user.js 110 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770
  1. /******
  2. * name: ghacks user.js
  3. * date: 26 June 2019
  4. * version 68-alpha: Knock on Pants
  5. * "It's like thunder, lightning... the way you wear me is frightening"
  6. * authors: v52+ github | v51- www.ghacks.net
  7. * url: https://github.com/ghacksuserjs/ghacks-user.js
  8. * license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
  9. * releases: These are end-of-stable-life-cycle legacy archives.
  10. *Always* use the master branch user.js for a current up-to-date version.
  11. url: https://github.com/ghacksuserjs/ghacks-user.js/releases
  12. * README:
  13. 0. Consider using Tor Browser if it meets your needs or fits your threat model better
  14. * https://www.torproject.org/about/torusers.html.en
  15. 1. READ the full README
  16. * https://github.com/ghacksuserjs/ghacks-user.js/blob/master/README.md
  17. 2. READ this
  18. * https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.3-Implementation
  19. 3. If you skipped steps 1 and 2 above (shame on you), then here is the absolute minimum
  20. * Real time binary checks with Google services are disabled (0402)
  21. * You will still get prompts to update Firefox, but auto-installing them is disabled (0302a)
  22. * Some user data is erased on close (section 2800). Change this to suit your needs
  23. * EACH RELEASE check:
  24. - 4600s: reset prefs made redundant due to privacy.resistFingerprinting (RPF)
  25. or enable them as an alternative to RFP or for ESR users
  26. - 9999s: reset deprecated prefs in about:config or enable relevant section(s) for ESR
  27. * Site breakage WILL happen
  28. - There are often trade-offs and conflicts between Security vs Privacy vs Anti-Fingerprinting
  29. and these need to be balanced against Functionality & Convenience & Breakage
  30. * You will need to make changes, and to troubleshoot at times (choose wisely, there is always a trade-off).
  31. While not 100% definitive, search for "[SETUP". If required, add each pref to your overrides section at
  32. default values (or comment them out and reset them in about:config). Here are the main ones:
  33. [SETUP-SECURITY] it's one item, read it
  34. [SETUP-WEB] can cause some websites to break
  35. [SETUP-CHROME] changes how Firefox itself behaves (i.e. NOT directly website related)
  36. [SETUP-PERF] may impact performance
  37. [SETUP-HARDEN] maybe you should consider using the Tor Browser
  38. * [WARNING] tags are extra special and used sparingly, so heed them
  39. 4. BACKUP your profile folder before implementing (and/or test in a new/cloned profile)
  40. 5. KEEP UP TO DATE: https://github.com/ghacksuserjs/ghacks-user.js/wiki#small_orange_diamond-maintenance
  41. * INDEX:
  42. 0100: STARTUP
  43. 0200: GEOLOCATION
  44. 0300: QUIET FOX
  45. 0400: BLOCKLISTS / SAFE BROWSING
  46. 0500: SYSTEM ADD-ONS / EXPERIMENTS
  47. 0600: BLOCK IMPLICIT OUTBOUND
  48. 0700: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc
  49. 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS
  50. 0900: PASSWORDS
  51. 1000: CACHE / SESSION (RE)STORE / FAVICONS
  52. 1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS)
  53. 1400: FONTS
  54. 1600: HEADERS / REFERERS
  55. 1700: CONTAINERS
  56. 1800: PLUGINS
  57. 2000: MEDIA / CAMERA / MIC
  58. 2200: WINDOW MEDDLING & LEAKS / POPUPS
  59. 2300: WEB WORKERS
  60. 2400: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT
  61. 2500: HARDWARE FINGERPRINTING
  62. 2600: MISCELLANEOUS
  63. 2700: PERSISTENT STORAGE
  64. 2800: SHUTDOWN
  65. 4000: FPI (FIRST PARTY ISOLATION)
  66. 4500: RFP (RESIST FINGERPRINTING)
  67. 4600: RFP ALTERNATIVES
  68. 4700: RFP ALTERNATIVES (NAVIGATOR / USER AGENT (UA) SPOOFING)
  69. 5000: PERSONAL
  70. 9999: DEPRECATED / REMOVED / LEGACY / RENAMED
  71. ******/
  72. /* START: internal custom pref to test for syntax errors
  73. * [NOTE] In FF60+, not all syntax errors cause parsing to abort i.e. reaching the last debug
  74. * pref no longer necessarily means that all prefs have been applied. Check the console right
  75. * after startup for any warnings/error messages related to non-applied prefs
  76. * [1] https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/
  77. user_pref("_user.js.parrot", "START: Oh yes, the Norwegian Blue... what's wrong with it?");
  78. /*** [SECTION 0100]: STARTUP ***/
  79. user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!");
  80. /* 0101: disable default browser check
  81. * [SETTING] General>Startup>Always check if Firefox is your default browser ***/
  82. user_pref("browser.shell.checkDefaultBrowser", false);
  83. /* 0102: set START page (0=blank, 1=home, 2=last visited page, 3=resume previous session)
  84. * [NOTE] Session Restore is not used in PB mode (0110) and is cleared with history (2803, 2804)
  85. * [SETTING] General>Startup>Restore previous session ***/
  86. user_pref("browser.startup.page", 0);
  87. /* 0103: set HOME+NEWWINDOW page
  88. * about:home=Activity Stream (default, see 0105), custom URL, about:blank
  89. * [SETTING] Home>New Windows and Tabs>Homepage and new windows ***/
  90. user_pref("browser.startup.homepage", "about:blank");
  91. /* 0104: set NEWTAB page
  92. * true=Activity Stream (default, see 0105), false=blank page
  93. * [SETTING] Home>New Windows and Tabs>New tabs ***/
  94. user_pref("browser.newtabpage.enabled", false);
  95. user_pref("browser.newtab.preload", false);
  96. /* 0105: disable Activity Stream stuff (AS)
  97. * AS is the default homepage/newtab in FF57+, based on metadata and browsing behavior.
  98. * **NOT LISTING ALL OF THESE: USE THE PREFERENCES UI**
  99. * [SETTING] Home>Firefox Home Content>... to show/hide what you want ***/
  100. /* 0105a: disable Activity Stream telemetry ***/
  101. user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
  102. user_pref("browser.newtabpage.activity-stream.telemetry", false);
  103. user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "");
  104. /* 0105b: disable Activity Stream Snippets
  105. * Runs code received from a server (aka Remote Code Execution) and sends information back to a metrics server
  106. * [1] https://abouthome-snippets-service.readthedocs.io/ ***/
  107. user_pref("browser.aboutHomeSnippets.updateUrl", "");
  108. user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "");
  109. user_pref("browser.newtabpage.activity-stream.disableSnippets", true);
  110. user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
  111. /* 0105c: disable Activity Stream Top Stories, Pocket-based and/or sponsored content ***/
  112. user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
  113. user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
  114. user_pref("browser.newtabpage.activity-stream.showSponsored", false);
  115. user_pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false); // [FF66+]
  116. /* 0105d: disable Activity Stream recent Highlights in the Library [FF57+] ***/
  117. // user_pref("browser.library.activity-stream.enabled", false);
  118. /* 0110: start Firefox in PB (Private Browsing) mode
  119. * [NOTE] In this mode *all* windows are "private windows" and the PB mode icon is not displayed
  120. * [WARNING] The P in PB mode is misleading: it means no "persistent" disk storage such as history,
  121. * caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode).
  122. * In fact, PB mode limits or removes the ability to control some of these, and you need to quit
  123. * Firefox to clear them. PB is best used as a one off window (File>New Private Window) to provide
  124. * a temporary self-contained new session. Close all Private Windows to clear the PB mode session.
  125. * [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode
  126. * [1] https://wiki.mozilla.org/Private_Browsing
  127. * [2] https://spreadprivacy.com/is-private-browsing-really-private/ ***/
  128. // user_pref("browser.privatebrowsing.autostart", true);
  129. /*** [SECTION 0200]: GEOLOCATION ***/
  130. user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!");
  131. /* 0201: disable Location-Aware Browsing
  132. * [1] https://www.mozilla.org/firefox/geolocation/ ***/
  133. // user_pref("geo.enabled", false);
  134. /* 0201b: set a default permission for Location [FF58+]
  135. * 0=always ask (default), 1=allow, 2=block
  136. * [NOTE] Best left at default "always ask", fingerprintable via Permissions API
  137. * [SETTING] to add site exceptions: Page Info>Permissions>Access Your Location
  138. * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Location>Settings ***/
  139. // user_pref("permissions.default.geo", 2);
  140. /* 0202: disable GeoIP-based search results
  141. * [NOTE] May not be hidden if Firefox has changed your settings due to your locale
  142. * [1] https://trac.torproject.org/projects/tor/ticket/16254
  143. * [2] https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine ***/
  144. user_pref("browser.search.region", "US"); // [HIDDEN PREF]
  145. user_pref("browser.search.geoip.url", "");
  146. /* 0205: set Firefox language [FF59+] [RESTART]
  147. * Go to the end of about:support to view Internationalization & Localization settings
  148. * If set to empty, the OS locales are used. If not set at all, default locale is used
  149. * This is the language used in menus, about pages, messages, and notifications from Firefox ***/
  150. // user_pref("intl.locale.requested", "en-US"); // [HIDDEN PREF]
  151. /* 0206: disable geographically specific results/search engines e.g. "browser.search.*.US"
  152. * i.e. ignore all of Mozilla's various search engines in multiple locales ***/
  153. user_pref("browser.search.geoSpecificDefaults", false);
  154. user_pref("browser.search.geoSpecificDefaults.url", "");
  155. /* 0207: set preferred language for diplaying web pages
  156. * [TEST] https://addons.mozilla.org/about ***/
  157. user_pref("intl.accept_languages", "en-US, en");
  158. /* 0208: enforce US English locale regardless of the system locale
  159. * [1] https://bugzilla.mozilla.org/867501 ***/
  160. user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF]
  161. /* 0209: use APP locale over OS locale in regional preferences [FF56+]
  162. * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1379420,1364789 ***/
  163. user_pref("intl.regional_prefs.use_os_locales", false);
  164. /* 0210: use Mozilla geolocation service instead of Google when geolocation is enabled
  165. * Optionally enable logging to the console (defaults to false) ***/
  166. user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");
  167. // user_pref("geo.wifi.logging.enabled", true); // [HIDDEN PREF]
  168. /* 0211: disable using the OS's geolocation service ***/
  169. user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
  170. user_pref("geo.provider.use_corelocation", false); // [MAC]
  171. user_pref("geo.provider.use_gpsd", false); // [LINUX]
  172. /*** [SECTION 0300]: QUIET FOX
  173. Starting in user.js v67, we only disable the auto-INSTALL of Firefox. You still get prompts
  174. to update, in one click. We have NEVER disabled auto-CHECKING, and highly discourage that.
  175. Previously we also disabled auto-INSTALLING of extensions (302b).
  176. There are many legitimate reasons to turn off auto-INSTALLS, including hijacked or monetized
  177. extensions, time constraints, legacy issues, dev/testing, and fear of breakage/bugs. It is
  178. still important to do updates for security reasons, please do so manually if you make changes.
  179. ***/
  180. user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!");
  181. /* 0301b: disable auto-CHECKING for extension and theme updates ***/
  182. // user_pref("extensions.update.enabled", false);
  183. /* 0302a: disable auto-INSTALLING Firefox updates [NON-WINDOWS FF65+]
  184. * [NOTE] In FF65+ on Windows this SETTING (below) is now stored in a file and the pref was removed
  185. * [SETTING] General>Firefox Updates>Check for updates but let you choose... ***/
  186. user_pref("app.update.auto", false);
  187. /* 0302b: disable auto-INSTALLING extension and theme updates (after the check in 0301b)
  188. * [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/
  189. // user_pref("extensions.update.autoUpdateDefault", false);
  190. /* 0306: disable extension metadata
  191. * used when installing/updating an extension, and in daily background update checks: if false, it
  192. * hides the expanded text description (if it exists) when you "show more details about an addon" ***/
  193. // user_pref("extensions.getAddons.cache.enabled", false);
  194. /* 0307: disable auto updating of lightweight themes (LWT)
  195. * Not to be confused with themes in 0301* + 0302*, which use the FF55+ Theme API
  196. * Mozilla plan to convert existing LWTs and remove LWT support in the future, see [1]
  197. * [1] https://blog.mozilla.org/addons/2018/09/20/future-themes-here/ ***/
  198. user_pref("lightweightThemes.update.enabled", false);
  199. /* 0308: disable search update
  200. * [SETTING] General>Firefox Updates>Automatically update search engines ***/
  201. user_pref("browser.search.update", false);
  202. /* 0309: disable sending Flash crash reports ***/
  203. user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
  204. /* 0310: disable sending the URL of the website where a plugin crashed ***/
  205. user_pref("dom.ipc.plugins.reportCrashURL", false);
  206. /* 0320: disable about:addons' Recommendations pane (uses Google Analytics) ***/
  207. user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
  208. user_pref("extensions.webservice.discoverURL", "");
  209. /* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/
  210. user_pref("extensions.getAddons.discovery.api_url", "");
  211. user_pref("extensions.htmlaboutaddons.discover.enabled", false);
  212. /* 0330: disable telemetry
  213. * the pref (.unified) affects the behaviour of the pref (.enabled)
  214. * IF unified=false then .enabled controls the telemetry module
  215. * IF unified=true then .enabled ONLY controls whether to record extended data
  216. * so make sure to have both set as false
  217. * [NOTE] FF58+ `toolkit.telemetry.enabled` is now LOCKED to reflect prerelease
  218. * or release builds (true and false respectively), see [2]
  219. * [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html
  220. * [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/
  221. user_pref("toolkit.telemetry.unified", false);
  222. user_pref("toolkit.telemetry.enabled", false); // see [NOTE] above FF58+
  223. user_pref("toolkit.telemetry.server", "data:,");
  224. user_pref("toolkit.telemetry.archive.enabled", false);
  225. user_pref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+]
  226. user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+]
  227. user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+]
  228. user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter
  229. user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+]
  230. user_pref("toolkit.telemetry.hybridContent.enabled", false); // [FF59+]
  231. /* 0331: disable Telemetry Coverage
  232. * [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/
  233. user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF]
  234. user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF]
  235. user_pref("toolkit.coverage.endpoint.base", "");
  236. /* 0340: disable Health Reports
  237. * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send technical... data ***/
  238. user_pref("datareporting.healthreport.uploadEnabled", false);
  239. /* 0341: disable new data submission, master kill switch [FF41+]
  240. * If disabled, no policy is shown or upload takes place, ever
  241. * [1] https://bugzilla.mozilla.org/1195552 ***/
  242. user_pref("datareporting.policy.dataSubmissionEnabled", false);
  243. /* 0342: disable Studies (see 0503)
  244. * [NOTE] This pref has no effect when Health Reports (0340) are disabled
  245. * [SETTING] Privacy & Security>Firefox Data Collection & Use>...>Allow Firefox to install and run studies ***/
  246. user_pref("app.shield.optoutstudies.enabled", false);
  247. /* 0343: disable personalized Extension Recommendations in about:addons and AMO [FF65+]
  248. * [NOTE] This pref has no effect when Health Reports (0340) are disabled
  249. * [SETTING] Privacy & Security>Firefox Data Collection & Use>...>Allow Firefox to make personalized extension rec.
