diff --git a/librewolf.cfg b/librewolf.cfg index adb39b4..d7a6ff6 100644 --- a/librewolf.cfg +++ b/librewolf.cfg @@ -1,8 +1,7 @@ -// ===================================================================================== -// +// --------- // LibreWolf +// --------- // -// ===================================================================================== // Documentation .............. : // ============================== // @@ -213,151 +212,78 @@ lockPref("media.gmp-widevinecdm.autoupdate", false); lockPref("media.gmp-gmpopenh264.enabled", false); lockPref("media.gmp-gmpopenh264.autoupdate", false); -lockPref("media.peerconnection.video.enabled", false); //Deprecated Active - +lockPref("media.peerconnection.video.enabled", false); //lockPref("media.peerconnection.video.h264", true); - lockPref("media.gmp-eme-adobe.enabled", false); - lockPref("media.gmp-manager.certs.2.commonName", ""); lockPref("media.gmp-manager.certs.1.commonName", ""); -// ---------------------------------------------------------------------------------------------------- -// User Settings : WebRTC (Very efficient for fingerprinting this is why its disabled) -// ---------------------------------------------------------------------------------------------------- +// ---------------------- +// User Settings : WebRTC +// ---------------------- -// Pref : Disable WebRTC getUserMedia, screen sharing, audio capture, video capture -// https://wiki.mozilla.org/Media/getUserMedia -// https://blog.mozilla.org/futurereleases/2013/01/12/capture-local-camera-and-microphone-streams-with-getusermedia-now-enabled-in-firefox/ -// https://developer.mozilla.org/en-US/docs/Web/API/Navigator lockPref("media.navigator.enabled", false); -lockPref("media.navigator.video.enabled", false); //Deprecated Active +lockPref("media.navigator.video.enabled", false); lockPref("media.getusermedia.browser.enabled", false); lockPref("media.getusermedia.screensharing.enabled", false); lockPref("media.getusermedia.audiocapture.enabled", false); +lockPref("media.peerconnection.use_document_iceservers", false); +lockPref("media.peerconnection.identity.enabled", false); +lockPref("media.peerconnection.identity.timeout", 1); +lockPref("media.peerconnection.turn.disable", true); +lockPref("media.peerconnection.ice.tcp", false); +lockPref("media.peerconnection.ice.default_address_only", true); +lockPref("media.peerconnection.ice.no_host", true); -// Pref : 2001 : disable WebRTC (Web Real-Time Communication) -// [1] https://www.privacytools.io/#webrtc -lockPref("media.peerconnection.use_document_iceservers", false); //Deprecated Active -lockPref("media.peerconnection.identity.enabled", false); //Deprecated Active -lockPref("media.peerconnection.identity.timeout", 1); //Deprecated Active -lockPref("media.peerconnection.turn.disable", true); //Deprecated Active -lockPref("media.peerconnection.ice.tcp", false); //Deprecated Active - -// Pref : 2002: limit WebRTC IP leaks if using WebRTC -// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416 -// [2] https://wiki.mozilla.org/Media/WebRTC/Privacy -lockPref("media.peerconnection.ice.default_address_only", true); // (FF42-FF50) -lockPref("media.peerconnection.ice.no_host", true); // (FF51+) - -// ---------------------------------------------------------------------------------------------------- +// ------------------------------ // User Settings : Proxy settings -// ---------------------------------------------------------------------------------------------------- +// ------------------------------ -// Pref : 0706 : remove paths when sending URLs to PAC scripts (FF51+) -// CVE-2017-5384 : Information disclosure via Proxy Auto-Config (PAC) -// [1] https://bugzilla.mozilla.org/1255474 -// Does not need to be set as its false by default -// BUG : This locks proxy settings from the panel -// BUG-Fix : Fixed in defaulting section -// MIGRATED : To defaulting section -// WARNING : Do not change this settings here or proxy settings will be locked //lockPref("network.proxy.autoconfig_url.include_path", false); - -// Pref : Send