +user_pref("network.http.spdy.enabled.http2", false); +/* 2617: enable Firefox's built-in PDF reader [SETUP] + * [SETTING-56+] Options>General>Applications>Portable Document Format (PDF) + * [SETTING-ESR] Options>Applications>Portable Document Format (PDF) + * This setting controls if the option "Display in Firefox" in the above setting is available + * and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With") + * [WHY USE false=default=view PDFs in Firefox] + * pdfjs is lightweight, open source and as secure as any pdf reader out there, certainly better and more + * vetted than most. Exploits are rare (1 serious case in 3 years), treated seriously and patched quickly. + * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). It + * maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. + * [WHY USE true=open with or save to disk] + * If you think a particular external app is more secure... + * [NOTE] + * See 2662, and JS can still force a pdf to open in-browser by bundling its own code (rare) ***/ +user_pref("pdfjs.disabled", false); +/* 2618: enforce the proxy server to do any DNS lookups when using SOCKS + * e.g. in TOR, this stops your local DNS server from knowing your Tor destination + * as a remote Tor node will handle the DNS request + * [1] http://kb.mozillazine.org/Network.proxy.socks_remote_dns + * [2] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/ +user_pref("network.proxy.socks_remote_dns", true); +/* 2619: limit HTTP redirects (this does not control redirects with HTML meta tags or JS) + * [WARNING] A low setting of 5 or under will probably break some sites (e.g. gmail logins) + * To control HTML Meta tag and JS redirects, use an extension. Default is 20 ***/ +user_pref("network.http.redirection-limit", 10); +/* 2620: disable middle mouse click opening links from clipboard + * [1] https://trac.torproject.org/projects/tor/ticket/10089 + * [2] http://kb.mozillazine.org/Middlemouse.contentLoadURL ***/ +user_pref("middlemouse.contentLoadURL", false); +/* 2621: disable IPv6 (included for knowledge ONLY [WARNING] do not do this) + * This is all about covert channels such as MAC addresses being included/abused in the + * IPv6 protocol for tracking. If you want to mask your IP address, this is not the way + * to do it. It's 2016, IPv6 is here. Here are some old links + * 2010: https://christopher-parsons.com/ipv6-and-the-future-of-privacy/ + * 2011: https://iapp.org/news/a/2011-09-09-facing-the-privacy-implications-of-ipv6/ + * 2012: http://www.zdnet.com/article/security-versus-privacy-with-ipv6-deployment/ + * [NOTE] It is a myth that disabling IPv6 will speed up your internet connection + * [1] https://www.howtogeek.com/195062/no-disabling-ipv6-probably-wont-speed-up-your-internet-connection/ ***/ // user_pref("network.dns.disableIPv6", true); -/* 5510: control when to send a cross-origin referer - * 0=always (default), 1=only if base domains match, 2=only if hosts match - * [NOTE] Will cause breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram ***/ - // user_pref("network.http.referer.XOriginPolicy", 2); -/* 5511: set DoH bootstrap address [FF89+] - * Firefox uses the system DNS to initially resolve the IP address of your DoH server. - * When set to a valid, working value that matches your "network.trr.uri" (0712) Firefox - * won't use the system DNS. If the IP doesn't match then DoH won't work ***/ - // user_pref("network.trr.bootstrapAddr", "10.0.0.1"); // [HIDDEN PREF] + // user_pref("network.http.fast-fallback-to-IPv4", true); +/* 2622: enforce a security delay when installing extensions (milliseconds) + * default=1000, This also covers the delay in "Save" on downloading files. + * [1] http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox + * [2] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ +user_pref("security.dialog_enable_delay", 700); +/* 2623: enable Strict File Origin Policy on local files + * [1] http://kb.mozillazine.org/Security.fileuri.strict_origin_policy ***/ +user_pref("security.fileuri.strict_origin_policy", true); +/* 2624: enable Subresource Integrity (SRI) (FF43+) + * [1] https://developer.mozilla.org/docs/Web/Security/Subresource_Integrity + * [2] https://wiki.mozilla.org/Security/Subresource_Integrity ***/ +user_pref("security.sri.enable", true); +/* 2625: disable DNS requests for hostnames with a .onion TLD (FF45+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1228457 ***/ +user_pref("network.dns.blockDotOnion", true); +/* 2626: disable optional user agent token, default is false, included for completeness + * [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/User-Agent/Firefox ***/ +user_pref("general.useragent.compatMode.firefox", false); +/* 2628: disable UITour backend so there is no chance that a remote page can use it ***/ +user_pref("browser.uitour.enabled", false); +user_pref("browser.uitour.url", ""); +/* 2629: disable remote JAR files being opened, regardless of content type (FF42+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1173171 ***/ +user_pref("network.jar.block-remote-files", true); +/* 2630: prevent accessibility services from accessing your browser [RESTART] + * [SETTING] Options>Privacy & Security>Permissions>Prevent accessibility services from accessing your browser + * [1] https://support.mozilla.org/kb/accessibility-services ***/ +user_pref("accessibility.force_disabled", 1); +/* 2631: block web content in file processes (FF55+) + * [WARNING] [SETUP] You may want to disable this for corporate or developer environments + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1343184 ***/ +user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false); +/* 2632: disable websites overriding Firefox's keyboard shortcuts (FF58+) + * [SETTING] to add site exceptions: Page Info>Permissions>Override Keyboard Shortcuts + * [NOTE] At the time of writing, causes issues with delete and backspace keys ***/ + // user_pref("permissions.default.shortcuts", 2); // 0 (default) or 1=allow, 2=block +/* 2662: disable "open with" in download dialog (FF50+) + * This is very useful to enable when the browser is sandboxed (e.g. via AppArmor) + * in such a way that it is forbidden to run external applications. + * [SETUP] This may interfere with some users' workflow or methods + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1281959 ***/ +user_pref("browser.download.forbid_open_with", true); +/* 2663: disable MathML (Mathematical Markup Language) (FF51+) + * [TEST] http://browserspy.dk/mathml.php + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1173199 ***/ +user_pref("mathml.disabled", true); +/* 2664: disable DeviceStorage API + * [1] https://wiki.mozilla.org/WebAPI/DeviceStorageAPI ***/ +user_pref("device.storage.enabled", false); +/* 2665: remove webchannel whitelist ***/ +user_pref("webchannel.allowObject.urlWhitelist", ""); +/* 2666: disable HTTP Alternative Services + * [1] https://www.ghacks.net/2015/08/18/a-comprehensive-list-of-firefox-privacy-and-security-settings/#comment-3970881 ***/ +user_pref("network.http.altsvc.enabled", false); +user_pref("network.http.altsvc.oe", false); +/* 2667: disable various developer tools in browser context + * [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes + * [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/ +user_pref("devtools.chrome.enabled", false); +/* 2668: lock down allowed extension directories + * [WARNING] This will break extensions that do not use the default XPI directories + * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ + * [1] archived: https://archive.is/DYjAM ***/ +user_pref("extensions.enabledScopes", 1); // (hidden pref) +user_pref("extensions.autoDisableScopes", 15); +/* 2669: remove paths when sending URLs to PAC scripts (FF51+) + * CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1255474 ***/ +user_pref("network.proxy.autoconfig_url.include_path", false); +/* 2670: disable "image/" mime types bypassing CSP (FF51+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1288361 ***/ +user_pref("security.block_script_with_wrong_mime", true); +/* 2671: disable in-content SVG (Scalable Vector Graphics) (FF53+) + * [WARNING] SVG is fairly common (~15% of the top 10K sites), so will cause some breakage + * including youtube player controls. Best left for "hardened" or specific profiles. + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1216893 ***/ + // user_pref("svg.disabled", true); +/* 2672: enforce Punycode for Internationalized Domain Names to eliminate possible spoofing security risk + * Firefox has *some* protections to mitigate the risk, but it is better to be safe + * than sorry. The downside: it will also display legitimate IDN's punycoded, which + * might be undesirable for users from countries with non-latin alphabets + * [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com) + * [1] http://kb.mozillazine.org/Network.IDN_show_punycode + * [2] https://wiki.mozilla.org/IDN_Display_Algorithm + * [3] https://en.wikipedia.org/wiki/IDN_homograph_attack + * [4] CVE-2017-5383: https://www.mozilla.org/security/advisories/mfsa2017-02/ + * [5] https://www.xudongz.com/blog/2017/idn-phishing/ ***/ +user_pref("network.IDN_show_punycode", true); +/* 2673: enable CSP (Content Security Policy) (default is true) + * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/ +user_pref("security.csp.enable", true); +/* 2674: enable CSP 1.1 experimental hash-source directive (FF29+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=855326 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=883975 ***/ +user_pref("security.csp.experimentalEnabled", true); +/* 2675: block top level window data: URIs (FF56+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1331351 + * [2] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/ + * [3] https://www.fxsitecompat.com/en-CA/docs/2017/data-url-navigations-on-top-level-window-will-be-blocked/ ***/ +user_pref("security.data_uri.block_toplevel_data_uri_navigations", true); -/*** [SECTION 6000]: DON'T TOUCH ***/ -user_pref("_user.js.parrot", "6000 syntax error: the parrot's 'istory!"); -/* 6001: enforce Firefox blocklist - * [WHY] It includes updates for "revoked certificates" - * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/ -user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true] -/* 6002: enforce no referer spoofing - * [WHY] Spoofing can affect CSRF (Cross-Site Request Forgery) protections ***/ -user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false] -/* 6004: enforce a security delay on some confirmation dialogs such as install, open/save - * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/ -user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000] -/* 6008: enforce no First Party Isolation [FF51+] - * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), and enabling FPI - * disables those. FPI is no longer maintained except at Tor Project for Tor Browser's config ***/ -user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false] -/* 6009: enforce SmartBlock shims (about:compat) [FF81+] - * [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/ -user_pref("extensions.webcompat.enable_shims", true); // [HIDDEN PREF] [DEFAULT: true] -/* 6010: enforce no TLS 1.0/1.1 downgrades - * [TEST] https://tls-v1-1.badssl.com:1010/ ***/ -user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false] -/* 6011: enforce disabling of Web Compatibility Reporter [FF56+] - * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla - * [WHY] To prevent wasting Mozilla's time with a custom setup ***/ -user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false] -/* 6012: enforce Quarantined Domains [FF115+] - * [WHY] https://support.mozilla.org/kb/quarantined-domains */ -user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true] -/* 6050: prefsCleaner: reset previously active items removed from arkenfox FF128+ ***/ - // user_pref("privacy.clearOnShutdown.cache", ""); - // user_pref("privacy.clearOnShutdown.cookies", ""); - // user_pref("privacy.clearOnShutdown.downloads", ""); - // user_pref("privacy.clearOnShutdown.formdata", ""); - // user_pref("privacy.clearOnShutdown.history", ""); - // user_pref("privacy.clearOnShutdown.offlineApps", ""); - // user_pref("privacy.clearOnShutdown.sessions", ""); - // user_pref("privacy.cpd.cache", ""); - // user_pref("privacy.cpd.cookies", ""); - // user_pref("privacy.cpd.formdata", ""); - // user_pref("privacy.cpd.history", ""); - // user_pref("privacy.cpd.offlineApps", ""); - // user_pref("privacy.cpd.sessions", ""); - -/*** [SECTION 7000]: DON'T BOTHER ***/ -user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!"); -/* 7001: disable APIs - * Location-Aware Browsing, Full Screen - * [WHY] The API state is easily fingerprintable. - * Geo is behind a prompt (7002). Full screen requires user interaction ***/ - // user_pref("geo.enabled", false); - // user_pref("full-screen-api.enabled", false); -/* 7002: set default permissions - * Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+] - * 0=always ask (default), 1=allow, 2=block - * [WHY] These are fingerprintable via Permissions API, except VR. Just add site - * exceptions as allow/block for frequently visited/annoying sites: i.e. not global - * [SETTING] to add site exceptions: Ctrl+I>Permissions> - * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/ - // user_pref("permissions.default.geo", 0); - // user_pref("permissions.default.camera", 0); - // user_pref("permissions.default.microphone", 0); - // user_pref("permissions.default.desktop-notification", 0); - // user_pref("permissions.default.xr", 0); // Virtual Reality -/* 7003: disable non-modern cipher suites [1] - * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks - * [1] https://browserleaks.com/ssl ***/ - // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); - // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); - // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false); - // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false); - // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS - // user_pref("security.ssl3.rsa_aes_256_gcm_sha384", false); // no PFS - // user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS - // user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS -/* 7004: control TLS versions - * [WHY] Passive fingerprinting and security ***/ - // user_pref("security.tls.version.min", 3); // [DEFAULT: 3] - // user_pref("security.tls.version.max", 4); -/* 7005: disable SSL session IDs [FF36+] - * [WHY] Passive fingerprinting and perf costs. These are session-only - * and isolated with network partitioning (FF85+) and/or containers ***/ - // user_pref("security.ssl.disable_session_identifiers", true); -/* 7007: referers - * [WHY] Only cross-origin referers (1602, 5510) matter ***/ - // user_pref("network.http.sendRefererHeader", 2); - // user_pref("network.http.referer.trimmingPolicy", 0); -/* 7008: set the default Referrer Policy [FF59+] - * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade - * [WHY] Defaults are fine. They can be overridden by a site-controlled Referrer Policy ***/ - // user_pref("network.http.referer.defaultPolicy", 2); // [DEFAULT: 2] - // user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2] -/* 7010: disable HTTP Alternative Services [FF37+] - * [WHY] Already isolated with network partitioning (FF85+) ***/ - // user_pref("network.http.altsvc.enabled", false); -/* 7011: disable website control over browser right-click context menu - * [WHY] Just use Shift-Right-Click ***/ - // user_pref("dom.event.contextmenu.enabled", false); -/* 7012: disable icon fonts (glyphs) and local fallback rendering - * [WHY] Breakage, font fallback is equivalency, also RFP - * [1] https://bugzilla.mozilla.org/789788 - * [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/ - // user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+] - // user_pref("gfx.downloadable_fonts.fallback_delay", -1); -/* 7013: disable Clipboard API - * [WHY] Fingerprintable. Breakage. Cut/copy/paste require user - * interaction, and paste is limited to focused editable fields ***/ - // user_pref("dom.event.clipboardevents.enabled", false); -/* 7014: disable System Add-on updates - * [WHY] It can compromise security. System addons ship with prefs, use those ***/ - // user_pref("extensions.systemAddon.update.enabled", false); // [FF62+] - // user_pref("extensions.systemAddon.update.url", ""); // [FF44+] -/* 7015: enable the DNT (Do Not Track) HTTP header - * [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/ - // user_pref("privacy.donottrackheader.enabled", true); -/* 7016: customize ETP settings - * [NOTE] FPP (fingerprintingProtection) is ignored when RFP (4501) is enabled - * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/ - // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5] - // user_pref("network.cookie.cookieBehavior.optInPartitioning", true); // [ETP FF132+] - // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); - // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+] - // user_pref("privacy.bounceTrackingProtection.mode", 1); // [FF131+] [ETP FF133+] - // user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+] - // user_pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT: true] - // user_pref("privacy.query_stripping.enabled", true); // [FF101+] - // user_pref("privacy.trackingprotection.enabled", true); - // user_pref("privacy.trackingprotection.socialtracking.enabled", true); - // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true] - // user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true] -/* 7017: disable service workers - * [WHY] Already isolated with TCP (2701) behind a pref (2710) ***/ - // user_pref("dom.serviceWorkers.enabled", false); -/* 7018: disable Web Notifications [FF22+] - * [WHY] Web Notifications are behind a prompt (7002) - * [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ ***/ - // user_pref("dom.webnotifications.enabled", false); -/* 7019: disable Push Notifications [FF44+] - * [WHY] Website "push" requires subscription, and the API is required for CRLite (1224) - * [NOTE] To remove all subscriptions, reset "dom.push.userAgentID" - * [1] https://support.mozilla.org/kb/push-notifications-firefox ***/ - // user_pref("dom.push.enabled", false); -/* 7020: disable WebRTC (Web Real-Time Communication) - * [WHY] Firefox desktop uses mDNS hostname obfuscation and the private IP is never exposed until - * required in TRUSTED scenarios; i.e. after you grant device (microphone or camera) access - * [TEST] https://browserleaks.com/webrtc - * [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ - * [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 ***/ - // user_pref("media.peerconnection.enabled", false); -/* 7021: enable GPC (Global Privacy Control) in non-PB windows - * [WHY] Passive and active fingerprinting. Mostly redundant with Tracking Protection - * in ETP Strict (2701) and sanitizing on close (2800s) ***/ - // user_pref("privacy.globalprivacycontrol.enabled", true); - -/*** [SECTION 8000]: DON'T BOTHER: FINGERPRINTING - [WHY] They are insufficient to help anti-fingerprinting and do more harm than good - [WARNING] DO NOT USE with RFP. RFP already covers these and they can interfere +/*** 2700: PERSISTENT STORAGE + Data SET by websites including + cookies : profile\cookies.sqlite + localStorage : profile\webappsstore.sqlite + indexedDB : profile\storage\default + appCache : profile\OfflineCache + serviceWorkers : ***/ -user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan"); -/* 8001: prefsCleaner: reset items useless for anti-fingerprinting ***/ - // user_pref("browser.display.use_document_fonts", ""); - // user_pref("browser.zoom.siteSpecific", ""); - // user_pref("device.sensors.enabled", ""); - // user_pref("dom.enable_performance", ""); - // user_pref("dom.enable_resource_timing", ""); - // user_pref("dom.gamepad.enabled", ""); - // user_pref("dom.maxHardwareConcurrency", ""); - // user_pref("dom.w3c_touch_events.enabled", ""); - // user_pref("dom.webaudio.enabled", ""); - // user_pref("font.system.whitelist", ""); - // user_pref("general.appname.override", ""); - // user_pref("general.appversion.override", ""); - // user_pref("general.buildID.override", ""); - // user_pref("general.oscpu.override", ""); - // user_pref("general.platform.override", ""); - // user_pref("general.useragent.override", ""); - // user_pref("media.navigator.enabled", ""); - // user_pref("media.ondevicechange.enabled", ""); - // user_pref("media.video_stats.enabled", ""); - // user_pref("media.webspeech.synth.enabled", ""); - // user_pref("ui.use_standins_for_native_colors", ""); - // user_pref("webgl.enable-debug-renderer-info", ""); +user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!"); +/* 2701: disable cookies on all sites [SETUP] + * You can set exceptions under site permissions or use an extension + * 0=allow all 1=allow same host 2=disallow all 3=allow 3rd party if it already set a cookie + * [SETTING-56+] Options>Privacy & Security>History>Custom Settings>Accept cookies from sites + * [SETTING-ESR] Options>Privacy>History>Custom Settings>Accept cookies from sites + * [NOTE] This also controls access to 3rd party Web Storage, IndexedDB, Cache API and Service Worker Cache + * [1] https://www.fxsitecompat.com/en-CA/docs/2015/web-storage-indexeddb-cache-api-now-obey-third-party-cookies-preference/ ***/ +user_pref("network.cookie.cookieBehavior", 2); +/* 2702: set third-party cookies (i.e ALL) (if enabled, see above pref) to session-only + and (FF58+) set third-party non-secure (i.e HTTP) cookies to session-only + [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and + .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones + * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/ + * [2] http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly ***/ +user_pref("network.cookie.thirdparty.sessionOnly", true); +user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // (FF58+) +/* 2703: set cookie lifetime policy + * 0=until they expire (default), 2=until you close Firefox, 3=for n days (see next pref) + * [SETTING-56+] Options>Privacy & Security>History>Custom Settings>Accept cookies from sites>Keep until + * [SETTING-ESR] Options>Privacy>History>Custom Settings>Accept cookies from sites>Keep until ***/ + // user_pref("network.cookie.lifetimePolicy", 0); +/* 2704: set cookie lifetime in days (see above pref) - default is 90 days ***/ + // user_pref("network.cookie.lifetime.days", 90); +/* 2705: disable HTTP sites setting cookies with the "secure" directive (default: true) (FF52+) + * [1] https://developer.mozilla.org/Firefox/Releases/52#HTTP ***/ +user_pref("network.cookie.leave-secure-alone", true); +/* 2710: disable DOM (Document Object Model) Storage + * [WARNING] This will break a LOT of sites' functionality. + * You are better off using an extension for more granular control ***/ + // user_pref("dom.storage.enabled", false); +/* 2711: clear localStorage and UUID when an extension is uninstalled + * [NOTE] Both preferences must be the same + * [1] https://developer.mozilla.org/Add-ons/WebExtensions/API/storage/local + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1213990 ***/ +user_pref("extensions.webextensions.keepStorageOnUninstall", false); +user_pref("extensions.webextensions.keepUuidOnUninstall", false); +/* 2720: disable JS storing data permanently [SETUP] + * [WARNING] This BREAKS uBlock Origin [1.14.0+] and other extensions that require IndexedDB + * [1] https://github.com/gorhill/uBlock/releases/tag/1.14.0 + * [WARNING] This *will* break other extensions including legacy, and *will* break some sites ***/ + // user_pref("dom.indexedDB.enabled", false); +/* 2730: disable offline cache ***/ +user_pref("browser.cache.offline.enable", false); +/* 2731: enforce websites to ask to store data for offline use + * [1] https://support.mozilla.org/questions/1098540 + * [2] https://bugzilla.mozilla.org/show_bug.cgi?id=959985 ***/ +user_pref("offline-apps.allow_by_default", false); +/* 2732: display a notification when websites ask to store data for offline use + * [SETTING-56+] Options>Privacy & Security>Offline Web Content and User Data>Tell you when a website asks... + * [SETTING-ESR] Options>Advanced>Network>Tell me when a website asks to store data for offline use ***/ +user_pref("browser.offline-apps.notify", true); +/* 2733: set size of warning quota for offline cache (default 51200) + * Offline cache is only used in rare cases to store data locally. FF will store small amounts + * (default <50MB) of data in the offline (application) cache without asking for permission. ***/ + // user_pref("offline-apps.quota.warn", 51200); +/* 2740: disable service workers cache and cache storage + * [1] https://w3c.github.io/ServiceWorker/#privacy ***/ +user_pref("dom.caches.enabled", false); +/* 2750: disable Storage API + * The API gives sites the ability to find out how much space they can use, how much + * they are already using, and even control whether or not they need to be alerted + * before the user agent disposes of site data in order to make room for other things. + * [NOTE] This also controls the visibility of the "Options>Privacy & Security>Site Data" + * section, which also requires Offline Cache (2730) enabled to function + * [1] https://developer.mozilla.org/docs/Web/API/StorageManager + * [2] https://developer.mozilla.org/docs/Web/API/Storage_API + * [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/ +user_pref("dom.storageManager.enabled", false); // (FF51+) +user_pref("browser.storageManager.enabled", false); // (FF53+) -/*** [SECTION 8500]: TELEMETRY - Arkenfox does not consider Firefox telemetry to be a privacy or security concern - comments below. - But since most arkenfox users prefer it disabled, we'll do that rather than cause overrides. +/*** 2800: SHUTDOWN [SETUP] + You should set the values to what suits you best. Be aware that the settings below clear + browsing, download and form history, but not cookies (we expect you to use an extension). + [NOTE] In both 2803 + 2804, the 'download' and 'history' prefs are combined in the + Firefox interface as "Browsing & Download History" and their values will be synced + ***/ +user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!"); +/* 2802: enable Firefox to clear history items on shutdown + * [SETTING-56+] Options>Privacy & Security>History>Clear history when Firefox closes + * [SETTING-ESR] Options>Privacy>Clear history when Firefox closes ***/ +user_pref("privacy.sanitize.sanitizeOnShutdown", true); +/* 2803: set what history items to clear on shutdown + * [SETTING-56+] Options>Privacy & Security>History>Clear history when Firefox closes>Settings + * [SETTING-ESR] Options>Privacy>Clear history when Firefox closes>Settings + * [NOTE] If 'history' is true, downloads will also be cleared regardless of the value + * but if 'history' is false, downloads can still be cleared independently + * However, this may not always be the case. The interface combines and syncs these + * prefs when set from there, and the sanitize code may change at any time ***/ +user_pref("privacy.clearOnShutdown.cache", true); +user_pref("privacy.clearOnShutdown.cookies", false); +user_pref("privacy.clearOnShutdown.downloads", true); // see note above +user_pref("privacy.clearOnShutdown.formdata", true); // Form & Search History +user_pref("privacy.clearOnShutdown.history", true); // Browsing & Download History +user_pref("privacy.clearOnShutdown.offlineApps", true); // Offline Website Data +user_pref("privacy.clearOnShutdown.sessions", true); // Active Logins +user_pref("privacy.clearOnShutdown.siteSettings", false); // Site Preferences +/* 2804: reset default history items to clear with Ctrl-Shift-Del (to match above) + * This dialog can also be accessed from the menu History>Clear Recent History + * Firefox remembers your last choices. This will reset them when you start Firefox. + * [NOTE] Regardless of what you set privacy.cpd.downloads to, as soon as the dialog + * for "Clear Recent History" is opened, it is synced to the same as 'history' ***/ +user_pref("privacy.cpd.cache", true); +user_pref("privacy.cpd.cookies", false); + // user_pref("privacy.cpd.downloads", true); // not used, see note above +user_pref("privacy.cpd.formdata", true); // Form & Search History +user_pref("privacy.cpd.history", true); // Browsing & Download History +user_pref("privacy.cpd.offlineApps", true); // Offline Website Data +user_pref("privacy.cpd.passwords", false); // this is not listed +user_pref("privacy.cpd.sessions", true); // Active Logins +user_pref("privacy.cpd.siteSettings", false); // Site Preferences +/* 2805: privacy.