  250. * [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/
  251. user_pref("browser.discovery.enabled", false);
  252. /* 0350: disable Crash Reports ***/
  253. user_pref("breakpad.reportURL", "");
  254. user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+]
  255. user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+]
  256. /* 0351: disable backlogged Crash Reports
  257. * [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send backlogged crash reports ***/
  258. user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+]
  259. /* 0370: disable Pocket [FF46+]
  260. * Pocket is a third party (now owned by Mozilla) "save for later" cloud service
  261. * [1] https://en.wikipedia.org/wiki/Pocket_(application)
  262. * [2] https://www.gnu.gl/blog/Posts/multiple-vulnerabilities-in-pocket/ ***/
  263. user_pref("extensions.pocket.enabled", false);
  264. /* 0390: disable Captive Portal detection
  265. * [1] https://en.wikipedia.org/wiki/Captive_portal
  266. * [2] https://wiki.mozilla.org/Necko/CaptivePortal
  267. * [3] https://trac.torproject.org/projects/tor/ticket/21790 ***/
  268. user_pref("captivedetect.canonicalURL", "");
  269. user_pref("network.captive-portal-service.enabled", false); // [FF52+]
  270. /* 0391: disable Network Connectivity checks [FF65+]
  271. * [1] https://bugzilla.mozilla.org/1460537 ***/
  272. user_pref("network.connectivity-service.enabled", false);
  273. /*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING (SB)
  274. Safe Browsing has taken many steps to preserve privacy. *IF* required, a full url is never
  275. sent to Google, only a PART-hash of the prefix, and this is hidden with noise of other real
  276. PART-hashes. Google also swear it is anonymized and only used to flag malicious sites.
  277. Firefox also takes measures such as striping out identifying parameters and since SBv4 (FF57+)
  278. doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity)
  279. #Required reading [#] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/
  280. [1] https://wiki.mozilla.org/Security/Safe_Browsing
  281. ***/
  282. user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!");
  283. /* 0401: enforce Firefox blocklist, but sanitize blocklist url
  284. * [NOTE] It includes updates for "revoked certificates"
  285. * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
  286. * [2] https://trac.torproject.org/projects/tor/ticket/16931 ***/
  287. user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true]
  288. user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/");
  289. /* 0402: disable binaries NOT in Safe Browsing local lists being checked
  290. * This is a real-time check with Google services
  291. * [SETUP-SECURITY] If you do not understand this, or if you want this protection, then override it ***/
  292. user_pref("browser.safebrowsing.downloads.remote.enabled", false);
  293. /* 0403: disable 'ignore this warning' on Safe Browsing warnings
  294. * If clicked, it bypasses the block for that session. This is a means for admins to enforce SB
  295. * [TEST] see github wiki APPENDIX A: Test Sites: Section 5
  296. * [1] https://bugzilla.mozilla.org/1226490 ***/
  297. // user_pref("browser.safebrowsing.allowOverride", false);
  298. /*** [SECTION 0500]: SYSTEM ADD-ONS / EXPERIMENTS
  299. System Add-ons are a method for shipping extensions, considered to be
  300. built-in features to Firefox, that are hidden from the about:addons UI.
  301. To view your System Add-ons go to about:support, they are listed under "Firefox Features"
  302. Some System Add-ons have no on-off prefs. Instead you can manually remove them. Note that app
  303. updates will restore them. They may also be updated and possibly restored automatically (see 0505)
  304. * Portable: "...\App\Firefox64\browser\features\" (or "App\Firefox\etc" for 32bit)
  305. * Windows: "...\Program Files\Mozilla\browser\features" (or "Program Files (X86)\etc" for 32bit)
  306. * Mac: "...\Applications\Firefox\Contents\Resources\browser\features\"
  307. [NOTE] On Mac you can right-click on the application and select "Show Package Contents"
  308. * Linux: "/usr/lib/firefox/browser/features" (or similar)
  309. [1] https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html
  310. [2] https://dxr.mozilla.org/mozilla-central/source/browser/extensions
  311. ***/
  312. user_pref("_user.js.parrot", "0500 syntax error: the parrot's cashed in 'is chips!");
  313. /* 0503: disable Normandy/Shield [FF60+]
  314. * Shield is an telemetry system (including Heartbeat) that can also push and test "recipes"
  315. * [1] https://wiki.mozilla.org/Firefox/Shield
  316. * [2] https://github.com/mozilla/normandy ***/
  317. user_pref("app.normandy.enabled", false);
  318. user_pref("app.normandy.api_url", "");
  319. /* 0505: disable System Add-on updates ***/
  320. user_pref("extensions.systemAddon.update.enabled", false); // [FF62+]
  321. user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
  322. /* 0506: disable PingCentre telemetry (used in several System Add-ons) [FF57+]
  323. * Currently blocked by 'datareporting.healthreport.uploadEnabled' (see 0340) ***/
  324. user_pref("browser.ping-centre.telemetry", false);
  325. /* 0515: disable Screenshots
  326. * alternatively in FF60+, disable uploading to the Screenshots server
  327. * [1] https://github.com/mozilla-services/screenshots
  328. * [2] https://www.ghacks.net/2017/05/28/firefox-screenshots-integrated-in-firefox-nightly/ ***/
  329. // user_pref("extensions.screenshots.disabled", true); // [FF55+]
  330. // user_pref("extensions.screenshots.upload-disabled", true); // [FF60+]
  331. /* 0517: disable Form Autofill
  332. * [NOTE] Stored data is NOT secure (uses a JSON file)
  333. * [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes
  334. * [SETTING] Privacy & Security>Forms & Passwords>Autofill addresses
  335. * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill
  336. * [2] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/ ***/
  337. user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+]
  338. user_pref("extensions.formautofill.available", "off"); // [FF56+]
  339. user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+]
  340. user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+]
  341. /* 0518: disable Web Compatibility Reporter [FF56+]
  342. * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla ***/
  343. user_pref("extensions.webcompat-reporter.enabled", false);
  344. /*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/
  345. user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!");
  346. /* 0601: disable link prefetching
  347. * [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
  348. user_pref("network.prefetch-next", false);
  349. /* 0602: disable DNS prefetching
  350. * [1] https://www.ghacks.net/2013/04/27/firefox-prefetching-what-you-need-to-know/
  351. * [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
  352. user_pref("network.dns.disablePrefetch", true);
  353. user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF]
  354. /* 0603: disable predictor / prefetching ***/
  355. user_pref("network.predictor.enabled", false);
  356. user_pref("network.predictor.enable-prefetch", false); // [FF48+]
  357. /* 0605: disable link-mouseover opening connection to linked server
  358. * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests
  359. * [2] https://www.ghacks.net/2015/08/16/block-firefox-from-connecting-to-sites-when-you-hover-over-links/ ***/
  360. user_pref("network.http.speculative-parallel-limit", 0);
  361. /* 0606: disable pings (but enforce same host in case)
  362. * [1] http://kb.mozillazine.org/Browser.send_pings
  363. * [2] http://kb.mozillazine.org/Browser.send_pings.require_same_host ***/
  364. user_pref("browser.send_pings", false); // [DEFAULT: false]
  365. user_pref("browser.send_pings.require_same_host", true);
  366. /*** [SECTION 0700]: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc ***/
  367. user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!");
  368. /* 0701: disable IPv6
  369. * IPv6 can be abused, especially regarding MAC addresses. They also do not play nice
  370. * with VPNs. That's even assuming your ISP and/or router and/or website can handle it.
  371. * Firefox telemetry (April 2019) shows only 5% of all connections are IPv6.
  372. * [NOTE] This is just an application level fallback. Disabling IPv6 is best done at an
  373. * OS/network level, and/or configured properly in VPN setups. If you are not masking your IP,
  374. * then this won't make much difference. If you are maksing your IP, then it can only help.
  375. * [TEST] http://ipv6leak.com/
  376. * [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/437#issuecomment-403740626
  377. * [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/
  378. user_pref("network.dns.disableIPv6", true);
  379. /* 0702: disable HTTP2
  380. * HTTP2 raises concerns with "multiplexing" and "server push", does nothing to
  381. * enhance privacy, and opens up a number of server-side fingerprinting opportunities.
  382. * [WARNING] Disabling this made sense in the past, and doesn't break anything, but HTTP2 is
  383. * at 35% (April 2019) and growing [5]. Don't be that one person using HTTP1.1 on HTTP2 sites
  384. * [1] https://http2.github.io/faq/
  385. * [2] https://blog.scottlogic.com/2014/11/07/http-2-a-quick-look.html
  386. * [3] https://http2.github.io/http2-spec/#rfc.section.10.8
  387. * [4] https://queue.acm.org/detail.cfm?id=2716278
  388. * [5] https://w3techs.com/technologies/details/ce-http2/all/all ***/
  389. // user_pref("network.http.spdy.enabled", false);
  390. // user_pref("network.http.spdy.enabled.deps", false);
  391. // user_pref("network.http.spdy.enabled.http2", false);
  392. // user_pref("network.http.spdy.websockets", false); // [FF65+]
  393. /* 0703: disable HTTP Alternative Services [FF37+]
  394. * [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the
  395. * consequences. FPI isolates these, but it was designed with the Tor protocol in mind,
  396. * and the Tor Browser has extra protection, including enhanced sanitizing per Identity.
  397. * [1] https://tools.ietf.org/html/rfc7838#section-9
  398. * [2] https://www.mnot.net/blog/2016/03/09/alt-svc ***/
  399. user_pref("network.http.altsvc.enabled", false);
  400. user_pref("network.http.altsvc.oe", false);
  401. /* 0704: enforce the proxy server to do any DNS lookups when using SOCKS
  402. * e.g. in Tor, this stops your local DNS server from knowing your Tor destination
  403. * as a remote Tor node will handle the DNS request
  404. * [1] http://kb.mozillazine.org/Network.proxy.socks_remote_dns
  405. * [2] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
  406. user_pref("network.proxy.socks_remote_dns", true);
  407. /* 0707: disable (or setup) DNS-over-HTTPS (DoH) [FF60+]
  408. * TRR = Trusted Recursive Resolver
  409. * .mode: 0=off, 1=race, 2=TRR first, 3=TRR only, 4=race for stats but always use native result
  410. * [WARNING] DoH bypasses hosts and gives info to yet another party (e.g. Cloudflare)
  411. * [1] https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/
  412. * [2] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ ***/
  413. // user_pref("network.trr.mode", 0);
  414. // user_pref("network.trr.bootstrapAddress", "");
  415. // user_pref("network.trr.uri", "");
  416. /* 0708: disable FTP [FF60+]
  417. * [1] https://www.ghacks.net/2018/02/20/firefox-60-with-new-preference-to-disable-ftp/ ***/
  418. // user_pref("network.ftp.enabled", false);
  419. /* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+]
  420. * [SETUP-CHROME] Can break extensions for profiles on network shares
  421. * [1] https://trac.torproject.org/projects/tor/ticket/26424 ***/
  422. user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF]
  423. /* 0710: disable GIO as a potential proxy bypass vector
  424. * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda,
  425. * gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64)
  426. * [1] https://bugzilla.mozilla.org/1433507
  427. * [2] https://trac.torproject.org/23044
  428. * [3] https://en.wikipedia.org/wiki/GVfs
  429. * [4] https://en.wikipedia.org/wiki/GIO_(software) ***/
  430. user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF]
  431. /*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS
  432. Change items 0850 and above to suit for privacy vs convenience and functionality. Consider
  433. your environment (no unwanted eyeballs), your device (restricted access), your device's
  434. unattended state (locked, encrypted, forensic hardened). Likewise, you may want to check
  435. the items cleared on shutdown in section 2800.
  436. [NOTE] The urlbar is also commonly referred to as the location bar and address bar
  437. #Required reading [#] https://xkcd.com/538/
  438. ***/
  439. user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!");
  440. /* 0801: disable location bar using search
  441. * Don't leak URL typos to a search engine, give an error message instead.
