2019-04-24 23:38:24 +00:00
//
/ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * * * * * * * * * * * * @ quindecim | user . js * * * * * * * * * * * * * *
2019-04-25 16:58:17 +00:00
* *
* project based on gHacksuser . js and Librefox Browser . Redesigned for Fennec *
2019-04-24 23:38:24 +00:00
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * /
//
// gHacks: https://github.com/ghacksuserjs/ghacks-user.js
// Librefox: https://github.com/intika/Librefox
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-27 09:27:34 +00:00
// Section : Quiet Fox
// >>>>>>>>>>>>>>>>>>>>>
// Pref : Disable auto-CHECKING for extension and theme updates
// user_pref("extensions.update.enabled", false);
// Pref : Disable app from auto-update
user _pref ( "app.update.auto" , false ) ;
user _pref ( "app.update.autodownload" , "" ) ;
user _pref ( "app.update.channel" , "" ) ;
user _pref ( "app.update.timerFirstInterval" , - 1 ) ;
user _pref ( "app.update.timerMinimumDelay" , - 1 ) ;
user _pref ( "app.update.url.android" , "" ) ;
// Pref : Opt-out of add-on metadata updates
// https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/
user _pref ( "extensions.getAddons.cache.enabled" , false ) ;
user _pref ( "extensions.getAddons.cache.lastUpdate" , 0 ) ;
user _pref ( "extensions.getAddons.cache.LastUpdate" , 0 ) ;
// Pref : Never check updates for search engines
// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_auto-update-checking
user _pref ( "browser.search.update" , false ) ;
user _pref ( "browser.search.update.interval" , - 1 ) ;
user _pref ( "browser.search.update.log" , false ) ;
// Pref : Disable sending Flash Player crash reports
user _pref ( "dom.ipc.plugins.flash.subprocess.crashreporter.enabled" , false ) ;
// Pref : Disable sending the URL of the website where a plugin crashed
user _pref ( "dom.ipc.plugins.reportCrashURL" , false ) ;
// Pref : Disable telemetry
user _pref ( "toolkit.telemetry.enabled" , false ) ;
user _pref ( "toolkit.telemetry.reportingpolicy.firstRun" , false ) ;
user _pref ( "toolkit.telemetry.server" , "data:," ) ;
user _pref ( "toolkit.telemetry.server_owner" , "" ) ;
user _pref ( "toolkit.telemetry.unified" , false ) ;
// Pref : Disable collection/sending of the health report (healthreport.sqlite*)
user _pref ( "datareporting.policy.currentPolicyVersion" , 0 ) ;
user _pref ( "datareporting.policy.dataSubmissionEnabled" , false ) ;
user _pref ( "datareporting.policy.currentPolicyAcceptedVersion" , 0 ) ;
user _pref ( "datareporting.policy.dataSubmissionPolicyAcceptedVersion" , 0 ) ;
user _pref ( "datareporting.policy.dataSubmissionPolicyBypassNotification" , false ) ;
user _pref ( "datareporting.policy.dataSubmissionPolicyNotifiedTime" , "" ) ;
user _pref ( "datareporting.policy.FirstRunURL" , "" ) ;
user _pref ( "datareporting.policy.firstRunURL" , "" ) ;
user _pref ( "datareporting.policy.minimumPolicyVersion" , 0 ) ;
user _pref ( "datareporting.policy.minimumPolicyVersion.channel-beta" , 0 ) ;
// Pref : Disable personalized Extension Recommendations in about:addons and AMO
2019-04-27 17:36:54 +00:00
// [NOTE] This pref has no effect when Health Reports are disabled
2019-04-27 09:27:34 +00:00
// https://support.mozilla.org/kb/personalized-extension-recommendations
user _pref ( "browser.discovery.enabled" , false ) ; // [DEFAULT: false]
// Pref : Disable Crash Reports
user _pref ( "breakpad.reportURL" , "" ) ;
// Pref : Disable automatic captive portal detection
// https://en.wikipedia.org/wiki/Captive_portal
// https://wiki.mozilla.org/Necko/CaptivePortal
// https://trac.torproject.org/projects/tor/ticket/21790
user _pref ( "captivedetect.canonicalURL" , "" ) ;
user _pref ( "network.captive-portal-service.enabled" , false ) ;
user _pref ( "network.captive-portal-service.backoffFactor" , "" ) ;
user _pref ( "network.captive-portal-service.maxInterval" , - 1 ) ;
user _pref ( "network.captive-portal-service.minInterval" , - 1 ) ;
// Pref : Disable Network Connectivity checks
// https://bugzilla.mozilla.org/1460537
user _pref ( "network.connectivity-service.enabled" , false ) ; // [DEFAULT: true]
user _pref ( "network.connectivity-service.IPv4.url" , "" ) ;
user _pref ( "network.connectivity-service.IPv6.url" , "" ) ;
user _pref ( "network.connectivity-service.DNSv4.domain" , "" ) ;
user _pref ( "network.connectivity-service.DNSv6.domain" , "" ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-24 23:38:24 +00:00
// Section : IJWY To Shut Up
// I Just Want You To Shut Up : Closing all non necessary communication to mozilla.org etc.
// >>>>>>>>>>>>>>>>>>>>>
// Pref :
user _pref ( "urlclassifier.passwordAllowTable" , "" ) ;
// Default Value
// goog-passwordwhite-proto
// Pref :
user _pref ( "app.support.baseURL" , "" ) ;
// Default Value
// https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
// Pref :
user _pref ( "extensions.getAddons.compatOverides.url" , "" ) ;
// Default Value
// https://services.addons.mozilla.org/api/v3/addons/compat-override/?guid=%IDS%&lang=%LOCALE%
// Pref :
user _pref ( "extensions.getAddons.get.url" , "" ) ;
// Default Value
// https://services.addons.mozilla.org/api/v3/addons/search/?guid=%IDS%&lang=%LOCALE%
// Pref :
user _pref ( "extensions.getAddons.langpacks.url" , "" ) ;
// Default Value
// https://services.addons.mozilla.org/api/v3/addons/language-tools/?app=firefox&type=language&appversion=%VERSION%
// Pref :
user _pref ( "extensions.getAddons.search.browseURL" , "" ) ;
// Default Value
// https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
// Pref :
user _pref ( "identity.sync.tokenserver.uri" , "" ) ;
// Default Value
// https://token.services.mozilla.com/1.0/sync/1.5
// Pref :
user _pref ( "media.decoder-doctor.new-issue-endpoint" , "" ) ;
// Default Value
// https://webcompat.com/issues/new
// Pref : Accept Only 1st Party Cookies
// http://kb.mozillazine.org/Network.cookie.cookieBehavior#1
// Pref :
user _pref ( "network.trr.confirmationNS" , "" ) ;
// Default Value
// example.com
// Pref : Test To Make FFox Silent
user _pref ( "security.content.signature.root_hash" , "" ) ;
// Default Value
// remote-settings.content-signature.mozilla.org
// Pref :
user _pref ( "services.settings.default_signer" , "" ) ;
// Default Value
// remote-settings.content-signature.mozilla.org
// Pref :
user _pref ( "services.settings.server" , "" ) ;
// Default Value
// https://firefox.settings.services.mozilla.com/v1
// Pref :
user _pref ( "urlclassifier.phishTable" , "" ) ;
// Default Value
// goog-phish-proto,test-phish-simple
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : Miscellaneous
// >>>>>>>>>>>>>>>>>>>>>>
2019-04-27 09:27:34 +00:00
// Pref : Disable Web Compatibility Reporter
// Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla
user _pref ( "extensions.webcompat-reporter.enabled" , false ) ;
user _pref ( "extensions.webcompat-reporter.newIssueEndpoint" , "" ) ;
// Pref : Disable System Add-on updates
2019-04-24 23:38:24 +00:00
user _pref ( "extensions.systemAddon.update.url" , "" ) ;
// Pref :
user _pref ( "app.feedback.baseURL" , "" ) ;
// Pref :
user _pref ( "devtools.devices.url" , "" ) ;
// Pref :
user _pref ( "dom.battery.enabled" , false ) ;
// Pref : Maximum pop launch at the same time
user _pref ( "dom.popup_maximum" , 4 ) ;
// Pref :
user _pref ( "dom.registerProtocolHandler.insecure.enabled" , true ) ;
// Pref : Block list url disabled
// gHacks tune this to minimize privacy issue.. its complitely disabled here
// Disabled complitely
user _pref ( "extensions.blocklist.url" , "" ) ;
user _pref ( "extensions.blocklist.detailsURL" , "" ) ;
user _pref ( "extensions.blocklist.itemURL" , "" ) ;
user _pref ( "extensions.update.background.url" , "" ) ;
user _pref ( "extensions.getAddons.browseAddons" , "" ) ;
