causalhonk/dots
1
0
Fork 0
forked from nico/dots
Code Pull requests Activity

nix: harden firefox with arkenfox user.js

Browse source
This commit is contained in:
Nico 2025-05-03 16:15:59 +10:00
parent 8e170eae3f
commit 66b707f4f6
1 changed files with 921 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

925
modules/firefox.nix
View file

@ -100,8 +100,925 @@
DisableProfileImport = true; DisableProfileImport = true;
}; };
programs.firefox.preferences = { programs.firefox.autoConfig = ''
"sidebar.revamp" = true; // mostly from arkenfox
"sidebar.verticalTabs" = true; // at commit: https://github.com/arkenfox/user.js/blob/eae5762d29f18115fbffd73d89bd9e2510b25427/user.js
};
lockPref("sidebar.revamp", true);
lockPref("sidebar.verticalTabs", true);
/*** [SECTION 0100]: STARTUP ***/
/* 0105: disable sponsored content on Firefox Home (Activity Stream
* [SETTING] Home>Firefox Home Content ***/
lockPref("browser.newtabpage.activity-stream.showSponsored", false); // [FF58+]
lockPref("browser.newtabpage.activity-stream.showSponsoredTopSites", false); // [FF83+] Shortcuts>Sponsored shortcuts
/* 0106: clear default topsites
* [NOTE] This does not block you from adding your own ***/
lockPref("browser.newtabpage.activity-stream.default.sites", "");
/*** [SECTION 0200]: GEOLOCATION ***/
/* 0202: disable using the geolocation service ***/
lockPref("geo.enabled", false);
/*** [SECTION 0300]: QUIETER FOX ***/
/** RECOMMENDATIONS ***/
/* 0320: disable recommendation pane in about:addons (uses Google Analytics ***/
lockPref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
/* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/
lockPref("extensions.htmlaboutaddons.recommendations.enabled", false);
/* 0322: disable personalized Extension Recommendations in about:addons and AMO [FF65+]
* [NOTE] This pref has no effect when Health Reports (0331 are disabled
* [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to make personalized extension recommendations
* [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/
lockPref("browser.discovery.enabled", false);
/* 0323: disable shopping experience [FF116+]
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1840156//c0 ***/
lockPref("browser.shopping.experience2023.enabled", false); // [DEFAULT: false]
/** TELEMETRY ***/
/* 0330: disable new data submission [FF41+]
* If disabled, no policy is shown or upload takes place, ever
* [1] https://bugzilla.mozilla.org/1195552 ***/
lockPref("datareporting.policy.dataSubmissionEnabled", false);
/* 0331: disable Health Reports
* [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send technical... data ***/
lockPref("datareporting.healthreport.uploadEnabled", false);
/* 0332: disable telemetry
* ThelockPref("unified" pref affects the behavior of the "enabled" pref
* - IflockPref("unified" is false then "enabled" controls the telemetry module
* - IflockPref("unified" is true then "enabled" only controls whether to record extended data
* [NOTE]lockPref("toolkit.telemetry.enabled" is now LOCKED to reflect prerelease (true or release builds (false) [2]
* [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html
* [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/
lockPref("toolkit.telemetry.unified", false);
lockPref("toolkit.telemetry.enabled", false); // see [NOTE]
lockPref("toolkit.telemetry.server", "data:,");
lockPref("toolkit.telemetry.archive.enabled", false);
lockPref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+]
lockPref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+]
lockPref("toolkit.telemetry.updatePing.enabled", false); // [FF56+]
lockPref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter
lockPref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+]
/* 0333: disable Telemetry Coverage
* [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/
lockPref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF]
lockPref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF]
lockPref("toolkit.coverage.endpoint.base", "");
/* 0335: disable Firefox Home (Activity Stream telemetry ***/
lockPref("browser.newtabpage.activity-stream.feeds.telemetry", false);
lockPref("browser.newtabpage.activity-stream.telemetry", false);
/** STUDIES ***/
/* 0340: disable Studies
* [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to install and run studies ***/
lockPref("app.shield.optoutstudies.enabled", false);
/* 0341: disable Normandy/Shield [FF60+]
* Shield is a telemetry system that can push and testlockPref("recipes"
* [1] https://mozilla.github.io/normandy/ ***/
lockPref("app.normandy.enabled", false);
lockPref("app.normandy.api_url", "");
/** CRASH REPORTS ***/
/* 0350: disable Crash Reports ***/
lockPref("breakpad.reportURL", "");
lockPref("browser.tabs.crashReporting.sendReport", false); // [FF44+]
//lockPref("browser.crashReports.unsubmittedCheck.enabled", false);# [FF51+] [DEFAULT: false]
/* 0351: enforce no submission of backlogged Crash Reports [FF58+]
* [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send backlogged crash reports ***/
lockPref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [DEFAULT: false]
/** OTHER ***/
/* 0360: disable Captive Portal detection
* [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy ***/
lockPref("captivedetect.canonicalURL", "");
lockPref("network.captive-portal-service.enabled", false); // [FF52+]
/* 0361: disable Network Connectivity checks [FF65+]
* [1] https://bugzilla.mozilla.org/1460537 ***/
lockPref("network.connectivity-service.enabled", false);
/*** [SECTION 0400]: SAFE BROWSING (SB
SB has taken many steps to preserve privacy. If required, a full url is never sent
to Google, only a part-hash of the prefix, hidden with noise of other real part-hashes.