DNS request through SOCKS when SOCKS proxying is in use -// https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers -// BUG : This lock proxy settings from the panel -// BUG-Fix : Fixed with defaulting section -// MIGRATED : To defaulting section -// WARNING : Do not change this settings here or proxy settings will be locked //lockPref("network.proxy.socks_remote_dns", true); -// ---------------------------------------------------------------------------------------------------- +// ---------------------------- // User Settings : DNS settings -// ---------------------------------------------------------------------------------------------------- +// ---------------------------- -// Pref : 0707 : disable (or setup) DNS-over-HTTPS (DoH) (FF60+) -// TRR = Trusted Recursive Resolver -// .mode: 0=off, 1=race, 2=TRR first, 3=TRR only, 4=race for stats, -// but always use native result, 5=explicitly turn it off -// [WARNING] DoH bypasses hosts and gives info to yet another party (e.g. Cloudflare) -// [1] https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/ -// [2] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ -// BUG : This seems to disable socks_remote_dns ?! need to check with wireshark -// If true, just settings urls to null should be enough to disable -// Without impacting socks_remote_dns -// ------- -// Mode 0 is only off because right now that's the default, the default can change. -// Mode 5 means explicitly off, regardless of default. -// https://wiki.mozilla.org/Trusted_Recursive_Resolver -// https://nakedsecurity.sophos.com/2018/08/07/mozilla-faces-resistance-over-dns-privacy-test/#comment-5193521 -// ------- lockPref("network.trr.mode", 5); lockPref("network.trr.bootstrapAddress", ""); lockPref("network.trr.uri", ""); - -// If your OS or ISP does not support IPv6, there is no reason to have this preference set to false. lockPref("network.dns.disableIPv6", true); - -// Pref : Disable DNS pre-fetching -// http://kb.mozillazine.org/Network.dns.disablePrefetch -// https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching lockPref("network.dns.disablePrefetch", true); lockPref("network.dns.disablePrefetchFromHTTPS", true); -// ---------------------------------------------------------------------------------------------------- +// ------------------------------------ // User Settings : Start page highlight -// ---------------------------------------------------------------------------------------------------- +// ------------------------------------ -// Pref : Defaulting Settings : Start page highlight settings -// This does not seems to work with defaultPref lockPref("browser.newtabpage.activity-stream.feeds.section.highlights", false); lockPref("browser.newtabpage.activity-stream.section.highlights.includeBookmarks", false); lockPref("browser.newtabpage.activity-stream.section.highlights.includeDownloads", false); lockPref("browser.newtabpage.activity-stream.section.highlights.includeVisited", false); lockPref("browser.newtabpage.activity-stream.prerender", false); -// ---------------------------------------------------------------------------------------------------- +// ------------------------------------------- // Defaulting Settings : Do not track settings -// ---------------------------------------------------------------------------------------------------- +// ------------------------------------------- -// Set to enforce; choice was left to the user in a previous version lockPref("privacy.donottrackheader.enabled", true); - -// Pref : 1610: (36+) set DNT "value" to "not be tracked" (FF21+) -// [1] http://kb.mozillazine.org/Privacy.donottrackheader.value -// [-] https://bugzilla.mozilla.org/1042135#c101 lockPref("privacy.donottrackheader.value", 1); -// ---------------------------------------------------------------------------------------------------- +// -------------------------------------- // User Settings : Other theming settings -// ---------------------------------------------------------------------------------------------------- +// -------------------------------------- -// Pref : Fix white text on white background for linux -// fixed with lockPref("ui.use_standins_for_native_colors", true); //lockPref("widget.content.gtk-theme-override", "Adwaita:light"); - -// Pref : //lockPref("browser.devedition.theme.enabled", true); - -// Pref : //lockPref("devtools.theme", "dark"); - -// Pref : //lockPref("browser.devedition.theme.showCustomizeButton", true); -// ---------------------------------------------------------------------------------------------------- +// -------------------------------------- // User Settings : Miscellaneous settings -// ---------------------------------------------------------------------------------------------------- +// -------------------------------------- -// Pref : Disable "Are you sure you want to leave this page?" popups on page close -// https://support.mozilla.org/en-US/questions/1043508 -// Does not prevent JS leaks of the page close event. -// https://developer.mozilla.org/en-US/docs/Web/Events/beforeunload -// Disabled by default in Librefox; could be useful on some sites, e.g. banking sites lockPref("dom.disable_beforeunload", true); - -// Pref : Disable geo localisation lockPref("permissions.default.geo", 2); // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> @@ -367,107 +293,37 @@ lockPref("permissions.default.geo", 2); // Bench Diff : +0/5000 // >>>>>>>>>>>>>>>>>>>> -// ---------------------------------------------------------------------------------------------------- +// -------------------------------------- // Defaulting Settings : Other Defaulting -// ---------------------------------------------------------------------------------------------------- +// -------------------------------------- -// Pref : Preferred language for displaying websites. -// The first settings overflow the second one defaultPref("privacy.spoof_english", 2); //defaultPref("intl.accept_languages", "en-US, en"); //This make lang windows unusable - -// Pref : 1606: ALL: set the default Referrer Policy -// 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade -// [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy -// [1] https://www.w3.org/TR/referrer-policy/ -// [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy -// [3] https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/ defaultPref("network.http.referer.defaultPolicy", 3); // (FF59+) default: 3 defaultPref("network.http.referer.defaultPolicy.pbmode", 2); // (FF59+) default: 2 - -// Pref : 1701: enable Container Tabs setting in preferences (see 1702) (FF50+) -// [1] https://bugzilla.mozilla.org/1279029 defaultPref("privacy.userContext.ui.enabled", true); -// Pref : 1702: enable Container Tabs (FF50+) -// [SETTING] General>Tabs>Enable Container Tabs defaultPref("privacy.userContext.enabled", true); -// Pref : 1703: enable a private container for thumbnail loads (FF51+) -defaultPref("privacy.usercontext.about_newtab_segregation.enabled", true); // default: true in FF61+ -// Pref : 1704: set long press behaviour on "+ Tab" button to display container menu (FF53+) -// 0=disables long press, 1=when clicked, the menu is shown -// 2=the menu is shown after X milliseconds -// [NOTE] The menu does not contain a non-container tab option -// [1] https://bugzilla.mozilla.org/1328756 defaultPref("privacy.userContext.longPressBehavior", 2); - -// Pref : (FF57+) defaultPref("browser.download.autohideButton", false); - -// Pref : enable "Find As You Type" defaultPref("accessibility.typeaheadfind", true); - -// Pref : disable autocopy default [LINUX] defaultPref("clipboard.autocopy", false); - -// Pref : 0=none, 1-multi-line, 2=multi-line & single-line defaultPref("layout.spellcheckDefault", 2); - -// Pref : closeWindowWithLastTab defaultPref("browser.tabs.closeWindowWithLastTab", false); - -// Pref : middle-click enabling auto-scrolling [WINDOWS] [MAC] defaultPref("general.autoScroll", false); - -// Pref : 1601: ALL: control when images/links send a referer -// This breaks a lot of sites. This is mitigating by an extension. -// 0=never, 1=send only when links