// Pref : Disable Firefox Accounts and Sync
user _pref ( "identity.fxaccounts.auth.uri" , "" ) ;
user _pref ( "identity.fxaccounts.remote.oauth.uri" , "" ) ;
user _pref ( "identity.fxaccounts.remote.profile.uri" , "" ) ;
// [FENNEC][BUG] If empty "Settings" faded
2019-04-26 00:08:12 +00:00
user _pref ( "identity.fxaccounts.remote.webchannel.uri" , "https://0.0.0.0" ) ;
// Pref : Disable sync
2019-04-24 23:38:24 +00:00
user _pref ( "services.sync.enabled" , false ) ;
2019-04-26 00:08:12 +00:00
user _pref ( "browser.startup.homepage_override.mstone" , "ignore" ) ;
2019-04-24 23:38:24 +00:00
user _pref ( "webextensions.storage.sync.enabled" , false ) ;
user _pref ( "webextensions.storage.sync.serverURL" , "" ) ;
user _pref ( "privacy.item.syncAccount" , false ) ;
2019-04-26 00:08:12 +00:00
// Pref : [FENNEC] Disable snippets
user _pref ( "browser.snippets.enabled" , false ) ;
2019-04-27 09:27:34 +00:00
user _pref ( "browser.snippets.firstrunHomepage.enabled" , false ) ;
2019-04-26 00:08:12 +00:00
user _pref ( "browser.snippets.firstrunHomepageenabled" , false ) ;
user _pref ( "browser.snippets.statsUrl" , "" ) ;
user _pref ( "browser.snippets.updateInterval" , - 1 ) ;
user _pref ( "browser.snippets.updateUrl" , "" ) ;
user _pref ( "browser.snippets.syncPromo.enabled" , false ) ;
2019-04-24 23:38:24 +00:00
// Pref : Force Punycode for Internationalized Domain Names
// http://kb.mozillazine.org/Network.IDN_show_punycode
// https://www.xudongz.com/blog/2017/idn-phishing/
// https://wiki.mozilla.org/IDN_Display_Algorithm
// https://en.wikipedia.org/wiki/IDN_homograph_attack
// https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/
// CIS Mozilla Firefox 24 ESR v1.0.0 - 3.6
user _pref ( "network.IDN_show_punycode" , true ) ;
// Pref : Disable prefetching of <link rel="next"> URLs
// http://kb.mozillazine.org/Network.prefetch-next
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#Is_there_a_preference_to_disable_link_prefetching.3F
// Link prefetching is when a webpage hints to the browser that certain pages are likely to be visited,
// so the browser downloads them immediately so they can be displayed immediately when the user requests it.
user _pref ( "network.prefetch-next" , false ) ;
// Pref : Disable speculative pre-connections
// Disable prefetch link on hover.
// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_speculative-pre-connections
// https://bugzilla.mozilla.org/show_bug.cgi?id=814169
user _pref ( "network.http.speculative-parallel-limit" , 0 ) ;
// Pref : Disable DOM timing API
// https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI
// https://www.w3.org/TR/navigation-timing/#privacy
user _pref ( "dom.enable_performance" , false ) ;
user _pref ( "dom.enable_performance_navigation_timing" , false ) ;
// Pref : Disable "beacon" asynchronous HTTP transfers (used for analytics)
// https://developer.mozilla.org/en-US/docs/Web/API/navigator.sendBeacon
user _pref ( "beacon.enabled" , false ) ;
// Pref : Disable speech recognition
// https://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html
// https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition
// https://wiki.mozilla.org/HTML5_Speech_API
user _pref ( "media.webspeech.recognition.enable" , false ) ;
// Pref : Don't use Mozilla-provided location-specific search engines
user _pref ( "browser.search.geoSpecificDefaults" , false ) ;
// Pref : Don't monitor OS online/offline connection state
// https://trac.torproject.org/projects/tor/ticket/18945
user _pref ( "network.manage-offline-status" , false ) ;
// Pref : Set File URI Origin Policy
// http://kb.mozillazine.org/Security.fileuri.strict_origin_policy
// CIS Mozilla Firefox 24 ESR v1.0.0 - 3.8
user _pref ( "security.fileuri.strict_origin_policy" , true ) ;
// Pref : Disable SVG in OpenType fonts
// https://wiki.mozilla.org/SVGOpenTypeFonts
// https://github.com/iSECPartners/publications/tree/master/reports/Tor%20Browser%20Bundle
user _pref ( "gfx.font_rendering.opentype_svg.enabled" , false ) ;
// Pref : Ensure you have a security delay when installing add-ons (milliseconds)
// http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox
// http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/
user _pref ( "security.dialog_enable_delay" , 700 ) ;
// Default Value
// 97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
user _pref ( "services.blocklist.addons.signer" , "" ) ;
// Default Value
// remote-settings.content-signature.mozilla.org
// Pref :
user _pref ( "services.blocklist.gfx.signer" , "" ) ;
// Default Value
// remote-settings.content-signature.mozilla.org
// Pref :
user _pref ( "services.blocklist.onecrl.signer" , "" ) ;
// Default Value
// onecrl.content-signature.mozilla.org
// Pref :
user _pref ( "services.blocklist.pinning.signer" , "" ) ;
// Default Value
// pinning-preload.content-signature.mozilla.org
// Pref :
user _pref ( "services.blocklist.plugins.signer" , "" ) ;
// Pref : Debugging settings
user _pref ( "devtools.debugger.remote-enabled" , false ) ;
// Pref : Disable remote debugging
// https://developer.mozilla.org/en-US/docs/Tools/Remote_Debugging/Debugging_Firefox_Desktop
// https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox#Advanced_settings
user _pref ( "devtools.debugger.force-local" , true ) ;
// Pref : Prevent accessibility services from accessing your browser
// https://support.mozilla.org/kb/accessibility-services
user _pref ( "accessibility.force_disabled" , 1 ) ;
// Pref : Remove temp files opened with an external application
// https://bugzilla.mozilla.org/302433
user _pref ( "browser.helperApps.deleteTempFileOnExit" , true ) ;
// Pref : Disable various developer tools in browser context
// https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676
user _pref ( "devtools.chrome.enabled" , false ) ;
// Pref : Disable MathML (Mathematical Markup Language)
// [TEST] http://browserspy.dk/mathml.php
// https://bugzilla.mozilla.org/1173199
user _pref ( "mathml.disabled" , true ) ;
// Pref : Disable in-content SVG (Scalable Vector Graphics)
// [SETUP-WEB] Expect breakage incl. youtube player controls. Best left for a "hardened" profile.
// https://bugzilla.mozilla.org/1216893
// user_pref("svg.disabled", true);
// Pref : Disable middle mouse click opening links from clipboard
// https://trac.torproject.org/projects/tor/ticket/10089
// http://kb.mozillazine.org/Middlemouse.contentLoadURL
user _pref ( "middlemouse.contentLoadURL" , false ) ;
// Pref : Limit HTTP redirects (this does not control redirects with HTML meta tags or JS)
// [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins)
// To control HTML Meta tag and JS redirects, use an extension. Default is 20
user _pref ( "network.http.redirection-limit" , 15 ) ;
// Pref : Remove webchannel whitelist
user _pref ( "webchannel.allowObject.urlWhitelist" , "" ) ;
// Pref : Disable exposure of system colors to CSS or canvas
// [NOTE] May cause black on black for elements with undefined colors
// https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876
// user_pref("ui.use_native_colors", true);
// Pref : Discourage downloading to desktop (0=desktop 1=downloads 2=last used)
user _pref ( "browser.download.folderList" , 2 ) ;
// Pref : Enforce user interaction for security by always asking the user where to download
user _pref ( "browser.download.useDownloadDir" , false ) ;
// Pref : Disable adding downloads to the system's "recent documents" list
user _pref ( "browser.download.manager.addToRecentDocs" , false ) ;
// Pref : Disable "open with" in download dialog
// This is very useful to enable when the browser is sandboxed (e.g. via AppArmor)
// in such a way that it is forbidden to run external applications.