Firefox takes measures such as stripping out identifying parameters and since SBv4 (FF57+
doesn't even use cookies. (//Turn on browser.safebrowsing.debug to monitor this activity
[1] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/
[2] https://wiki.mozilla.org/Security/Safe_Browsing
[3] https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work
[4] https://educatedguesswork.org/posts/safe-browsing-privacy/
***/
/* 0401: disable SB (Safe Browsing
* [WARNING] Do this at your own risk! These are the master switches
* [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content ***/
//lockPref("browser.safebrowsing.malware.enabled", false);
//lockPref("browser.safebrowsing.phishing.enabled", false);
/* 0402: disable SB checks for downloads (both local lookups + remote
* This is the master switch for the safebrowsing.downloads* prefs (0403, 0404
* [SETTING] Privacy & Security>Security>...lockPref("Block dangerous downloads" ***/
//lockPref("browser.safebrowsing.downloads.enabled", false);
/* 0403: disable SB checks for downloads (remote
* To verify the safety of certain executable files, Firefox may submit some information about the
* file, including the name, origin, size and a cryptographic hash of the contents, to the Google
* Safe Browsing service which helps Firefox determine whether or not the file should be blocked
* [SETUP-SECURITY] If you do not understand this, or you want this protection, then override this ***/
lockPref("browser.safebrowsing.downloads.remote.enabled", false);
//lockPref("browser.safebrowsing.downloads.remote.url", "");# Defense-in-depth
/* 0404: disable SB checks for unwanted software
* [SETTING] Privacy & Security>Security>...lockPref("Warn you about unwanted and uncommon software" ***/
//lockPref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
//lockPref("browser.safebrowsing.downloads.remote.block_uncommon", false);
/* 0405: disablelockPref("ignore this warning" on SB warnings [FF45+]
* If clicked, it bypasses the block for that session. This is a means for admins to enforce SB
* [TEST] see https://github.com/arkenfox/user.js/wiki/Appendix-A-Test-Sites//-mozilla
* [1] https://bugzilla.mozilla.org/1226490 ***/
//lockPref("browser.safebrowsing.allowOverride", false);
/*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/
/* 0601: disable link prefetching
* [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
lockPref("network.prefetch-next", false);
/* 0602: disable DNS prefetching
* [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
lockPref("network.dns.disablePrefetch", true);
lockPref("network.dns.disablePrefetchFromHTTPS", true);
/* 0603: disable predictor / prefetching ***/
lockPref("network.predictor.enabled", false);
lockPref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false]
/* 0604: disable link-mouseover opening connection to linked server
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/
lockPref("network.http.speculative-parallel-limit", 0);
/* 0605: disable mousedown speculative connections on bookmarks and history [FF98+] ***/
lockPref("browser.places.speculativeConnect.enabled", false);
/* 0610: enforce nolockPref("Hyperlink Auditing" (click tracking
* [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/
//lockPref("browser.send_pings", false);# [DEFAULT: false]
/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/
/* 0801: disable location bar making speculative connections [FF56+]
* [1] https://bugzilla.mozilla.org/1348275 ***/
lockPref("browser.urlbar.speculativeConnect.enabled", false);
/* 0802: disable location bar contextual suggestions
* [NOTE] The UI is controlled by the .enabled pref
* [SETTING] Search>Address Bar>Suggestions from...
* [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/
lockPref("browser.urlbar.quicksuggest.enabled", false); // [FF92+]
lockPref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+]
lockPref("browser.urlbar.suggest.quicksuggest.sponsored", false); // [FF92+]
/* 0803: disable live search suggestions
* [NOTE] Both must be true for live search to work in the location bar
* [SETUP-CHROME] Override these if you trust and use a privacy respecting search engine
* [SETTING] Search>Show search suggestions | Show search suggestions in address bar results ***/
lockPref("browser.search.suggest.enabled", false);
lockPref("browser.urlbar.suggest.searches", false);
/* 0805: disable urlbar trending search suggestions [FF118+]
* [SETTING] Search>Search Suggestions>Show trending search suggestions (FF119 ***/
lockPref("browser.urlbar.trending.featureGate", false);
/* 0806: disable urlbar suggestions ***/
lockPref("browser.urlbar.addons.featureGate", false); // [FF115+]
lockPref("browser.urlbar.mdn.featureGate", false); // [FF117+] [HIDDEN PREF]
lockPref("browser.urlbar.pocket.featureGate", false); // [FF116+] [DEFAULT: false]
lockPref("browser.urlbar.weather.featureGate", false); // [FF108+] [DEFAULT: false]
lockPref("browser.urlbar.yelp.featureGate", false); // [FF124+] [DEFAULT: false]
/* 0807: disable urlbar clipboard suggestions [FF118+] ***/
//lockPref("browser.urlbar.clipboard.featureGate", false);
/* 0808: disable recent searches [FF120+]
* [NOTE] Recent searches are cleared with history (2811
* [1] https://support.mozilla.org/kb/search-suggestions-firefox ***/
//lockPref("browser.urlbar.recentsearches.featureGate", false);
/* 0810: disable search and form history
* [NOTE] We also clear formdata on exit (2811
* [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2]
* [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history
* [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html
* [2] https://bugzilla.mozilla.org/381681 ***/
lockPref("browser.formfill.enable", false);
/* 0815: disable tab-to-search [FF85+]
* Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search
* [SETTING] Search>Address Bar>When using the address bar, suggest>Search engines ***/
//lockPref("browser.urlbar.suggest.engines", false);
/* 0820: disable coloring of visited links
* [SETUP-HARDEN] Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive
* redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501 further hampers timing
* attacks. Don't forget clearing history on exit (2811. However, social engineering [2//limits][4][5]
* and advanced targeted timing attacks could still produce usable results
* [1] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector
* [2] https://dbaron.org/mozilla/visited-privacy
* [3] https://bugzilla.mozilla.org/1632765
* [4] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use
* [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/
//lockPref("layout.css.visited_links_enabled", false);
/*** [SECTION 1000]: DISK AVOIDANCE ***/
/* 1001: disable disk cache
* [NOTE] We also clear cache on exit (2811
* [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this ***/
//"browser.cache.disk.enable", false);
/* 1002: disable media cache from writing to disk in Private Browsing
* [NOTE] MSE (Media Source Extensions are already stored in-memory in PB ***/
lockPref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+]
lockPref("media.memory_cache_max_size", 65536);
/* 1003: disable storing extra session data [SETUP-CHROME]
* define on which sites to save extra session data such as form content, cookies and POST data
* 0=everywhere, 1=unencrypted sites, 2=nowhere ***/
lockPref("browser.sessionstore.privacy_level", 2);
/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP
Your cipher and other settings can be used in server side fingerprinting
[TEST] https://www.ssllabs.com/ssltest/viewMyClient.html
[TEST] https://browserleaks.com/ssl
[TEST] https://ja3er.com/
[1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
***/
/** SSL (Secure Sockets Layer / TLS (Transport Layer Security) ***/
/* 1201: require safe negotiation
* Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a
* MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations
* but the problem is that the browser can't know that. Setting this pref to true is the only way for the
* browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server
* [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site?