  442. * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com"
  443. * [NOTE] Search buttons in the dropdown work, but hitting 'enter' in the location bar will fail
  444. * [TIP] You can add keywords to search engines in options (e.g. 'd' for DuckDuckGo) and
  445. * the dropdown will now auto-select it and you can then hit 'enter' and it will work
  446. * [SETUP-CHROME] If you don't, or rarely, type URLs, or you use a default search
  447. * engine that respects privacy, then you probably don't need this ***/
  448. user_pref("keyword.enabled", false);
  449. /* 0802: disable location bar domain guessing
  450. * domain guessing intercepts DNS "hostname not found errors" and resends a
  451. * request (e.g. by adding www or .com). This is inconsistent use (e.g. FQDNs), does not work
  452. * via Proxy Servers (different error), is a flawed use of DNS (TLDs: why treat .com
  453. * as the 411 for DNS errors?), privacy issues (why connect to sites you didn't
  454. * intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack),
  455. * and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/
  456. user_pref("browser.fixup.alternate.enabled", false);
  457. /* 0803: display all parts of the url in the location bar ***/
  458. user_pref("browser.urlbar.trimURLs", false);
  459. /* 0804: limit history leaks via enumeration (PER TAB: back/forward)
  460. * This is a PER TAB session history. You still have a full history stored under all history
  461. * default=50, minimum=1=currentpage, 2 is the recommended minimum as some pages
  462. * use it as a means of referral (e.g. hotlinking), 4 or 6 or 10 may be more practical ***/
  463. user_pref("browser.sessionhistory.max_entries", 10);
  464. /* 0805: disable CSS querying page history - CSS history leak
  465. * [NOTE] This has NEVER been fully "resolved": in Mozilla/docs it is stated it's
  466. * only in 'certain circumstances', also see latest comments in [2]
  467. * [TEST] http://lcamtuf.coredump.cx/yahh/ (see github wiki APPENDIX A on how to use)
  468. * [1] https://dbaron.org/mozilla/visited-privacy
  469. * [2] https://bugzilla.mozilla.org/147777
  470. * [3] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector ***/
  471. user_pref("layout.css.visited_links_enabled", false);
  472. /* 0807: disable live search suggestions
  473. /* [NOTE] Both must be true for the location bar to work
  474. * [SETUP-CHROME] Change these if you trust and use a privacy respecting search engine
  475. * [SETTING] Search>Provide search suggestions | Show search suggestions in address bar results ***/
  476. user_pref("browser.search.suggest.enabled", false);
  477. user_pref("browser.urlbar.suggest.searches", false);
  478. /* 0809: disable location bar suggesting "preloaded" top websites [FF54+]
  479. * [1] https://bugzilla.mozilla.org/1211726 ***/
  480. user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
  481. /* 0810: disable location bar making speculative connections [FF56+]
  482. * [1] https://bugzilla.mozilla.org/1348275 ***/
  483. user_pref("browser.urlbar.speculativeConnect.enabled", false);
  484. /* 0850a: disable location bar suggestion types
  485. * If all three suggestion types are false, search engine keywords are disabled
  486. * [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest ***/
  487. // user_pref("browser.urlbar.suggest.history", false);
  488. // user_pref("browser.urlbar.suggest.bookmark", false);
  489. // user_pref("browser.urlbar.suggest.openpage", false);
  490. /* 0850c: disable location bar dropdown
  491. * This value controls the total number of entries to appear in the location bar dropdown
  492. * [NOTE] Items (bookmarks/history/openpages) with a high "frecency"/"bonus" will always
  493. * be displayed (no we do not know how these are calculated or what the threshold is),
  494. * and this does not affect the search by search engine suggestion (see 0807)
  495. * [NOTE] This setting is only useful if you want to enable search engine keywords
  496. * (i.e. at least one of 0850a suggestion types must be true) but you want to *limit* suggestions shown ***/
  497. // user_pref("browser.urlbar.maxRichResults", 0);
  498. /* 0850d: disable location bar autofill
  499. * [1] http://kb.mozillazine.org/Inline_autocomplete ***/
  500. // user_pref("browser.urlbar.autoFill", false);
  501. /* 0850e: disable location bar one-off searches [FF51+]
  502. * [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ ***/
  503. // user_pref("browser.urlbar.oneOffSearches", false);
  504. /* 0860: disable search and form history [SETUP-WEB]
  505. * [WARNING] Autocomplete form data is still (in April 2019) easily read by third parties, see [1]
  506. * [NOTE] We also clear formdata on exiting Firefox (see 2803)
  507. * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history
  508. * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html ***/
  509. user_pref("browser.formfill.enable", false);
  510. /* 0862: disable browsing and download history
  511. * [NOTE] We also clear history and downloads on exiting Firefox (see 2803)
  512. * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/
  513. // user_pref("places.history.enabled", false);
  514. /* 0864: disable date/time picker
  515. * This can leak your locale if not en-US
  516. * [1] https://trac.torproject.org/projects/tor/ticket/21787 ***/
  517. user_pref("dom.forms.datetime", false);
  518. /* 0870: disable Windows jumplist [WINDOWS] ***/
  519. user_pref("browser.taskbar.lists.enabled", false);
  520. user_pref("browser.taskbar.lists.frequent.enabled", false);
  521. user_pref("browser.taskbar.lists.recent.enabled", false);
  522. user_pref("browser.taskbar.lists.tasks.enabled", false);
  523. /* 0871: disable Windows taskbar preview [WINDOWS] ***/
  524. user_pref("browser.taskbar.previews.enable", false);
  525. /*** [SECTION 0900]: PASSWORDS ***/
  526. user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!");
  527. /* 0901: disable saving passwords
  528. * [NOTE] This does not clear any passwords already saved
  529. * [SETTING] Privacy & Security>Forms & Passwords>Ask to save logins and passwords for websites ***/
  530. // user_pref("signon.rememberSignons", false);
  531. /* 0902: use a master password (recommended if you save passwords)
  532. * There are no preferences for this. It is all handled internally.
  533. * [SETTING] Privacy & Security>Forms & Passwords>Use a master password
  534. * [1] https://support.mozilla.org/kb/use-master-password-protect-stored-logins ***/
  535. /* 0903: set how often Firefox should ask for the master password
  536. * 0=the first time (default), 1=every time it's needed, 2=every n minutes (see 0904) ***/
  537. user_pref("security.ask_for_password", 2);
  538. /* 0904: set how often in minutes Firefox should ask for the master password (see 0903)
  539. * in minutes, default is 30 ***/
  540. user_pref("security.password_lifetime", 5);
  541. /* 0905: disable auto-filling username & password form fields
  542. * can leak in cross-site forms AND be spoofed
  543. * [NOTE] Password will still be auto-filled after a user name is manually entered
  544. * [1] http://kb.mozillazine.org/Signon.autofillForms ***/
  545. user_pref("signon.autofillForms", false);
  546. /* 0909: disable formless login capture for Password Manager [FF51+] ***/
  547. user_pref("signon.formlessCapture.enabled", false);
  548. /* 0912: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+]
  549. * hardens against potential credentials phishing
  550. * 0=don't allow sub-resources to open HTTP authentication credentials dialogs
  551. * 1=don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs
  552. * 2=allow sub-resources to open HTTP authentication credentials dialogs (default)
  553. * [1] https://www.fxsitecompat.com/en-CA/docs/2015/http-auth-dialog-can-no-longer-be-triggered-by-cross-origin-resources/ ***/
  554. user_pref("network.auth.subresource-http-auth-allow", 1);
  555. /*** [SECTION 1000]: CACHE / SESSION (RE)STORE / FAVICONS
  556. ETAG [1] and other [2][3] cache tracking/fingerprinting techniques can be averted by
  557. disabling *BOTH* disk (1001) and memory (1003) cache. ETAGs can also be neutralized
  558. by modifying response headers [4]. Another solution is to use a hardened configuration
  559. with Temporary Containers [5]. Alternatively, you can *LIMIT* exposure by clearing
  560. cache on close (2803). or on a regular basis manually or with an extension.
  561. [1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
  562. [2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/
  563. [3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache
  564. [4] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
  565. [5] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
  566. ***/
  567. user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
  568. /** CACHE ***/
  569. /* 1001: disable disk cache
  570. * [SETUP-PERF] If you think disk cache may help (heavy tab user, high-res video),
  571. * or you use a hardened Temporary Containers, then feel free to override this
  572. * [NOTE] We also clear cache on exiting Firefox (see 2803) ***/
  573. user_pref("browser.cache.disk.enable", false);
  574. /* 1002: disable disk cache for SSL pages
  575. * [1] http://kb.mozillazine.org/Browser.cache.disk_cache_ssl ***/
  576. user_pref("browser.cache.disk_cache_ssl", false);
  577. /* 1003: disable memory cache
  578. * [NOTE] Not recommended due to performance issues ***/
  579. // user_pref("browser.cache.memory.enable", false);
  580. // user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF]
  581. /* 1006: disable permissions manager from writing to disk [RESTART]
  582. * [NOTE] This means any permission changes are session only
  583. * [1] https://bugzilla.mozilla.org/967812 ***/
  584. // user_pref("permissions.memory_only", true); // [HIDDEN PREF]
  585. /** SESSIONS & SESSION RESTORE ***/
  586. /* 1020: exclude "Undo Closed Tabs" in Session Restore ***/
  587. // user_pref("browser.sessionstore.max_tabs_undo", 0);
  588. /* 1021: disable storing extra session data [SETUP-CHROME]
  589. * extra session data contains contents of forms, scrollbar positions, cookies and POST data
  590. * define on which sites to save extra session data:
  591. * 0=everywhere, 1=unencrypted sites, 2=nowhere ***/
  592. user_pref("browser.sessionstore.privacy_level", 2);
  593. /* 1022: disable resuming session from crash ***/
  594. // user_pref("browser.sessionstore.resume_from_crash", false);
  595. /* 1023: set the minimum interval between session save operations
  596. * Increasing this can help on older machines and some websites, as well as reducing writes, see [1]
  597. * Default is 15000 (15 secs). Try 30000 (30 secs), 60000 (1 min) etc
  598. * [SETUP-CHROME] This can also affect entries in the "Recently Closed Tabs" feature:
  599. * i.e. the longer the interval the more chance a quick tab open/close won't be captured.
  600. * This longer interval *may* affect history but we cannot replicate any history not recorded
  601. * [1] https://bugzilla.mozilla.org/1304389 ***/
  602. user_pref("browser.sessionstore.interval", 30000);
  603. /* 1024: disable automatic Firefox start and session restore after reboot [FF62+] [WINDOWS]
  604. * [1] https://bugzilla.mozilla.org/603903 ***/
  605. user_pref("toolkit.winRegisterApplicationRestart", false);
  606. /** FAVICONS ***/
  607. /* 1030: disable favicons in shortcuts
  608. * URL shortcuts use a cached randomly named .ico file which is stored in your
  609. * profile/shortcutCache directory. The .ico remains after the shortcut is deleted.
  610. * If set to false then the shortcuts use a generic Firefox icon ***/
  611. user_pref("browser.shell.shortcutFavicons", false);
  612. /* 1031: disable favicons in tabs and new bookmarks
  613. * bookmark favicons are stored as data blobs in favicons.sqlite ***/
  614. // user_pref("browser.chrome.site_icons", false);
  615. /* 1032: disable favicons in web notifications ***/
  616. user_pref("alerts.showFavicons", false); // [DEFAULT: false]
  617. /*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS)
  618. Note that your cipher and other settings can be used server side as a fingerprint attack
  619. vector, see [1] (It's quite technical but the first part is easy to understand
  620. and you can stop reading when you reach the second section titled "Enter Bro")
  621. Option 1: Use defaults for ciphers (1260's). There is nothing *weak* about these, but
  622. due to breakage, browsers can't deprecate them until the web stops using them
  623. Option 2: Disable the ciphers in 1261, 1262 and 1263. These shouldn't break anything.
  624. Optionally, disable the ciphers in 1264.
  625. [1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
  626. ***/
  627. user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
  628. /** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/
  629. /* 1201: disable old SSL/TLS "insecure" renegotiation (vulnerable to a MiTM attack)
  630. * [SETUP-WEB] <2% of secure sites do NOT support the newer "secure" renegotiation, see [2]
  631. * [1] https://wiki.mozilla.org/Security:Renegotiation
  632. * [2] https://www.ssllabs.com/ssl-pulse/ ***/
  633. user_pref("security.ssl.require_safe_negotiation", true);
  634. /* 1202: control TLS versions with min and max
  635. * 1=TLS 1.0, 2=TLS 1.1, 3=TLS 1.2, 4=TLS 1.3
  636. * [WARNING] Leave these at default, otherwise you alter your TLS fingerprint.
  637. * Firefox telemetry (April 2019) shows only 0.5% of TLS web traffic uses 1.0 or 1.1 ***/
  638. // user_pref("security.tls.version.min", 3);
  639. // user_pref("security.tls.version.max", 4);
  640. /* 1203: disable SSL session tracking [FF36+]
  641. * SSL Session IDs are unique, last up to 24hrs in Firefox, and can be used for tracking
  642. * [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the
  643. * consequences. FPI isolates these, but it was designed with the Tor protocol in mind,
  644. * and the Tor Browser has extra protection, including enhanced sanitizing per Identity.