are clicked, 2=for links and images (default) //defaultPref("network.http.sendRefererHeader", 1); - -// Pref : 2620: enable Firefox's built-in PDF reader -// [SETTING] General>Applications>Portable Document Format (PDF) -// This setting controls if the option "Display in Firefox" in the above setting is available -// and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With") -// PROS: pdfjs is lightweight, open source, and as secure/vetted as any pdf reader out there (more than most) -// Exploits are rare (1 serious case in 4 yrs), treated seriously and patched quickly. -// It doesn't break "state separation" of browser content (by not sharing with OS, independent apps). -// It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk. -// CONS: You may prefer a different pdf reader for security reasons -// CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare) defaultPref("pdfjs.disabled", false); - -// Pref : 2210: block popup windows -// [SETTING] Privacy & Security>Permissions>Block pop-up windows defaultPref("dom.disable_open_during_load", true); - -// Pref : 2203 : open links targeting new windows in a new tab instead -// User Settings : Migrated to Defaulting : Links pop-up open in new tab -// This stops malicious window sizes and some screen resolution leaks. -// You can still right-click a link and open in a new window. -// [TEST] https://people.torproject.org/~gk/misc/entire_desktop.html -// [1] https://trac.torproject.org/projects/tor/ticket/9881 defaultPref("browser.link.open_newwindow", 3); defaultPref("browser.link.open_newwindow.restriction", 0); - -// Pref : Defaulting Settings : Proxy defaultPref("network.proxy.autoconfig_url", ""); defaultPref("network.proxy.autoconfig_url.include_path", false); defaultPref("network.proxy.socks_remote_dns", true); defaultPref("network.proxy.socks_version", 5); - -// Pref : Defaulting Settings : Bookmark should by default open in newtab instead of -// replacing the current page defaultPref("browser.tabs.loadBookmarksInTabs", true); - -// Pref : Debugging settings defaultPref("devtools.debugger.remote-enabled", false); defaultPref("devtools.chrome.enabled", false); - -// Pref : site_specific_overrides useragent defaultPref("general.useragent.site_specific_overrides", false); - -// Pref : Display all sections by default defaultPref("extensions.ui.experiment.hidden", false); -// These two are not needed (they are set to true automatically when their list is empty) //defaultPref("extensions.ui.dictionary.hidden", false); //defaultPref("extensions.ui.locale.hidden", false); @@ -477,47 +333,10 @@ defaultPref("extensions.ui.experiment.hidden", false); // Bench Diff : +0/5000 // >>>>>>>>>>>>>>>>>>>> -// Pref : Disable IndexedDB (disabled) -// Pref : 2720: enforce IndexedDB (IDB) -// IDB is required for extensions and Firefox internals (even before FF63) -// To control *website* IDB data, control allowing cookies and service workers, or use -// Temporary Containers. To mitigate *website* IDB, FPI helps (4001), and/or sanitize -// on close (Offline Website Data, see User Settings : History settings) or on-demand (Ctrl-Shift-Del), -// or automatically via an extension. Note that IDB currently cannot be sanitized by host. -// IndexedDB could be used for tracking purposes, but is required for : -// twitter and many sites, some addons, old version of uBlock, session manager in certain cases -// This is mitigated with addons and sanitize settings -// IndexedDB is a low-level API for client-side storage of significant amounts of structured data, -// including files/blobs. This API uses indexes to enable high-performance searches of this data. -// While Web Storage is useful for storing smaller amounts of data, it is less useful for storing -// larger amounts of structured data. IndexedDB provides a solution. This is the main landing page -// for MDN's IndexedDB coverage — "here we provide links to the full API reference and usage guides, -// browser support details, and some explanation of key concepts" -// Also this is cleaned by