How to make Firefox more secure

[Member nugget]

I have recently discovered the extent to which certain companies,
and more companies than you imagine, are tracking us across the web
and joining up their data on us with each other.

After installing firefox I always go through the following routine
By doing these things, I believe that this makes it far more difficult
for any company to track me and make use of my data for free.

I make these suggestions so that others may benefit from them,
so others may question their usefulness and others may add to them.
Most of the suggestions are taken from this website
https://proprivacy.com/privacy-service/guides/firefox-privacy-security-guide
If you follow that guide be cautious as some of the suggestions go a little too
far and can diminish the functionality of some websites
Below I will only suggest those options and settings that I found to
be transparent and that will not interfere with the operation of websites

The plugins I install are
canvas Defender – this randomises canvas fingerprinting data
and makes it extremely difficult for trackers
to make use of any canvas fingerprint data

WebRTC leak Shield – an addon that helps to prevent sites obtaining
tracking data from “web storage cookies” that can
contain megabytes of data regarding your online habits

Referer Agent – This spoofs the data that your browser leaks out
it prevents sites putting together personally identifying
data. Instead of every site knowing your LAN IP address, OS
browser type, etc etc etc. It spoofs all that

umatrix — a lot like noscript but better – you have to allow scripts to operate
ublock origin — block adverts

In firefox if you type about:config in the url bar you will get to some settings
(If you have never done this before I suggest you stop here and learn about the about:config pages first)
If you know what you are doing
find these settings
browser.safebrowsing.phishing.enabled
setting that to false will stop sending data to google
phishing protection servers

browser.safebrowsing.malware.enabled
set to false for the same reason as above

dom.event.clipboardevents.enabled
set this to false, because, if you cut, copy or paste something from a website,
then the website owners can get notified of exactly which part of a webpage you
have cut, copied or pasted.

media.peerconnection.enabled
Set to false, if you dont use P2P or videowebchat etc

That’s it really. I just wanted to share that with you all
Like I say, if you want to see where I got those ideas from it was here
https://proprivacy.com/privacy-service/guides/firefox-privacy-security-guide

It’s just a site I have bookmarked that tells you simply and clearly
some of the techniques tracking companies such as google and amazon
use to gather data on you and how to prevent that
I believe, from the little I know about Antix philosophy
that it fits in nicely with the raison d’etre of Antix

I hope someone finds this useful or can tell me more about this subject or add to it

• This topic was modified 3 years, 4 months ago by nugget.

---------------------
Wittgenstein (Tractatus Logico Philosophicus): Whereof one cannot speak, thereof one must be silent.

[Member ModdIt]

Helpful

Up

0

::

Edited 26.01.2020, with more knowledge comes more about how to tame foxes.

Problem is Mozilla keeps changing the ruleset. When you update your, in mozillas consideration “broken” installation may well be repaired, broken meaning restoring tracking, geolocation, telemetry, H264 vunerability, hidden extensions and a lot of other other inbuilt traps. Favorite game is change prfeference names to something “clearer” and more helpful to the user, which is blatantly deceptive.

please take the time to read privacy and security policy/data sharing Mozilla, Take at least a day off work, you will need it to go through all policy including links.

Before you start Firefox disconnect from Internet, make all settings you wish, Please refer too more recent posts for options.

The more addons you use the more likely you will be unique. Go to Panopticlick for a check.

In your Firefox installation folder get in to the habit to delete saved session states etc. Look in folder features, I am not sure what the secret extensions are supposed to do. I just deleted all of them. After open 264 codec had installed itself I malformed the application as I do not need it. You can disable it.

You can switch off telemetry pings, crash reports, Data Reporting but still find many files saved. That stinks worse than rotten fish.
Crash reports include a complete memory dump. Convenient if your browser just happens to crash when you are banking and just entered your credentials. Safe, I am not convinced.