  645. * [1] https://tools.ietf.org/html/rfc5077
  646. * [2] https://bugzilla.mozilla.org/967977
  647. * [3] https://arxiv.org/abs/1810.07304 ***/
  648. user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF]
  649. /* 1204: disable SSL Error Reporting
  650. * [1] https://firefox-source-docs.mozilla.org/browser/base/sslerrorreport/preferences.html ***/
  651. user_pref("security.ssl.errorReporting.automatic", false);
  652. user_pref("security.ssl.errorReporting.enabled", false);
  653. user_pref("security.ssl.errorReporting.url", "");
  654. /* 1205: disable TLS1.3 0-RTT (round-trip time) [FF51+]
  655. * [1] https://github.com/tlswg/tls13-spec/issues/1001
  656. * [2] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/
  657. user_pref("security.tls.enable_0rtt_data", false);
  658. /** OCSP (Online Certificate Status Protocol)
  659. #Required reading [#] https://scotthelme.co.uk/revocation-is-broken/ ***/
  660. /* 1210: enable OCSP Stapling
  661. * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ ***/
  662. user_pref("security.ssl.enable_ocsp_stapling", true);
  663. /* 1211: control when to use OCSP fetching (to confirm current validity of certificates)
  664. * 0=disabled, 1=enabled (default), 2=enabled for EV certificates only
  665. * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority)
  666. * It's a trade-off between security (checking) and privacy (leaking info to the CA)
  667. * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling
  668. * [1] https://en.wikipedia.org/wiki/Ocsp ***/
  669. user_pref("security.OCSP.enabled", 1);
  670. /* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail [SETUP-WEB]
  671. * When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail)
  672. * Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail)
  673. * It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it
  674. * could have been revoked) and/or you could be under attack (e.g. malicious blocking of OCSP servers)
  675. * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
  676. * [2] https://www.imperialviolet.org/2014/04/19/revchecking.html ***/
  677. user_pref("security.OCSP.require", true);
  678. /** CERTS / HPKP (HTTP Public Key Pinning) ***/
  679. /* 1220: disable or limit SHA-1 certificates
  680. * 0=all SHA1 certs are allowed
  681. * 1=all SHA1 certs are blocked
  682. * 2=deprecated option that now maps to 1
  683. * 3=only allowed for locally-added roots (e.g. anti-virus)
  684. * 4=only allowed for locally-added roots or for certs in 2015 and earlier
  685. * [SETUP-CHROME] When disabled, some man-in-the-middle devices (e.g. security scanners and
  686. * antivirus products, may fail to connect to HTTPS sites. SHA-1 is *almost* obsolete.
  687. * [1] https://blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ ***/
  688. user_pref("security.pki.sha1_enforcement_level", 1);
  689. /* 1221: disable Windows 8.1's Microsoft Family Safety cert [FF50+] [WINDOWS]
  690. * 0=disable detecting Family Safety mode and importing the root
  691. * 1=only attempt to detect Family Safety mode (don't import the root)
  692. * 2=detect Family Safety mode and import the root
  693. * [1] https://trac.torproject.org/projects/tor/ticket/21686 ***/
  694. user_pref("security.family_safety.mode", 0);
  695. /* 1222: disable intermediate certificate caching (fingerprinting attack vector) [RESTART]
  696. * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
  697. * Saved logins and passwords are not available. Reset the pref and restart to return them.
  698. * [TEST] https://fiprinca.0x90.eu/poc/
  699. * [1] https://bugzilla.mozilla.org/1334485 - related bug
  700. * [2] https://bugzilla.mozilla.org/1216882 - related bug (see comment 9) ***/
  701. // user_pref("security.nocertdb", true); // [HIDDEN PREF]
  702. /* 1223: enforce strict pinning
  703. * PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict
  704. * [WARNING] If you rely on an AV (antivirus) to protect your web browsing
  705. * by inspecting ALL your web traffic, then leave at current default=1
  706. * [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/
  707. user_pref("security.cert_pinning.enforcement_level", 2);
  708. /** MIXED CONTENT ***/
  709. /* 1240: disable insecure active content on https pages
  710. * [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/
  711. user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true]
  712. /* 1241: disable insecure passive content (such as images) on https pages [SETUP-WEB] ***/
  713. user_pref("security.mixed_content.block_display_content", true);
  714. /* 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+]
  715. * [1] https://bugzilla.mozilla.org/1190623 ***/
  716. user_pref("security.mixed_content.block_object_subrequest", true);
  717. /** CIPHERS [see the section 1200 intro] ***/
  718. /* 1261: disable 3DES (effective key size < 128)
  719. * [1] https://en.wikipedia.org/wiki/3des#Security
  720. * [2] http://en.citizendium.org/wiki/Meet-in-the-middle_attack
  721. * [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/
  722. // user_pref("security.ssl3.rsa_des_ede3_sha", false);
  723. /* 1262: disable 128 bits ***/
  724. // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
  725. // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
  726. /* 1263: disable DHE (Diffie-Hellman Key Exchange)
  727. * [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/
  728. // user_pref("security.ssl3.dhe_rsa_aes_128_sha", false);
  729. // user_pref("security.ssl3.dhe_rsa_aes_256_sha", false);
  730. /* 1264: disable the remaining non-modern cipher suites as of FF52 ***/
  731. // user_pref("security.ssl3.rsa_aes_128_sha", false);
  732. // user_pref("security.ssl3.rsa_aes_256_sha", false);
  733. /** UI (User Interface) ***/
  734. /* 1270: display warning (red padlock) for "broken security" (see 1201)
  735. * [1] https://wiki.mozilla.org/Security:Renegotiation ***/
  736. user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
  737. /* 1271: control "Add Security Exception" dialog on SSL warnings
  738. * 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default)
  739. * [1] https://github.com/pyllyukko/user.js/issues/210 ***/
  740. user_pref("browser.ssl_override_behavior", 1);
  741. /* 1272: display advanced information on Insecure Connection warning pages
  742. * only works when it's possible to add an exception
  743. * i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/)
  744. * [TEST] https://expired.badssl.com/ ***/
  745. user_pref("browser.xul.error_pages.expert_bad_cert", true);
  746. /* 1273: display "insecure" icon and "Not Secure" text on HTTP sites ***/
  747. user_pref("security.insecure_connection_icon.enabled", true); // [FF59+]
  748. user_pref("security.insecure_connection_text.enabled", true); // [FF60+]
  749. // user_pref("security.insecure_connection_icon.pbmode.enabled", true); // [FF59+] private windows only
  750. // user_pref("security.insecure_connection_text.pbmode.enabled", true); // [FF60+] private windows only
  751. /*** [SECTION 1400]: FONTS ***/
  752. user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!");
  753. /* 1401: disable websites choosing fonts (0=block, 1=allow)
  754. * This can limit most (but not all) JS font enumeration which is a high entropy fingerprinting vector
  755. * [SETUP-WEB] Disabling fonts can uglify the web a fair bit.
  756. * [SETTING] General>Language and Appearance>Fonts & Colors>Advanced>Allow pages to choose... ***/
  757. user_pref("browser.display.use_document_fonts", 0);
  758. /* 1403: disable icon fonts (glyphs) and local fallback rendering
  759. * [1] https://bugzilla.mozilla.org/789788
  760. * [2] https://trac.torproject.org/projects/tor/ticket/8455 ***/
  761. // user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+]
  762. // user_pref("gfx.downloadable_fonts.fallback_delay", -1);
  763. /* 1404: disable rendering of SVG OpenType fonts
  764. * [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/
  765. user_pref("gfx.font_rendering.opentype_svg.enabled", false);
  766. /* 1405: disable WOFF2 (Web Open Font Format) [FF35+] ***/
  767. // user_pref("gfx.downloadable_fonts.woff2.enabled", false);
  768. /* 1408: disable graphite which FF49 turned back on by default
  769. * In the past it had security issues. Update: This continues to be the case, see [1]
  770. * [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 ***/
  771. user_pref("gfx.font_rendering.graphite.enabled", false);
  772. /* 1409: limit system font exposure to a whitelist [FF52+] [RESTART]
  773. * If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
  774. * [WARNING] Creating your own probably highly-unique whitelist will raise your entropy.
  775. * Eventually privacy.resistFingerprinting (see 4500) will cover this
  776. * [1] https://bugzilla.mozilla.org/1121643 ***/
  777. // user_pref("font.system.whitelist", ""); // [HIDDEN PREF]
  778. /*** [SECTION 1600]: HEADERS / REFERERS
  779. Only *cross domain* referers need controlling: leave 1601, 1602, 1605 and 1606 alone
  780. ---
  781. harden it a bit: set XOriginPolicy (1603) to 1 (as per the settings below)
  782. harden it a bit more: set XOriginPolicy (1603) to 2 (and optionally 1604 to 1 or 2), expect breakage
  783. ---
  784. If you want any REAL control over referers and breakage, then use an extension. Either:
  785. uMatrix: limited by scope, all requests are spoofed or not-spoofed
  786. Smart Referrer: granular with source<->destination, whitelists
  787. ---
  788. full URI: https://example.com:8888/foo/bar.html?id=1234
  789. scheme+host+port+path: https://example.com:8888/foo/bar.html
  790. scheme+host+port: https://example.com:8888
  791. ---
  792. #Required reading [#] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/
  793. ***/
  794. user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!");
  795. /* 1601: ALL: control when images/links send a referer
  796. * 0=never, 1=send only when links are clicked, 2=for links and images (default) ***/
  797. // user_pref("network.http.sendRefererHeader", 2); // [DEFAULT: 2]
  798. /* 1602: ALL: control the amount of information to send
  799. * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/
  800. // user_pref("network.http.referer.trimmingPolicy", 0); // [DEFAULT: 0]
  801. /* 1603: CROSS ORIGIN: control when to send a referer
  802. * 0=always (default), 1=only if base domains match, 2=only if hosts match
  803. * [SETUP-WEB] Known to cause issues with older modems/routers and some sites e.g vimeo ***/
  804. user_pref("network.http.referer.XOriginPolicy", 1);
  805. /* 1604: CROSS ORIGIN: control the amount of information to send [FF52+]
  806. * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/
  807. user_pref("network.http.referer.XOriginTrimmingPolicy", 0); // [DEFAULT: 0]
  808. /* 1605: ALL: disable spoofing a referer
  809. * [WARNING] Do not set this to true, as spoofing effectively disables the anti-CSRF
  810. * (Cross-Site Request Forgery) protections that some sites may rely on ***/
  811. // user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false]
  812. /* 1606: ALL: set the default Referrer Policy [FF59+]
  813. * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade
  814. * [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy
  815. * [1] https://www.w3.org/TR/referrer-policy/
  816. * [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy
  817. * [3] https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/ ***/
  818. // user_pref("network.http.referer.defaultPolicy", 3); // [DEFAULT: 3]
  819. // user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2]
  820. /* 1607: TOR: hide (not spoof) referrer when leaving a .onion domain [FF54+]
  821. * [NOTE] Firefox cannot access .onion sites by default. We recommend you use
  822. * the Tor Browser which is specifically designed for hidden services
  823. * [1] https://bugzilla.mozilla.org/1305144 ***/
  824. user_pref("network.http.referer.hideOnionSource", true);
  825. /* 1610: ALL: enable the DNT (Do Not Track) HTTP header
  826. * [NOTE] DNT is enforced with Tracking Protection regardless of this pref
  827. * [SETTING] Privacy & Security>Content Blocking>Send websites a "Do Not Track"... ***/
  828. user_pref("privacy.donottrackheader.enabled", true);
