alexander.schaeferdiek/privacy
1
0
Fork 0
Code Activity

Switch to arkenfox for Firefox privacy

Browse source
This commit is contained in:
Alexander Schäferdiek 2022-02-19 10:29:32 +01:00
parent ba5df1f834
commit 75a6ac45a7
6 changed files with 91 additions and 269 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

69
firefox/README.md
View file

@ -1,10 +1,36 @@
# Firefox
# README
Make using the web more safe by disabling commonly used techniques and mechanism _without_ sacrificing usability.
Why Firefox? It provides high configurability, is open source and thus better to be reviewed by external security advisories.
Based on [https://www.privacy-handbuch.de/handbuch_21.htm](https://www.privacy-handbuch.de/handbuch_21.htm).
Mainly based on [arkenfox](https://github.com/arkenfox/user.js) with some [custom overrides](https://github.com/arkenfox/user.js/wiki/3.1-Overrides).
## Install
To find your profile folder, click on the menu top right, on `Help -> Troubleshooting Information`. You can directly open your **Profile Directory** from there or see it, typically it's something like `$HOME/.mozilla/firefox/...` or in Windows `%APPDATA%\Mozilla\Firefox\Profiles\...`
* Install [arkenfox](https://github.com/arkenfox/user.js/releases) (copy to your Firefox profile)
* Copy `user-overrides.js` also into your Firefox profile folder
* Change any setting if needed, e.g. not clean history?
* Apply the `user-overrides.js` by running `./updater.sh` or the `.bat` file on Windows in the Firefox profile folder
* Remove unnecessary search engines and apply your own or use DuckDuckGo/Startpage
* Install necessary plugins
* uBlock
* Canvas Blocker
* Skip Redirect
* Import provides settings file for uBlock and Canvas Blocker
* Customize toolbar
* add home button
* remove separator spaces
* Disallow saving logins and use a password manager, e.g. KeePassXC
* Login to Firefox sync
## Custom overrides
Look into `user-overrides.js` which custom overrides are enabled and maybe adapt to your needs. In general
they're applied to ease browsing without sacrificing too much security or are just preferences, e.g. _scroll speed_.
## Recommended extensions
@ -18,7 +44,6 @@ Besides Firefox integrated anti-tracking mechanisms, it's still advised to insta
**More**:
* Use a password manager and don't store or synchronize your passwords within internal browser functionality, e.g. `KeePassXC`
* Use `Invidious` instances for a liberated YouTube experience (a proxy to YouTube)
**Hint**: All extensions, especially extensions interferring in redirects and cookies like `Skip Redirect` _might_ lead to malfunctioning of some websites, e.g. websites not redirecting correctly or not being able to store cookies. _It's recommended to disable them per page if you notice something's not working as expected_!
@ -29,6 +54,10 @@ You can **hide extension icons** in the overflow menu if you like. Just right cl
* Import the `ublock-config-1.txt` in the "My Filter" menu for proper settings.
* Import `https://raw.githubusercontent.com/gwarser/filter-lists/master/lan-block.txt` in "Filter lists" (Custom)
### Canvas Blocker
Import the provided Canvas settings `json` file.
## Recommended search engines
If not possible in another way, you can add them via [Add custom search engine](https://addons.mozilla.org/en-US/firefox/addon/add-custom-search-engine/). Just follow instructions after installing and opening the extension.
@ -43,40 +72,6 @@ https://duckduckgo.com/?q=%s&ks=l&kav=1&kn=1&kp=-2&kak=-1&kax=-1&kaq=-1&kao=-1&k
Be sure to add shortcuts to be used in your navigation bar, e.g. `@ddg` refers to DuckDuckGo search engine and directly issues searches to DuckDuckGo from the navigation bar.
## Recommended settings
How to do it?
* Use the provided `user.js` file and copy it into your Firefox profile folder while application is _not_ running.
To find your profile folder, click on the menu top right, on `Help -> Troubleshooting Information`. You can directly open your **Profile Directory** from there or see it, typically it's something like `$HOME/.mozilla/firefox/...` or in Windows `%APPDATA%\Mozilla\Firefox\Profiles\...`
* Adjust values by browsing `about:config` in the address bar. `""` means empty, just delete the characters and press ENTER.
* Create your own profile and copy it into the application data folder while application is _not_ running. See [https://ffprofile.com](https://ffprofile.com).
Some settings _might_ break website behavior although this is not very likely. Be aware of that!
Use an external password manager like KeepassXC, at least AutoFill is advised to be disabled). See [https://www.privacy-handbuch.de/handbuch_21j2.htm#08_07_18](https://www.privacy-handbuch.de/handbuch_21j2.htm#08_07_18).
### Common User Preferences
Optional, but commonly used to ease browsing. Not security-related.
```
general.smoothScroll = false
general.smoothScroll.pages = false
mousewheel.min_line_scroll_amount = 40
browser.newtabpage.activity-stream.feeds.topsites = true
```
Optional and **potentially dangerous in terms of website behavior**, for _GNU/Linux only_.
```
image.mem.max_decoded_image_kb = 512000
media.getusermedia.aec_enabled = false
media.getusermedia.agc_enabled = false
media.getusermedia.noise_enabled = false
```
## Additional hints
Besides securing Firefox, you should consider not using the DNS servers of your Internet provider and instead install system-wide [DNS alternatives](https://www.kuketz-blog.de/empfehlungsecke/#dns) or a [local DNS server](https://wiki.archlinux.org/index.php/Unbound) which directly queries root DNS servers. There's really no downside of this.