// [NOTE] This may interfere with some users' workflow or methods
// https://bugzilla.mozilla.org/1281959
user _pref ( "browser.download.forbid_open_with" , true ) ;
// Pref : Lock down allowed extension directories
// [SETUP-CHROME] This will break extensions, language packs, themes and any other XPI files which are
// installed outside of profile directories
// https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/
// archived: https://archive.is/DYjAM
user _pref ( "extensions.enabledScopes" , 1 ) ; // [DEFAULT: 1]
user _pref ( "extensions.autoDisableScopes" , 15 ) ; // [DEFAULT: 15]
// Pref : Enable warning when websites try to install add-ons
user _pref ( "xpinstall.whitelist.required" , true ) ; // [DEFAULT: true]
// Pref : Enable CSP (Content Security Policy)
// https://developer.mozilla.org/docs/Web/HTTP/CSP
user _pref ( "security.csp.enable" , true ) ; // [DEFAULT: true]
// Pref : Block top level window data: URIs
// https://bugzilla.mozilla.org/1331351
// https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/
// https://www.fxsitecompat.com/en-CA/docs/2017/data-url-navigations-on-top-level-window-will-be-blocked/
user _pref ( "security.data_uri.block_toplevel_data_uri_navigations" , true ) ; // [DEFAULT: true]
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-27 17:36:54 +00:00
// Section : Web Workers
// >>>>>>>>>>>>>>>>>>>>>>
// Pref : Disable service workers
// Service workers essentially act as proxy servers that sit between web apps, and the browser and network, are event driven, and can control the web page/site it is associated with, intercepting and modifying navigation and resource requests, and caching resources.
// [NOTE] Service worker APIs are hidden (in Firefox) and cannot be used when in PB mode.
// [NOTE] Service workers only run over HTTPS. Service Workers have no DOM access.
user _pref ( "dom.serviceWorkers.enabled" , false ) ;
// Pref : Disable web notifications
// https://developer.mozilla.org/docs/Web/API/Notifications_API
user _pref ( "dom.webnotifications.enabled" , false ) ;
user _pref ( "dom.webnotifications.serviceworker.enabled" , false ) ;
// Pref : Disable push notifications
// Web apps can receive messages pushed to them from a server, whether or not the web app is in the foreground, or even currently loaded
// https://developer.mozilla.org/docs/Web/API/Push_API
user _pref ( "dom.push.alwaysConnect" , false ) ;
user _pref ( "dom.push.enabled" , false ) ;
user _pref ( "dom.push.debug" , false ) ;
user _pref ( "dom.push.connection.enabled" , false ) ;
user _pref ( "dom.push.serverURL" , "" ) ;
user _pref ( "dom.push.userAgentID" , "" ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : DOM (Document Object Model) & Javascript
// >>>>>>>>>>>>>>>>>>>>>>
// Pref : Disable right-click menu manipulation via JavaScript
user _pref ( "dom.event.contextmenu.enabled" , false ) ;
// Pref : Disable website access to clipboard events/content
// Disabling clipboard events breaks Ctrl+C/X/V copy/cut/paste functionaility in JS-based web applications (Google Docs...)
// https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/dom.event.clipboardevents.enabled
user _pref ( "dom.event.clipboardevents.enabled" , false ) ;
// Pref : Disable "Confirm you want to leave" dialog on page close
// Does not prevent JS leaks of the page close event.
// https://developer.mozilla.org/docs/Web/Events/beforeunload
// https://support.mozilla.org/questions/1043508
user _pref ( "dom.disable_beforeunload" , true ) ;
// Pref : Disable shaking the screen (Vibrator API)
user _pref ( "dom.vibrator.enabled" , false ) ;
// Pref : Disable asm.js
// http://asmjs.org/
// https://www.mozilla.org/security/advisories/mfsa2015-29/
// https://www.mozilla.org/security/advisories/mfsa2015-50/
// https://www.mozilla.org/security/advisories/mfsa2017-01/#CVE-2017-5375
// https://www.mozilla.org/security/advisories/mfsa2017-05/#CVE-2017-5400
// https://rh0dev.github.io/blog/2017/the-return-of-the-jit/
user _pref ( "javascript.options.asmjs" , false ) ;
// Pref : Disable Ion and baseline JIT to help harden JS against exploits
// If false, causes the odd site issue and there is also a performance loss
// https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817
// user_pref("javascript.options.ion", false);
// user_pref("javascript.options.baselinejit", false);
// Pref : Disable WebAssembly
// https://webassembly.org/
// https://developer.mozilla.org/docs/WebAssembly
// https://en.wikipedia.org/wiki/WebAssembly
// https://trac.torproject.org/projects/tor/ticket/21549
// user_pref("javascript.options.wasm", false);
// Pref : Disable Intersection Observer API
// Almost a year to complete, three versions late to stable (as default false), number #1 cause of crashes in nightly numerous times, and is (primarily) an ad network API for "ad viewability checks" down to a pixel level
// https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API
// https://w3c.github.io/IntersectionObserver/
// https://bugzilla.mozilla.org/1243846
user _pref ( "dom.IntersectionObserver.enabled" , false ) ;
// Pref : Disable Shared Memory (Spectre mitigation)
// https://github.com/tc39/ecmascript_sharedmem/blob/master/TUTORIAL.md
// https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/
user _pref ( "javascript.options.shared_memory" , false ) ; // [DEFAULT: false]
// Pref : Enforce DOMHighResTimeStamp API
// [WARNING] Required for normalization of timestamps and any timer resolution mitigations
user _pref ( "dom.event.highrestimestamp.enabled" , true ) ; // [DEFAULT: true]
// Pref : Enable (limited but sufficient) window.opener protection
// Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set
user _pref ( "dom.targetBlankNoOpener.enabled" , true ) ; // [DEFAULT: false]
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-24 23:38:24 +00:00
// Section : Media / Camera / Mic
// >>>>>>>>>>>>>>>>>>>>>>
2019-04-27 17:36:54 +00:00
// Pref : WebSockets is a technology that makes it possible to open an interactive communication session between the user's browser and a server. (May leak IP when using proxy/VPN)
2019-04-24 23:38:24 +00:00
user _pref ( "media.peerconnection.enabled" , false ) ;
// Pref : Limit WebRTC IP leaks if using WebRTC
// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416
// https://wiki.mozilla.org/Media/WebRTC/Privacy
user _pref ( "media.peerconnection.ice.default_address_only" , true ) ;
user _pref ( "media.peerconnection.ice.no_host" , true ) ;
user _pref ( "media.peerconnection.use_document_iceservers" , false ) ;
user _pref ( "media.peerconnection.identity.enabled" , false ) ;
user _pref ( "media.peerconnection.identity.timeout" , 1 ) ;
user _pref ( "media.peerconnection.turn.disable" , true ) ;
user _pref ( "media.peerconnection.ice.tcp" , false ) ;
// Pref : Disable webGL I/II
// WebGL introduce high fingerprinting... (webgl is direct hardware js)
user _pref ( "webgl.disabled" , true ) ;
user _pref ( "webgl.enable-webgl2" , false ) ;
user _pref ( "webgl.min_capability_mode" , true ) ;
// Pref : Disable webGL II/II
// WebGL introduce high fingerprinting... (webgl is direct hardware js)
user _pref ( "pdfjs.enableWebGL" , false ) ;
user _pref ( "webgl.disable-extensions" , true ) ;
user _pref ( "webgl.disable-fail-if-major-performance-caveat" , true ) ;
// Pref : Disable audiocapture
user _pref ( "media.getusermedia.browser.enabled" , false ) ;
user _pref ( "media.getusermedia.audiocapture.enabled" , false ) ;
// Pref : Disable camera
user _pref ( "device.camera.enabled" , false ) ;
// Pref : Disable canvas capture stream
// https://developer.mozilla.org/docs/Web/API/HTMLCanvasElement/captureStream