* [STATS] SSL Labs (May 2024 reports over 99.7% of top sites have secure renegotiation [4]
* [1] https://wiki.mozilla.org/Security:Renegotiation
* [2] https://datatracker.ietf.org/doc/html/rfc5746
* [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
* [4] https://www.ssllabs.com/ssl-pulse/ ***/
lockPref("security.ssl.require_safe_negotiation", true);
/* 1206: disable TLS1.3 0-RTT (round-trip time [FF51+]
* This data is not forward secret, as it is encrypted solely under keys derived using
* the offered PSK. There are no guarantees of non-replay between connections
* [1] https://github.com/tlswg/tls13-spec/issues/1001
* [2] https://www.rfc-editor.org/rfc/rfc9001.html//name-replay-attacks-with-0-rtt
* [3] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/
lockPref("security.tls.enable_0rtt_data", false);
/** OCSP (Online Certificate Status Protocol
[1] https://scotthelme.co.uk/revocation-is-broken/
[2] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
***/
/* 1211: enforce OCSP fetching to confirm current validity of certificates
* 0=disabled, 1=enabled (default, 2=enabled for EV certificates only
* OCSP (non-stapled leaks information about the sites you visit to the CA (cert authority)
* It's a trade-off between security (checking and privacy (leaking info to the CA)
* [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling
* [SETTING] Privacy & Security>Security>Certificates>Query OCSP responder servers...
* [1] https://en.wikipedia.org/wiki/Ocsp ***/
lockPref("security.OCSP.enabled", 1); // [DEFAULT: 1]
/* 1212: set OCSP fetch failures (non-stapled, see 1211 to hard-fail
* [SETUP-WEB] SEC_ERROR_OCSP_SERVER_ERROR
* When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail
* Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail
* It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it
* could have been revoked and/or you could be under attack (e.g. malicious blocking of OCSP servers)
* [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
* [2] https://www.imperialviolet.org/2014/04/19/revchecking.html ***/
lockPref("security.OCSP.require", true);
/** CERTS / HPKP (HTTP Public Key Pinning ***/
/* 1223: enable strict PKP (Public Key Pinning
* 0=disabled, 1=allow user MiTM (default); such as your antivirus, 2=strict
* [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE ***/
lockPref("security.cert_pinning.enforcement_level", 2);
/* 1224: enable CRLite [FF73+]
* 0, disabled
* 1, consult CRLite but only collect telemetry
* 2, consult CRLite and enforce bothlockPref("Revoked" and "Not Revoked" results
* 3, consult CRLite and enforcelockPref("Not Revoked" results = but defer to OCSP for "Revoked" (default
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985,1753071
* [2] https://blog.mozilla.org/security/tag/crlite/ ***/
lockPref("security.remote_settings.crlite_filters.enabled", true);
lockPref("security.pki.crlite_mode", 2);
/** MIXED CONTENT ***/
/* 1241: disable insecure passive content (such as images on https pages ***/
//lockPref("security.mixed_content.block_display_content", true);# Defense-in-depth (see 1244)
/* 1244: enable HTTPS-Only mode in all windows
* When the top-level is HTTPS, insecure subresources are also upgraded (silent fail
* [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (afterlockPref("Continue to HTTP Site"
* [SETTING] Privacy & Security>HTTPS-Only Mode (and manage exceptions
* [TEST] http://example.com [upgrade]
* [TEST] http://httpforever.com/ | http://http.rip [no upgrade] ***/
lockPref("dom.security.https_only_mode", true); // [FF76+]
//lockPref("dom.security.https_only_mode_pbm", true);# [FF80+]
/* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/
//lockPref("dom.security.https_only_mode.upgrade_local", true);
/* 1246: disable HTTP background requests [FF82+]
* When attempting to upgrade, if the server doesn't respond within 3 seconds, Firefox sends
* a top-level HTTP request without path in order to check if the server supports HTTPS or not
* This is done to avoid waiting for a timeout which takes 90 seconds
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/
//"dom.security.https_only_mode_send_http_background_request", false);
/** UI (User Interface ***/
/* 1270: display warning on the padlock forlockPref("broken security" (if 1201 is false
* Bug: warning padlock not indicated for subresources on a secure page! [2]
* [1] https://wiki.mozilla.org/Security:Renegotiation
* [2] https://bugzilla.mozilla.org/1353705 ***/
lockPref("security.ssl.treat_unsafe_negotiation_as_broken", true);
/* 1272: display advanced information on Insecure Connection warning pages
* only works when it's possible to add an exception
* i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/
* [TEST] https://expired.badssl.com/ ***/
lockPref("browser.xul.error_pages.expert_bad_cert", true);
/*** [SECTION 1600]: REFERERS
full URI: https://example.com:8888/foo/bar.html?id=1234
scheme+host+port+path: https://example.com:8888/foo/bar.html
scheme+host+port: https://example.com:8888
[1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/
***/
/* 1602: control the amount of cross-origin information to send [FF52+]
* 0=send full URI (default, 1=scheme+host+port+path, 2=scheme+host+port ***/
lockPref("network.http.referer.XOriginTrimmingPolicy", 2);
/*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/
/* 2002: force WebRTC inside the proxy [FF70+] ***/
lockPref("media.peerconnection.ice.proxy_only_if_behind_proxy", true);
/* 2003: force a single network interface for ICE candidates generation [FF42+]
* When using a system-wide proxy, it uses the proxy interface
* [1] https://developer.mozilla.org/docs/Web/API/RTCIceCandidate
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/
lockPref("media.peerconnection.ice.default_address_only", true);
/* 2004: force exclusion of private IPs from ICE candidates [FF51+]
* [SETUP-HARDEN] This will protect your private IP even in TRUSTED scenarios after you
* grant device access, but often results in breakage on video-conferencing platforms ***/
//lockPref("media.peerconnection.ice.no_host", true);
/* 2020: disable GMP (Gecko Media Plugins
* [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/
//lockPref("media.gmp-provider.enabled", false);
/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL ***/
/* 2402: prevent scripts from moving and resizing open windows ***/
lockPref("dom.disable_window_move_resize", true);
/*** [SECTION 2600]: MISCELLANEOUS ***/
/* 2603: remove temp files opened from non-PB windows with an external application
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=302433,1738574 ***/
lockPref("browser.download.start_downloads_in_tmp_dir", true); // [FF102+]
lockPref("browser.helperApps.deleteTempFileOnExit", true);
/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
lockPref("browser.uitour.enabled", false);
//lockPref("browser.uitour.url", "");# Defense-in-depth
/* 2608: reset remote debugging to disabled
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
lockPref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
/* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+]
* 0 (default or 1=allow, 2=block
* [SETTING] to add site exceptions: Ctrl+I>Permissions>Override Keyboard Shortcuts ***/
lockPref("permissions.default.shortcuts", 2);
/* 2616: remove special permissions for certain mozilla domains [FF35+]
* [1] resource://app/defaults/permissions ***/
lockPref("permissions.manager.defaultsUrl", "");
/* 2617: remove webchannel whitelist ***/
lockPref("webchannel.allowObject.urlWhitelist", "");
/* 2619: use Punycode in Internationalized Domain Names to eliminate possible spoofing
* [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded
* [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com
* [1] https://wiki.mozilla.org/IDN_Display_Algorithm
* [2] https://en.wikipedia.org/wiki/IDN_homograph_attack
* [3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox
* [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/
lockPref("network.IDN_show_punycode", true);
/* 2620: enforce PDFJS, disable PDFJS scripting
* This setting controls if the optionlockPref("Display in Firefox" is available in the setting below
* and by effect controls whether PDFs are handled in-browser or externally ("Ask" orlockPref("Open With"
* [WHY] pdfjs is lightweight, open source, and secure: the last exploit was June 2015 [1]
* It doesn't breaklockPref("state separation" of browser content (by not sharing with OS, independent apps.