0
firefox/CanvasBlocker-settings.json → firefox/extension_settings/CanvasBlocker-settings.json
View file

1
firefox/extension_settings/keepassxc-browser_settings.json Executable file
View file

@ -0,0 +1 @@
{"autoCompleteUsernames":true,"showGroupNameInAutocomplete":true,"autoFillAndSend":true,"autoFillSingleEntry":false,"autoReconnect":true,"autoRetrieveCredentials":true,"autoSubmit":false,"checkUpdateKeePassXC":0,"colorTheme":"system","clearCredentialsTimeout":10,"credentialSorting":"sortByUsername","defaultGroup":"","defaultGroupAlwaysAsk":false,"downloadFaviconAfterSave":false,"redirectAllowance":1,"saveDomainOnly":true,"showLoginFormIcon":true,"showLoginNotifications":false,"showNotifications":true,"showOTPIcon":true,"usePasswordGeneratorIcons":false,"useObserver":true,"usePredefinedSites":true,"sitePreferences":[],"saveDomainOnlyNewCreds":true}

13
firefox/ublock-config-1.txt → firefox/extension_settings/ublock.txt
View file

@ -1,11 +1,13 @@
{
"timeStamp": 1631363114897,
"version": "1.37.2",
"timeStamp": 1645230051113,
"version": "1.41.4",
"userSettings": {
"advancedUserEnabled": true,
"alwaysDetachLogger": false,
"dynamicFilteringEnabled": true,
"importedLists": [],
"externalLists": "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt",
"importedLists": [
"https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
],
"showIconBadge": false,
"tooltipsDisabled": true,
"webrtcIPAddressHidden": true
@ -28,7 +30,8 @@
"fanboy-thirdparty_social",
"fanboy-social",
"ublock-annoyances",
"DEU-0"
"DEU-0",
"https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt"
],
"hiddenSettings": {
"autoUpdatePeriod": 7,