If you sniff network traffic you will find Palemoon and waterfox uploading far less data. Compare policy with Palemoon and Mozilla. Palemoon short clear and concise.
Mozilla a snake pit of legalese bull and links. BUT YOU CAN TAME THE ANIMAL. Firefox is still highly configurable, stable and fast. Need it for some sites where palemoon is hit and mostly miss, like this forum for instance.

• This reply was modified 3 years, 3 months ago by ModdIt.

[Member ex_Koo]

Helpful

Up

0

::

Thanks for these tips I used a couple with Waterfox and some were already invoked.

[Member fungalnet]

Helpful

Up

0

::

Don’t take my word for it, but all the stuff I would take a long time to turn off on firefox are already turned off by waterfox by default. I was told to try brave for a while, it looked pretty safe, then I looked at their extended options or security options, and there were stuff there to be turned off. Some browsers portray themselves as protecting you from third parties, but that means you really have to trust them to protect you. They will not protect you from themselves. Mozilla has been alarming people for a long while with what they do, they are not to be trusted.

anti-X - Adélie - obarun - systemd Free Space

[Member ModdIt]

Helpful

Up

0

::

@fungalnet, yes agree entirely on Mozilla, waterfox is only available for 64 bit systems, on 32 bit systems Palemoon has become my go to workhorse.
It has a few settings in about:config that I do not leave as is but done in a few minutes. I install No Script along with a few other extensions.
I have ignored the dire warnings, No Script breaks some sites but that does not break my heart.
Often use MetaGer2 as a search engine along with Duck, Searx, Startpage, Ecosia. Google is banned from all my devices the best I can but like killing
the hydra that is no way easy….

I also use TOR for You Tube as well as accessing some Geo blocked sites. It also gets around the anti ad blocker feature on some news sites.

I do not think anything we do will protect agains the love and care government agencys may give any of us.
If you live in some countrys using computers and phones may end your remaining freedoms or your life.

[Member ModdIt]

Helpful

Up

0

::

For those who wish to use it Firefox 71 is released and has a changed about:config along with other great improvements which should save about , 002 milliseconds of starttime. sarcasm off.
Should you install it, disconnect from internet before first start and do your settings, remove the hidden extensions in browser/features unless you think you need them. Check, they may get autinstalled again, it happened to me.
Do your normal interface settings then abut config. chrome://global/content/config.xul will call the old about:config. It shows far more settings than the new one, likely as not it will soon be gone.
to get sound you will need to go to your firefox installation and do
patchelf –set-rpath /usr/lib/apulse libxul.so that is minus minus before set minus rpath in case the forum software messes that. For users without it install patchelf first.

I am now archiving versions as freshly downloaded packages. Might come in useful one day.

ghacks dot net among others has very good ongoing updated information on Firefox situation.

Mozilla will not care about users unless google stops paying them millions to avoid anti trust charges.

[Member ModdIt]

Helpful

Up

0

::

Just a warning 🙂 while you are in the firefox installation directory be very careful not to somehow accidentally change the names
of crashreporter, crashreporter ini, pingsender in to something silly.

You would be very concerned if your browser somehow crashed on a banking site or while writing a confidential note and it
was technically unable to send a memory dump to mozilla, even send pings in background might not work !!!.

Conky is your friend, watch memory usage, browsers, at least some not just firefox can run headless after an apparent crash.
Maybe get started remotely in headless mode too despite settings. See block updates below.

Enterprise Policy Generator add on will speed up starts if you block firefox update check the add on gives easy access to some other
settings on top. Blocking updates directly from Mozilla also is a really awful idea, it prevents things you have broken being repaired
automatically and badly damages your user experience.

I have done this and more Performance is noticeably better without all the background activity.

[Member ModdIt]

Helpful

Up

0

::

Tested how to, hardening with user.js For Firefox 72.1 Version 72 has security issues.
Reported works in LTS but not tried.
*Tested. This hack will cripple Palemoon, it is far away from firefox now.