* It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk.
* [NOTE] JS can still force a pdf to open in-browser by bundling its own code
* [SETUP-CHROME] You may prefer a different pdf reader for security/workflow reasons
* [SETTING] General>Applications>Portable Document Format (PDF
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/
lockPref("pdfjs.disabled", false); // [DEFAULT: false]
lockPref("pdfjs.enableScripting", false); // [FF86+]
/* 2624: disable middle click on new tab button opening URLs or searches using clipboard [FF115+] */
//"browser.tabs.searchclipboardfor.middleclick", false); # [DEFAULT: false NON-LINUX]
/* 2630: disable content analysis by DLP (Data Loss Prevention agents
* DLP agents are background processes on managed computers that allow enterprises to monitor locally running
* applications for data exfiltration events, which they can allow/block based on customer defined DLP policies.
* 0=Block all requests, 1=Warn on all requests (which lets the user decide, 2=Allow all requests
* [1] https://github.com/chromium/content_analysis_sdk */
lockPref("browser.contentanalysis.enabled", false); // [FF121+] [DEFAULT: false]
lockPref("browser.contentanalysis.default_result", 0); // [FF127+] [DEFAULT: 0]
/** EXTENSIONS ***/
/* 2660: limit allowed extension directories
* 1=profile, 2=user, 4=application, 8=system, 16=temporary, 31=all
* The pref value represents the sum: e.g. 5 would be profile and application directories
* [SETUP-CHROME] Breaks usage of files which are installed outside allowed directories
* [1] https://archive.is/DYjAM ***/
lockPref("extensions.enabledScopes", 5); // [HIDDEN PREF]
//lockPref("extensions.autoDisableScopes", 15);# [DEFAULT: 15]
/* 2661: disable bypassing 3rd party extension install prompts [FF82+]
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1659530,1681331 ***/
lockPref("extensions.postDownloadThirdPartyPrompt", false);
/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503 [FF60+]
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
//lockPref("extensions.webextensions.restrictedDomains", "");
/*** [SECTION 2700]: ETP (ENHANCED TRACKING PROTECTION ***/
/* 2701: enable ETP Strict Mode [FF86+]
* ETP Strict Mode enables Total Cookie Protection (TCP
* [NOTE] Adding site exceptions disables all ETP protections for that site and increases the risk of
* cross-site state tracking e.g. exceptions for SiteA and SiteB means PartyC on both sites is shared
* [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/
* [SETTING] to add site exceptions: Urlbar>ETP Shield
* [SETTING] to manage site exceptions: Options>Privacy & Security>Enhanced Tracking Protection>Manage Exceptions ***/
lockPref("browser.contentblocking.category", "strict"); // [HIDDEN PREF]
/* 2702: disable ETP web compat features [FF93+]
* [SETUP-HARDEN] Includes skip lists, heuristics (SmartBlock and automatic grants
* Opener and redirect heuristics are granted for 30 days, see [3]
* [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/
* [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab//l4.12
* [3] https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning//storage_access_heuristics ***/
//lockPref("privacy.antitracking.enableWebcompat", false);
/** SANITIZE MANUAL: TIMERANGE ***/
/* 2840: setlockPref("Time range to clear" for "Clear Data" (2820 and "Clear History" (2830)
* Firefox remembers your last choice. This will reset the value when you start Firefox
* 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today
* [NOTE] Values 5 (last 5 minutes and 6 (last 24 hours) are not listed in the dropdown,
* which will display a blank value, and are not guaranteed to work ***/
lockPref("privacy.sanitize.timeSpan", 0);
/*** [SECTION 4000]: FPP (fingerprintingProtection
RFP (4501 overrides FPP
In FF118+ FPP is on by default in private windows (4001 and in FF119+ is controlled
by ETP (2701. FPP will also use Remote Services in future to relax FPP protections
on a per site basis for compatibility (4004.
https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargetsDefault.inc
1826408 - restrict fonts to system (kBaseFonts + kLangPackFonts (Windows, Mac, some Linux)
https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc
1858181 - subtly randomize canvas per eTLD+1, per session and per window-mode (FF120+
***/
/* 4001: enable FPP in PB mode [FF114+]
* [NOTE] In FF119+, FPP for all modes (7016 is enabled with ETP Strict (2701) ***/
lockPref("privacy.fingerprintingProtection.pbmode", true); // [DEFAULT: true FF118+]
/* 4002: set global FPP overrides [FF114+]
* useslockPref("RFPTargets" [1] which despite the name these are not used by RFP
* e.g.lockPref("+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC" = all targets but allow prefers-color-scheme and do not change timezone
* e.g.lockPref("-AllTargets,+CanvasRandomization,+JSDateTimeUTC" = no targets but do use FPP canvas and change timezone
* [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults
* [1] https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargets.inc ***/
//lockPref("privacy.fingerprintingProtection.overrides", "");
/* 4003: set granular FPP overrides
* JSON format: e.g."[{\"firstPartyDomain\": \"netflix.com\", \"overrides\": \"-CanvasRandomization,-FrameRate,\"}]"
* [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults ***/
//lockPref("privacy.fingerprintingProtection.granularOverrides", "");
/* 4004: disable remote FPP overrides [FF127+] ***/
//lockPref("privacy.fingerprintingProtection.remoteOverrides.enabled", false);
/*** [SECTION 4500]: OPTIONAL RFP (resistFingerprinting
RFP overrides FPP (4000
FF128+ Arkenfox by default uses FPP (automatically enabled with ETP Strict. For most people
this is all you need. To use RFP instead, add RFP (4501 to your overrides, and optionally
add letterboxing (4504, spoof_english (4506), and webgl (4520).