50
firefox/user-overrides.js Executable file
View file

@ -0,0 +1,50 @@
/* See https://github.com/arkenfox/user.js/wiki/3.2-Overrides-%5BCommon%5D */
/* override recipe: RFP is not for me ***/
user_pref("privacy.resistFingerprinting", false); // 4501
user_pref("privacy.resistFingerprinting.letterboxing", false); // 4504 [pointless if not using RFP]
user_pref("webgl.disabled", false); // 4520 [mostly pointless if not using RFP]
/* override-recipe: desktop: alter new window max sizes **/
// user_pref("privacy.window.maxInnerWidth", "200s"); // 4502 [default 1600 in user.js v95]
// user_pref("privacy.window.maxInnerHeight", "100s"); // 4502 [default 900 in user.js v95]
/* Enable green icons again */
user_pref("security.secure_connection_icon_color_gray", false);
user_pref("security.insecure_connection_icon.enabled", true);
user_pref("security.insecure_connection_icon.pbmode.enabled", true);
user_pref("security.insecure_connection_text.enabled", true);
/* Keep history */
user_pref("privacy.clearOnShutdown.history", false); // [DEFAULT: true]
user_pref("places.history.enabled", true);
user_pref("privacy.cpd.history", false); // 2812 to match when you use Ctrl-Shift-Del
/* Disable logins */
user_pref("services.sync.engine.passwords", false);
/* Enable faster scroll */
user_pref("general.smoothScroll", false);
user_pref("general.smoothScroll.pages", false);
user_pref("mousewheel.min_line_scroll_amount", 40);
/* Do not warn about config */
user_pref("general.warnOnAboutConfig", false);
/* DNS over HTTPS
adjust the following to your liking
0 = use system DNS, 2 = use DNS-over-HTTPS resolver, select one in UI under network, otherwise you might end up with cloudflare
*/
user_pref("network.trr.mode", 0);
user_pref("network.trr.uri", "https://dns.myservermanager.com/dns-query");
user_pref("network.trr.resolvers", '[{ "name": "Cloudflare", "url": "https://mozilla.cloudflare-dns.com/dns-query" },{ "name": "NextDNS", "url": "https://trr.dns.nextdns.io/" },{ "name": "dnsforge.de", "url": "https://dnsforge.de/dns-query" },{ "name": "Digitale Gesellschaft (CH)", "url": "https://dns.digitale-gesellschaft.ch/dns-query" }, { "name": "Freifunk Muenchen", "url": "https://doh.ffmuc.net" }, { "name": "BlahDNS (DE)", "url": "https://doh-de.blahdns.com/dns-query" }, { "name": "BlahDNS (FI)", "url": "https://doh-fi.blahdns.com/dns-query" }, { "name": "Quad9", "url": "https://dns.quad9.net/dns-query" }, { "name": "dns.myservermanager.com", "url": "https://dns.myservermanager.com/dns-query" }]');
/* Disable some default extensions */
user_pref("extensions.pocket.enabled", false);
user_pref("extensions.screenshots.disabled", true);
user_pref("extensions.systemAddon.update.enabled", false);
/* Enable keyword search */
user_pref("keyword.enabled", true);
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.urlbar.suggest.searches", true);