A GHacks user.js is still working, here is how in short form.
Get the file, it is easy to find by search. I read the instructions and info carefuly.
@ https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.1-Overview, copied the latest file and pasted
in to Leafpad. checked it as best my knowledge allows, saved file as user.js

I downloaded firefox to home, unpacked it. Disconnected from Internet.
Opened the forefox directory and started firefox by click on firefox-bin, waited a long time
for the browser window to come up. Made the obvious settings in the interface. Set search to ddg.

Closed Firefox. Using file manager of choice open the .mozilla directory in your home, open the
firefox directory. Open the default release directory and copy the user.js to there.

Start the browser and open about:config You have the Parrot is sleeping message, the userjs is in
use. If you wish to make changes do so. You can also open the old style config with
chrome://global/content/config.xul?filter=accessibility
In Nightly for anyone using it: chrome://global/content/config.xul

Pls do not get mad if things are changed by Mozilla. Ongoing information is only a search away.

Connect to Internet, start the Browser Install NoScript or your alternative choice. Restart Browser
install other addons if you wish.

Save your user.js and the now generated prefs.js, you might need them.
If you make config settings after this point which kill the browser just copy your backup files back
in to replace the bad versions and you are good to go.
If sound does not work for you, expected, patchelf howto is in other post.
I also accidentaly deleted some hidden addons as described in previous post, have experienced no negative
effects.

[Member ModdIt]

Helpful

Up

0

::

Yet another update to Firefox released by Mozilla. I will not be installing it as it is not for security risk.
Moz says stability. I have no isues. Pretty sure the update will REPAIR your broken installation.
Before first start

If you want to install the update make sure to save your configs first. See previous post.
Before first start of firefox disconnct from internet.
First start very slow because trying to send your data to moz before you can turn that off, which we prevent by disconnecting.

Remove the reinstalled hidden extensions.
add user.js and prefs.js
check other settings and set preferred search engine
delete cookies and saved data, last install brought cookie with the download
Remove any telemetry or crash saves in your user config directory.
Depending on how your personal setup works you will have to download extensions again, sending data to Moz as you do so.
Pain in the ass . Remember Monthly update coming soon…

I will be trying again to get no script installed before first start. No successs yet.

[Member ModdIt]

Helpful

Up

0

::

Just got a flaming RED WARNING NOTICE.
FORUM
Dashboard

It looks like you’re using an insecure version of Firefox.
Using an outdated browser makes your computer unsafe.
For the best WordPress experience, please update your browser.

Update Firefox or learn how to browse happy. I think I did, Firefox 72.1 thinks it is Safari on a Mac.

right now I am using latest Palemoon.

Maybe this explains it 🙂 https://www.whatismybrowser.com/detect/what-http-headers-is-my-browser-sending

ACCEPT text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
ACCEPT-ENCODING gzip, deflate, br
ACCEPT-LANGUAGE en-US,en;q=0.5
DNT 1
REFERER https://duckduckgo.com/
Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0 Firefox 72.1 thinks it is Safari on a Mac.

Is my computer schizophrenic ??

• This reply was modified 3 years, 3 months ago by ModdIt.

[Anonymous]

Helpful

Up

0

::

Is my computer schizophrenic ??

this explains it:
Regardless what details we may spoof via the user-agent HTTP request header, sites can check (via javascript) the values of various object properties, e.g. navigator.userAgent

hasTouchScreen, maxTouchPoints…
The diverse set of wildly-configurable available properties makes us each fingerprintable.
Further, (suspiciously, inexplicably, and “by design”) we can notice that, across versions, the firefox browser has been “rigged” to emit http requests bearing individual headers which have been assembled (concatenated) in a KNOWN fixed order. Changing the ordering of headers packed into a request has ZERO functional merit. I’ve never found a bug ticket explaining WHY mozilla has, repeatedly across versions, juggled the ordering ~~ and I cannot fathom any motivation to do so, aside from surreptitiously facilitating the practice of fingerprinting.

[Member ModdIt]

Helpful

Up

0

::

To further quieten firefox you can use policies, the example below stops FF contacting Mozilla and checking for Browser updates as well as preventing a couple of other regular calls home.
At a future date policy.js may become a replacement for the user.js as mozilla is discussing cleaning up the present system by reducing user options..