*.openWindows (clear session restore data) (FF34+) + * [NOTE] There is a years-old bug that these cause two windows when Firefox restarts. + * You do not need these anyway if session restore is disabled (see 1020) ***/ + // user_pref("privacy.clearOnShutdown.openWindows", true); + // user_pref("privacy.cpd.openWindows", true); +/* 2806: reset default 'Time range to clear' for 'Clear Recent History' (see 2804) + * Firefox remembers your last choice. This will reset the value when you start Firefox. + * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, + * 4=today, 5=last five minutes, 6=last twenty-four hours + * [NOTE] The values 5 + 6 are not listed in the dropdown, which will display a + * blank value if they are used, but they do work as advertised ***/ +user_pref("privacy.sanitize.timeSpan", 0); - Opt-out - - Telemetry is essential: a browser engine is a _very_ large complex beast costing billions to maintain - - Opt-in telemetry _does not_ work and results in data that is unrepresentative and may be misleading - Choice - - Every new profile on first use provides data collection/use policy and the abillty to opt-out - - It can be disabled at any time (Settings>Privacy & Security>Data Collection and Use) - Data - - no PII (Personally Identifiable Information) - - can be viewed in about:telemetry - - uses Prio [1][2][3], Glean [4], Oblivious HTTP [5][6] +/*** 4000: FIRST PARTY ISOLATION (FPI) + ** 1277803 - isolate favicons (FF52+) + ** 1264562 - isolate OCSP cache (FF52+) + ** 1268726 - isolate Shared Workers (FF52+) + ** 1316283 - isolate SSL session cache (FF52+) + ** 1317927 - isolate media cache (FF53+) + ** 1323644 - isolate HSTS and HPKP (FF54+) + ** 1334690 - isolate HTTP Alternative Services (FF54+) + ** 1334693 - isolate SPDY/HTTP2 (FF55+) + ** 1337893 - isolate DNS cache (FF55+) + ** 1344170 - isolate blob: URI (FF55+) + ** 1300671 - isolate data:, about: URLs (FF55+) - [1] https://crypto.stanford.edu/prio/ - [2] https://hacks.mozilla.org/2018/10/testing-privacy-preserving-telemetry-with-prio/ - [3] https://blog.mozilla.org/security/2019/06/06/next-steps-in-privacy-preserving-telemetry-with-prio/ - [4] https://firefox-source-docs.mozilla.org/toolkit/components/glean/index.html - [5] https://firefox-source-docs.mozilla.org/toolkit/components/glean/user/ohttp.html - [6] https://blog.mozilla.org/en/tag/oblivious-http/ + NOTE: FPI has some issues depending on your Firefox release + ** 1418931 - [fixed in FF58+] IndexedDB (Offline Website Data) with FPI Origin Attributes + are not removed with "Clear All/Recent History" or "On Close" + ** 1381197 - [fixed in FF59+] extensions cannot control cookies with FPI Origin Attributes ***/ -user_pref("_user.js.parrot", "8500 syntax error: the parrot's off the twig!"); -/* 8500: disable new data submission [FF41+] - * If disabled, no policy is shown or upload takes place, ever - * [1] https://bugzilla.mozilla.org/1195552 ***/ -user_pref("datareporting.policy.dataSubmissionEnabled", false); -/* 8501: disable Health Reports - * [SETTING] Privacy & Security>Firefox Data Collection and Use>Send technical... data ***/ -user_pref("datareporting.healthreport.uploadEnabled", false); -/* 0802: disable telemetry - * The "unified" pref affects the behavior of the "enabled" pref - * - If "unified" is false then "enabled" controls the telemetry module - * - If "unified" is true then "enabled" only controls whether to record extended data - * [NOTE] "toolkit.telemetry.enabled" is now LOCKED to reflect prerelease (true) or release builds (false) [2] - * [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html - * [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/ -user_pref("toolkit.telemetry.unified", false); -user_pref("toolkit.telemetry.enabled", false); // see [NOTE] -user_pref("toolkit.telemetry.server", "data:,"); -user_pref("toolkit.telemetry.archive.enabled", false); -user_pref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+] -user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+] -user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+] -user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter -user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+] -/* 8503: disable Telemetry Coverage - * [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/ -user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF] -user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF] -user_pref("toolkit.coverage.endpoint.base", ""); +user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out"); +/* 4001: enable First Party Isolation (FF51+) + * [WARNING] May break cross-domain logins and site functionality until perfected + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1260931 ***/ +user_pref("privacy.firstparty.isolate", true); +/* 4002: enforce FPI restriction for window.opener (FF54+) + * [NOTE] Setting this to false may reduce the breakage in 4001 + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1319773#c22 ***/ +user_pref("privacy.firstparty.isolate.restrict_opener_access", true); -/*** [SECTION 9000]: NON-PROJECT RELATED ***/ -user_pref("_user.js.parrot", "9000 syntax error: the parrot's cashed in 'is chips!"); -/* 9001: disable welcome notices ***/ -user_pref("browser.startup.homepage_override.mstone", "ignore"); // [HIDDEN PREF] -/* 9002: disable General>Browsing>Recommend extensions/features as you browse [FF67+] ***/ -user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false); -user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false); -/* 9004: disable search terms [FF110+] - * [SETTING] Search>Search Bar>Use the address bar for search and navigation>Show search terms instead of URL... ***/ -user_pref("browser.urlbar.showSearchTerms.enabled", false); +/*** 4500: privacy.resistFingerprinting (RFP) + This master switch will be used for a wide range of items, many of which will + **override** existing prefs from FF55+, often providing a **better** solution -/*** [SECTION 9999]: DEPRECATED / RENAMED ***/ -user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!"); -/* ESR128.x still uses all the following prefs -// [NOTE] replace the * with a slash in the line above to re-enable active ones -// FF132 -/* 2617: remove webchannel whitelist - // [-] https://bugzilla.mozilla.org/1275612 - // user_pref("webchannel.allowObject.urlWhitelist", ""); + IMPORTANT: As existing prefs become redundant, and some of them WILL interfere + with how RFP works, they will be moved to section 4600 and made inactive + + ** 418986 - limit window.screen & CSS media queries leaking identifiable info (FF41+) + [POC] http://ip-check.info/?lang=en (screen, usable screen, and browser window will match) + [NOTE] Does not cover everything yet - https://bugzilla.mozilla.org/show_bug.cgi?id=1216800 + [NOTE] This will probably make your values pretty unique until you resize or snap the + inner window width + height into standard/common resolutions (such as 1366x768) + To set a size, open a XUL (chrome) page (such as about:config) which is at 100% zoom, hit + Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run. Test + your window size, do some math, resize to allow for all the non inner window elements + [TEST] http://browserspy.dk/screen.php + ** 1281949 - spoof screen orientation (FF50+) + ** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+) + ** 1330890 - spoof timezone as UTC 0 (FF55+) + ** 1360039 - spoof navigator.hardwareConcurrency as 2 (see 4601) (FF55+) + This spoof *shouldn't* affect core chrome/Firefox performance + ** 1217238 - reduce precision of time exposed by javascript (FF55+) + ** 1369303 - spoof/disable performance API (see 2410-deprecated, 4602, 4603) (FF56+) + ** 1333651 & 1383495 & 1396468 & 1393283 & 1404608 - spoof Navigator API (see section 4700) (FF56+) + FF56: The version number will be rounded down to the nearest multiple of 10 + FF57+: The version number will match current ESR + FF59+: The OS will be reported as Windows, OSX, Android, or Linux (to reduce breakage) + ** 1369319 - disable device sensor API (see 4604) (FF56+) + ** 1369357 - disable site specific zoom (see 4605) (FF56+) + ** 1337161 - hide gamepads from content (see 4606) (FF56+) + ** 1372072 - spoof network information API as "unknown" (see 4607) (FF56+) + ** 1333641 - reduce fingerprinting in