227
firefox/user.js
View file

@ -1,227 +0,0 @@
// Mozilla User Preferences
//
// 2021/09/11
//
// Based on Privacy-Handbuch, merged/adjusted strong user.js
// Download: https://www.privacy-handbuch.de/handbuch_21u.htm
//
// Install when Firefox is closed!
// Feel free to comment in or modify if you don't like the default setting.
user_pref("app.normandy.enabled", false);
user_pref("app.shield.optoutstudies.enabled", false);
user_pref("beacon.enabled", false);
user_pref("browser.cache.disk.enable", false);
user_pref("browser.cache.disk_cache_ssl", false);
user_pref("browser.cache.offline.enable", false);
user_pref("browser.chrome.site_icons", false);
// ignore any website fonts
//user_pref("browser.display.use_document_fonts", 0);
// true to disallow playback of DRM content
user_pref("browser.eme.ui.enabled", false);
user_pref("browser.fixup.alternate.enabled", false);
user_pref("browser.formfill.enable", false);
user_pref("browser.link.open_newwindow.restriction", 0);
user_pref("browser.messaging-system.whatsNewPanel.enabled", false);
user_pref("browser.newtabpage.enabled", false);
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
user_pref("browser.newtabpage.activity-stream.feeds.topsites", false);
user_pref("browser.newtabpage.activity-stream.feeds.system.topsites", false);
user_pref("browser.newtabpage.activity-stream.showSponsored", false);
user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false);
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);
user_pref("browser.pagethumbnails.capturing_disabled", true);
user_pref("browser.ping-centre.telemetry", false);
user_pref("browser.region.update.enabled", false);
user_pref("browser.region.network.url", "");
user_pref("browser.safebrowsing.downloads.remote.url", " ");
user_pref("browser.safebrowsing.downloads.enabled", false);
user_pref("browser.safebrowsing.phishing.enabled", false);
user_pref("browser.safebrowsing.malware.enabled", false);
user_pref("browser.safebrowsing.downloads.remote.enabled", false);
user_pref("browser.safebrowsing.downloads.remote.block_dangerous", false);
user_pref("browser.safebrowsing.downloads.remote.block_dangerous_host", false);
user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false);
user_pref("browser.safebrowsing.blockedURIs.enabled", false);
user_pref("browser.safebrowsing.provider.google.gethashURL", "");
user_pref("browser.safebrowsing.provider.google.updateURL", "");
user_pref("browser.safebrowsing.provider.google4.gethashURL", "");
user_pref("browser.safebrowsing.provider.google4.updateURL", "");
user_pref("browser.safebrowsing.provider.mozilla.gethashURL", "");
user_pref("browser.safebrowsing.provider.mozilla.updateURL", "");
user_pref("browser.search.update", false);
user_pref("browser.search.suggest.enabled", false);
// avoid video buffering issues
user_pref("browser.sessionstore.interval", 300000);
// set to -1 for unlimited ctrl+shift+t
user_pref("browser.sessionstore.max_tabs_undo", 5);
user_pref("browser.sessionstore.max_windows_undo", 0);
user_pref("browser.sessionstore.privacy_level", 2);
// 0 = blank page, 1 = home pages, 2 = last visited, 3 = resume previous session
user_pref("browser.startup.page", 0);
user_pref("browser.startup.homepage_override.mstone", "ignore");
user_pref("browser.tabs.crashReporting.sendReport", false);
user_pref("browser.urlbar.speculativeConnect.enabled", false);
user_pref("browser.urlbar.trimURLs", false);
user_pref("browser.urlbar.suggest.openpage", false);
user_pref("browser.urlbar.suggest.searches", false);
user_pref("browser.urlbar.suggest.topsites", false);
user_pref("browser.topsites.contile.enabled", false);
user_pref("browser.urlbar.suggest.engines", false);
user_pref("browser.urlbar.groupLabels.enabled", false);
user_pref("datareporting.healthreport.uploadEnabled", false);
user_pref("datareporting.policy.dataSubmissionEnabled", false);
user_pref("dom.block_download_insecure", true);
user_pref("dom.enable_performance", false);