RFP is an all-or-nothing buy in: you cannot pick and choose what parts you want
[TEST] https://arkenfox.github.io/TZP/tzp.html
[WARNING] DO NOT USE extensions to alter RFP protected metrics
418986 - limit window.screen & CSS media queries (FF41
1281949 - spoof screen orientation (FF50
1360039 - spoof navigator.hardwareConcurrency as 2 (FF55
FF56
1333651 - spoof User Agent & Navigator API
version: android version spoofed as ESR (FF119 or lower
OS: JS spoofed as Windows 10, OS 10.15, Android 10, or Linux | HTTP Headers spoofed as Windows or Android
1369319 - disable device sensor API
1369357 - disable site specific zoom
1337161 - hide gamepads from content
1372072 - spoof network information API aslockPref("unknown" when dom.netinfo.enabled, true
1333641 - reduce fingerprinting in WebSpeech API
FF57
1369309 - spoof media statistics
1382499 - reduce screen co-ordinate fingerprinting in Touch API
1217290 & 1409677 - enable some fingerprinting resistance for WebGL
1354633 - limit MediaError.message to a whitelist
FF58+
1372073 - spoof/block fingerprinting in MediaDevices API (FF59
Spoof: enumerate devices as onelockPref("Internal Camera" and one "Internal Microphone"
Block: suppresses the ondevicechange event
1039069 - warn when language prefs are not set tolockPref("en*" (FF59
1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59
Spoofing mimics the content language of the document. Currently it only supports en-US.
Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected.
1337157 - disable WebGL debug renderer info (FF60
1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID (FF62)
1479239 - returnlockPref("no-preference" with prefers-reduced-motion (FF63
1363508 - spoof/suppress Pointer Events (FF64
1492766 - spoof pointerEvent.pointerid (FF65
1485266 - disable exposure of system colors to CSS or canvas (FF67
1494034 - returnlockPref("light" with prefers-color-scheme (FF67
1564422 - spoof audioContext outputLatency (FF70
1595823 - return audioContext sampleRate as 44100 (FF72
1607316 - spoof pointer as coarse and hover as none (ANDROID (FF74)
1621433 - randomize canvas (previously FF58+ returned an all-white canvas (FF78)
1506364 - returnlockPref("no-preference" with prefers-contrast (FF80
1653987 - limit font visibility to bundled andlockPref("Base Fonts" (Windows, Mac, some Linux (FF80)
1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82
531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1
1756280 - enforce navigator.pdfViewerEnabled as true and plugins/mimeTypes as hard-coded values (FF100-115
1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms (FF102)
1422237 - returnlockPref("srgb" with color-gamut (FF110
1794628 - returnlockPref("none" with inverted-colors (FF114
1554751 - return devicePixelRatio as 2 (previously FF41+ was 1 (FF127)
1787790 - normalize system fonts (FF128
1835987 - spoof timezone as Atlantic/Reykjavik (previously FF55+ was UTC (FF128)
***/
/* 4501: enable RFP
* [NOTE] pbmode applies if true and the original pref is false
* [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a canvas site exception via the urlbar.
* RFP also has a few side effects: mainly that timezone is GMT, and websites will prefer light theme ***/
lockPref("privacy.resistFingerprinting", true);// [FF41+]
lockPref("privacy.resistFingerprinting.pbmode", true);// [FF114+]
/* 4502: set RFP new window size max rounded values [FF55+]
* [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen
* [1] https://bugzilla.mozilla.org/1330882 ***/
lockPref("privacy.window.maxInnerWidth", 1600);
lockPref("privacy.window.maxInnerHeight", 900);
/* 4503: disable mozAddonManager Web API [FF57+]
* [NOTE] To allow extensions to work on AMO, you also need 2662
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
lockPref("privacy.resistFingerprinting.block_mozAddonManager", true);
/* 4504: enable letterboxing [FF67+]
* Dynamically resizes the inner window by applying margins in stepped ranges [2]
* If you use the dimension pref, then it will only apply those resolutions.
* The format islockPref("width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000"
* [SETUP-WEB] This is independent of RFP (4501. If you're not using RFP, or you are but
* dislike the margins, then flip this pref, keeping in mind that it is effectively fingerprintable
* [WARNING] DO NOT USE: the dimension pref is only meant for testing
* [1] https://bugzilla.mozilla.org/1407366
* [2] https://hg.mozilla.org/mozilla-central/rev/6d2d7856e468//l2.32 ***/
lockPref("privacy.resistFingerprinting.letterboxing", true);// [HIDDEN PREF]
//lockPref("privacy.resistFingerprinting.letterboxing.dimensions", "");# [HIDDEN PREF]
/* 4505: disable RFP by domain [FF91+] ***/
//lockPref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid");
/* 4506: disable RFP spoof english prompt [FF59+]
* 0=prompt, 1=disabled, 2=enabled
* [NOTE] When changing from value 2, preferred languages ('intl.accept_languages' is not reset.
* [SETUP-WEB] when enabled, sets 'en-US, en' for displaying pages and 'en-US' as locale.
* [SETTING] General>Language>Choose your preferred language for displaying pages>Choose>Request English... ***/
//"privacy.spoof_english", 1);
/* 4510: disable using system colors
* [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors ***/
lockPref("browser.display.use_system_colors", false); // [DEFAULT: false NON-WINDOWS]
/* 4512: enforce links targeting new windows to open in a new tab instead
* 1=most recent window or tab, 2=new window, 3=new tab
* Stops malicious window sizes and some screen resolution leaks.
* You can still right-click a link and open in a new window
* [SETTING] General>Tabs>Open links in tabs instead of new windows
* [TEST] https://arkenfox.github.io/TZP/tzp.html//screen
* [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
lockPref("browser.link.open_newwindow", 3); // [DEFAULT: 3]
/* 4513: set all open window methods to abide bylockPref("browser.link.open_newwindow" (4512
* [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js ***/
lockPref("browser.link.open_newwindow.restriction", 0);
/* 4520: disable WebGL (Web Graphics Library ***/
lockPref("webgl.disabled", true);
/*** [SECTION 5000]: OPTIONAL OPSEC
Disk avoidance, application data isolation, eyeballs...