user _pref ( "canvas.capturestream.enabled" , false ) ;
// Pref : Disable camera image capture
// https://trac.torproject.org/projects/tor/ticket/16339
user _pref ( "dom.imagecapture.enabled" , false ) ; // [DEFAULT: false]
// Pref : Disable offscreen canvas
// https://developer.mozilla.org/docs/Web/API/OffscreenCanvas
user _pref ( "gfx.offscreencanvas.enabled" , false ) ; // [DEFAULT: false]
// Pref : Disable autoplay of HTML5 media
// 0=Allowed, 1=Blocked, 2=Prompt
// [NOTE] You can set exceptions under site permissions
user _pref ( "media.autoplay.default" , 1 ) ;
// Pref : Disable autoplay of HTML5 media if you interacted with the site
user _pref ( "media.autoplay.enabled.user-gestures-needed" , false ) ;
// Pref : Disable audio autoplay in non-active tabs
// https://www.ghacks.net/2016/11/14/firefox-51-blocks-automatic-audio-playback-in-non-active-tabs/
user _pref ( "media.block-autoplay-until-in-foreground" , true ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-25 16:58:17 +00:00
// Section : Location Bar / Search Bar / Suggestions / History / Forms
// >>>>>>>>>>>>>>>>>>>>
// Pref : Disable location bar using search
// Don't leak typos to a search engine, give an error message instead
2019-04-26 00:08:12 +00:00
// user_pref("keyword.enabled", false); // [DEFAULT: true]
2019-04-25 16:58:17 +00:00
// Pref : Don't try to guess domain names when entering an invalid domain name in URL bar
// http://www-archive.mozilla.org/docs/end-user/domain-guessing.html
user _pref ( "browser.fixup.alternate.enabled" , false ) ;
// Pref : Don't trim HTTP off of URLs in the address bar
// https://bugzilla.mozilla.org/show_bug.cgi?id=665580
user _pref ( "browser.urlbar.trimURLs" , false ) ;
// Pref : Limit history leaks via enumeration (PER TAB: back/forward)
// This is a PER TAB session history. You still have a full history stored under all history
// Default=50, minimum=1=currentpage, 2 is the recommended minimum as some pages use it as a means of referral (e.g. hotlinking), 4 or 6 or 10 may be more practical
user _pref ( "browser.sessionhistory.max_entries" , 10 ) ;
// Pref : Disable CSS querying page history - CSS history leak
// [NOTE] This has NEVER been fully "resolved": in Mozilla/docs it is stated it's only in 'certain circumstances'
// [TEST] http://lcamtuf.coredump.cx/yahh/ (see github wiki APPENDIX C on how to use)
// https://dbaron.org/mozilla/visited-privacy
// https://bugzilla.mozilla.org/147777
// https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector
user _pref ( "layout.css.visited_links_enabled" , false ) ;
// Pref : Disable search bar LIVE search suggestions
user _pref ( "browser.search.suggest.enabled" , false ) ;
// Pref : Disable search and form history
// [NOTE] You can clear formdata on exiting Firefox
user _pref ( "browser.formfill.enable" , false ) ;
// Pref : Disable date/time picker
2019-04-26 00:08:12 +00:00
// [WARNING] This can leak your locale if not en-US
2019-04-25 16:58:17 +00:00
// https://trac.torproject.org/projects/tor/ticket/21787
2019-04-26 00:08:12 +00:00
// user_pref("dom.forms.datetime", false);
2019-04-25 16:58:17 +00:00
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-24 23:38:24 +00:00
// Section : Security
// >>>>>>>>>>>>>>>>>>>>
// Pref : Pre-populate the current URL but do not pre-fetch the certificate in the
// "Add Security Exception" dialog
// http://kb.mozillazine.org/Browser.ssl_override_behavior
// https://github.com/pyllyukko/user.js/issues/210
user _pref ( "browser.ssl_override_behavior" , 1 ) ;
// Pref : Blocking GD Parking Scam Site
user _pref ( "network.dns.localDomains" , "librefox.com" ) ;
// Pref : Disable HSTS preload list (pre-set HSTS sites list provided by Mozilla)
// https://blog.mozilla.org/security/2012/11/01/preloading-hsts/
// https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List
// https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
user _pref ( "network.stricttransportsecurity.preloadlist" , false ) ;
// Pref : Check disabled section
// OCSP Leaks the visited sited exactly same issue as safebrowsing.
// Stapling have the site itsefl proof that his certificate is good
// through the CA so apparently nothing is leaked in this case.
// https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
user _pref ( "security.OCSP.enabled" , 0 ) ;
user _pref ( "security.OCSP.require" , false ) ;
user _pref ( "security.ssl.enable_ocsp_stapling" , true ) ;
// Pref :
user _pref ( "security.ssl.errorReporting.enabled" , false ) ;
// Pref : Enfore Public Key Pinning
// https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
// https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning
// "2. Strict. Pinning is always enforced."
user _pref ( "security.cert_pinning.enforcement_level" , 2 ) ;
// Pref :
user _pref ( "security.mixed_content.upgrade_display_content" , true ) ;
user _pref ( "security.mixed_content.block_object_subrequest" , true ) ;
user _pref ( "security.mixed_content.block_display_content" , true ) ;
user _pref ( "security.mixed_content.block_active_content" , true ) ;
// Pref : Disallow SHA-1
// https://bugzilla.mozilla.org/show_bug.cgi?id=1302140
// https://shattered.io/
user _pref ( "security.pki.sha1_enforcement_level" , 1 ) ;
// Pref :
user _pref ( "security.ssl.errorReporting.automatic" , false ) ;
user _pref ( "security.ssl.errorReporting.url" , "" ) ;
// Pref : Warn the user when server doesn't support RFC 5746 ("safe" renegotiation)
// https://wiki.mozilla.org/Security:Renegotiation#security.ssl.treat_unsafe_negotiation_as_broken
// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555
user _pref ( "security.ssl.treat_unsafe_negotiation_as_broken" , true ) ;
// Pref :
user _pref ( "security.ssl3.rsa_des_ede3_sha" , false ) ;
user _pref ( "security.ssl3.rsa_aes_256_sha" , false ) ;
user _pref ( "security.ssl3.rsa_aes_128_sha" , false ) ;
// Pref : Disable insecure TLS version fallback
// https://bugzilla.mozilla.org/show_bug.cgi?id=1084025
// https://github.com/pyllyukko/user.js/pull/206#issuecomment-280229645
user _pref ( "security.tls.version.fallback-limit" , 3 ) ;
// Pref : Only allow TLS 1.[0-3]
// http://kb.mozillazine.org/Security.tls.version.*
user _pref ( "security.tls.version.min" , 2 ) ;
2019-04-26 00:08:12 +00:00
// Pref : Limits the amount of entries in your DNS cache which can give someone who has access to your computer a list of websites you visited
user _pref ( "network.dnsCacheEntries" , 100 ) ;
2019-04-24 23:38:24 +00:00
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-27 09:27:34 +00:00
// Section : Block Implicit Outbound
2019-04-24 23:38:24 +00:00
// >>>>>>>>>>>>>>>>>>>>
2019-04-27 09:27:34 +00:00
// Pref : Disable prefetching of <link rel="next"> URLs
// http://kb.mozillazine.org/Network.prefetch-next
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#Is_there_a_preference_to_disable_link_prefetching.3F
// Link prefetching is when a webpage hints to the browser that certain pages are likely to be visited, so the browser downloads them immediately so they can be displayed immediately when the user requests it.
user _pref ( "network.prefetch-next" , false ) ;
2019-04-24 23:38:24 +00:00
// Pref : Disable DNS prefetching
// http://kb.mozillazine.org/Network.dns.disablePrefetch
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching
user _pref ( "network.dns.disablePrefetch" , true ) ;
2019-04-27 09:27:34 +00:00
// Pref : Disable Seer/Necko
// https://developer.mozilla.org/docs/Mozilla/Projects/Necko
user _pref ( "network.predictor.enabled" , false ) ;
user _pref ( "network.predictor.cleaned-up" , true ) ;
// Pref : Disable speculative pre-connections
// Disable prefetch link on hover.
// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_speculative-pre-connections
// https://bugzilla.mozilla.org/show_bug.cgi?id=814169
user _pref ( "network.http.speculative-parallel-limit" , 0 ) ;
// Pref : Disable pinging URIs specified in HTML <a> ping= attributes
// http://kb.mozillazine.org/Browser.send_pings
user _pref ( "browser.send_pings" , false ) ;
// Pref : When browser pings are enabled, only allow pinging the same host as the origin page
// http://kb.mozillazine.org/Browser.send_pings.require_same_host
user _pref ( "browser.send_pings.require_same_host" , true ) ;
// Pref : Disable predictor / prefetching
// Network predicator load pages before they are opened with mose hover for example
user _pref ( "network.predictor.enable-prefetch" , false ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : HTTP / TCP/IP / DNS / PROXY / SOCKS etc.
// >>>>>>>>>>>>>>>>>>>>
// Pref : Disable IPv6
// If your OS or ISP does not support IPv6, there is no reason to have this preference set to false.
user _pref ( "network.dns.disableIPv6" , true ) ;
// Pref : Disable HTTP2 (which was based on SPDY which is now deprecated)
// HTTP2 raises concerns with "multiplexing" and "server push", does nothing to enhance privacy, and in fact opens up a number of server-side fingerprinting opportunities.
// [SETUP-PERF] Relax this if you have FPI enabled and you understand the consequences. FPI isolates these, but it was designed with the Tor protocol in mind, and the Tor Browser has extra protection, including enhanced sanitizing per Identity.
// https://http2.github.io/faq/
// https://blog.scottlogic.com/2014/11/07/http-2-a-quick-look.html
// https://queue.acm.org/detail.cfm?id=2716278
// https://github.com/ghacksuserjs/ghacks-user.js/issues/107
// user_pref("network.http.spdy.enabled", false);
// user_pref("network.http.spdy.enabled.deps", false);
// user_pref("network.http.spdy.enabled.http2", false);
// user_pref("network.http.spdy.websockets", false);
// Pref : Disable HTTP Alternative Services
// [SETUP-PERF] Relax this if you have FPI enabled and you understand the consequences. FPI isolates these, but it was designed with the Tor protocol in mind, and the Tor Browser has extra protection, including enhanced sanitizing per Identity.
// https://tools.ietf.org/html/rfc7838#section-9
// https://www.mnot.net/blog/2016/03/09/alt-svc
// user_pref("network.http.altsvc.enabled", false);
// user_pref("network.http.altsvc.oe", false);
// Pref : Enforce the proxy server to do any DNS lookups when using SOCKS
// e.g. in Tor, this stops your local DNS server from knowing your Tor destination as a remote Tor node will handle the DNS request
// http://kb.mozillazine.org/Network.proxy.socks_remote_dns
// https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers
// user_pref("network.proxy.socks_remote_dns", true);
// Pref : Remove paths when sending URLs to PAC scripts
// CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC)
// https://bugzilla.mozilla.org/1255474
user _pref ( "network.proxy.autoconfig_url.include_path" , false ) ; // [DEFAULT: false]
2019-04-24 23:38:24 +00:00
// Pref : Disable (or setup) DNS-over-HTTPS (DoH)
// TRR = Trusted Recursive Resolver
// .mode: 0=off, 1=race, 2=TRR first, 3=TRR only, 4=race for stats, but always use native result
// [WARNING] DoH bypasses hosts and gives info to yet another party (e.g. Cloudflare)
// https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/
// https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/
// BUG : This seem to disable socks_remote_dns ?! need to check with wireshark
// If true, just settings urls to null should be enough to disable
// Without impacting socks_remote_dns
user _pref ( "network.trr.mode" , 0 ) ;
user _pref ( "network.trr.bootstrapAddress" , "" ) ;
user _pref ( "network.trr.uri" , "" ) ;
2019-04-27 09:27:34 +00:00
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : User Settings
// >>>>>>>>>>>>>>>>>>>>
2019-04-24 23:38:24 +00:00
// Pref : Do No Tracker enabled by default
user _pref ( "privacy.donottrackheader.enabled" , false ) ;
// Pref : Enable Container Tabs
user _pref ( "privacy.userContext.enabled" , true ) ;
// Pref : Set long press behaviour on "+ Tab" button to display container menu
// 0=disables long press, 1=when clicked, the menu is shown
// 2=the menu is shown after X milliseconds
// [NOTE] The menu does not contain a non-container tab option
// https://bugzilla.mozilla.org/1328756
user _pref ( "privacy.userContext.longPressBehavior" , 2 ) ;
// Pref : Enable Container Tabs setting in preferences
// https://bugzilla.mozilla.org/1279029
user _pref ( "privacy.userContext.ui.enabled" , true ) ;
// Pref : Enable Container Tabs
user _pref ( "privacy.userContext.enabled" , true ) ;
// Pref : Enable a private container for thumbnail loads
user _pref ( "privacy.usercontext.about_newtab_segregation.enabled" , true ) ; // default: true
// Pref : Set long press behaviour on "+ Tab" button to display container menu
// 0=disables long press, 1=when clicked, the menu is shown
// 2=the menu is shown after X milliseconds
// [NOTE] The menu does not contain a non-container tab option
// https://bugzilla.mozilla.org/1328756
user _pref ( "privacy.userContext.longPressBehavior" , 2 ) ;
// Pref : Changing block list (Tracking protection)
// Default value "test-track-simple,base-track-digest256"
user _pref ( "urlclassifier.trackingTable" , "" ) ;
// Pref : Enable First Party Isolation
// [SETUP-WEB] May break cross-domain logins and site functionality until perfected
// https://bugzilla.mozilla.org/1260931
// Enabled via addons
user _pref ( "privacy.firstparty.isolate" , true ) ;
user _pref ( "privacy.firstparty.isolate.restrict_opener_access" , true ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : Passwords
// >>>>>>>>>>>>>>>>>>>>
// Pref : Disable autofilling saved passwords on HTTP pages and show warning
// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1217152,1319119
user _pref ( "signon.autofillForms.http" , false ) ;
user _pref ( "security.insecure_field_warning.contextual.enabled" , true ) ;
// [NOTE] This does not clear any passwords already saved
user _pref ( "signon.rememberSignons" , false ) ;
// Pref : Set how often Firefox should ask for the master password
// 0=the first time (default), 1=every time it's needed, 2=every n minutes
user _pref ( "security.ask_for_password" , 2 ) ;
// Pref : Set how often in minutes Firefox should ask for the master password in minutes, default is 30
user _pref ( "security.password_lifetime" , 5 ) ;
// Pref : Disable auto-filling username & password form fields
// can leak in cross-site forms AND be spoofed
// [NOTE] Password will still be auto-filled after a user name is manually entered
// http://kb.mozillazine.org/Signon.autofillForms
user _pref ( "signon.autofillForms" , false ) ;
// Pref : Disable websites autocomplete
// Don't let sites dictate use of saved logins and passwords.
user _pref ( "signon.storeWhenAutocompleteOff" , false ) ;
// Pref : Disable formless login capture
// https://bugzilla.mozilla.org/show_bug.cgi?id=1166947
user _pref ( "signon.formlessCapture.enabled" , false ) ;
// Pref : Limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources
// Hardens against potential credentials phishing
// 0=don't allow sub-resources to open HTTP authentication credentials dialogs
// 1=don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs
// 2=allow sub-resources to open HTTP authentication credentials dialogs (default)
// 1] https://www.fxsitecompat.com/en-CA/docs/2015/http-auth-dialog-can-no-longer-be-triggered-by-cross-origin-resources/
user _pref ( "network.auth.subresource-http-auth-allow" , 1 ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-27 09:27:34 +00:00
// Section : Window Meddling & Leaks / Popups
// >>>>>>>>>>>>>>>>>>>>
// Pref : Prevent websites from disabling new window features
// http://kb.mozillazine.org/Prevent_websites_from_disabling_new_window_features
user _pref ( "dom.disable_window_open_feature.close" , true ) ; // [DEFAULT: false]
user _pref ( "dom.disable_window_open_feature.location" , true ) ; // [DEFAULT: false]
user _pref ( "dom.disable_window_open_feature.menubar" , true ) ; // [DEFAULT: false]
user _pref ( "dom.disable_window_open_feature.minimizable" , true ) ; // [DEFAULT: false]
user _pref ( "dom.disable_window_open_feature.personalbar" , true ) ; // [DEFAULT: false]
user _pref ( "dom.disable_window_open_feature.resizable" , true ) ; // [DEFAULT: true]
user _pref ( "dom.disable_window_open_feature.status" , true ) ; // [DEFAULT: true]
user _pref ( "dom.disable_window_open_feature.titlebar" , true ) ; // [DEFAULT: false]
user _pref ( "dom.disable_window_open_feature.toolbar" , true ) ; // [DEFAULT: false]
// Pref : Prevent scripts from moving and resizing open windows
user _pref ( "dom.disable_window_move_resize" , true ) ; // [DEFAULT: true]
// Pref : Open links targeting new windows in a new tab instead
// This stops malicious window sizes and some screen resolution leaks.