WebSpeech API (see 4608) (FF56+) + ** 1372069 & 1403813 - block geolocation requests (same as if you deny a site permission) (see 4609, 4612) (FF56+) + ** 1369309 - spoof media statistics (see 4610) (FF57+) + ** 1382499 - reduce screen co-ordinate fingerprinting in Touch API (see 4611) (FF57+) + ** 1217290 - enable fingerprinting resistance for WebGL (see 2010-12) (FF57+) + ** 1382545 - reduce fingerprinting in Animation API (FF57+) + ** 1354633 - limit MediaError.message to a whitelist (FF57+) + ** 1382533 - enable fingerprinting resistance for Presentation API (FF57+) + This blocks exposure of local IP Addresses via mDNS (Multicast DNS) + ** 967895 - enable site permission prompt before allowing canvas data extraction (FF58+) + In FF59+ this is controllable via the site permissions panel, see 1413780 (FF59+) + ** 1372073 - spoof/block fingerprinting in MediaDevices API (FF59+) + ** 1039069 - warn when language prefs are set to non en-US (see 0207, 0208) (FF59+) + ** 1222285 - spoof keyboard events and suppress keyboard modifier events (FF59+) + Spoofing mimics the content language of the document. Currently it only supports en-US. + Modifier events suppressed are SHIFT, CTRL and both ALT keys. Chrome is not affected. +***/ +user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs"); +/* 4501: enable privacy.resistFingerprinting (FF41+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=418986 ***/ +user_pref("privacy.resistFingerprinting", true); // (hidden pref) (not hidden FF55+) +/* 4502: set new window sizes to round to hundreds (FF55+) [SETUP] + * [NOTE] Width will round down to multiples of 200s and height to 100s, to fit your screen. + * The override values are a starting point to round from if you want some control + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1330882 + * [2] https://hardware.metrics.mozilla.com/ ***/ + // user_pref("privacy.window.maxInnerWidth", 1600); // (hidden pref) + // user_pref("privacy.window.maxInnerHeight", 900); // (hidden pref) +/* 4503: disable mozAddonManager Web API (FF57+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1384330 ***/ + // user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // (hidden pref) + +/*** 4600: RFP (4500) ALTERNATIVES [SETUP] + * IF you DO use RFP (see 4500) then you DO NOT need these redundant prefs. In fact, + some even cause RFP to not behave as you would expect and alter your fingerprint. + Make sure they are RESET in about:config as per your Firefox version + * IF you DO NOT use RFP or are on ESR... then turn on each ESR section below +***/ +user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan"); +/* [NOTE] ESR52.x and non-RFP users replace the * with a slash on this line to enable these +// FF55+ +// 4601: [2514] spoof (or limit?) number of CPU cores (FF48+) + // [WARNING] *may* affect core chrome/Firefox performance, will affect content. + // [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1008453 + // [2] https://trac.torproject.org/projects/tor/ticket/21675 + // [3] https://trac.torproject.org/projects/tor/ticket/22127 + // [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency + // user_pref("dom.maxHardwareConcurrency", 2); +// * * * / +// FF56+ +// 4602: [2411] disable resource/navigation timing +user_pref("dom.enable_resource_timing", false); +// 4603: [2412] disable timing attacks + // [1] https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI +user_pref("dom.enable_performance", false); +// 4604: [2512] disable device sensor API + // [WARNING] [SETUP] Optional protection depending on your device + // [1] https://trac.torproject.org/projects/tor/ticket/15758 + // [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/ + // [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1357733 + // [4] https://bugzilla.mozilla.org/show_bug.cgi?id=1292751 + // user_pref("device.sensors.enabled", false); +// 4605: [2515] disable site specific zoom + // Zoom levels affect screen res and are highly fingerprintable. This does not stop you using + // zoom, it will just not use/remember any site specific settings. Zoom levels on new tabs + // and new windows are reset to default and only the current tab retains the current zoom +user_pref("browser.zoom.siteSpecific", false); +// 4606: [2501] disable gamepad API - USB device ID enumeration + // [WARNING] [SETUP] Optional protection depending on your connected devices + // [1] https://trac.torproject.org/projects/tor/ticket/13023 + // user_pref("dom.gamepad.enabled", false); +// 4607: [2503] disable giving away network info (FF31+) + // e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none + // [1] https://developer.mozilla.org/docs/Web/API/Network_Information_API + // [2] https://wicg.github.io/netinfo/ + // [3] https://bugzilla.mozilla.org/show_bug.cgi?id=960426 +user_pref("dom.netinfo.enabled", false); +// 4608: [2021] disable the SpeechSynthesis (Text-to-Speech) part of the Web Speech API + // [1] https://developer.mozilla.org/docs/Web/API/Web_Speech_API + // [2] https://developer.mozilla.org/docs/Web/API/SpeechSynthesis + // [3] https://wiki.mozilla.org/HTML5_Speech_API +user_pref("media.webspeech.synth.enabled", false); +// 4609: [0201] disable Location-Aware Browsing + // [1] https://www.mozilla.org/firefox/geolocation/ +user_pref("geo.enabled", false); +// * * * / +// FF57+ +// 4610: [2506] disable video statistics - JS performance fingerprinting (FF25+) + // [1] https://trac.torproject.org/projects/tor/ticket/15757 + // [2] https://bugzilla.mozilla.org/show_bug.cgi?id=654550 +user_pref("media.video_stats.enabled", false); +// 4611: [2509] disable touch events + // fingerprinting attack vector - leaks screen res & actual screen coordinates + // 0=disabled, 1=enabled, 2=autodetect + // [WARNING] [SETUP] Optional protection depending on your device + // [1] https://developer.mozilla.org/docs/Web/API/Touch_events + // [2] https://trac.torproject.org/projects/tor/ticket/10286 + // user_pref("dom.w3c_touch_events.enabled", 0); +// * * * / +// FF58+ +// 4612: [new] set a default permission for Location (FF58+) + // [SETTING] to add site exceptions: Page Info>Permissions>Access Your Location + // [SETTING] to manage site exceptions: Options>Privacy>Permissions>Location>Settings + // user_pref("permissions.default.geo", 2); // 0=always ask (default), 1=allow, 2=block +// * * * / +// ***/ + +/*** 4700: RFP (4500) ALTERNATIVES - NAVIGATOR / USER AGENT (UA) SPOOFING + Spoofing your UA to *LOWER* entropy *does* *not* *work*. It may even cause site breakage + depending on your values. Even if you spoof, like TBB (Tor Browser Bundle) does, as the + latest ESR, it still *does* *not* *work*. There are two main reasons for this. + 1. Many of the components that make up your UA can be derived by other means. And when + those values differ, you provide more bits and raise entropy. Examples of leaks include + navigator objects, date locale/formats, iframes, headers, resource://URIs, + feature detection and more. + 2. You are not in a controlled set of significant numbers, where the values are enforced + by default. It works for TBB because for TBB, the spoofed values ARE their default. + * We do not recommend UA spoofing yourself, leave it to privacy.resistFingerprinting (see 4500) + which is already plugging leaks (see 1 above) the prefs below do not address + * Values below are for example only based on the current TBB at the time of writing +***/ +user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow"); +/* 4701: navigator.userAgent leaks in JS + * [NOTE] Setting this will break any UA spoofing extension whitelisting ***/ + // user_pref("general.useragent.override", "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0"); // (hidden pref) +/* 4702: navigator.buildID (see gecko.buildID in about:config) reveals build time + * down to the second which defeats user agent spoofing and can compromise OS etc + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=583181 ***/ + // user_pref("general.buildID.override", "20100101"); // (hidden pref) +/* 4703: navigator.appName ***/ + // user_pref("general.appname.override", "Netscape"); // (hidden pref) +/* 4704: navigator.appVersion ***/ + // user_pref("general.appversion.override", "5.0 (Windows)"); // (hidden pref) +/* 4705: navigator.platform leaks in JS ***/ + // user_pref("general.platform.override", "Win32"); // (hidden pref) +/* 4706: navigator.oscpu leaks in JS ***/ + // user_pref("general.oscpu.override", "Windows NT 6.1"); // (hidden pref) +/* 4707: general.useragent.locale (related, see 0204 deprecated FF59+) ***/ + +/*** 5000: PERSONAL SETTINGS [SETUP] + Settings that are handy to migrate and/or are not in the Options interface. Users + can put their own non-security/privacy/fingerprinting/tracking stuff here ***/ +user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!"); +/* 5001: disable annoying warnings ***/ +user_pref("browser.tabs.warnOnClose", false); +user_pref("browser.tabs.warnOnCloseOtherTabs", false); +user_pref("browser.tabs.warnOnOpen", false); +/* 5002: disable warning when a domain requests full screen + * [1] https://developer.mozilla.org/docs/Web/API/Fullscreen_API ***/ + // user_pref("full-screen-api.warning.delay", 0); + // user_pref("full-screen-api.warning.timeout", 