***/
/* 5001: start Firefox in PB (Private Browsing mode
* [NOTE] In this mode all windows arelockPref("private windows" and the PB mode icon is not displayed
* [NOTE] The P in PB mode can be misleading: it means nolockPref("persistent" disk state such as history,
* caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode.
* In fact, PB mode limits or removes the ability to control some of these, and you need to quit
* Firefox to clear them. PB is best used as a one off window (Menu>New Private Window to provide
* a temporary self-contained new session. Close all private windows to clear the PB session.
* [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode
* [1] https://wiki.mozilla.org/Private_Browsing
* [2] https://support.mozilla.org/kb/common-myths-about-private-browsing ***/
//lockPref("browser.privatebrowsing.autostart", true);
/* 5002: disable memory cache
* capacity: -1=determine dynamically (default, 0=none, n=memory capacity in kibibytes ***/
//lockPref("browser.cache.memory.enable", false);
//lockPref("browser.cache.memory.capacity", 0);
/* 5003: disable saving passwords
* [NOTE] This does not clear any passwords already saved
* [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/
//lockPref("signon.rememberSignons", false);
/* 5004: disable permissions manager from writing to disk [FF41+] [RESTART]
* [NOTE] This means any permission changes are session only
* [1] https://bugzilla.mozilla.org/967812 ***/
lockPref("permissions.memory_only", true);// [HIDDEN PREF]
/* 5005: disable intermediate certificate caching [FF41+] [RESTART]
* [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
* Saved logins and passwords are not available. Reset the pref and restart to return them ***/
//lockPref("security.nocertdb", true);
/* 5006: disable favicons in history and bookmarks
* [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your
* actual history (and bookmarks already do. Your history is more detailed, so
* control that instead); e.g. disable history, clear history on exit, use PB mode
* [NOTE] favicons.sqlite is sanitized on Firefox close ***/
//lockPref("browser.chrome.site_icons", false);
/* 5007: excludelockPref("Undo Closed Tabs" in Session Restore ***/
//lockPref("browser.sessionstore.max_tabs_undo", 0);
/* 5008: disable resuming session from crash
* [TEST] about:crashparent ***/
lockPref("browser.sessionstore.resume_from_crash", false);
/* 5009: disablelockPref("open with" in download dialog [FF50+]
* Application data isolation [1]
* [1] https://bugzilla.mozilla.org/1281959 ***/
lockPref("browser.download.forbid_open_with", true);
/* 5010: disable location bar suggestion types
* [SETTING] Search>Address Bar>When using the address bar, suggest ***/
lockPref("browser.urlbar.suggest.history", false);
//lockPref("browser.urlbar.suggest.bookmark", false);
//lockPref("browser.urlbar.suggest.openpage", false);
//lockPref("browser.urlbar.suggest.topsites", false);# [FF78+]
/* 5011: disable location bar dropdown
* This value controls the total number of entries to appear in the location bar dropdown ***/
//lockPref("browser.urlbar.maxRichResults", 0);
/* 5012: disable location bar autofill
* [1] https://support.mozilla.org/kb/address-bar-autocomplete-firefox//w_url-autocomplete ***/
//lockPref("browser.urlbar.autoFill", false);
/* 5013: disable browsing and download history
* [NOTE] We also clear history and downloads on exit (2811
* [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/
lockPref("places.history.enabled", false);
/* 5014: disable Windows jumplist [WINDOWS] ***/
//lockPref("browser.taskbar.lists.enabled", false);
//lockPref("browser.taskbar.lists.frequent.enabled", false);
//lockPref("browser.taskbar.lists.recent.enabled", false);
//lockPref("browser.taskbar.lists.tasks.enabled", false);
/* 5016: discourage downloading to desktop
* 0=desktop, 1=downloads (default, 2=custom
* [SETTING] To set your custom defaultlockPref("downloads": General>Downloads>Save files to ***/
//lockPref("browser.download.folderList", 2);
/* 5017: disable Form Autofill
* If .supportedCountries includes your region (browser.search.region and .supported
* islockPref("detect" (default, then the UI will show. Stored data is not secure, uses JSON
* [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/
//lockPref("extensions.formautofill.addresses.enabled", false);# [FF55+]
//lockPref("extensions.formautofill.creditCards.enabled", false);# [FF56+]
/* 5018: limit events that can cause a pop-up ***/
//lockPref("dom.popup_allowed_events", "click dblclick mousedown pointerdown");
/* 5019: disable page thumbnail collection ***/
//lockPref("browser.pagethumbnails.capturing_disabled", true);# [HIDDEN PREF]
/* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/
//lockPref("alerts.useSystemBackend.windows.notificationserver.enabled", false);
/* 5021: disable location bar using search
* Don't leak URL typos to a search engine, give an error message instead
* Examples:lockPref("secretplace,com", "secretplace/com", "secretplace com", "secret place.com"
* [NOTE] This does not affect explicit user action such as using search buttons in the
* dropdown, or using keyword search shortcuts you configure in options (e.g.lockPref("d" for DuckDuckGo ***/
//lockPref("keyword.enabled", false);
/*** [SECTION 5500]: OPTIONAL HARDENING
Not recommended. Overriding these can cause breakage and performance issues,
they are mostly fingerprintable, and the threat model is practically nonexistent
***/
/* 5501: disable MathML (Mathematical Markup Language [FF51+]
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mathml ***/
//lockPref("mathml.disabled", true);# 1173199
/* 5502: disable in-content SVG (Scalable Vector Graphics [FF53+]
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+svg ***/
//lockPref("svg.disabled", true);# 1216893
/* 5503: disable graphite
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+graphite
* [2] https://en.wikipedia.org/wiki/Graphite_(SIL ***/
//lockPref("gfx.font_rendering.graphite.enabled", false);
/* 5504: disable asm.js [FF22+]
* [1] http://asmjs.org/
* [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js
* [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/
//lockPref("javascript.options.asmjs", false);
/* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART]
* [NOTE] When both Ion and JIT are disabled, and trustedprincipals
* is enabled, then Ion can still be used by extensions (1599226
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit
* [2] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ ***/
//lockPref("javascript.options.ion", false);
//lockPref("javascript.options.baselinejit", false);
//lockPref("javascript.options.jit_trustedprincipals", true);# [FF75+] [HIDDEN PREF]
/* 5506: disable WebAssembly [FF52+]
* Vulnerabilities [1] have increasingly been found, including those known and fixed
* in native programs years ago [2]. WASM has powerful low-level access, making
* certain attacks (brute-force and vulnerabilities more possible
* [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3]
* [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm
* [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly
* [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/
lockPref("javascript.options.wasm", false);
/* 5507: disable rendering of SVG OpenType fonts ***/
//lockPref("gfx.font_rendering.opentype_svg.enabled", false);
/* 5508: disable all DRM content (EME: Encryption Media Extension
* Optionally hide the UI setting which also disables the DRM prompt
* [SETTING] General>DRM Content>Play DRM-controlled content
* [TEST] https://bitmovin.com/demos/drm
* [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/
//lockPref("media.eme.enabled", false);
//lockPref("browser.eme.ui.enabled", false);
/* 5509: disable IPv6 if using a VPN
* This is an application level fallback. Disabling IPv6 is best done at an OS/network
* level, and/or configured properly in system wide VPN setups.