privacy.clearOnShutdown.offlineApps" -// https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/ -// https://developer.mozilla.org/en-US/docs/IndexedDB -// https://en.wikipedia.org/wiki/Indexed_Database_API -// https://wiki.mozilla.org/Security/Reviews/Firefox4/IndexedDB_Security_Review -// http://forums.mozillazine.org/viewtopic.php?p=13842047 -// https://github.com/pyllyukko/user.js/issues/8 lockPref("dom.indexedDB.enabled", true); //default true - -// Pref : indexedDB Loggingq - disabled for performance //lockPref("dom.indexedDB.logging.details", false); //default true //lockPref("dom.indexedDB.logging.enabled", false); //default true - -// Pref : 2516 : disable PointerEvents -// [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent lockPref("dom.w3c_pointer_events.enabled", false); - -// Pref : 0702 : disable HTTP2 (which was based on SPDY which is now deprecated) -// HTTP2 adds "multiplexing" and "server push", but does nothing to enhance -// privacy, and in fact opens up a number of server-side fingerprinting opportunities -// [1] https://http2.github.io/faq/ -// [2] https://blog.scottlogic.com/2014/11/07/http-2-a-quick-look.html -// [3] https://queue.acm.org/detail.cfm?id=2716278 -// [4] https://github.com/ghacksuserjs/ghacks-user.js/issues/107 -// Disabled because of [4] //lockPref("network.http.spdy.enabled", false); //lockPref("network.http.spdy.enabled.deps", false); //lockPref("network.http.spdy.enabled.http2", false); @@ -530,15 +349,7 @@ lockPref("dom.w3c_pointer_events.enabled", false); // Bench Diff : +0/5000 // >>>>>>>>>>>>>>>>>>>> -// Pref : Enable hardening against various fingerprinting vectors (Tor Uplift project) -// https://wiki.mozilla.org/Security/Tor_Uplift/Tracking -// https://bugzilla.mozilla.org/show_bug.cgi?id=1333933 lockPref("privacy.resistFingerprinting", true); - -// Pref : 4503 : disable mozAddonManager Web API (FF57+) -// [NOTE] As a side-effect in FF57-59 this allowed extensions to work on AMO. In FF60+ you also need -// to sanitize or clear extensions.webextensions.restrictedDomains (see 2662) to keep that side-effect -// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 lockPref("privacy.resistFingerprinting.block_mozAddonManager", true); // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> @@ -546,32 +357,11 @@ lockPref("privacy.resistFingerprinting.block_mozAddonManager", true); // Bench Diff : +0/5000 // >>>>>>>>>>>>>>>>>>>> -// Pref : 0864 : disable date/time picker (FF57+ default true) -// This can leak your locale if not en-US -// [1] https://trac.torproject.org/projects/tor/ticket/21787 -// Does this work efficiently with resistFingerprinting ?? lockPref("dom.forms.datetime", false); - -// Pref : Prevent leaking application locale/date format using JavaScript -// https://bugzilla.mozilla.org/show_bug.cgi?id=867501 -// https://hg.mozilla.org/mozilla-central/rev/52d635f2b33d -// Already applied by resistFingerprinting ? lockPref("javascript.use_us_english_locale", true); - -// Pref : Set Accept-Language HTTP header to en-US regardless of Firefox localization -// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language -// Already applied by resistFingerprinting ? lockPref("intl.regional_prefs.use_os_locales", false); - -// Pref : Locale and useragent. -// Already applied by resistFingerprinting ? lockPref("intl.locale.requested", "en-US"); - -// Pref : Spoof User-agent (re-enabled) -// See https://gitlab.com/librewolf-community/librewolf/issues/26 lockPref("general.useragent.override", "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0, 45"); - -// Pref : This does not work with resistFingerprinting. Still needed for ESR. lockPref("general.appname.override", "Netscape"); lockPref("general.appversion.override", "5.0 (Windows)"); lockPref("general.platform.override", "Win32"); @@ -582,199 +372,52 @@ lockPref("general.oscpu.override", "Windows NT 6.1"); // Bench Diff : +100/5000 // >>>>>>>>>>>>>>>>>>>>>> -// Pref : 0335 : disable Telemetry Coverage [FF64+] -// [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ lockPref("toolkit.coverage.endpoint.base", ""); lockPref("toolkit.coverage.opt-out", true); // [HIDDEN PREF] - -// DOWNLOADS -// Pref : 2652: disable adding downloads to the system's "recent documents" list lockPref("browser.download.manager.addToRecentDocs", false); //do not disable -// Pref : 2653: disable hiding mime types (Options>General>Applications) not associated with a plugin lockPref("browser.download.hide_plugins_without_extensions", false); //do not disable - -// Pref : 2617: remove webchannel whitelist -// Default value: -// "https://content.cdn.mozilla.net https://input.mozilla.org https://support.mozilla.org https://install.mozilla.org" lockPref("webchannel.allowObject.urlWhitelist", ""); - -// Pref : 2730b: disable offline cache on insecure sites (FF60+) -// [1] https://blog.mozilla.org/security/2018/02/12/restricting-appcache-secure-contexts/ lockPref("browser.cache.offline.insecure.enable", false); // default: false in FF62+ - -// Pref : 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS) -// [NOTE] A low setting of 5 or less will probably break some sites (e.g. gmail logins) -// To control HTML Meta tag and JS redirects, use an extension. -// Default: 20 lockPref("network.http.redirection-limit", 10); - -// Pref : 2731: enforce websites to ask whether to store data for offline use -// [1] https://support.mozilla.org/questions/1098540 -// [2] https://bugzilla.mozilla.org/959985 lockPref("offline-apps.allow_by_default", false); - -// EXTENSIONS -// Pref : 2660: lock down allowed extension directories -// [SETUP-CHROME] This will break extensions that do not use the default XPI directories -// [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/ -// [1] archived: https://archive.is/DYjAM lockPref("extensions.enabledScopes", 5); // (hidden pref) -// Breaks all default themes (including dark) starting with FF68.0+ - -// Tor-compatibility-patch lockPref("extensions.autoDisableScopes", 15); //Tor value must be 0 -// Pref : 2663: enable warning when websites try to install add-ons -// [SETTING] Privacy & Security>Permissions>Warn you when websites try to install add-ons lockPref("xpinstall.whitelist.required", true); // default: true - -// Pref : 2306: disable push notifications (FF44+) -// web apps can receive messages pushed to them from a server, whether or -// not the web app is in the foreground, or even currently loaded -// [1] https://developer.mozilla.org/docs/Web/API/Push_API lockPref("dom.push.enabled", false); lockPref("dom.push.connection.enabled", false); lockPref("dom.push.serverURL", ""); //default "wss://push.services.mozilla.com/" lockPref("dom.push.userAgentID", ""); - -// Pref : 2683: block top level window data: URIs (FF56+) -// [1] https://bugzilla.mozilla.org/1331351 -// [2] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/ -// [3] https://www.fxsitecompat.com/en-CA/docs/2017/data-url-navigations-on-top-level-window-will-be-blocked/ lockPref("security.data_uri.block_toplevel_data_uri_navigations", true); // default: true in FF59+ - -// Pref : 2618: disable exposure of system colors to CSS or canvas (FF44+) -// [NOTE] see second listed bug: may cause black on black for elements with undefined colors -// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876 lockPref("ui.use_standins_for_native_colors", true); // (hidden pref) -// Fix for widget.content.gtk-theme-override;Adwaita:light - -// Pref : 0403: disable individual unwanted/unneeded parts of the Kinto blocklists -// What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications -// As Firefox transitions to Kinto, the blocklists have been broken down into entries for certs to be -// revoked, extensions and plugins to be disabled, and gfx environments that cause problems or crashes lockPref("services.blocklist.onecrl.collection", ""); // revoked certificates lockPref("services.blocklist.addons.collection", ""); lockPref("services.blocklist.plugins.collection", ""); lockPref("services.blocklist.gfx.collection", ""); - -// Pref : disable showing about:blank as soon as possible during startup (FF60+) -// When default true (FF62+) this