// You can still right-click a link and open in a new window.
// [TEST] https://people.torproject.org/~gk/misc/entire_desktop.html
// https://trac.torproject.org/projects/tor/ticket/9881
2019-04-27 17:36:54 +00:00
user _pref ( "browser.link.open_newwindow" , 3 ) ; // [DEFAULT: 3]
2019-04-27 09:27:34 +00:00
user _pref ( "browser.link.open_newwindow.restriction" , 0 ) ; // [DEFAULT: 0]
// Pref : Disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
// [NOTE] You can still manually toggle the browser's fullscreen state, but this pref will disable embedded video fullscreen controls, e.g. youtube
// [TEST] https://developer.mozilla.org/samples/domref/fullscreen.html
// user_pref("full-screen-api.enabled", false);
// Pref : Block popup windows
user _pref ( "dom.disable_open_during_load" , true ) ; // [DEFAULT: true]
// Pref : Set max popups from a single non-click event
2019-04-27 17:36:54 +00:00
user _pref ( "dom.popup_maximum" , 2 ) ; // [DEFAULT: 20]
2019-04-27 09:27:34 +00:00
// Pref : Limit events that can cause a popup
// http://kb.mozillazine.org/Dom.popup_allowed_events
user _pref ( "dom.popup_allowed_events" , "click dblclick" ) ; // [DEFAULT: "change click dblclick mouseup pointerup notificationclick reset submit touchend"]
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-24 23:38:24 +00:00
// Section : Cache / Session (Re)Store / Favicons
// >>>>>>>>>>>>>>>>>>>>
2019-04-27 09:27:34 +00:00
// ETAG and other cache tracking/fingerprinting techniques can be averted by disabling *BOTH* disk and memory cache. ETAGs can also be neutralized by modifying response headers. Another solution is to use a hardened configuration with Temporary Containers. Alternatively, you can *LIMIT* exposure by clearing cache on close. Or on a regular basis manually or with an extension.
2019-04-24 23:38:24 +00:00
// https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
// https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/
// https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache
// https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
// https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
// Pref : Disable disk cache
user _pref ( "browser.cache.disk.enable" , false ) ;
user _pref ( "browser.cache.disk.capacity" , 0 ) ;
user _pref ( "browser.cache.disk.smart_size.enabled" , false ) ;
user _pref ( "browser.cache.disk.smart_size.first_run" , false ) ;
// Pref : Disable disk cache for SSL pages
//http://kb.mozillazine.org/Browser.cache.disk_cache_ssl
user _pref ( "browser.cache.disk_cache_ssl" , false ) ;
// Pref : Disable memory cache
// [NOTE] Not recommended due to performance issues
// user_pref("browser.cache.memory.enable", false);
// user_pref("browser.cache.memory.capacity", 0);
// Pref : Disable fastback cache
// To improve performance when pressing back/forward Firefox stores visited pages so they don't have to be re-parsed. This is not the same as memory cache.
// 0=none, -1=auto (that's minus 1).
// [WARNING] Not recommended unless you know what you're doing
// http://kb.mozillazine.org/Browser.sessionhistory.max_total_viewers
// user_pref("browser.sessionhistory.max_total_viewers", 0);
// Pref : Exclude "Undo Closed Tabs" in Session Restore
2019-04-26 00:08:12 +00:00
user _pref ( "browser.sessionstore.max_tabs_undo" , 0 ) ;
2019-04-24 23:38:24 +00:00
// Pref : Disable storing extra session data
// Extra session data contains contents of forms, scrollbar positions, cookies and POST data
// Define on which sites to save extra session data:
// 0=everywhere, 1=unencrypted sites, 2=nowhere
user _pref ( "browser.sessionstore.privacy_level" , 2 ) ;
// Pref : Disable resuming session from crash
// user_pref("browser.sessionstore.resume_from_crash", false);
// Pref : Set the minimum interval between session save operations
// Increasing this can help on older machines and some websites, as well as reducing writes.
// Default is 15000 (15 secs). Try 30000 (30 secs), 60000 (1 min) etc
// This can also affect entries in the "Recently Closed Tabs" feature:
// i.e. the longer the interval the more chance a quick tab open/close won't be captured.
// This longer interval *may* affect history but we cannot replicate any history not recorded
// https://bugzilla.mozilla.org/1304389
user _pref ( "browser.sessionstore.interval" , 30000 ) ;
// Pref : Disable favicons in web notifications
user _pref ( "alerts.showFavicons" , false ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : Geolocation
// >>>>>>>>>>>>>>>>>>>>
// Pref : Disable location
user _pref ( "geo.enabled" , false ) ;
user _pref ( "geo.wifi.xhr.timeout" , 0 ) ;
// Pref : Disable GeoIP lookup on your address to set default search engine region
// https://trac.torproject.org/projects/tor/ticket/16254
// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine
user _pref ( "browser.search.region" , "US" ) ;
user _pref ( "browser.search.geoip.url" , "" ) ;
user _pref ( "browser.search.geoip.timeout" , 0 ) ;
user _pref ( "browser.search.geoSpecificDefaults.url" , "" ) ;
user _pref ( "browser.snippets.geoUrl" , "" ) ;
2019-04-25 16:58:17 +00:00
// Pref : [FENNEC] Set Browser locale
user _pref ( "intl.locale.os" , "en-US" ) ;
2019-04-24 23:38:24 +00:00
// Pref : Set OS & APP locale
// If set to empty, the OS locales are used. If not set at all, default locale is used
user _pref ( "intl.locale.requested" , "en-US" ) ;
// Pref: Set language to match
user _pref ( "intl.accept_languages" , "en-US, en" ) ;
// Pref : Use APP locale over OS locale in regional preferences
// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1379420,1364789
user _pref ( "intl.regional_prefs.use_os_locales" , false ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : Fonts
// >>>>>>>>>>>>>>>>>>>>>>
// Pref : Disable websites choosing fonts (0=block, 1=allow)
// If you disallow fonts, this drastically limits/reduces font enumeration (by JS) which is a high entropy fingerprinting vector.
// [NOTE] Disabling fonts can uglify the web a fair bit.
user _pref ( "browser.display.use_document_fonts" , 0 ) ;
// Pref: Set more legible default fonts
// [NOTE] Example below for Windows/Western only
// user_pref("font.name.serif.x-unicode", "Georgia");
// user_pref("font.name.serif.x-western", "Georgia"); // default: Times New Roman
// user_pref("font.name.sans-serif.x-unicode", "Arial");
// user_pref("font.name.sans-serif.x-western", "Arial"); // default: Arial
// user_pref("font.name.monospace.x-unicode", "Lucida Console");
// user_pref("font.name.monospace.x-western", "Lucida Console"); // default: Courier New
// Pref: Disable icon fonts (glyphs) and local fallback rendering
// https://bugzilla.mozilla.org/789788
// https://trac.torproject.org/projects/tor/ticket/8455
user _pref ( "gfx.downloadable_fonts.enabled" , false ) ;
user _pref ( "gfx.downloadable_fonts.fallback_delay" , - 1 ) ;
// Pref: Disable rendering of SVG OpenType fonts
// https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this
user _pref ( "gfx.font_rendering.opentype_svg.enabled" , false ) ;
// Pref: Disable WOFF2 (Web Open Font Format)
user _pref ( "gfx.downloadable_fonts.woff2.enabled" , false ) ;
// Pref: Disable CSS Font Loading API
// [NOTE] Disabling fonts can uglify the web a fair bit.
user _pref ( "layout.css.font-loading-api.enabled" , false ) ;
// Pref: Disable special underline handling for a few fonts which you will probably never use
// Any of these fonts on your system can be enumerated for fingerprinting.