* [NOTE] PHP defaults to IPv6 withlockPref("localhost". Use "php -S 127.0.0.1:PORT"
* [SETUP-WEB] PR_CONNECT_RESET_ERROR
* [TEST] https://ipleak.org/
* [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6 ***/
//lockPref("network.dns.disableIPv6", true);
/* 5510: control when to send a cross-origin referer
* 0=always (default, 1=only if base domains match, 2=only if hosts match
* [NOTE] Will cause breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram ***/
//lockPref("network.http.referer.XOriginPolicy", 2);
/* 5511: set DoH bootstrap address [FF89+]
* Firefox uses the system DNS to initially resolve the IP address of your DoH server.
* When set to a valid, working value that matches yourlockPref("network.trr.uri" (0712 Firefox
* won't use the system DNS. If the IP doesn't match then DoH won't work ***/
//lockPref("network.trr.bootstrapAddr", "10.0.0.1");# [HIDDEN PREF]
/*** [SECTION 6000]: DON'T TOUCH ***/
/* 6001: enforce Firefox blocklist
* [WHY] It includes updates forlockPref("revoked certificates"
* [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/
lockPref("extensions.blocklist.enabled", true); // [DEFAULT: true]
/* 6002: enforce no referer spoofing
* [WHY] Spoofing can affect CSRF (Cross-Site Request Forgery protections ***/
lockPref("network.http.referer.spoofSource", false); // [DEFAULT: false]
/* 6004: enforce a security delay on some confirmation dialogs such as install, open/save
* [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
lockPref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000]
/* 6008: enforce no First Party Isolation [FF51+]
* [WARNING] Replaced with network partitioning (FF85+ and TCP (2701), and enabling FPI
* disables those. FPI is no longer maintained except at Tor Project for Tor Browser's config ***/
lockPref("privacy.firstparty.isolate", false); // [DEFAULT: false]
/* 6009: enforce SmartBlock shims (about:compat [FF81+]
* [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/
lockPref("extensions.webcompat.enable_shims", true); // [HIDDEN PREF] [DEFAULT: true]
/* 6010: enforce no TLS 1.0/1.1 downgrades
* [TEST] https://tls-v1-1.badssl.com:1010/ ***/
lockPref("security.tls.version.enable-deprecated", false); // [DEFAULT: false]
/* 6011: enforce disabling of Web Compatibility Reporter [FF56+]
* Web Compatibility Reporter adds alockPref("Report Site Issue" button to send data to Mozilla
* [WHY] To prevent wasting Mozilla's time with a custom setup ***/
lockPref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false]
/* 6012: enforce Quarantined Domains [FF115+]
* [WHY] https://support.mozilla.org/kb/quarantined-domains */
lockPref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true]
/* 6050: prefsCleaner: previously active items removed from arkenfox 115-127 ***/
//lockPref("accessibility.force_disabled", "");
//lockPref("browser.urlbar.dnsResolveSingleWordsAfterSearch", "");
//lockPref("geo.provider.network.url", "");
//lockPref("geo.provider.network.logging.enabled", "");
//lockPref("geo.provider.use_gpsd", "");
//lockPref("network.protocol-handler.external.ms-windows-store", "");
//lockPref("privacy.partition.always_partition_third_party_non_cookie_storage", "");
//lockPref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", "");
//lockPref("privacy.partition.serviceWorkers", "");
/*** [SECTION 7000]: DON'T BOTHER ***/
/* 7001: disable APIs
* Location-Aware Browsing, Full Screen
* [WHY] The API state is easily fingerprintable.
* Geo is behind a prompt (7002. Full screen requires user interaction ***/
//lockPref("geo.enabled", false);
//lockPref("full-screen-api.enabled", false);
/* 7002: set default permissions
* Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+]
* 0=always ask (default, 1=allow, 2=block
* [WHY] These are fingerprintable via Permissions API, except VR. Just add site
* exceptions as allow/block for frequently visited/annoying sites: i.e. not global
* [SETTING] to add site exceptions: Ctrl+I>Permissions>
* [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/
//lockPref("permissions.default.geo", 0);
//lockPref("permissions.default.camera", 0);
//lockPref("permissions.default.microphone", 0);
//lockPref("permissions.default.desktop-notification", 0);
//lockPref("permissions.default.xr", 0);# Virtual Reality
/* 7003: disable non-modern cipher suites [1]
* [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks
* [1] https://browserleaks.com/ssl ***/
//lockPref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
//lockPref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
//lockPref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
//lockPref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
//lockPref("security.ssl3.rsa_aes_128_gcm_sha256", false);# no PFS
//lockPref("security.ssl3.rsa_aes_256_gcm_sha384", false);# no PFS
//lockPref("security.ssl3.rsa_aes_128_sha", false);# no PFS
//lockPref("security.ssl3.rsa_aes_256_sha", false);# no PFS
/* 7004: control TLS versions
* [WHY] Passive fingerprinting and security ***/
//lockPref("security.tls.version.min", 3);# [DEFAULT: 3]
//lockPref("security.tls.version.max", 4);
/* 7005: disable SSL session IDs [FF36+]
* [WHY] Passive fingerprinting and perf costs. These are session-only
* and isolated with network partitioning (FF85+ and/or containers ***/
//lockPref("security.ssl.disable_session_identifiers", true);
/* 7006: onions
* [WHY] Firefox doesn't support hidden services. Use Tor Browser ***/
//lockPref("dom.securecontext.allowlist_onions", true);# [FF97+] 1382359/1744006
//lockPref("network.http.referer.hideOnionSource", true);# 1305144
/* 7007: referers
* [WHY] Only cross-origin referers (1602, 5510 matter ***/
//lockPref("network.http.sendRefererHeader", 2);
//lockPref("network.http.referer.trimmingPolicy", 0);
/* 7008: set the default Referrer Policy [FF59+]