user_pref("dom.enable_performance_navigation_timing", false);
user_pref("dom.enable_resource_timing", false);
user_pref("dom.event.clipboardevents.enabled", true);
user_pref("dom.push.connection.enabled", false);
user_pref("dom.push.enabled", false);
user_pref("dom.push.serverURL", "");
user_pref("dom.security.https_only_mode", true);
user_pref("dom.security.https_only_mode_send_http_background_request", false);
user_pref("dom.vibrator.max_vibrate_ms", 0);
user_pref("dom.security.https_first", true);
user_pref("extensions.blocklist.enabled", false);
user_pref("extensions.formautofill.addresses.enabled", false);
user_pref("extensions.formautofill.creditCards.enabled", false);
user_pref("extensions.formautofill.heuristics.enabled", false);
user_pref("extensions.getAddons.cache.enabled", false);
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);
user_pref("extensions.ui.lastCategory", "addons://list/extension");
user_pref("extensions.pocket.enabled", false);
user_pref("extensions.screenshots.disabled", true);
user_pref("extensions.systemAddon.update.enabled", false);
user_pref("extensions.webextensions.restrictedDomains", "");
//user_pref("font.blacklist.underline_offset", "");
//user_pref("gfx.direct2d.disabled", true);
//user_pref("gfx.downloadable_fonts.enabled", false);
//user_pref("gfx.font_rendering.opentype_svg.enabled", false);
//user_pref("gfx.font_rendering.graphite.enabled", false);
//user_pref("javascript.options.baselinejit", false);
//user_pref("javascript.options.ion", false);
//user_pref("layers.acceleration.disabled", true);
//user_pref("layout.css.font-loading-api.enabled", false);
user_pref("media.autoplay.default", 5);
user_pref("media.autoplay.blocking_policy", 2);
user_pref("media.eme.enabled", false);
//user_pref("media.gmp-gmpopenh264.enabled", false);
//user_pref("media.gmp-gmpopenh264.autoupdate", false);
//user_pref("media.gmp-gmpopenh264.provider.enabled", false);
//user_pref("media.gmp-gmpopenh264.visible", false);
//user_pref("media.hardware-video-decoding.enabled", false);
user_pref("media.navigator.enabled", false);
user_pref("media.navigator.video.enabled", false);
user_pref("media.peerconnection.enabled", false);
user_pref("media.video_stats.enabled", false);
user_pref("media.webspeech.synth.enabled", false);
// 5 = isolate
user_pref("network.cookie.cookieBehavior", 4);
user_pref("network.dns.disablePrefetch", true);
user_pref("network.captive-portal-service.enabled", false);
user_pref("network.connectivity-service.enabled", false);
// set policy to 3 lifetime.days to kick in, see http://kb.mozillazine.org/Network.cookie.lifetimePolicy
user_pref("network.cookie.lifetimePolicy", 2);
//user_pref("network.cookie.lifetime.days", 5)
user_pref("network.http.altsvc.enabled", false);
user_pref("network.http.altsvc.oe", false);
user_pref("network.http.referer.XOriginPolicy", 2);
user_pref("network.http.speculative-parallel-limit", 0);
user_pref("network.IDN_show_punycode", true);
user_pref("network.manage-offline-status", false);
// allow local storage, so websites won't break
user_pref("offline-apps.allow_by_default", true);
//user_pref("offline-apps.quota.warn", 0);
user_pref("pdfjs.disabled", true);
user_pref("pdfjs.enableScripting", false);
user_pref("permissions.default.desktop-notification", 2);
user_pref("permissions.isolateBy.userContext", true);
user_pref("places.history.enabled", true);
user_pref("plugin.default.state", 0);
user_pref("plugins.update.url", "");
user_pref("privacy.clearOnShutdown.cache", true);
// allow to set exceptions
user_pref("privacy.clearOnShutdown.cookies", false);
user_pref("privacy.clearOnShutdown.downloads", true);
// keep history
user_pref("privacy.clearOnShutdown.history", false);
user_pref("privacy.clearOnShutdown.offlineApps", true);
// allow to set exceptions
user_pref("privacy.clearOnShutdown.siteSettings", false);
user_pref("privacy.cpd.offlineApps", true);
user_pref("privacy.cpd.passwords", true);
user_pref("privacy.cpd.siteSettings", true);