0); +/* 5003: disable closing browser with last tab ***/ +user_pref("browser.tabs.closeWindowWithLastTab", false); +/* 5004: disable backspace (0=previous page, 1=scroll up, 2=do nothing) ***/ +user_pref("browser.backspace_action", 2); +/* 5005: disable autocopy default [LINUX] ***/ + // user_pref("clipboard.autocopy", false); +/* 5006: disable enforced extension signing (FF43+) + * [NOTE] Only applicable to Nightly and ESR (FF48+) + * [1] https://wiki.mozilla.org/Add-ons/Extension_Signing#Documentation ***/ + // user_pref("xpinstall.signatures.required", false); +/* 5007: open new windows in a new tab instead + * 1=current window, 2=new window, 3=most recent window + * [SETTING] Options>General>Tabs>Open new windows in a new tab instead ***/ +user_pref("browser.link.open_newwindow", 3); +/* 5008: open bookmarks in a new tab (FF57+) + * [NOTE] You can also use middle-click, cmd/ctl-click, and use the context menu ***/ + // user_pref("browser.tabs.loadBookmarksInTabs", true); +/* 5010: enable ctrl-tab previews ***/ +user_pref("browser.ctrlTab.previews", true); +/* 5011: don't open "page/selection source" in a tab. The window used instead is cleaner + * and easier to use and move around (e.g. developers/multi-screen). ***/ +user_pref("view_source.tab", false); +/* 5012: control spellchecking: 0=none, 1-multi-line controls, 2=multi-line & single-line controls ***/ +user_pref("layout.spellcheckDefault", 1); +/* 5013: disable automatic "Work Offline" status + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=620472 + * [2] https://developer.mozilla.org/docs/Online_and_offline_events ***/ +user_pref("network.manage-offline-status", false); +/* 5014: control download button visibility (FF57+) + * true = the button is automatically shown/hidden based on whether the session has downloads or not + * false = the button is always visible ***/ + // user_pref("browser.download.autohideButton", false); +/* 5015: disable animations (FF55+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1352069 ***/ + // user_pref("toolkit.cosmeticAnimations.enabled", false); +/* 5016: disable reload/stop animation (FF56+) ***/ + // user_pref("browser.stopReloadAnimation.enabled", true); +/* 5017: set submenu delay in milliseconds. 0=instant while a small number allows + * a mouse pass over menu items without any submenus alarmingly shooting out ***/ +user_pref("ui.submenuDelay", 150); // (hidden pref) +/* 5018: set maximum number of daily bookmark backups to keep (default is 15) ***/ +user_pref("browser.bookmarks.max_backups", 2); +/* 5020: control urlbar click behaviour (with defaults) ***/ +user_pref("browser.urlbar.clickSelectsAll", true); +user_pref("browser.urlbar.doubleClickSelectsAll", false); +/* 5021a: control tab behaviours (with defaults) + * open links in a new tab immediately to the right of parent tab, not far right ***/ +user_pref("browser.tabs.insertRelatedAfterCurrent", true); +/* 5021b: switch to the parent tab (if it has one) on close, rather than + * to the adjacent right tab if it exists or to the adjacent left tab if it doesn't. + * [NOTE] Requires browser.link.open_newwindow set to 3 (see pref 5007) ***/ +user_pref("browser.tabs.selectOwnerOnClose", true); +/* 5021c: stay on the parent tab when opening links in a new tab + * [SETTING] Options>General>Tabs>When you open a link in a new tab, switch to it immediately ***/ +user_pref("browser.tabs.loadInBackground", true); +/* 5021d: set behavior of pages normally meant to open in a new window (such as target="_blank" + * or from an external program), but that have instead been loaded in a new tab. + * true: load the new tab in the background, leaving focus on the current tab + * false: load the new tab in the foreground, taking the focus from the current tab. ***/ +user_pref("browser.tabs.loadDivertedInBackground", false); +/* 5023: enable "Find As You Type" + * [1] http://kb.mozillazine.org/Accessibility.typeaheadfind ***/ + // user_pref("accessibility.typeaheadfind", true); +/* 5024: enable/disable MSE (Media Source Extensions) + * [1] https://www.ghacks.net/2014/05/10/enable-media-source-extensions-firefox/ ***/ + // user_pref("media.mediasource.enabled", false); + // user_pref("media.mediasource.mp4.enabled", false); + // user_pref("media.mediasource.webm.audio.enabled", false); + // user_pref("media.mediasource.webm.enabled", false); +/* 5025: enable/disable various media types ***/ + // user_pref("media.mp4.enabled", false); + // user_pref("media.flac.enabled", false); // (FF51+) + // user_pref("media.ogg.enabled", false); + // user_pref("media.ogg.flac.enabled", false); // (FF51+) + // user_pref("media.opus.enabled", false); + // user_pref("media.raw.enabled", false); + // user_pref("media.wave.enabled", false); + // user_pref("media.webm.enabled", false); + // user_pref("media.wmf.enabled", false); // https://www.youtube.com/html5 - for the two H.264 entries + // user_pref("media.wmf.amd.vp9.enabled", true); // (FF57+) + // user_pref("media.wmf.vp9.enabled", false); +/* 5026: disable "Reader View" ***/ + // user_pref("reader.parse-on-load.enabled", false); +/* 5027: decode URLs on copy from the urlbar (FF53+) + * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1320061 ***/ +user_pref("browser.urlbar.decodeURLsOnCopy", true); +/* 5028: disable middle-click enabling auto-scrolling [WINDOWS] [MAC] ***/ + // user_pref("general.autoScroll", false); + +/*** 9999: DEPRECATED / REMOVED / LEGACY / RENAMED + Documentation denoted as [-]. Numbers may be re-used. See [1] for a link-clickable, + viewer-friendly version of the deprecated bugzilla tickets. The original state of each pref + has been preserved, or changed to match the current setup, but you are advised to review them. + [NOTE] Up to FF53, to enable a section change /* FFxx to // FFxx + For FF53 on, we have bundled releases to cater for ESR. Change /* to // on the first line + [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123 +***/ +user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!"); +/* FF42 and older +// 2607: (25+) disable page thumbnails - replaced by browser.pagethumbnails.capturing_disabled + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=897811 +user_pref("pageThumbs.enabled", false); +// 2503: (31+) disable network API - replaced by dom.netinfo.enabled + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=960426 +user_pref("dom.network.enabled", false); +// 2620: (35+) disable WebSockets + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1091016 +user_pref("network.websocket.enabled", false); +// 1610: (36+) set DNT "value" to "not be tracked" (FF21+) + // [1] http://kb.mozillazine.org/Privacy.donottrackheader.value + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1042135#c101 + // user_pref("privacy.donottrackheader.value", 1); +// 2023: (37+) disable camera autofocus callback + // The API will be superceded by the WebRTC Capture and Stream API + // [1] https://developer.mozilla.org/docs/Archive/B2G_OS/API/CameraControl + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1107683 +user_pref("camera.control.autofocus_moving_callback.enabled", false); +// 0415: (41+) disable reporting URLs (safe browsing) - removed or replaced by various + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1109475 +user_pref("browser.safebrowsing.reportErrorURL", ""); // browser.safebrowsing.reportPhishMistakeURL +user_pref("browser.safebrowsing.reportGenericURL", ""); // removed +user_pref("browser.safebrowsing.reportMalwareErrorURL", ""); // browser.safebrowsing.reportMalwareMistakeURL +user_pref("browser.safebrowsing.reportMalwareURL", ""); // removed +user_pref("browser.safebrowsing.reportURL", ""); // removed +// 1804: (41+) disable plugin enumeration + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1169945 +user_pref("plugins.enumerable_names", ""); +// 2614: (41+) disable HTTP2 (draft) + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1132357 +user_pref("network.http.spdy.enabled.http2draft", false); +// 2803: (42+) clear passwords on shutdown + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1102184 + // user_pref("privacy.clearOnShutdown.passwords", false); +// 5002: (42+) disable warning when a domain requests full screen + // replaced by setting full-screen-api.warning.timeout to zero + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1160017 + // user_pref("full-screen-api.approval-required", false); +// ***/ +/* FF43 +// 0410's: disable safebrowsing urls & updates - replaced by various + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1107372 + // user_pref("browser.safebrowsing.gethashURL", ""); // browser.safebrowsing.provider.google.gethashURL + // user_pref("browser.safebrowsing.updateURL", ""); // browser.safebrowsing.provider.google.updateURL +user_pref("browser.safebrowsing.malware.reportURL", ""); // browser.safebrowsing.provider.google.reportURL +// 0420's: disable tracking protection - replaced by various + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1107372 + // user_pref("browser.trackingprotection.gethashURL", ""); // browser.safebrowsing.provider.mozilla.gethashURL + // user_pref("browser.trackingprotection.updateURL", ""); // browser.safebrowsing.provider.mozilla.updateURL +// 1803: remove plugin finder service + // [1] http://kb.mozillazine.org/Pfs.datasource.url + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1202193 +user_pref("pfs.datasource.url", ""); +// 5003: disable new search panel UI + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1119250 + // user_pref("browser.search.showOneOffButtons", false); +// ***/ +/* FF44 +// 0414: disable safebrowsing's real-time binary checking (google) (FF43+) + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1237103 +user_pref("browser.safebrowsing.provider.google.appRepURL", ""); // browser.safebrowsing.appRepURL +// 1200's: block rc4 whitelist + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1215796 +user_pref("security.tls.insecure_fallback_hosts.use_static_list", false); +// 2301: disable SharedWorkers + // [1] https://trac.torproject.org/projects/tor/ticket/15562 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1207635 +user_pref("dom.workers.sharedWorkers.enabled", false); +// 2403: disable scripts changing images + // [TEST] https://www.w3schools.com/jsref/tryit.asp?filename=tryjsref_img_src2 + // [WARNING] Will break some sites such as Google Maps and a lot of web apps + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=773429 + // user_pref("dom.disable_image_src_set", true); +// ***/ +/* FF45 +// 1021b: disable deferred level of storing extra session data 0=all 1=http-only 2=none + // extra session data contains contents of forms, scrollbar positions, cookies and POST data + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1235379 +user_pref("browser.sessionstore.privacy_level_deferred", 2); +// ***/ +/* FF46 +// 0333a: disable health report + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1234526 +user_pref("datareporting.healthreport.service.enabled", false); // (hidden pref) +user_pref("datareporting.healthreport.documentServerURI", ""); // (hidden pref) +// 0334b: disable FHR (Firefox Health Report) v2 data being sent to Mozilla servers + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1234522 +user_pref("datareporting.policy.dataSubmissionEnabled.v2", false); +// 0414: disable safebrowsing pref - replaced by browser.safebrowsing.downloads.remote.url + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1239587 +user_pref("browser.safebrowsing.appRepURL", ""); // Google application reputation check +// 0420: disable polaris (part of Tracking Protection, never used in stable) + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1235565 + // user_pref("browser.polaris.enabled", false); +// 0510: disable "Pocket" - replaced by extensions.pocket.* + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1215694 +user_pref("browser.pocket.enabled", false); +user_pref("browser.pocket.api", ""); +user_pref("browser.pocket.site", ""); +user_pref("browser.pocket.oAuthConsumerKey", ""); +// ***/ +/* FF47 +// 0330b: set unifiedIsOptIn to make sure telemetry respects OptIn choice and that telemetry + // is enabled ONLY for people that opted into it, even if unified Telemetry is enabled + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1236580 +user_pref("toolkit.telemetry.unifiedIsOptIn", true); // (hidden pref) +// 0333b: disable about:healthreport page UNIFIED + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1236580 +user_pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,"); +// 0807: disable history manipulation + // [1] https://developer.mozilla.org/docs/Web/API/History_API + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1249542 +user_pref("browser.history.allowPopState", false); +user_pref("browser.history.allowPushState", false); +user_pref("browser.history.allowReplaceState", false); +// ***/ +/* FF48 +// 0806: disable 'unified complete': 'Search with [default search engine]' + // [-] http://techdows.com/2016/05/firefox-unified-complete-aboutconfig-preference-removed.html + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1181078 +user_pref("browser.urlbar.unifiedcomplete", false); +// ***/ +/* FF49 +// 0372: disable "Hello" + // [1] https://www.mozilla.org/privacy/archive/hello/2016-03/ + // [2] https://security.stackexchange.com/questions/94284/how-secure-is-firefox-hello + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1287827 +user_pref("loop.enabled", false); +user_pref("loop.server", ""); +user_pref("loop.feedback.formURL", ""); +user_pref("loop.feedback.manualFormURL", ""); +user_pref("loop.facebook.appId", ""); +user_pref("loop.facebook.enabled", false); +user_pref("loop.facebook.fallbackUrl", ""); +user_pref("loop.facebook.shareUrl", ""); +user_pref("loop.logDomains", false); +// 2202: disable new window scrollbars being hidden + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1257887 +user_pref("dom.disable_window_open_feature.scrollbars", true); +// 2303: disable push notification (UDP wake-up) + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1265914 +user_pref("dom.push.udp.wakeupEnabled", false); +// ***/ +/* FF50 +// 0101: disable Windows10 intro on startup [WINDOWS] + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1274633 +user_pref("browser.usedOnWindows10.introURL", ""); +// 0308: disable plugin update notifications + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1277905 +user_pref("plugins.update.notifyUser", false); +// 0410: disable "Block dangerous and deceptive content" - replaced by browser.safebrowsing.phishing.enabled + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1025965 + // user_pref("browser.safebrowsing.enabled", false); +// 1266: disable rc4 ciphers + // [1] https://trac.torproject.org/projects/tor/ticket/17369 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1268728 + // [-] https://www.fxsitecompat.com/en-CA/docs/2016/rc4-support-has-been-completely-removed/ +user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false); +user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false); +user_pref("security.ssl3.rsa_rc4_128_md5", false); +user_pref("security.ssl3.rsa_rc4_128_sha", false); +// 1809: remove Mozilla's plugin update URL + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1277905 +user_pref("plugins.update.url", ""); +// ***/ +/* FF51 +// 1851: delay play of videos until they're visible + // [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1180563 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1262053 +user_pref("media.block-play-until-visible", true); +// 2504: disable virtual reality devices + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1250244 +user_pref("dom.vr.oculus050.enabled", false); +// 2614: disable SPDY + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1248197 +user_pref("network.http.spdy.enabled.v3-1", false); +// ***/ +/* FF52 +// 1601: disable referer from an SSL Website + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1308725 +user_pref("network.http.sendSecureXSiteReferrer", false); +// 1850: disable Adobe EME "Primetime CDM" (Content Decryption Module) + // [1] https://trac.torproject.org/projects/tor/ticket/16285 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1329538 // FF52 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1337121 // FF52 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1329543 // FF53 +user_pref("media.gmp-eme-adobe.enabled", false); +user_pref("media.gmp-eme-adobe.visible", false); +user_pref("media.gmp-eme-adobe.autoupdate", false); +// 2405: disable WebTelephony API + // [1] https://wiki.mozilla.org/WebAPI/Security/WebTelephony + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1309719 +user_pref("dom.telephony.enabled", false); +// 2502: disable Battery Status API + // Initially a Linux issue (high precision readout) that was fixed. + // However, it is still another metric for fingerprinting, used to raise entropy. + // e.g. do you have a battery or not, current charging status, charge level, times remaining etc + // [1] https://techcrunch.com/2015/08/04/battery-attributes-can-be-used-to-track-web-users/ + // [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1124127 + // [3] https://www.w3.org/TR/battery-status/ + // [4] https://www.theguardian.com/technology/2016/aug/02/battery-status-indicators-tracking-online + // [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1313580 +user_pref("dom.battery.enabled", false); +// ***/ + +/* ESR52 still needs all the following prefs +// [NOTE] replace the * with a slash in the line above to re-enable them if you're using ESR52.x.x +// FF53 +// 1265: block rc4 fallback + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1130670 +user_pref("security.tls.unrestricted_rc4_fallback", false); +// 1806: disable Acrobat, Quicktime, WMP (the string = min version number allowed) + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1317109 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1317110 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1317108 +user_pref("plugin.scan.Acrobat", "99999"); +user_pref("plugin.scan.Quicktime", "99999"); +user_pref("plugin.scan.WindowsMediaPlayer", "99999"); +// 2022: disable screensharing + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1329562 +user_pref("media.getusermedia.screensharing.allow_on_old_platforms", false); +// 2507: disable keyboard fingerprinting + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1322736 +user_pref("dom.beforeAfterKeyboardEvent.enabled", false); +// * * * / +// FF54 +// 0415: disable reporting URLs (safe browsing) + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1288633 +user_pref("browser.safebrowsing.reportMalwareMistakeURL", ""); +user_pref("browser.safebrowsing.reportPhishMistakeURL", ""); +// 1830: block websites detecting DRM is disabled + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1242321 +user_pref("media.eme.apiVisible", false); +// 2425: disable Archive Reader API + // i.e. reading archive contents directly in the browser, through DOM file objects + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1342361 +user_pref("dom.archivereader.enabled", false); +// * * * / +// FF55 +// 0209: disable geolocation on non-secure origins (FF54+) + // [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1269531 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1072859 +user_pref("geo.security.allowinsecure", false); +// 0336: disable "Heartbeat" (Mozilla user rating telemetry) (FF37+) + // [1] https://trac.torproject.org/projects/tor/ticket/18738 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1361578 +user_pref("browser.selfsupport.enabled", false); // (hidden pref) +user_pref("browser.selfsupport.url", ""); +// 0360: disable new tab "pings" + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1241390 +user_pref("browser.newtabpage.directory.ping", "data:text/plain,"); +// 0861: disable saving form history on secure websites + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1361220 +user_pref("browser.formfill.saveHttpsForms", false); +// 0863: disable Form Autofill (FF54+) - replaced by extensions.formautofill.* + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1364334 +user_pref("browser.formautofill.enabled", false); +// 2410: disable User Timing API + // [1] https://trac.torproject.org/projects/tor/ticket/16336 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1344669 +user_pref("dom.enable_user_timing", false); +// 2507: disable keyboard fingerprinting (FF38+) (physical keyboards) + // The Keyboard API allows tracking the "read parameter" of pressed keys in forms on + // web pages. These parameters vary between types of keyboard layouts such as QWERTY, + // AZERTY, Dvorak, and between various languages, e.g. German vs English. + // [WARNING] Don't use if Android + physical keyboard + // [1] https://developer.mozilla.org/docs/Web/API/KeyboardEvent/code + // [2] https://www.privacy-handbuch.de/handbuch_21v.htm + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1352949 +user_pref("dom.keyboardevent.code.enabled", false); +// 5015: disable tab animation - replaced by toolkit.cosmeticAnimations.enabled + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1352069 +user_pref("browser.tabs.animate", false); +// 5016: disable fullscreeen animation - replaced by toolkit.cosmeticAnimations.enabled + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1352069 +user_pref("browser.fullscreen.animate", false); +// * * * / +// FF56 +// 0515: disable Screenshots (rollout pref only) (FF54+) + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1386333 + // user_pref("extensions.screenshots.system-disabled", true); +// 0517: disable Form Autofill (FF55+) - replaced by extensions.formautofill.available + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1385201 +user_pref("extensions.formautofill.experimental", false); +// * * * / +// FF57 +// 0374: disable "social" integration + // [1] https://developer.mozilla.org/docs/Mozilla/Projects/Social_API + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1388902 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1406193 (leftover prefs removed in FF58) +user_pref("social.whitelist", ""); +user_pref("social.toast-notifications.enabled", false); +user_pref("social.shareDirectory", ""); +user_pref("social.remote-install.enabled", false); +user_pref("social.directories", ""); +user_pref("social.share.activationPanelEnabled", false); +user_pref("social.enabled", false); // (hidden pref) +// 1830: disable DRM's EME WideVineAdapter + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1395468 +user_pref("media.eme.chromium-api.enabled", false); // (FF55+) +// 2611: disable WebIDE extension downloads (Valence) + // [1] https://trac.torproject.org/projects/tor/ticket/16222 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1393497 +user_pref("devtools.webide.autoinstallFxdtAdapters", false); +// 2612: disable SimpleServiceDiscovery - which can bypass proxy settings - e.g. Roku + // [1] https://trac.torproject.org/projects/tor/ticket/16222 + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1393582 +user_pref("browser.casting.enabled", false); +// 5022: hide recently bookmarked items (you still have the original bookmarks) (FF49+) + // [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1401238 +user_pref("browser.bookmarks.showRecentlyBookmarked", false); +// * * * / // ***/ /* END: internal custom pref to test for syntax errors ***/ diff --git a/wikipiki/License-MIT-yellow.svg b/wikipiki/License-MIT-yellow.svg deleted file mode 100644 index d4aa560..0000000 --- a/wikipiki/License-MIT-yellow.svg +++ /dev/null @@ -1 +0,0 @@ - licenselicenseMITMIT \ No newline at end of file diff --git a/wikipiki/backup01.png b/wikipiki/backup01.png new file mode 100644 index 0000000..e10f1ea Binary files /dev/null and b/wikipiki/backup01.png differ diff --git a/wikipiki/bullet01.png b/wikipiki/bullet01.png new file mode 100644 index 0000000..eaaacd5 Binary files /dev/null and b/wikipiki/bullet01.png differ diff --git a/wikipiki/concurrent01.png b/wikipiki/concurrent01.png new file mode 100644 index 0000000..60e0c4a Binary files /dev/null and b/wikipiki/concurrent01.png differ diff --git a/wikipiki/concurrent02.png b/wikipiki/concurrent02.png new file mode 100644 index 0000000..3571614 Binary files /dev/null and b/wikipiki/concurrent02.png differ diff --git a/wikipiki/concurrent03.png b/wikipiki/concurrent03.png new file mode 100644 index 0000000..9c97787 Binary files /dev/null and b/wikipiki/concurrent03.png differ diff --git a/wikipiki/concurrent04.png b/wikipiki/concurrent04.png new file mode 100644 index 0000000..04321df Binary files /dev/null and b/wikipiki/concurrent04.png differ diff --git a/wikipiki/exceptions01.png b/wikipiki/exceptions01.png new file mode 100644 index 0000000..1733fbb Binary files /dev/null and b/wikipiki/exceptions01.png differ diff --git a/wikipiki/exceptions02.png b/wikipiki/exceptions02.png new file mode 100644 index 0000000..c6c5686 Binary files /dev/null and b/wikipiki/exceptions02.png differ diff --git a/wikipiki/exceptions03.png b/wikipiki/exceptions03.png new file mode 100644 index 0000000..d6ce963 Binary files /dev/null and b/wikipiki/exceptions03.png differ diff --git a/wikipiki/exclamation.png b/wikipiki/exclamation.png new file mode 100644 index 0000000..e8e4ff5 Binary files /dev/null and b/wikipiki/exclamation.png differ diff --git a/wikipiki/icon-librewolf.png b/wikipiki/icon-librewolf.png deleted file mode 100644 index 0bb9299..0000000 Binary files a/wikipiki/icon-librewolf.png and /dev/null differ diff --git a/wikipiki/icon-mull.png b/wikipiki/icon-mull.png deleted file mode 100644 index d80042f..0000000 Binary files a/wikipiki/icon-mull.png and /dev/null differ diff --git a/wikipiki/icon-mullvadbrowser.png b/wikipiki/icon-mullvadbrowser.png deleted file mode 100644 index f5381b6..0000000 Binary files a/wikipiki/icon-mullvadbrowser.png and /dev/null differ diff --git a/wikipiki/icon-torbrowser.png b/wikipiki/icon-torbrowser.png deleted file mode 100644 index ad7e8d1..0000000 Binary files a/wikipiki/icon-torbrowser.png and /dev/null differ diff --git a/wikipiki/overview01.png b/wikipiki/overview01.png new file mode 100644 index 0000000..2c8f3b6 Binary files /dev/null and b/wikipiki/overview01.png differ diff --git a/wikipiki/overview02.png b/wikipiki/overview02.png new file mode 100644 index 0000000..28638fb Binary files /dev/null and b/wikipiki/overview02.png differ diff --git a/wikipiki/overview03.png b/wikipiki/overview03.png new file mode 100644 index 0000000..1219710 Binary files /dev/null and b/wikipiki/overview03.png differ diff --git a/wikipiki/parseError.png b/wikipiki/parseError.png deleted file mode 100644 index 8f8a420..0000000 Binary files a/wikipiki/parseError.png and /dev/null differ diff --git a/wikipiki/profiles01.png b/wikipiki/profiles01.png new file mode 100644 index 0000000..c8ba7b2 Binary files /dev/null and b/wikipiki/profiles01.png differ diff --git a/wikipiki/profiles02.png b/wikipiki/profiles02.png new file mode 100644 index 0000000..71b3076 Binary files /dev/null and b/wikipiki/profiles02.png differ diff --git a/wikipiki/rfpCanvas.png b/wikipiki/rfpCanvas.png deleted file mode 100644 index 97488cc..0000000 Binary files a/wikipiki/rfpCanvas.png and /dev/null differ diff --git a/wikipiki/rfpCanvasException.png b/wikipiki/rfpCanvasException.png deleted file mode 100644 index 6889f80..0000000 Binary files a/wikipiki/rfpCanvasException.png and /dev/null differ diff --git a/wikipiki/uboCustom.png b/wikipiki/uboCustom.png deleted file mode 100644 index 2b8c443..0000000 Binary files a/wikipiki/uboCustom.png and /dev/null differ