Step one: Ensure firefox is not running.

Find the directory Firefox binary is installed to

Create a folder called distribution in that directory

create a file called policies.json

add following content to that file.
Reminder: disabling app update notification or updates is not recommended
unless you are sure to keep your system updated in a timely manner and understand
any risk involved in not doing so. No script is your friend but should be kept up to date.

{
“policies”: {
“AppUpdateURL”: “http://127.0.0.1/”,
“DisableAppUpdate”: true,
“DisableFirefoxStudies”: true,
“DisableSystemAddonUpdate”: true,
“DisableTelemetry”: true,
“DisablePocket”: true,
“ExtensionUpdate”: false
}
}

save file in the directory you previously created. you can check if it is working by entering about:policies in the urlbar of firefox and tapping enter. If the policies set are not displayed you have an error in the file or its location.

If you want to use pocket just remove entry and save file. At present I am using user.js, plus some further settings in about:config, which both enter my prefs.js. These files are in .mozilla in my home directory.

These settings should not be used with Palemoon, it is on a different codebase to current Firefox, they may be of interest to waterfox users but some of the settings will not be relevant. the .js files mentioned can be opened as text, viewed and edited then saved normaly. If you change your user.js settings you will also have to manualy edit the prefs.js file to enable your changes.

please do keep backups of your customised preference files, you will have to fix any repairs mozilla may do to your “broken installation”.

The policies.json file is intended for system administrators in corporations and stated to be respected by mozilla in the future.

Changes are only effective after restarting the browser.

• This reply was modified 3 years, 3 months ago by ModdIt. Reason: Clarity
• This reply was modified 3 years, 3 months ago by ModdIt. Reason: Notice on Responsibility
• This reply was modified 3 years, 2 months ago by ModdIt.

[Member ModdIt]

Helpful

Up

0

::

Was asked to point out Thunderbird not only contains a complete browser it can also be controlled in a similar manner. Equevialent to about:config is Tools → Options → Advanced → General → Config Editor.
Some more info here http://kb.mozillazine.org/Modify_Thunderbird_settings

Sorry no more details from me as I use and recommend Claws Mail.

[Member ModdIt]

Helpful

Up

0

::

In Firefox 73 yet another Telemetry feature extension in “your directory/firefox/browser/features/

I have removed all extensions in the folder. No usage issues at all.

For those on low memory systems reducing the number of threads in settings can help to lower mem usage when multiple tabs are open.

Performance
Remove tick from Use recommended performance settings. Reduce content process limit from default 8 to your choice.

Latest ghacks user.js and policies.json post#32010 working correctly with the FF73 version.

If you install Firefox directly from Mozilla and block Update notification that is an own risk setting. Pls do not blame others if you forget to update in a timely manner. If you installed from Antix Repo you will get updates from
that source, again you are owner and responsible for keeping your system up to date.

To access full older style about:config. No dire warnings.
FF71+ @ chrome://global/content/config.xul
FF73+ @ chrome://global/content/config.xhtml

• This reply was modified 3 years, 2 months ago by ModdIt. Reason: Clarify disclaimer updating
• This reply was modified 3 years, 2 months ago by ModdIt.

[Moderator Brian Masinick]

Helpful

Up

0

::

FYI, for those of you who want to know the planned release schedule for Firefox – especially if you have just completed your personal “hardening” or personal protection, altering the default settings.

Here is the next release – Nightly, Beta, Release, and Extended Support Release:

Future branch dates

Release Owners
Quarter Soft Freeze Merge Date Nightly Beta Release Date Release ESR
Q1 2020 2020-03-05 2020-03-09 Firefox 76 Firefox 75 2020-03-10 Firefox 74 Firefox 68.6

URL containing a more complete schedule plan:
https://wiki.mozilla.org/Release_Management/Calendar

• This reply was modified 3 years, 2 months ago by Brian Masinick.

--
Brian Masinick

[Author]

Posts