// http://kb.mozillazine.org/Font.blacklist.underline_offset
user _pref ( "font.blacklist.underline_offset" , "" ) ;
// Pref: Disable graphite which turned back on by default
// https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778
user _pref ( "gfx.font_rendering.graphite.enabled" , false ) ;
// Pref: Limit system font exposure to a whitelist [RESTART]
// If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
// [WARNING] Creating your own probably highly-unique whitelist will raise your entropy. Eventually privacy.resistFingerprinting will cover this.
// https://bugzilla.mozilla.org/1121643
// user_pref("font.system.whitelist", "");
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : Plugins
// >>>>>>>>>>>>>>>>>>>>
// Pref: Set default plugin state (i.e. new plugins on discovery) to never activate
// 0=disabled, 1=ask to activate, 2=active - you can override individual plugins
user _pref ( "plugin.default.state" , 0 ) ;
// Pref : Enable plugins click-to-play
// https://wiki.mozilla.org/Firefox/Click_To_Play
// https://blog.mozilla.org/security/2012/10/11/click-to-play-plugins-blocklist-style/
user _pref ( "plugins.click_to_play" , true ) ;
user _pref ( "plugin.sessionPermissionNow.intervalInMinutes" , 0 ) ;
// Pref : Disable all GMP (Gecko Media Plugins)
user _pref ( "media.gmp-provider.enabled" , false ) ;
user _pref ( "media.gmp-manager.certs.1.issuerName" , "" ) ;
user _pref ( "media.gmp-manager.certs.1.commonName" , "" ) ;
user _pref ( "media.gmp-manager.certs.2.issuerName" , "" ) ;
user _pref ( "media.gmp-manager.certs.2.commonName" , "" ) ;
user _pref ( "media.gmp-manager.url" , "data:text/plain," ) ;
user _pref ( "media.gmp-manager.url.override" , "data:text/plain," ) ;
// Pref : Disable all DRM content (EME: Encryption Media Extension)
// https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next
user _pref ( "media.eme.enabled" , false ) ;
// Pref : Disable the OpenH264 Video Codec by Cisco to "Never Activate".
// This is the bundled codec used for video chat in WebRTC.
user _pref ( "media.gmp-gmpopenh264.enabled" , false ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : Hardware Fingerprinting
// >>>>>>>>>>>>>>>>>>>>
// Pref : Disable Battery Status API
// Initially a Linux issue (high precision readout) that was fixed.
// However, it is still another metric for fingerprinting, used to raise entropy.
// e.g. do you have a battery or not, current charging status, charge level, times remaining etc
// https://bugzilla.mozilla.org/1313580
// user_pref("dom.battery.enabled", false);
// Pref : Disable virtual reality devices APIs
// https://developer.mozilla.org/en-US/Firefox/Releases/36#Interfaces.2FAPIs.2FDOM
// https://developer.mozilla.org/en-US/docs/Web/API/WebVR_API
user _pref ( "dom.vr.enabled" , false ) ;
// Pref : Disable WebRTC getUserMedia, screen sharing, audio capture, video capture
// https://wiki.mozilla.org/Media/getUserMedia
// https://blog.mozilla.org/futurereleases/2013/01/12/capture-local-camera-and-microphone-streams-with-getusermedia-now-enabled-in-firefox/
// https://developer.mozilla.org/en-US/docs/Web/API/Navigator
user _pref ( "media.navigator.enabled" , false ) ;
user _pref ( "media.navigator.video.enabled" , false ) ;
// Pref : Disable hardware acceleration to reduce graphics fingerprinting
// [SETUP-PERF] Affects text rendering (fonts will look different), impacts video performance,
// and parts of Quantum that utilize the GPU will also be affected as they are rolled out
// https://wiki.mozilla.org/Platform/GFX/HardwareAcceleration
// user_pref("layers.acceleration.disabled", true);
// Pref : Disable Web Audio API
// https://bugzilla.mozilla.org/show_bug.cgi?id=1288359
// Avoid fingerprinting...
user _pref ( "dom.webaudio.enabled" , false ) ;
// Pref : Disable Media Capabilities API
// [SETUP-PERF] This *may* affect media performance if disabled, no one is sure
// https://github.com/WICG/media-capabilities
// https://wicg.github.io/media-capabilities/#security-privacy-considerations
// user_pref("media.media-capabilities.enabled", false);
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : Blocklists / Safe Browsing / Tracking Protection
// >>>>>>>>>>>>>>>>>>>>
// This section has security & tracking protection implications vs privacy concerns vs effectiveness vs 3rd party 'censorship'. If you disable Tracking Protection (TP) and/or Safe Browsing (SB), REQUIRES YOU HAVE uBLOCK ORIGIN INSTALLED.
// Pref : Enable add-on and certificate blocklists (OneCRL) from Mozilla
// Updated at interval defined in extensions.blocklist.interval
user _pref ( "app.update.lastUpdateTime-blocklist-background-update-timer" , 0 ) ;
user _pref ( "app.update.lastUpdateTime.blocklist-background-update-timer" , 0 ) ;
user _pref ( "extensions.blocklist.enabled" , false ) ;
user _pref ( "extensions.blocklist.interval" , 0 ) ;
user _pref ( "extensions.blocklist.level" , 0 ) ;
user _pref ( "extensions.blocklist.pingCountTotal" , 0 ) ;
user _pref ( "extensions.blocklist.pingCountVersion" , 0 ) ;
user _pref ( "extensions.blocklist.url" , "" ) ;
user _pref ( "services.blocklist.addons.signer" , "" ) ;
user _pref ( "services.blocklist.bucket" , "" ) ;
user _pref ( "services.blocklist.pinning.bucket" , "" ) ;
user _pref ( "services.blocklist.pinning.checked" , 0 ) ;
user _pref ( "services.blocklist.pinning.collection" , "" ) ;
user _pref ( "services.blocklist.pinning.enabled" , false ) ;
user _pref ( "services.blocklist.plugins.checked" , 0 ) ;
user _pref ( "services.blocklist.plugins.collection" , "" ) ;
// Pref : Disable individual unwanted/unneeded parts of the Kinto blocklists
// What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications
// As Firefox transitions to Kinto, the blocklists have been broken down into entries for certs to be revoked, extensions and plugins to be disabled, and gfx environments that cause problems or crashes
user _pref ( "services.blocklist.onecrl.checked" , 0 ) ;
user _pref ( "services.blocklist.onecrl.collection" , "" ) ;
user _pref ( "services.blocklist.addons.checked" , 0 ) ;
user _pref ( "services.blocklist.addons.collection" , "" ) ;
user _pref ( "services.blocklist.gfx.checked" , 0 ) ;
user _pref ( "services.blocklist.gfx.collection" , "" ) ;
// Pref : Disable Google Safe Browsing (Block dangerous and deceptive contents)
user _pref ( "browser.safebrowsing.allowOverride" , false ) ;
user _pref ( "browser.safebrowsing.blockedURIs.enabled" , false ) ;
user _pref ( "browser.safebrowsing.debug" , false ) ;
user _pref ( "browser.safebrowsing.downloads.enabled" , false ) ;
user _pref ( "browser.safebrowsing.downloads.remote.block_dangerous" , false ) ;
user _pref ( "browser.safebrowsing.downloads.remote.block_dangerous_host" , false ) ;
user _pref ( "browser.safebrowsing.downloads.remote.block_potentially_unwanted" , false ) ;
user _pref ( "browser.safebrowsing.downloads.remote.block_uncommon" , false ) ;
user _pref ( "browser.safebrowsing.downloads.remote.enabled" , false ) ;
user _pref ( "browser.safebrowsing.downloads.remote.url" , "" ) ;
user _pref ( "browser.safebrowsing.downloads.remote.timeout_ms" , 0 ) ;
user _pref ( "browser.safebrowsing.id" , "" ) ;
user _pref ( "browser.safebrowsing.malware.enabled" , false ) ;
user _pref ( "browser.safebrowsing.passwords.enabled" , false ) ;
user _pref ( "browser.safebrowsing.phishing.enabled" , false ) ;
user _pref ( "browser.safebrowsing.provider.google.advisoryURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google.pver" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google.advisoryName" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google.gethashURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google.lists" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google.reportMalwareMistakeURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google.reportPhishMistakeURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google.reportURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google.updateURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.advisoryName" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.advisoryURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.gethashURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.lists" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.reportMalwareMistakeURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.reportPhishMistakeURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.reportURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.updateURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.dataSharing.enabled" , false ) ;
user _pref ( "browser.safebrowsing.provider.google4.dataSharingURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.gethashURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.google4.pver" , "" ) ;
user _pref ( "browser.safebrowsing.provider.mozilla.gethashURL" , "" ) ;
user _pref ( "browser.safebrowsing.provider.mozilla.lists" , "" ) ;
user _pref ( "browser.safebrowsing.provider.mozilla.lists.base" , "" ) ;
user _pref ( "browser.safebrowsing.provider.mozilla.lists.content" , "" ) ;
user _pref ( "browser.safebrowsing.provider.mozilla.nextupdatetime" , "" ) ;
user _pref ( "browser.safebrowsing.provider.mozilla.pver" , "" ) ;
user _pref ( "browser.safebrowsing.provider.mozilla.updateURL" , "" ) ;
user _pref ( "browser.safebrowsing.reportPhishURL" , "" ) ;
// Pref : Disable Mozilla's tracking protection and Flash blocklist updates
user _pref ( "browser.safebrowsing.provider.mozilla.lists.base" , "" ) ;
user _pref ( "browser.safebrowsing.provider.mozilla.lists.content" , "" ) ;
// Pref : Disable passive Tracking Protection
// Passive TP annotates channels to lower the priority of network loads for resources on the tracking protection list.