no longer masks the RFP resizing activity -// [1] https://bugzilla.mozilla.org/1448423 lockPref("browser.startup.blankWindow", false); - -// Pref : 2428: enforce DOMHighResTimeStamp API -// [WARNING] Required for normalization of timestamps and any timer resolution mitigations lockPref("dom.event.highrestimestamp.enabled", true); // default: true - -// Pref : 0516 : disable Onboarding (FF55+) -// Onboarding is an interactive tour/setup for new installs/profiles and features. Every time -// about:home or about:newtab is opened, the onboarding overlay is injected into that page -// [NOTE] Onboarding uses Google Analytics [2], and leaks resource://URIs [3] -// [1] https://wiki.mozilla.org/Firefox/Onboarding -// [2] https://github.com/mozilla/onboard/commit/db4d6c8726c89a5d6a241c1b1065827b525c5baf -// [3] https://bugzilla.mozilla.org/863246#c154 -// Pref : URL that kicks off the UI tour lockPref("privacy.trackingprotection.introURL", ""); - -// Pref : 0703 : disable HTTP Alternative Services (FF37+) -// [1] https://www.ghacks.net/2015/08/18/a-comprehensive-list-of-firefox-privacy-and-security-settings/#comment-3970881 -// [2] https://www.mnot.net/blog/2016/03/09/alt-svc lockPref("network.http.altsvc.enabled", false); lockPref("network.http.altsvc.oe", false); - -// Pref : 0709 : disable using UNC (Uniform Naming Convention) paths (FF61+) -// [1] https://trac.torproject.org/projects/tor/ticket/26424 lockPref("network.file.disable_unc_paths", true); // (hidden pref) - -// Pref : 0710 : disable GIO as a potential proxy bypass vector -// Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda, -// gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64) -// [1] https://bugzilla.mozilla.org/1433507 -// [2] https://trac.torproject.org/23044 -// [3] https://en.wikipedia.org/wiki/GVfs -// [4] https://en.wikipedia.org/wiki/GIO_(software) lockPref("network.gio.supported-protocols", ""); // (hidden pref) - -// Pref : 0809 : disable location bar suggesting "preloaded" top websites (FF54+) -// [1] https://bugzilla.mozilla.org/1211726 lockPref("browser.urlbar.usepreloadedtopurls.enabled", false); - -// Pref : 0810 : disable location bar making speculative connections (FF56+) -// [1] https://bugzilla.mozilla.org/1348275 lockPref("browser.urlbar.speculativeConnect.enabled", false); - -// Pref : 0850e: disable location bar one-off searches (FF51+) -// [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ lockPref("browser.urlbar.oneOffSearches", false); - -// Pref : 0911 : prevent cross-origin images from triggering an HTTP-Authentication prompt (FF55+) -// [1] https://bugzilla.mozilla.org/1357835 lockPref("network.auth.subresource-img-cross-origin-http-auth-allow", false); //Deprecated Active - -// Pref : 1030 : disable favicons in shortcuts -// URL shortcuts use a cached randomly named .ico file which is stored in your -// profile/shortcutCache directory. The .ico remains after the shortcut is deleted. -// If set to false then the shortcuts use a generic Firefox icon lockPref("browser.shell.shortcutFavicons", false); - -// Pref : 1032 : disable favicons in web notifications lockPref("alerts.showFavicons", false); // default: false - -// Pref : 1201 : disable old SSL/TLS "insecure" renegotiation (vulnerable to a MiTM attack) -// [WARNING] <2% of secure sites do NOT support the newer "secure" renegotiation, see [2] -// [1] https://wiki.mozilla.org/Security:Renegotiation -// [2] https://www.ssllabs.com/ssl-pulse/ lockPref("security.ssl.require_safe_negotiation", true); - -// Pref : 1205 : disable TLS1.3 0-RTT (round-trip time) (FF51+) -// [1] https://github.com/tlswg/tls13-spec/issues/1001 -// [2] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ lockPref("security.tls.enable_0rtt_data", false); // (FF55+ default true) - -// Pref : 1272 : display advanced information on Insecure Connection warning pages -// Only works when it's possible to add an exception -// i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/) -// [TEST] https://expired.badssl.com/ lockPref("browser.xul.error_pages.expert_bad_cert", true); - -// Pref : 1407 : disable special underline handling for a few fonts which you will probably never use [RESTART] -// Any of these fonts on your system can be enumerated for fingerprinting. -// [1] http://kb.mozillazine.org/Font.blacklist.underline_offset lockPref("font.blacklist.underline_offset", ""); - -// Pref : 1408 : disable graphite which FF49 turned back on by default -// In the past it had security issues. Update: This continues to be the case, see [1] -// [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 lockPref("gfx.font_rendering.graphite.enabled", false); - -// Pref : 1604 : CROSS ORIGIN: control the amount of information to send (FF52+) -// Pref : 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port lockPref("network.http.referer.XOriginTrimmingPolicy", 0); - -// Pref : 1605 : ALL: disable spoofing a referer -// [WARNING] Spoofing effectively disables the anti-CSRF (Cross-Site Request Forgery) protections that some sites may rely on -// Default false lockPref("network.http.referer.spoofSource", false); - -// Pref : 1801 : set default plugin state (i.e. new plugins on discovery) to never activate -// Pref : 0=disabled, 1=ask to activate, 2=active - you can override individual plugins lockPref("plugin.default.state", 1); lockPref("plugin.defaultXpi.state", 1); - -// Pref : 2026 : disable canvas capture stream (FF41+) -// [1] https://developer.mozilla.org/docs/Web/API/HTMLCanvasElement/captureStream lockPref("canvas.capturestream.enabled", false); - -// Pref : 2027 : disable camera image capture (FF35+) -// [1] https://trac.torproject.org/projects/tor/ticket/16339 lockPref("dom.imagecapture.enabled", false); // default: false - -// Pref : 2028 : disable offscreen canvas (FF44+) -// [1] https://developer.mozilla.org/docs/Web/API/OffscreenCanvas lockPref("gfx.offscreencanvas.enabled", false); // default: false - -// Pref : 2201 : prevent websites from disabling new window features -// [1] http://kb.mozillazine.org/Prevent_websites_from_disabling_new_window_features lockPref("dom.disable_window_open_feature.close", true); lockPref("dom.disable_window_open_feature.location", true); // default: true lockPref("dom.disable_window_open_feature.menubar", true); @@ -784,35 +427,12 @@ lockPref("dom.disable_window_open_feature.resizable", true); // default: true lockPref("dom.disable_window_open_feature.status", true); // status bar - default: true lockPref("dom.disable_window_open_feature.titlebar", true); lockPref("dom.disable_window_open_feature.toolbar", true); - -// Pref : 2202 : prevent scripts from moving and resizing open windows lockPref("dom.disable_window_move_resize", true); - -// Pref : 2426 : disable Intersection Observer API (FF53+) -// Took almost a year to complete, three versions late to 'stable' (as default false), -// number 1 cause of crashes in nightly numerous times, and is (primarily) an -// ad network API for "ad viewability checks" down to a pixel level -// [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API -// [2] https://w3c.github.io/IntersectionObserver/ -// [3] https://bugzilla.mozilla.org/1243846 lockPref("dom.IntersectionObserver.enabled", false); - -// Pref : 2601 : prevent accessibility services from accessing your browser [RESTART] -// [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser -// [1] https://support.mozilla.org/kb/accessibility-services lockPref("accessibility.force_disabled", 1); - -// Pref : 2606 : disable UITour backend so there is no chance that a remote page can use it lockPref("browser.uitour.enabled", false); lockPref("browser.uitour.url", ""); - -// Pref : 2611 : disable middle mouse click opening links from clipboard -// [1] https://trac.torproject.org/projects/tor/ticket/10089 -// [2] http://kb.mozillazine.org/Middlemouse.contentLoadURL lockPref("middlemouse.contentLoadURL", false); - -// Pref : 2616 : remove special permissions for certain mozilla domains (FF35+) -// [1] resource://app/defaults/permissions lockPref("permissions.manager.defaultsUrl", ""); // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>