  829. /*** [SECTION 1700]: CONTAINERS
  830. If you want to *really* leverage containers, we highly recommend Temporary Containers [2].
  831. Read the article by the extension author [3], and check out the github wiki/repo [4].
  832. [1] https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers
  833. [2] https://addons.mozilla.org/firefox/addon/temporary-containers/
  834. [3] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
  835. [4] https://github.com/stoically/temporary-containers/wiki
  836. ***/
  837. user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!");
  838. /* 1701: enable Container Tabs setting in preferences (see 1702) [FF50+]
  839. * [1] https://bugzilla.mozilla.org/1279029 ***/
  840. user_pref("privacy.userContext.ui.enabled", true);
  841. /* 1702: enable Container Tabs [FF50+]
  842. * [SETTING] General>Tabs>Enable Container Tabs ***/
  843. user_pref("privacy.userContext.enabled", true);
  844. /* 1703: enable a private container for thumbnail loads [FF51+] ***/
  845. user_pref("privacy.usercontext.about_newtab_segregation.enabled", true); // [DEFAULT: true in FF61+]
  846. /* 1704: set behaviour on "+ Tab" button to display container menu [FF53+] [SETUP-CHROME]
  847. * 0=no menu (default), 1=show when clicked, 2=show on long press
  848. * [NOTE] The menu does not contain a non-container tab option (use Ctrl+T to open non-container tab)
  849. * [1] https://bugzilla.mozilla.org/1328756 ***/
  850. user_pref("privacy.userContext.longPressBehavior", 2);
  851. /*** [SECTION 1800]: PLUGINS ***/
  852. user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies!");
  853. /* 1802: enable click to play and set to 0 minutes ***/
  854. user_pref("plugins.click_to_play", true);
  855. user_pref("plugin.sessionPermissionNow.intervalInMinutes", 0);
  856. /* 1803: disable Flash plugin
  857. * 0=deactivated, 1=ask, 2=enabled
  858. * ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash
  859. * [NOTE] You can still override individual sites via site permissions
  860. * [1] https://www.ghacks.net/2013/07/09/how-to-make-sure-that-a-firefox-plugin-never-activates-again/ ***/
  861. user_pref("plugin.state.flash", 0);
  862. /* 1820: disable GMP (Gecko Media Plugins)
  863. * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/
  864. // user_pref("media.gmp-provider.enabled", false);
  865. /* 1825: disable widevine CDM (Content Decryption Module)
  866. * [SETUP-WEB] if you *need* CDM, e.g. Netflix, Amazon Prime, Hulu, whatever ***/
  867. user_pref("media.gmp-widevinecdm.visible", false);
  868. user_pref("media.gmp-widevinecdm.enabled", false);
  869. /* 1830: disable all DRM content (EME: Encryption Media Extension)
  870. * [SETUP-WEB] if you *need* EME, e.g. Netflix, Amazon Prime, Hulu, whatever
  871. * [SETTING] General>DRM Content>Play DRM-controlled content
  872. * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/
  873. user_pref("media.eme.enabled", false);
  874. /*** [SECTION 2000]: MEDIA / CAMERA / MIC ***/
  875. user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
  876. /* 2001: disable WebRTC (Web Real-Time Communication)
  877. * [SETUP-WEB] WebRTC can leak your IP address from behind your VPN, but if this is not
  878. * in your threat model, and you want Real-Time Communication, this is the pref for you
  879. * [1] https://www.privacytools.io/#webrtc ***/
  880. user_pref("media.peerconnection.enabled", false);
  881. /* 2002: limit WebRTC IP leaks if using WebRTC
  882. * [TEST] https://browserleaks.com/webrtc
  883. * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416
  884. * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/
  885. user_pref("media.peerconnection.ice.default_address_only", true);
  886. user_pref("media.peerconnection.ice.no_host", true); // [FF51+]
  887. /* 2010: disable WebGL (Web Graphics Library)
  888. * [SETUP-WEB] When disabled, may break some websites. When enabled, provides high entropy,
  889. * especially with readPixels(). Some of the other entropy is lessened with RFP (see 4501)
  890. * [1] https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/
  891. * [2] https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern ***/
  892. user_pref("webgl.disabled", true);
  893. user_pref("webgl.dxgl.enabled", false); // [WINDOWS]
  894. user_pref("webgl.enable-webgl2", false);
  895. /* 2012: limit WebGL ***/
  896. user_pref("webgl.min_capability_mode", true);
  897. user_pref("webgl.disable-extensions", true);
  898. user_pref("webgl.disable-fail-if-major-performance-caveat", true);
  899. /* 2022: disable screensharing ***/
  900. user_pref("media.getusermedia.screensharing.enabled", false);
  901. user_pref("media.getusermedia.browser.enabled", false);
  902. user_pref("media.getusermedia.audiocapture.enabled", false);
  903. /* 2024: set a default permission for Camera/Microphone [FF58+]
  904. * 0=always ask (default), 1=allow, 2=block
  905. * [SETTING] to add site exceptions: Page Info>Permissions>Use the Camera/Microphone
  906. * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Camera/Microphone>Settings ***/
  907. // user_pref("permissions.default.camera", 2);
  908. // user_pref("permissions.default.microphone", 2);
  909. /* 2030: disable autoplay of HTML5 media [FF63+]
  910. * 0=Allowed, 1=Blocked (2=Prompt - removed in FF66)
  911. * [NOTE] You can set exceptions under site permissions
  912. * [SETTING] Privacy & Security>Permissions>Block websites from automatically playing sound ***/
  913. user_pref("media.autoplay.default", 1); // [DEFAULT: 1 in FF67+]
  914. /* 2031: disable autoplay of HTML5 media if you interacted with the site [FF66+] ***/
  915. user_pref("media.autoplay.enabled.user-gestures-needed", false);
  916. /* 2032: disable audio autoplay in non-active tabs [FF51+]
  917. * [1] https://www.ghacks.net/2016/11/14/firefox-51-blocks-automatic-audio-playback-in-non-active-tabs/ ***/
  918. user_pref("media.block-autoplay-until-in-foreground", true);
  919. /*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/
  920. user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!");
  921. /* 2201: prevent websites from disabling new window features
  922. * [1] http://kb.mozillazine.org/Prevent_websites_from_disabling_new_window_features ***/
  923. user_pref("dom.disable_window_open_feature.close", true);
  924. user_pref("dom.disable_window_open_feature.location", true); // [DEFAULT: true]
  925. user_pref("dom.disable_window_open_feature.menubar", true);
  926. user_pref("dom.disable_window_open_feature.minimizable", true);
  927. user_pref("dom.disable_window_open_feature.personalbar", true); // bookmarks toolbar
  928. user_pref("dom.disable_window_open_feature.resizable", true); // [DEFAULT: true]
  929. user_pref("dom.disable_window_open_feature.status", true); // [DEFAULT: true]
  930. user_pref("dom.disable_window_open_feature.titlebar", true);
  931. user_pref("dom.disable_window_open_feature.toolbar", true);
  932. /* 2202: prevent scripts from moving and resizing open windows ***/
  933. user_pref("dom.disable_window_move_resize", true);
  934. /* 2203: open links targeting new windows in a new tab instead
  935. * This stops malicious window sizes and some screen resolution leaks.
  936. * You can still right-click a link and open in a new window.
  937. * [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
  938. * [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/
  939. user_pref("browser.link.open_newwindow", 3);
  940. user_pref("browser.link.open_newwindow.restriction", 0);
  941. /* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
  942. * [NOTE] You can still manually toggle the browser's fullscreen state (F11),
  943. * but this pref will disable embedded video/game fullscreen controls, e.g. youtube
  944. * [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen ***/
  945. // user_pref("full-screen-api.enabled", false);
  946. /* 2210: block popup windows
  947. * [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/
  948. user_pref("dom.disable_open_during_load", true);
  949. /* 2212: limit events that can cause a popup [SETUP-WEB]
  950. * default is "change click dblclick auxclick mouseup pointerup notificationclick reset submit touchend contextmenu"
  951. * [1] http://kb.mozillazine.org/Dom.popup_allowed_events ***/
  952. user_pref("dom.popup_allowed_events", "click dblclick");
  953. /*** [SECTION 2300]: WEB WORKERS
  954. A worker is a JS "background task" running in a global context, i.e. it is different from
  955. the current window. Workers can spawn new workers (must be the same origin & scheme),
  956. including service and shared workers. Shared workers can be utilized by multiple scripts and
  957. communicate between browsing contexts (windows/tabs/iframes) and can even control your cache.
  958. [NOTE] uMatrix 1.2.0+ allows a per-scope control for workers (2301-deprecated) and service workers (2302)
  959. #Required reading [#] https://github.com/gorhill/uMatrix/releases/tag/1.2.0
  960. [1] Web Workers: https://developer.mozilla.org/docs/Web/API/Web_Workers_API
  961. [2] Worker: https://developer.mozilla.org/docs/Web/API/Worker
  962. [3] Service Worker: https://developer.mozilla.org/docs/Web/API/Service_Worker_API
  963. [4] SharedWorker: https://developer.mozilla.org/docs/Web/API/SharedWorker
  964. [5] ChromeWorker: https://developer.mozilla.org/docs/Web/API/ChromeWorker
  965. [6] Notifications: https://support.mozilla.org/questions/1165867#answer-981820
  966. ***/
  967. user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!");
  968. /* 2302: disable service workers [FF32, FF44-compat]
  969. * Service workers essentially act as proxy servers that sit between web apps, and the browser
  970. * and network, are event driven, and can control the web page/site it is associated with,
  971. * intercepting and modifying navigation and resource requests, and caching resources.
  972. * [NOTE] Service worker APIs are hidden (in Firefox) and cannot be used when in PB mode.
  973. * [NOTE] Service workers only run over HTTPS. Service workers have no DOM access.
  974. * [SETUP-WEB] Disabling service workers will break some sites. This pref is a master switch, and controls
  975. * notifications (2304, 2305) and service worker cache (2740) - all three are inactive. Notifications are
  976. * behind a prompt (2306). If you enable service workers, then you may want to look at those as well ***/
  977. user_pref("dom.serviceWorkers.enabled", false);
  978. /* 2304: disable Web Notifications
  979. * [NOTE] Web Notifications require service workers (2302) and are behind a prompt (2306)
  980. * [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/
  981. // user_pref("dom.webnotifications.enabled", false); // [FF22+]
  982. // user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+]
  983. /* 2305: disable Push Notifications [FF44+]
  984. * web apps can receive messages pushed to them from a server, whether or
  985. * not the web app is in the foreground, or even currently loaded
  986. * [NOTE] Push Notifications require service workers (2302) and are behind a prompt (2306)
  987. * [1] https://developer.mozilla.org/docs/Web/API/Push_API ***/
  988. // user_pref("dom.push.enabled", false);
  989. // user_pref("dom.push.connection.enabled", false);
  990. // user_pref("dom.push.serverURL", "");
  991. // user_pref("dom.push.userAgentID", "");
  992. /* 2306: set a default permission for Notifications (both 2305 and 2306) [FF58+]
  993. * 0=always ask (default), 1=allow, 2=block
  994. * [NOTE] Best left at default "always ask", fingerprintable via Permissions API
  995. * [SETTING] to add site exceptions: Page Info>Permissions>Receive Notifications
  996. * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Notifications>Settings ***/
  997. // user_pref("permissions.default.desktop-notification", 2);
  998. /*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT ***/
  999. user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!");
  1000. /* 2401: disable website control over browser right-click context menu
  1001. * [NOTE] Shift-Right-Click will always bring up the browser right-click context menu ***/
  1002. // user_pref("dom.event.contextmenu.enabled", false);
  1003. /* 2402: disable website access to clipboard events/content
  1004. * [SETUP-WEB] This will break some sites functionality such as pasting into facebook, wordpress
  1005. * this applies to onCut, onCopy, onPaste events - i.e. you have to interact with
  1006. * the website for it to look at the clipboard
  1007. * [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ ***/
  1008. user_pref("dom.event.clipboardevents.enabled", false);
  1009. /* 2403: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+]
  1010. * this disables document.execCommand("cut"/"copy") to protect your clipboard
  1011. * [1] https://bugzilla.mozilla.org/1170911 ***/
  1012. user_pref("dom.allow_cut_copy", false);
  1013. /* 2404: disable "Confirm you want to leave" dialog on page close
  1014. * Does not prevent JS leaks of the page close event.
  1015. * [1] https://developer.mozilla.org/docs/Web/Events/beforeunload
  1016. * [2] https://support.mozilla.org/questions/1043508 ***/
  1017. user_pref("dom.disable_beforeunload", true);
  1018. /* 2414: disable shaking the screen ***/
  1019. user_pref("dom.vibrator.enabled", false);
  1020. /* 2420: disable asm.js [FF22+] [SETUP-PERF]
  1021. * [1] http://asmjs.org/
  1022. * [2] https://www.mozilla.org/security/advisories/mfsa2015-29/
  1023. * [3] https://www.mozilla.org/security/advisories/mfsa2015-50/
  1024. * [4] https://www.mozilla.org/security/advisories/mfsa2017-01/#CVE-2017-5375
  1025. * [5] https://www.mozilla.org/security/advisories/mfsa2017-05/#CVE-2017-5400
  1026. * [6] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/
  1027. user_pref("javascript.options.asmjs", false);
  1028. /* 2421: disable Ion and baseline JIT to help harden JS against exploits
  1029. * [WARNING] If false, causes the odd site issue and there is also a performance loss
  1030. * [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 ***/
  1031. // user_pref("javascript.options.ion", false);
  1032. // user_pref("javascript.options.baselinejit", false);
  1033. /* 2422: disable WebAssembly [FF52+] [SETUP-PERF]
  1034. * [1] https://developer.mozilla.org/docs/WebAssembly ***/
  1035. user_pref("javascript.options.wasm", false);
  1036. /* 2426: disable Intersection Observer API [FF55+]
  1037. * [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API
  1038. * [2] https://w3c.github.io/IntersectionObserver/
  1039. * [3] https://bugzilla.mozilla.org/1243846 ***/
  1040. // user_pref("dom.IntersectionObserver.enabled", false);
  1041. /* 2429: enable (limited but sufficient) window.opener protection [FF65+]
  1042. * Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/
  1043. user_pref("dom.targetBlankNoOpener.enabled", true);
  1044. /*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/
  1045. user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!");
  1046. /* 2502: disable Battery Status API
  1047. * Initially a Linux issue (high precision readout) that was fixed.
  1048. * However, it is still another metric for fingerprinting, used to raise entropy.
  1049. * e.g. do you have a battery or not, current charging status, charge level, times remaining etc
  1050. * [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1]
  1051. * [1] https://bugzilla.mozilla.org/1313580 ***/
  1052. // user_pref("dom.battery.enabled", false);
  1053. /* 2504: disable virtual reality devices
  1054. * Optional protection depending on your connected devices
  1055. * [1] https://developer.mozilla.org/docs/Web/API/WebVR_API ***/
  1056. // user_pref("dom.vr.enabled", false);
  1057. /* 2505: disable media device enumeration [FF29+]
  1058. * [NOTE] media.peerconnection.enabled should also be set to false (see 2001)
  1059. * [1] https://wiki.mozilla.org/Media/getUserMedia
  1060. * [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/enumerateDevices ***/
  1061. user_pref("media.navigator.enabled", false);
  1062. /* 2508: disable hardware acceleration to reduce graphics fingerprinting [SETUP-HARDEN]
  1063. * [WARNING] Affects text rendering (fonts will look different), impacts video performance,
  1064. * and parts of Quantum that utilize the GPU will also be affected as they are rolled out
  1065. * [SETTING] General>Performance>Custom>Use hardware acceleration when available
  1066. * [1] https://wiki.mozilla.org/Platform/GFX/HardwareAcceleration ***/
  1067. // user_pref("gfx.direct2d.disabled", true); // [WINDOWS]
  1068. // user_pref("layers.acceleration.disabled", true);
  1069. /* 2510: disable Web Audio API [FF51+]
  1070. * [1] https://bugzilla.mozilla.org/1288359 ***/
  1071. user_pref("dom.webaudio.enabled", false);
  1072. /* 2517: disable Media Capabilities API [FF63+]
  1073. * [WARNING] This *may* affect media performance if disabled, no one is sure
  1074. * [1] https://github.com/WICG/media-capabilities
  1075. * [2] https://wicg.github.io/media-capabilities/#security-privacy-considerations ***/
  1076. // user_pref("media.media-capabilities.enabled", false);
  1077. /*** [SECTION 2600]: MISCELLANEOUS ***/
  1078. user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!");
  1079. /* 2601: prevent accessibility services from accessing your browser [RESTART]
  1080. * [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser
  1081. * [1] https://support.mozilla.org/kb/accessibility-services ***/
  1082. user_pref("accessibility.force_disabled", 1);
  1083. /* 2602: disable sending additional analytics to web servers
  1084. * [1] https://developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/
  1085. user_pref("beacon.enabled", false);
  1086. /* 2603: remove temp files opened with an external application
  1087. * [1] https://bugzilla.mozilla.org/302433 ***/
  1088. user_pref("browser.helperApps.deleteTempFileOnExit", true);
  1089. /* 2604: disable page thumbnail collection
  1090. * look in profile/thumbnails directory - you may want to clean that out ***/
  1091. user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF]
  1092. /* 2605: block web content in file processes [FF55+]
  1093. * [SETUP-WEB] You may want to disable this for corporate or developer environments
  1094. * [1] https://bugzilla.mozilla.org/1343184 ***/
  1095. user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
  1096. /* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
  1097. user_pref("browser.uitour.enabled", false);
  1098. user_pref("browser.uitour.url", "");
  1099. /* 2607: disable various developer tools in browser context
  1100. * [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes
  1101. * [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/
  1102. user_pref("devtools.chrome.enabled", false);
  1103. /* 2608: disable WebIDE to prevent remote debugging and ADB extension download
  1104. * [1] https://trac.torproject.org/projects/tor/ticket/16222 ***/
  1105. user_pref("devtools.debugger.remote-enabled", false);
  1106. user_pref("devtools.webide.enabled", false);
  1107. user_pref("devtools.webide.autoinstallADBExtension", false); // [FF64+]
  1108. /* 2609: disable MathML (Mathematical Markup Language) [FF51+] [SETUP-HARDEN]
  1109. * [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#misc
  1110. * [1] https://bugzilla.mozilla.org/1173199 ***/
  1111. // user_pref("mathml.disabled", true);
  1112. /* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+]
  1113. * [WARNING] Expect breakage incl. youtube player controls. Best left for a "hardened" profile.