* 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade
* [WHY] Defaults are fine. They can be overridden by a site-controlled Referrer Policy ***/
//lockPref("network.http.referer.defaultPolicy", 2);# [DEFAULT: 2]
//lockPref("network.http.referer.defaultPolicy.pbmode", 2);# [DEFAULT: 2]
/* 7010: disable HTTP Alternative Services [FF37+]
* [WHY] Already isolated with network partitioning (FF85+ ***/
//lockPref("network.http.altsvc.enabled", false);
/* 7011: disable website control over browser right-click context menu
* [WHY] Just use Shift-Right-Click ***/
//lockPref("dom.event.contextmenu.enabled", false);
/* 7012: disable icon fonts (glyphs and local fallback rendering
* [WHY] Breakage, font fallback is equivalency, also RFP
* [1] https://bugzilla.mozilla.org/789788
* [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/
//lockPref("gfx.downloadable_fonts.enabled", false);# [FF41+]
//lockPref("gfx.downloadable_fonts.fallback_delay", -1);
/* 7013: disable Clipboard API
* [WHY] Fingerprintable. Breakage. Cut/copy/paste require user
* interaction, and paste is limited to focused editable fields ***/
//lockPref("dom.event.clipboardevents.enabled", false);
/* 7014: disable System Add-on updates
* [WHY] It can compromise security. System addons ship with prefs, use those ***/
//lockPref("extensions.systemAddon.update.enabled", false);# [FF62+]
//lockPref("extensions.systemAddon.update.url", "");# [FF44+]
/* 7015: enable the DNT (Do Not Track HTTP header
* [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701 ***/
//lockPref("privacy.donottrackheader.enabled", true);
/* 7016: customize ETP settings
* [NOTE] FPP (fingerprintingProtection is ignored when RFP (4501) is enabled
* [WHY] Arkenfox only supports strict (2701 which sets these at runtime ***/
//lockPref("network.cookie.cookieBehavior", 5);# [DEFAULT: 5]
//lockPref("privacy.fingerprintingProtection", true);# [FF114+] [ETP FF119+]
//lockPref("network.http.referer.disallowCrossSiteRelaxingDefault", true);
//lockPref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true);# [FF100+]
//lockPref("privacy.partition.network_state.ocsp_cache", true);# [DEFAULT: true FF123+]
//lockPref("privacy.query_stripping.enabled", true);# [FF101+]
//lockPref("privacy.trackingprotection.enabled", true);
//lockPref("privacy.trackingprotection.socialtracking.enabled", true);
//lockPref("privacy.trackingprotection.cryptomining.enabled", true);# [DEFAULT: true]
//lockPref("privacy.trackingprotection.fingerprinting.enabled", true);# [DEFAULT: true]
/* 7017: disable service workers
* [WHY] Already isolated with TCP (2701 behind a pref (2710) ***/
//lockPref("dom.serviceWorkers.enabled", false);
/* 7018: disable Web Notifications [FF22+]
* [WHY] Web Notifications are behind a prompt (7002
* [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ ***/
//lockPref("dom.webnotifications.enabled", false);
/* 7019: disable Push Notifications [FF44+]
* [WHY] WebsitelockPref("push" requires subscription, and the API is required for CRLite (1224
* [NOTE] To remove all subscriptions, resetlockPref("dom.push.userAgentID"
* [1] https://support.mozilla.org/kb/push-notifications-firefox ***/
//lockPref("dom.push.enabled", false);
/* 7020: disable WebRTC (Web Real-Time Communication
* [WHY] Firefox desktop uses mDNS hostname obfuscation and the private IP is never exposed until
* required in TRUSTED scenarios); i.e. after you grant device (microphone or camera access
* [TEST] https://browserleaks.com/webrtc
* [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ
* [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates//section-3.1.1 ***/
//lockPref("media.peerconnection.enabled", false);
/* 7021: enable GPC (Global Privacy Control in non-PB windows
* [WHY] Passive and active fingerprinting. Mostly redundant with Tracking Protection
* in ETP Strict (2701 and sanitizing on close (2800s) ***/
//lockPref("privacy.globalprivacycontrol.enabled", true);
/*** [SECTION 8000]: DON'T BOTHER: FINGERPRINTING
[WHY] They are insufficient to help anti-fingerprinting and do more harm than good
[WARNING] DO NOT USE with RFP. RFP already covers these and they can interfere
***/
/* 8001: prefsCleaner: reset items useless for anti-fingerprinting ***/
//lockPref("browser.display.use_document_fonts", "");
//lockPref("browser.zoom.siteSpecific", "");
//lockPref("device.sensors.enabled", "");
//lockPref("dom.enable_performance", "");
//lockPref("dom.enable_resource_timing", "");
//lockPref("dom.gamepad.enabled", "");
//lockPref("dom.maxHardwareConcurrency", "");
//lockPref("dom.w3c_touch_events.enabled", "");
//lockPref("dom.webaudio.enabled", "");
//lockPref("font.system.whitelist", "");
//lockPref("general.appname.override", "");
//lockPref("general.appversion.override", "");
//lockPref("general.buildID.override", "");
//lockPref("general.oscpu.override", "");
//lockPref("general.platform.override", "");
//lockPref("general.useragent.override", "");
//lockPref("media.navigator.enabled", "");
//lockPref("media.ondevicechange.enabled", "");
//lockPref("media.video_stats.enabled", "");
//lockPref("media.webspeech.synth.enabled", "");
//lockPref("ui.use_standins_for_native_colors", "");
//lockPref("webgl.enable-debug-renderer-info", "");
/*** [SECTION 9000]: NON-PROJECT RELATED ***/
/* 9001: disable welcome notices ***/
lockPref("browser.startup.homepage_override.mstone", "ignore"); // [HIDDEN PREF]
/* 9002: disable General>Browsing>Recommend extensions/features as you browse [FF67+] ***/
lockPref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);
lockPref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
/* 9004: disable search terms [FF110+]
* [SETTING] Search>Search Bar>Use the address bar for search and navigation>Show search terms instead of URL... ***/
lockPref("browser.urlbar.showSearchTerms.enabled", false);
'';
} }