// [NOTE] It has no effect if TP is enabled, but keep in mind that by default TP is only enabled in Private Windows
// This is included for people who want to completely disable Tracking Protection.
// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1170190,1141814
user _pref ( "privacy.trackingprotection.annotate_channels" , false ) ;
user _pref ( "privacy.trackingprotection.lower_network_priority" , false ) ;
// Pref : Disable passive Tracking Protection in all windows
user _pref ( "privacy.trackingprotection.enabled" , false ) ;
user _pref ( "privacy.trackingprotection.pbmode.enabled" , false ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
// Section : Persistent Storage
// >>>>>>>>>>>>>>>>>>>>
// [NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode
// [NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage), indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications).
// If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become accessible to websites except shared/service workers where the cookie setting *must* be "Allow".
// Pref : Disable 3rd-party cookies and site-data
// [NOTE] Can breaks payment gateways
user _pref ( "network.cookie.cookieBehavior" , 1 ) ;
// Pref : Set third-party cookies (i.e ALL) (if enabled) to session-only and set third-party non-secure (i.e HTTP) cookies to session-only
// [NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and .nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones
// https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/
// http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly
user _pref ( "network.cookie.thirdparty.sessionOnly" , true ) ;
user _pref ( "network.cookie.thirdparty.nonsecureSessionOnly" , true ) ;
// Pref : Delete cookies and site data on close
// 0=keep until they expire (default), 2=keep until you close Firefox
// [NOTE] The setting below is disabled (but not changed) if you block all cookies
// user_pref("network.cookie.lifetimePolicy", 2);
// Pref : Disable HTTP sites setting cookies with the "secure" directive
// https://developer.mozilla.org/Firefox/Releases/52#HTTP
user _pref ( "network.cookie.leave-secure-alone" , true ) ; // [DEFAULT: true]
// Pref : Enable support for same-site cookies
// https://bugzilla.mozilla.org/795346
// https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/
// https://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/
user _pref ( "network.cookie.same-site.enabled" , true ) ; // [DEFAULT: true]
// Pref : Disable DOM (Document Object Model) Storage
// [WARNING] This will break a LOT of sites' functionality AND extensions!
// You are better off using an extension for more granular control
// user_pref("dom.storage.enabled", false);
// Pref : Enforce IndexedDB (IDB) as enabled
// IDB is required for extensions and Firefox internals.
// To control *website* IDB data, control allowing cookies and service workers, or use Temporary Containers. To mitigate *website* IDB, FPI helps, and/or sanitize on close (Offline Website Data, see 2800) or on-demand (Ctrl-Shift-Del), or automatically via an extension. Note that IDB currently cannot be sanitized by host.
// https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/
user _pref ( "dom.indexedDB.enabled" , true ) ; // [DEFAULT: true]
// Pref : Do not download URLs for the offline cache
// http://kb.mozillazine.org/Browser.cache.offline.enable
user _pref ( "browser.cache.offline.enable" , false ) ;
user _pref ( "browser.cache.offline.capacity" , 0 ) ;
// Pref : Disable offline cache on insecure sites
// https://blog.mozilla.org/security/2018/02/12/restricting-appcache-secure-contexts/
user _pref ( "browser.cache.offline.insecure.enable" , false ) ;
// Pref : Enforce websites to ask to store data for offline use
// https://support.mozilla.org/questions/1098540
// https://bugzilla.mozilla.org/959985
// user_pref("offline-apps.allow_by_default", false);
// Pref : Disable service workers cache and cache storage
// https://w3c.github.io/ServiceWorker/#privacy
user _pref ( "dom.caches.enabled" , false ) ;
// Pref : Disable Storage API
// The API gives sites the ability to find out how much space they can use, how much they are already using, and even control whether or not they need to be alerted before the user agent disposes of site data in order to make room for other things.
// https://developer.mozilla.org/docs/Web/API/StorageManager
// https://developer.mozilla.org/docs/Web/API/Storage_API
// https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/
user _pref ( "dom.storageManager.enabled" , false ) ;
// Pref : Disable Storage Access API
// https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API
user _pref ( "dom.storage_access.enabled" , false ) ;
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-25 16:58:17 +00:00
// Section : Headers / Referers
// >>>>>>>>>>>>>>>>>>>>
// Pref : Control when images/links send a referer
// 0=never, 1=send only when links are clicked, 2=for links and images (default)
user _pref ( "network.http.sendRefererHeader" , 2 ) ;
// Pref : Control the amount of information to send
// 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port
2019-04-26 00:08:12 +00:00
user _pref ( "network.http.referer.trimmingPolicy" , 2 ) ;
2019-04-25 16:58:17 +00:00
// Pref : Control when to send a referer
// 0=always (default), 1=only if base domains match, 2=only if hosts match
2019-04-26 00:08:12 +00:00
user _pref ( "network.http.referer.XOriginPolicy" , 2 ) ;
2019-04-25 16:58:17 +00:00
// Pref : Control the amount of information to send
// 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port
2019-04-26 00:08:12 +00:00
user _pref ( "network.http.referer.XOriginTrimmingPolicy" , 2 ) ;
2019-04-25 16:58:17 +00:00
// Pref : Disable spoofing a referer
2019-04-26 00:08:12 +00:00
user _pref ( "network.http.referer.spoofSource" , true ) ; // [DEFAULT: false]
// Pref : Set the default Referrer Policy
2019-04-25 16:58:17 +00:00
// 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade
// [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy
// https://www.w3.org/TR/referrer-policy/
// https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy
// https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/
user _pref ( "network.http.referer.defaultPolicy" , 3 ) ; // [DEFAULT: 3]
user _pref ( "network.http.referer.defaultPolicy.pbmode" , 2 ) ; // [DEFAULT: 2]
// Pref : Hide (not spoof) referrer when leaving a .onion domain
// [NOTE] Firefox cannot access .onion sites by default. We recommend you use the Tor Browser which is specifically designed for hidden services
// https://bugzilla.mozilla.org/1305144
user _pref ( "network.http.referer.hideOnionSource" , true ) ; // [DEFAULT: false]
// Pref : Disable the DNT (Do Not Track) HTTP header
user _pref ( "privacy.donottrackheader.enabled" , false ) ; // [DEFAULT: true]
//
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2019-04-24 23:38:24 +00:00
// Section : Resist Fingerprinting
// >>>>>>>>>>>>>>>>>>>>
// Pref : Enable hardening against various fingerprinting vectors (Tor Uplift project)
// https://wiki.mozilla.org/Security/Tor_Uplift/Tracking
// https://bugzilla.mozilla.org/show_bug.cgi?id=1333933
user _pref ( "privacy.resistFingerprinting" , true ) ;
// Pref : [FENNEC]
user _pref ( "privacy.trackingprotection.fingerprinting.enabled" , true ) ;