  1114. * [1] https://bugzilla.mozilla.org/1216893 ***/
  1115. // user_pref("svg.disabled", true);
  1116. /* 2611: disable middle mouse click opening links from clipboard
  1117. * [1] https://trac.torproject.org/projects/tor/ticket/10089
  1118. * [2] http://kb.mozillazine.org/Middlemouse.contentLoadURL ***/
  1119. user_pref("middlemouse.contentLoadURL", false);
  1120. /* 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS)
  1121. * [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins)
  1122. * To control HTML Meta tag and JS redirects, use an extension. Default is 20 ***/
  1123. user_pref("network.http.redirection-limit", 10);
  1124. /* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+]
  1125. * 0 (default) or 1=allow, 2=block
  1126. * [SETTING] to add site exceptions: Page Info>Permissions>Override Keyboard Shortcuts ***/
  1127. // user_pref("permissions.default.shortcuts", 2);
  1128. /* 2616: remove special permissions for certain mozilla domains [FF35+]
  1129. * [1] resource://app/defaults/permissions ***/
  1130. user_pref("permissions.manager.defaultsUrl", "");
  1131. /* 2617: remove webchannel whitelist ***/
  1132. user_pref("webchannel.allowObject.urlWhitelist", "");
  1133. /* 2619: enforce Punycode for Internationalized Domain Names to eliminate possible spoofing
  1134. * Firefox has *some* protections, but it is better to be safe than sorry. The downside: it will also
  1135. * display legitimate IDN's punycoded, which might be undesirable for users of non-latin alphabets
  1136. * [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com)
  1137. * [1] https://wiki.mozilla.org/IDN_Display_Algorithm
  1138. * [2] https://en.wikipedia.org/wiki/IDN_homograph_attack
  1139. * [3] CVE-2017-5383: https://www.mozilla.org/security/advisories/mfsa2017-02/
  1140. * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/
  1141. user_pref("network.IDN_show_punycode", true);
  1142. /* 2620: enable Firefox's built-in PDF reader [SETUP-CHROME]
  1143. * This setting controls if the option "Display in Firefox" is available in the setting below
  1144. * and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With")
  1145. * PROS: pdfjs is lightweight, open source, and as secure/vetted as any pdf reader out there (more than most)
  1146. * Exploits are rare (1 serious case in 4 yrs), treated seriously and patched quickly.
  1147. * It doesn't break "state separation" of browser content (by not sharing with OS, independent apps).
  1148. * It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk.
  1149. * CONS: You may prefer a different pdf reader for security reasons
  1150. * CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare)
  1151. * [SETTING] General>Applications>Portable Document Format (PDF) ***/
  1152. user_pref("pdfjs.disabled", false); // [DEFAULT: false]
  1153. /* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS]
  1154. * [1] https://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ ***/
  1155. user_pref("network.protocol-handler.external.ms-windows-store", false);
  1156. /* 2622: disable middlemouse paste leaking on Linux
  1157. * [1] https://bugzilla.mozilla.org/1528289 */
  1158. user_pref("middlemouse.paste", false); // [DEFAULT: false on Windows]
  1159. /** DOWNLOADS ***/
  1160. /* 2650: discourage downloading to desktop
  1161. * 0=desktop 1=downloads 2=last used
  1162. * [SETTING] To set your default "downloads": General>Downloads>Save files to ***/
  1163. // user_pref("browser.download.folderList", 2);
  1164. /* 2651: enforce user interaction for security by always asking where to download [SETUP-CHROME]
  1165. * [SETTING] General>Downloads>Always ask you where to save files ***/
  1166. user_pref("browser.download.useDownloadDir", false);
  1167. /* 2652: disable adding downloads to the system's "recent documents" list ***/
  1168. user_pref("browser.download.manager.addToRecentDocs", false);
  1169. /* 2653: disable hiding mime types (Options>General>Applications) not associated with a plugin ***/
  1170. user_pref("browser.download.hide_plugins_without_extensions", false);
  1171. /* 2654: disable "open with" in download dialog [FF50+] [SETUP-HARDEN]
  1172. * This is very useful to enable when the browser is sandboxed (e.g. via AppArmor)
  1173. * in such a way that it is forbidden to run external applications.
  1174. * [WARNING] This may interfere with some users' workflow or methods
  1175. * [1] https://bugzilla.mozilla.org/1281959 ***/
  1176. // user_pref("browser.download.forbid_open_with", true);
  1177. /** EXTENSIONS ***/
  1178. /* 2660: lock down allowed extension directories
  1179. * [SETUP-CHROME] This will break extensions, language packs, themes and any other
  1180. * XPI files which are installed outside of profile and application directories
  1181. * [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/
  1182. * [1] archived: https://archive.is/DYjAM ***/
  1183. user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF]
  1184. user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15]
  1185. /* 2662: disable webextension restrictions on certain mozilla domains (also see 4503) [FF60+]
  1186. * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
  1187. // user_pref("extensions.webextensions.restrictedDomains", "");
  1188. /** SECURITY ***/
  1189. /* 2680: enable CSP (Content Security Policy)
  1190. * [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/
  1191. user_pref("security.csp.enable", true); // [DEFAULT: true]
  1192. /* 2682: enable CSP 1.1 experimental hash-source directive [FF29+]
  1193. * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=855326,883975 ***/
  1194. user_pref("security.csp.experimentalEnabled", true);
  1195. /* 2684: enforce a security delay on some confirmation dialogs such as install, open/save
  1196. * [1] http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox
  1197. * [2] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
  1198. user_pref("security.dialog_enable_delay", 700);
  1199. /*** [SECTION 2700]: PERSISTENT STORAGE
  1200. Data SET by websites including
  1201. cookies : profile\cookies.sqlite
  1202. localStorage : profile\webappsstore.sqlite
  1203. indexedDB : profile\storage\default
  1204. appCache : profile\OfflineCache
  1205. serviceWorkers :
  1206. [NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode
  1207. [NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage),
  1208. indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications)
  1209. If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become
  1210. accessible to websites except shared/service workers where the cookie setting *must* be "Allow"
  1211. ***/
  1212. user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!");
  1213. /* 2701: disable 3rd-party cookies and site-data [SETUP-WEB]
  1214. * 0=Accept cookies and site data (default), 1=(Block) All third-party cookies, 2=(Block) All cookies,
  1215. * 3=(Block) Cookies from unvisited sites, 4=(Block) Third-party trackers (FF63+)
  1216. * [NOTE] Value 4 is tied to the Tracking Protection lists
  1217. * [NOTE] You can set exceptions under site permissions or use an extension
  1218. * [SETTING] Privacy & Security>Content Blocking>Custom>Choose what to block>Cookies ***/
  1219. user_pref("network.cookie.cookieBehavior", 1);
  1220. /* 2702: set third-party cookies (i.e ALL) (if enabled, see 2701) to session-only
  1221. and (FF58+) set third-party non-secure (i.e HTTP) cookies to session-only
  1222. [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and
  1223. .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones
  1224. * [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/
  1225. * [2] http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly ***/
  1226. user_pref("network.cookie.thirdparty.sessionOnly", true);
  1227. user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+]
  1228. /* 2703: delete cookies and site data on close
  1229. * 0=keep until they expire (default), 2=keep until you close Firefox
  1230. * [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2)
  1231. * [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Firefox is closed ***/
  1232. // user_pref("network.cookie.lifetimePolicy", 2);
  1233. /* 2710: disable DOM (Document Object Model) Storage
  1234. * [WARNING] This will break a LOT of sites' functionality AND extensions!
  1235. * You are better off using an extension for more granular control ***/
  1236. // user_pref("dom.storage.enabled", false);
  1237. /* 2720: enforce IndexedDB (IDB) as enabled
  1238. * IDB is required for extensions and Firefox internals (even before FF63 in [1])
  1239. * To control *website* IDB data, control allowing cookies and service workers, or use
  1240. * Temporary Containers. To mitigate *website* IDB, FPI helps (4001), and/or sanitize
  1241. * on close (Offline Website Data, see 2800) or on-demand (Ctrl-Shift-Del), or automatically
  1242. * via an extension. Note that IDB currently cannot be sanitized by host.
  1243. * [1] https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/ ***/
  1244. user_pref("dom.indexedDB.enabled", true); // [DEFAULT: true]
  1245. /* 2730: disable offline cache ***/
  1246. user_pref("browser.cache.offline.enable", false);
  1247. /* 2731: enforce websites to ask to store data for offline use
  1248. * [1] https://support.mozilla.org/questions/1098540
  1249. * [2] https://bugzilla.mozilla.org/959985 ***/
  1250. user_pref("offline-apps.allow_by_default", false);
  1251. /* 2740: disable service worker cache and cache storage
  1252. * [NOTE] We clear service worker cache on exiting Firefox (see 2803)
  1253. * [1] https://w3c.github.io/ServiceWorker/#privacy ***/
  1254. // user_pref("dom.caches.enabled", false);
  1255. /* 2750: disable Storage API [FF51+]
  1256. * The API gives sites the ability to find out how much space they can use, how much
  1257. * they are already using, and even control whether or not they need to be alerted
  1258. * before the user agent disposes of site data in order to make room for other things.
  1259. * [1] https://developer.mozilla.org/docs/Web/API/StorageManager
  1260. * [2] https://developer.mozilla.org/docs/Web/API/Storage_API
  1261. * [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/
  1262. // user_pref("dom.storageManager.enabled", false);
  1263. /* 2755: disable Storage Access API [FF65+]
  1264. * [1] https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API ***/
  1265. // user_pref("dom.storage_access.enabled", false);
  1266. /*** [SECTION 2800]: SHUTDOWN
  1267. You should set the values to what suits you best.
  1268. - "Offline Website Data" includes appCache (2730), localStorage (2710),
  1269. service worker cache (2740), and QuotaManager (IndexedDB (2720), asm-cache)
  1270. - In both 2803 + 2804, the 'download' and 'history' prefs are combined in the
  1271. Firefox interface as "Browsing & Download History" and their values will be synced
  1272. ***/
  1273. user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!");
  1274. /* 2802: enable Firefox to clear items on shutdown (see 2803)
  1275. * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes ***/
  1276. user_pref("privacy.sanitize.sanitizeOnShutdown", true);
  1277. /* 2803: set what items to clear on shutdown (if 2802 is true) [SETUP-CHROME]
  1278. * [NOTE] If 'history' is true, downloads will also be cleared regardless of the value
  1279. * but if 'history' is false, downloads can still be cleared independently
  1280. * However, this may not always be the case. The interface combines and syncs these
  1281. * prefs when set from there, and the sanitize code may change at any time
  1282. * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes>Settings ***/
  1283. user_pref("privacy.clearOnShutdown.cache", true);
  1284. user_pref("privacy.clearOnShutdown.cookies", true);
  1285. user_pref("privacy.clearOnShutdown.downloads", true); // see note above
  1286. user_pref("privacy.clearOnShutdown.formdata", true); // Form & Search History
  1287. user_pref("privacy.clearOnShutdown.history", true); // Browsing & Download History
  1288. user_pref("privacy.clearOnShutdown.offlineApps", true); // Offline Website Data
  1289. user_pref("privacy.clearOnShutdown.sessions", true); // Active Logins
  1290. user_pref("privacy.clearOnShutdown.siteSettings", false); // Site Preferences
  1291. /* 2804: reset default items to clear with Ctrl-Shift-Del (to match 2803) [SETUP-CHROME]
  1292. * This dialog can also be accessed from the menu History>Clear Recent History
  1293. * Firefox remembers your last choices. This will reset them when you start Firefox.
  1294. * [NOTE] Regardless of what you set privacy.cpd.downloads to, as soon as the dialog
  1295. * for "Clear Recent History" is opened, it is synced to the same as 'history' ***/
  1296. user_pref("privacy.cpd.cache", true);
  1297. user_pref("privacy.cpd.cookies", true);
  1298. // user_pref("privacy.cpd.downloads", true); // not used, see note above
  1299. user_pref("privacy.cpd.formdata", true); // Form & Search History
  1300. user_pref("privacy.cpd.history", true); // Browsing & Download History
  1301. user_pref("privacy.cpd.offlineApps", true); // Offline Website Data
  1302. user_pref("privacy.cpd.passwords", false); // this is not listed
  1303. user_pref("privacy.cpd.sessions", true); // Active Logins
  1304. user_pref("privacy.cpd.siteSettings", false); // Site Preferences
  1305. /* 2805: privacy.*.openWindows (clear session restore data) [FF34+]
  1306. * [NOTE] There is a years-old bug that these cause two windows when Firefox restarts.