user_pref("privacy.donottrackheader.enabled", false);
user_pref("privacy.firstparty.isolate", false);
user_pref("privacy.history.custom", true);
user_pref("privacy.sanitize.sanitizeOnShutdown", true);
user_pref("privacy.userContext.enabled", true);
user_pref("privacy.userContext.ui.enabled", true);
// avoid potential date bugs
user_pref("privacy.resistFingerprinting", false);
user_pref("reader.parse-on-load.enabled", false);
user_pref("security.cert_pinning.enforcement_level", 2);
user_pref("security.certerrors.mitm.auto_enable_enterprise_roots", false);
user_pref("security.family_safety.mode", 0);
user_pref("security.identityblock.show_extended_validation", true);
user_pref("security.insecure_connection_icon.enabled", true);
user_pref("security.insecure_connection_icon.pbmode.enabled", true);
user_pref("security.insecure_connection_text.enabled", true);
user_pref("security.insecure_connection_text.pbmode.enabled", true);
user_pref("security.mixed_content.upgrade_display_content", true);
user_pref("security.ssl.require_safe_negotiation", true);
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
user_pref("signon.autofillForms", false);
user_pref("signon.formlessCapture.enabled", false);
user_pref("signon.rememberSignons", false);
user_pref("svg.disabled", false);
user_pref("toolkit.coverage.endpoint.base", "");
user_pref("toolkit.coverage.opt-out", true);
user_pref("toolkit.telemetry.archive.enabled", false);
user_pref("toolkit.telemetry.coverage.opt-out", true);
user_pref("toolkit.telemetry.firstShutdownPing.enabled", false);
user_pref("toolkit.telemetry.hybridContent.enabled", false);
user_pref("toolkit.telemetry.bhrPing.enabled", false);
user_pref("toolkit.telemetry.newProfilePing.enabled", false);
user_pref("toolkit.telemetry.shutdownPingSender.enabled", false);
user_pref("toolkit.telemetry.updatePing.enabled", false);
user_pref("toolkit.telemetry.unified", false);
user_pref("ui.use_standins_for_native_colors", true);
user_pref("ui.systemUsesDarkTheme", 0);
user_pref("webgl.disabled", true);
user_pref("webgl.disable-fail-if-major-performance-caveat", true);
user_pref("webgl.enable-webgl2", false);
user_pref("webgl.min_capability_mode", true);
user_pref("webgl.enable-debug-renderer-info", false);
user_pref("network.trr.resolvers", '[{ "name": "Cloudflare", "url": "https://mozilla.cloudflare-dns.com/dns-query" },{ "name": "NextDNS", "url": "https://trr.dns.nextdns.io/" },{ "name": "dnsforge.de", "url": "https://dnsforge.de/dns-query" },{ "name": "Digitale Gesellschaft (CH)", "url": "https://dns.digitale-gesellschaft.ch/dns-query" }, { "name": "Freifunk Muenchen", "url": "https://doh.ffmuc.net" }, { "name": "BlahDNS (DE)", "url": "https://doh-de.blahdns.com/dns-query" }, { "name": "BlahDNS (FI)", "url": "https://doh-fi.blahdns.com/dns-query" }, { "name": "Quad9", "url": "https://dns.quad9.net/dns-query" }, { "name": "dns.myservermanager.com", "url": "https://dns.myservermanager.com/dns-query" }]');
// Enable green icons again
user_pref("security.secure_connection_icon_color_gray", false);
// Temporarily enabled (for now) as there are no hardware devices on desktop PCs to leak any information
user_pref("dom.webnotifications.enabled", true);
user_pref("dom.gamepad.enabled", true);
user_pref("device.sensors.enabled", true);
// adjust the following to your liking
// 0 = use system DNS, 2 = use DNS-over-HTTPS resolver, select one in UI under network, otherwise you might end up with cloudflare
user_pref("network.trr.mode", 0);
user_pref("network.trr.uri", "https://dns.myservermanager.com/dns-query");
// customly set, adjust to your liking
user_pref("general.warnOnAboutConfig", false);
user_pref("general.smoothScroll", false);
user_pref("general.smoothScroll.pages", false);
user_pref("mousewheel.min_line_scroll_amount", 40);
user_pref("media.cache_readahead_limit", 999999);
user_pref("media.cache_resume_threshold", 999999);
// Linux specific
user_pref("widget.disable-workspace-management", true);