  1307. * You do not need these anyway if session restore is cleared with history (see 2803) ***/
  1308. // user_pref("privacy.clearOnShutdown.openWindows", true);
  1309. // user_pref("privacy.cpd.openWindows", true);
  1310. /* 2806: reset default 'Time range to clear' for 'Clear Recent History' (see 2804)
  1311. * Firefox remembers your last choice. This will reset the value when you start Firefox.
  1312. * 0=everything, 1=last hour, 2=last two hours, 3=last four hours,
  1313. * 4=today, 5=last five minutes, 6=last twenty-four hours
  1314. * [NOTE] The values 5 + 6 are not listed in the dropdown, which will display a
  1315. * blank value if they are used, but they do work as advertised ***/
  1316. user_pref("privacy.sanitize.timeSpan", 0);
  1317. /*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION)
  1318. ** 1278037 - isolate indexedDB (FF51+)
  1319. ** 1277803 - isolate favicons (FF52+)
  1320. ** 1264562 - isolate OCSP cache (FF52+)
  1321. ** 1268726 - isolate Shared Workers (FF52+)
  1322. ** 1316283 - isolate SSL session cache (FF52+)
  1323. ** 1317927 - isolate media cache (FF53+)
  1324. ** 1323644 - isolate HSTS and HPKP (FF54+)
  1325. ** 1334690 - isolate HTTP Alternative Services (FF54+)
  1326. ** 1334693 - isolate SPDY/HTTP2 (FF55+)
  1327. ** 1337893 - isolate DNS cache (FF55+)
  1328. ** 1344170 - isolate blob: URI (FF55+)
  1329. ** 1300671 - isolate data:, about: URLs (FF55+)
  1330. ** 1473247 - isolate IP addresses (FF63+)
  1331. ** 1492607 - isolate postMessage with targetOrigin "*" (requires 4002) (FF65+)
  1332. ** 1542309 - isolate top-level domain URLs (FF68+)
  1333. ** 1506693 - isolate pdfjs range-based requests (FF68+)
  1334. ** 1330467 - isolate site permissions (coming)
  1335. ***/
  1336. user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
  1337. /* 4001: enable First Party Isolation [FF51+]
  1338. * [SETUP-WEB] May break cross-domain logins and site functionality until perfected
  1339. * [1] https://bugzilla.mozilla.org/1260931 ***/
  1340. user_pref("privacy.firstparty.isolate", true);
  1341. /* 4002: enforce FPI restriction for window.opener [FF54+]
  1342. * [NOTE] Setting this to false may reduce the breakage in 4001
  1343. * FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But
  1344. * to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
  1345. * The 2nd pref removes that limitation and will only allow communication if FPDs also match.
  1346. * [1] https://bugzilla.mozilla.org/1319773#c22
  1347. * [2] https://bugzilla.mozilla.org/1492607
  1348. * [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
  1349. user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true]
  1350. // user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF]
  1351. /*** [SECTION 4500]: RFP (RESIST FINGERPRINTING)
  1352. This master switch will be used for a wide range of items, many of which will
  1353. **override** existing prefs from FF55+, often providing a **better** solution
  1354. IMPORTANT: As existing prefs become redundant, and some of them WILL interfere
  1355. with how RFP works, they will be moved to section 4600 and made inactive
  1356. ** 418986 - limit window.screen & CSS media queries leaking identifiable info (FF41+)
  1357. [NOTE] Info only: To set a size, open a XUL (chrome) page (such as about:config) which is at
  1358. 100% zoom, hit Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run.
  1359. Test your window size, do some math, resize to allow for all the non inner window elements
  1360. [TEST] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
  1361. ** 1281949 - spoof screen orientation (FF50+)
  1362. ** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+)
  1363. FF53: Fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044)
  1364. ** 1330890 - spoof timezone as UTC 0 (FF55+)
  1365. FF58: Date.toLocaleFormat deprecated (818634)
  1366. FF60: Date.toLocaleDateString and Intl.DateTimeFormat fixed (1409973)
  1367. ** 1360039 - spoof navigator.hardwareConcurrency as 2 (see 4601) (FF55+)
  1368. This spoof *shouldn't* affect core chrome/Firefox performance
  1369. ** 1217238 - reduce precision of time exposed by javascript (FF55+)
  1370. ** 1369303 - spoof/disable performance API (see 2410-deprecated, 4602, 4603) (FF56+)
  1371. ** 1333651 & 1383495 & 1396468 - spoof Navigator API (see section 4700) (FF56+)
  1372. FF56: The version number will be rounded down to the nearest multiple of 10
  1373. FF57: The version number will match current ESR (1393283, 1418672, 1418162, 1511763)
  1374. FF59: The OS will be reported as Windows, OSX, Android, or Linux (to reduce breakage) (1404608)
  1375. FF66: The OS in HTTP Headers will be reduced to Windows or Android (1509829)
  1376. FF68: Reported OS versions updated to Windows 10, OS 10.14, and Adnroid 8.1 (1511434)
  1377. ** 1369319 - disable device sensor API (see 4604) (FF56+)
  1378. ** 1369357 - disable site specific zoom (see 4605) (FF56+)
  1379. ** 1337161 - hide gamepads from content (see 4606) (FF56+)
  1380. ** 1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true (see 4607) (FF56+)
  1381. ** 1333641 - reduce fingerprinting in WebSpeech API (see 4608) (FF56+)
  1382. ** 1372069 & 1403813 & 1441295 - block geolocation requests (same as denying a site permission) (see 0201, 0201b) (FF56-62)
  1383. ** 1369309 - spoof media statistics (see 4610) (FF57+)
  1384. ** 1382499 - reduce screen co-ordinate fingerprinting in Touch API (see 4611) (FF57+)
  1385. ** 1217290 & 1409677 - enable fingerprinting resistance for WebGL (see 2010-12) (FF57+)
  1386. ** 1382545 - reduce fingerprinting in Animation API (FF57+)
  1387. ** 1354633 - limit MediaError.message to a whitelist (FF57+)
  1388. ** 1382533 - enable fingerprinting resistance for Presentation API (FF57+)
  1389. This blocks exposure of local IP Addresses via mDNS (Multicast DNS)
  1390. ** 967895 - enable site permission prompt before allowing canvas data extraction (FF58+)
  1391. FF59: Added to site permissions panel (1413780) Only prompt when triggered by user input (1376865)
  1392. ** 1372073 - spoof/block fingerprinting in MediaDevices API (FF59+)
  1393. Spoof: enumerate devices reports one "Internal Camera" and one "Internal Microphone" if
  1394. media.navigator.enabled is true (see 2505 which we chose to keep disabled)
  1395. Block: suppresses the ondevicechange event (see 4612)
  1396. ** 1039069 - warn when language prefs are set to non en-US (see 0207, 0208) (FF59+)
  1397. ** 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59+)
  1398. Spoofing mimics the content language of the document. Currently it only supports en-US.
  1399. Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected.
  1400. FF60: Fix keydown/keyup events (1438795)
  1401. ** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
  1402. ** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+)
  1403. ** 1479239 - return "no-preference" with prefers-reduced-motion (FF63+)
  1404. ** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+)
  1405. FF65: pointerEvent.pointerid (1492766)
  1406. ** 1485266 - disable exposure of system colors to CSS or canvas (see 4615) (FF67+)
  1407. ** 1407366 - enable inner window letterboxing (see 4504) (FF67+)
  1408. ** 1540726 - return "light" with prefers-color-scheme (FF67+)
  1409. [1] https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-color-scheme
  1410. ***/
  1411. user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
  1412. /* 4501: enable privacy.resistFingerprinting [FF41+]
  1413. * This pref is the master switch for all other privacy.resist* prefs unless stated
  1414. * [SETUP-WEB] RFP can cause the odd website to break in strange ways, and has a few side affects,
  1415. * but is largely robust nowadays. Give it a try. Your choice. Also see 4504 (letterboxing).
  1416. * [1] https://bugzilla.mozilla.org/418986 ***/
  1417. user_pref("privacy.resistFingerprinting", true);
  1418. /* 4502: set new window sizes to round to hundreds [FF55+] [SETUP-CHROME]
  1419. * Width will round down to multiples of 200s and height to 100s, to fit your screen.
  1420. * The override values are a starting point to round from if you want some control
  1421. * [1] https://bugzilla.mozilla.org/1330882
  1422. * [2] https://hardware.metrics.mozilla.com/ ***/
  1423. // user_pref("privacy.window.maxInnerWidth", 1000);
  1424. // user_pref("privacy.window.maxInnerHeight", 1000);
  1425. /* 4503: disable mozAddonManager Web API [FF57+]
  1426. * [NOTE] As a side-effect in FF57-59 this allowed extensions to work on AMO. In FF60+ you also need
  1427. * to sanitize or clear extensions.webextensions.restrictedDomains (see 2662) to keep that side-effect
  1428. * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
  1429. user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF]
  1430. /* 4504: enable RFP letterboxing [FF67+]
  1431. * Dynamically resizes the inner window (FF67; 200w x100h: FF68+; stepped ranges) by applying letterboxing,
  1432. * using dimensions which waste the least content area, If you use the dimension pref, then it will only apply
  1433. * those resolutions. The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000, 1600x900")
  1434. * [SETUP-WEB] This does NOT require RFP (see 4501) **for now**, so if you're not using 4501, or you are but you're
  1435. * not taking anti-fingerprinting seriously and a little visual change upsets you, then feel free to flip this pref
  1436. * [WARNING] The dimension pref is only meant for testing, and we recommend you DO NOT USE it
  1437. * [1] https://bugzilla.mozilla.org/1407366 ***/
  1438. user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF]
  1439. // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF]
  1440. /* 4510: disable showing about:blank as soon as possible during startup [FF60+]
  1441. * When default true (FF62+) this no longer masks the RFP chrome resizing activity
  1442. * [1] https://bugzilla.mozilla.org/1448423 ***/
  1443. user_pref("browser.startup.blankWindow", false);
  1444. /*** [SECTION 4600]: RFP ALTERNATIVES
  1445. * IF you DO use RFP (see 4500) then you DO NOT need these redundant prefs. In fact,
  1446. some even cause RFP to not behave as you would expect and alter your fingerprint.
  1447. Make sure they are RESET in about:config as per your Firefox version
  1448. * IF you DO NOT use RFP or are on ESR... then turn on each ESR section below
  1449. ***/
  1450. user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan");
  1451. /* [SETUP-non-RFP] Non-RFP users replace the * with a slash on this line to enable these
  1452. // FF55+
  1453. // 4601: [2514] spoof (or limit?) number of CPU cores [FF48+]
  1454. // [NOTE] *may* affect core chrome/Firefox performance, will affect content.
  1455. // [1] https://bugzilla.mozilla.org/1008453
  1456. // [2] https://trac.torproject.org/projects/tor/ticket/21675
  1457. // [3] https://trac.torproject.org/projects/tor/ticket/22127
  1458. // [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency
  1459. // user_pref("dom.maxHardwareConcurrency", 2);
  1460. // * * * /
  1461. // FF56+
  1462. // 4602: [2411] disable resource/navigation timing
  1463. user_pref("dom.enable_resource_timing", false);
  1464. // 4603: [2412] disable timing attacks
  1465. // [1] https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI
  1466. user_pref("dom.enable_performance", false);
  1467. // 4604: [2512] disable device sensor API
  1468. // Optional protection depending on your device
  1469. // [1] https://trac.torproject.org/projects/tor/ticket/15758
  1470. // [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/
  1471. // [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751
  1472. // user_pref("device.sensors.enabled", false);
  1473. // 4605: [2515] disable site specific zoom
  1474. // Zoom levels affect screen res and are highly fingerprintable. This does not stop you using
  1475. // zoom, it will just not use/remember any site specific settings. Zoom levels on new tabs
  1476. // and new windows are reset to default and only the current tab retains the current zoom
  1477. user_pref("browser.zoom.siteSpecific", false);
  1478. // 4606: [2501] disable gamepad API - USB device ID enumeration
  1479. // Optional protection depending on your connected devices
  1480. // [1] https://trac.torproject.org/projects/tor/ticket/13023
  1481. // user_pref("dom.gamepad.enabled", false);
  1482. // 4607: [2503] disable giving away network info [FF31+]
  1483. // e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none
  1484. // [1] https://developer.mozilla.org/docs/Web/API/Network_Information_API
  1485. // [2] https://wicg.github.io/netinfo/
  1486. // [3] https://bugzilla.mozilla.org/960426
  1487. user_pref("dom.netinfo.enabled", false); // [DEFAULT: true on Android]
  1488. // 4608: [2021] disable the SpeechSynthesis (Text-to-Speech) part of the Web Speech API
  1489. // [1] https://developer.mozilla.org/docs/Web/API/Web_Speech_API
  1490. // [2] https://developer.mozilla.org/docs/Web/API/SpeechSynthesis
  1491. // [3] https://wiki.mozilla.org/HTML5_Speech_API
  1492. user_pref("media.webspeech.synth.enabled", false);
  1493. // * * * /
  1494. // FF57+
  1495. // 4610: [2506] disable video statistics - JS performance fingerprinting [FF25+]
  1496. // [1] https://trac.torproject.org/projects/tor/ticket/15757
  1497. // [2] https://bugzilla.mozilla.org/654550
  1498. user_pref("media.video_stats.enabled", false);
  1499. // 4611: [2509] disable touch events
  1500. // fingerprinting attack vector - leaks screen res & actual screen coordinates
  1501. // 0=disabled, 1=enabled, 2=autodetect
  1502. // Optional protection depending on your device
  1503. // [1] https://developer.mozilla.org/docs/Web/API/Touch_events
  1504. // [2] https://trac.torproject.org/projects/tor/ticket/10286
  1505. // user_pref("dom.w3c_touch_events.enabled", 0);
  1506. // * * * /
  1507. // FF59+
  1508. // 4612: [2511] disable MediaDevices change detection [FF51+]
  1509. // [1] https://developer.mozilla.org/docs/Web/Events/devicechange
  1510. // [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/ondevicechange
  1511. user_pref("media.ondevicechange.enabled", false);
  1512. // * * * /
  1513. // FF60+
  1514. // 4613: [2011] disable WebGL debug info being available to websites
  1515. // [1] https://bugzilla.mozilla.org/1171228
  1516. // [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info
  1517. user_pref("webgl.enable-debug-renderer-info", false);
  1518. // * * * /
  1519. // FF65+
  1520. // 4614: [2516] disable PointerEvents
  1521. // [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent
  1522. user_pref("dom.w3c_pointer_events.enabled", false);
  1523. // * * * /
  1524. // FF67+
  1525. // 4615: [2618] disable exposure of system colors to CSS or canvas [FF44+]
  1526. // [NOTE] See second listed bug: may cause black on black for elements with undefined colors
  1527. // [SETUP-CHROME] Might affect CSS in themes and extensions
  1528. // [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876
  1529. user_pref("ui.use_standins_for_native_colors", true);
  1530. // * * * /
  1531. // ***/
  1532. /*** [SECTION 4700]: RFP ALTERNATIVES (NAVIGATOR / USER AGENT (UA) SPOOFING)
  1533. This is FYI ONLY. These prefs are INSUFFICIENT(a) on their own, you need
  1534. to use RFP (4500) or an extension, in which case they become POINTLESS.
  1535. (a) Many of the components that make up your UA can be derived by other means.
  1536. And when those values differ, you provide more bits and raise entropy.
  1537. Examples of leaks include navigator objects, date locale/formats, iframes,
  1538. headers, tcp/ip attributes, feature detection, and **many** more.
  1539. ALL values below intentionally left blank - use RFP, or get a vetted, tested
  1540. extension and mimic RFP values to *lower* entropy, or randomize to *raise* it
  1541. ***/
  1542. user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow");
  1543. /* 4701: navigator.userAgent ***/
  1544. // user_pref("general.useragent.override", ""); // [HIDDEN PREF]
  1545. /* 4702: navigator.buildID
  1546. * Revealed build time down to the second. In FF64+ it now returns a fixed timestamp
  1547. * [1] https://bugzilla.mozilla.org/583181
  1548. * [2] https://www.fxsitecompat.com/en-CA/docs/2018/navigator-buildid-now-returns-a-fixed-timestamp/ ***/
  1549. // user_pref("general.buildID.override", ""); // [HIDDEN PREF]
  1550. /* 4703: navigator.appName ***/
  1551. // user_pref("general.appname.override", ""); // [HIDDEN PREF]
  1552. /* 4704: navigator.appVersion ***/
  1553. // user_pref("general.appversion.override", ""); // [HIDDEN PREF]
  1554. /* 4705: navigator.platform ***/
  1555. // user_pref("general.platform.override", ""); // [HIDDEN PREF]
  1556. /* 4706: navigator.oscpu ***/
  1557. // user_pref("general.oscpu.override", ""); // [HIDDEN PREF]
  1558. /*** [SECTION 5000]: PERSONAL
  1559. Non-project related but useful. If any of these interest you, add them to your overrides ***/
  1560. user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
  1561. /* WELCOME & WHAT's NEW NOTICES ***/
  1562. // user_pref("browser.startup.homepage_override.mstone", "ignore"); // master switch
  1563. // user_pref("startup.homepage_welcome_url", "");
  1564. // user_pref("startup.homepage_welcome_url.additional", "");
  1565. // user_pref("startup.homepage_override_url", ""); // What's New page after updates
  1566. /* WARNINGS ***/
  1567. // user_pref("browser.tabs.warnOnClose", false);
  1568. // user_pref("browser.tabs.warnOnCloseOtherTabs", false);
  1569. // user_pref("browser.tabs.warnOnOpen", false);
  1570. // user_pref("full-screen-api.warning.delay", 0);
  1571. // user_pref("full-screen-api.warning.timeout", 0);
  1572. // user_pref("general.warnOnAboutConfig", false);
  1573. // user_pref("browser.aboutConfig.showWarning", false); // [FF67+]
  1574. /* APPEARANCE ***/
  1575. // user_pref("browser.download.autohideButton", false); // [FF57+]
  1576. // user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
  1577. // user_pref("toolkit.legacyUserProfileCustomizations.stylesheets", true); // [FF68+] allow userChrome/userContent
  1578. /* CONTENT BEHAVIOR ***/
  1579. // user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type"
  1580. // user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX]
  1581. // user_pref("layout.spellcheckDefault", 2); // 0=none, 1-multi-line, 2=multi-line & single-line
  1582. /* UX BEHAVIOR ***/
  1583. // user_pref("browser.backspace_action", 2); // 0=previous page, 1=scroll up, 2=do nothing
  1584. // user_pref("browser.tabs.closeWindowWithLastTab", false);
  1585. // user_pref("browser.tabs.loadBookmarksInTabs", true); // open bookmarks in a new tab [FF57+]
  1586. // user_pref("browser.urlbar.decodeURLsOnCopy", true); // see bugzilla 1320061 [FF53+]
  1587. // user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [WINDOWS] [MAC]
  1588. // user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART]
  1589. // user_pref("view_source.tab", false); // view "page/selection source" in a new window [FF68+, FF59 and under]
  1590. /* OTHER ***/
  1591. // user_pref("browser.bookmarks.max_backups", 2);
  1592. // user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false); // disable CFR [FF67+]
  1593. // [SETTING] General>Browsing>Recommend extensions as you browse
  1594. // user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false); // disable CFR [FF67+]
  1595. // [SETTING] General>Browsing>Recommend features as you browse
  1596. // user_pref("identity.fxaccounts.enabled", false); // disable and hide Firefox Accounts and Sync [FF60+] [RESTART]
  1597. // user_pref("network.manage-offline-status", false); // see bugzilla 620472
  1598. // user_pref("reader.parse-on-load.enabled", false); // "Reader View"
  1599. // user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR)
  1600. /*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED
  1601. Documentation denoted as [-]. Items deprecated prior to FF61 have been archived at [1], which
  1602. also provides a link-clickable, viewer-friendly version of the deprecated bugzilla tickets
  1603. [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
  1604. ***/
  1605. user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
  1606. /* ESR60.x still uses all the following prefs
  1607. // [NOTE] replace the * with a slash in the line above to re-enable them
  1608. // FF61
  1609. // 0501: disable experiments
  1610. // [1] https://wiki.mozilla.org/Telemetry/Experiments
  1611. // [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1420908,1450801
  1612. user_pref("experiments.enabled", false);
  1613. user_pref("experiments.manifest.uri", "");
  1614. user_pref("experiments.supported", false);
  1615. user_pref("experiments.activeExperiment", false);
  1616. // 2612: disable remote JAR files being opened, regardless of content type [FF42+]
  1617. // [1] https://bugzilla.mozilla.org/1173171
  1618. // [2] https://www.fxsitecompat.com/en-CA/docs/2015/jar-protocol-support-has-been-disabled-by-default/
  1619. // [-] https://bugzilla.mozilla.org/1427726
  1620. user_pref("network.jar.block-remote-files", true);
  1621. // 2613: disable JAR from opening Unsafe File Types
  1622. // [-] https://bugzilla.mozilla.org/1427726
  1623. user_pref("network.jar.open-unsafe-types", false);
  1624. // * * * /
  1625. // FF62
  1626. // 1803: disable Java plugin
  1627. // [-] (part5) https://bugzilla.mozilla.org/1461243
  1628. user_pref("plugin.state.java", 0);
  1629. // * * * /
  1630. // FF63
  1631. // 0202: disable GeoIP-based search results
  1632. // [NOTE] May not be hidden if Firefox has changed your settings due to your locale
  1633. // [-] https://bugzilla.mozilla.org/1462015
  1634. user_pref("browser.search.countryCode", "US"); // [HIDDEN PREF]
  1635. // 0301a: disable auto-update checks for Firefox
  1636. // [SETTING] General>Firefox Updates>Never check for updates
  1637. // [-] https://bugzilla.mozilla.org/1420514
  1638. // user_pref("app.update.enabled", false);
  1639. // 0503: disable "Savant" Shield study [FF61+]
  1640. // [-] https://bugzilla.mozilla.org/1457226
  1641. user_pref("shield.savant.enabled", false);
  1642. // 1031: disable favicons in tabs and new bookmarks - merged into browser.chrome.site_icons
  1643. // [-] https://bugzilla.mozilla.org/1453751
  1644. // user_pref("browser.chrome.favicons", false);
  1645. // 2030: disable autoplay of HTML5 media - replaced by media.autoplay.default
  1646. // This may break video playback on various sites
  1647. // [-] https://bugzilla.mozilla.org/1470082
  1648. user_pref("media.autoplay.enabled", false);
  1649. // 2704: set cookie lifetime in days (see 2703)
  1650. // [-] https://bugzilla.mozilla.org/1457170
  1651. // user_pref("network.cookie.lifetime.days", 90); // [DEFAULT: 90]
  1652. // 5000's: enable "Ctrl+Tab cycles through tabs in recently used order" - replaced by browser.ctrlTab.recentlyUsedOrder
  1653. // [-] https://bugzilla.mozilla.org/1473595
  1654. // user_pref("browser.ctrlTab.previews", true);
  1655. // * * * /
  1656. // FF64
  1657. // 0516: disable Onboarding [FF55+]
  1658. // Onboarding is an interactive tour/setup for new installs/profiles and features. Every time
  1659. // about:home or about:newtab is opened, the onboarding overlay is injected into that page
  1660. // [NOTE] Onboarding uses Google Analytics [2], and leaks resource://URIs [3]
  1661. // [1] https://wiki.mozilla.org/Firefox/Onboarding
  1662. // [2] https://github.com/mozilla/onboard/commit/db4d6c8726c89a5d6a241c1b1065827b525c5baf
  1663. // [3] https://bugzilla.mozilla.org/863246#c154
  1664. // [-] https://bugzilla.mozilla.org/1462415
  1665. user_pref("browser.onboarding.enabled", false);
  1666. // 2608: disable WebIDE ADB extension downloads - both renamed
  1667. // [1] https://trac.torproject.org/projects/tor/ticket/16222
  1668. // [-] https://bugzilla.mozilla.org/1491315
  1669. user_pref("devtools.webide.autoinstallADBHelper", false);
  1670. user_pref("devtools.webide.adbAddonURL", "");
  1671. // 2681: disable CSP violation events [FF59+]
  1672. // [1] https://developer.mozilla.org/docs/Web/API/SecurityPolicyViolationEvent
  1673. // [-] https://bugzilla.mozilla.org/1488165
  1674. user_pref("security.csp.enable_violation_events", false);
  1675. // * * * /
  1676. // FF65
  1677. // 0850a: disable location bar autocomplete and suggestion types
  1678. // If you enforce any of the suggestion types (see the other 0850a), you MUST enforce 'autocomplete'
  1679. // - If *ALL* of the suggestion types are false, 'autocomplete' must also be false
  1680. // - If *ANY* of the suggestion types are true, 'autocomplete' must also be true
  1681. // [-] https://bugzilla.mozilla.org/1502392
  1682. user_pref("browser.urlbar.autocomplete.enabled", false);
  1683. // 0908: remove user & password info when attempting to fix an entered URL (i.e. 0802 is true)
  1684. // e.g. //user:password@foo -> //user@(prefix)foo(suffix) NOT //user:password@(prefix)foo(suffix)
  1685. // [-] https://bugzilla.mozilla.org/1510580
  1686. user_pref("browser.fixup.hide_user_pass", true); // [DEFAULT: true]
  1687. // * * * /
  1688. // FF66
  1689. // 0380: disable Browser Error Reporter [FF60+]
  1690. // [1] https://support.mozilla.org/en-US/kb/firefox-nightly-error-collection
  1691. // [2] https://firefox-source-docs.mozilla.org/browser/browser/BrowserErrorReporter.html
  1692. // [-] https://bugzilla.mozilla.org/1509888
  1693. user_pref("browser.chrome.errorReporter.enabled", false);
  1694. user_pref("browser.chrome.errorReporter.submitUrl", "");
  1695. // 0502: disable Mozilla permission to silently opt you into tests
  1696. // [-] https://bugzilla.mozilla.org/1415625
  1697. user_pref("network.allow-experiments", false);
  1698. // * * * /
  1699. // FF67
  1700. // 2428: enforce DOMHighResTimeStamp API
  1701. // [WARNING] Required for normalization of timestamps and any timer resolution mitigations
  1702. // [-] https://bugzilla.mozilla.org/1485264
  1703. user_pref("dom.event.highrestimestamp.enabled", true); // [DEFAULT: true]
  1704. // 5000's: disable CFR [FF64+] - split into two new prefs: *cfr.addons, *cfr.features
  1705. // [SETTING] General>Browsing>Recommend extensions as you browse
  1706. // [1] https://support.mozilla.org/en-US/kb/extension-recommendations
  1707. // [-] https://bugzilla.mozilla.org/1528953
  1708. // user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr", false);
  1709. // * * * /
  1710. // ***/
  1711. /* END: internal custom pref to test for syntax errors ***/
  1712. user_pref("_user.js.parrot", "SUCCESS: No no he's not dead, he's, he's restin'!");