forked from d3cim/mobile_user.js
Update 'user.js'
This commit is contained in:
parent
8561022d46
commit
ffd26f7bf4
129
user.js
129
user.js
|
|
@ -458,7 +458,7 @@ user_pref("extensions.systemAddon.update.enabled", false); // [FF62+]
|
|||
user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
|
||||
// -------------------------------------
|
||||
// Disable PingCentre telemetry (used in several System Add-ons) [FF57+]
|
||||
// Currently blocked by ''datareporting.healthreport.uploadEnabled''
|
||||
// Defense-in-depth
|
||||
user_pref("browser.ping-centre.telemetry", false);
|
||||
// -------------------------------------
|
||||
// Disable Screenshots
|
||||
|
|
@ -1076,30 +1076,7 @@ user_pref("privacy.userContext.enabled", true);
|
|||
// user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true);
|
||||
//
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
// PLUGINS
|
||||
// >>>>>>>>>>>>>>>>>>>>>
|
||||
// Disable GMP (Gecko Media Plugins)
|
||||
// https://wiki.mozilla.org/GeckoMediaPlugins
|
||||
user_pref("media.gmp-provider.enabled", false);
|
||||
// -------------------------------------
|
||||
// Disable downloading OpenH264 codec at the first start of Firefox
|
||||
user_pref("media.gmp-gmpopenh264.enabled", false);
|
||||
// -------------------------------------
|
||||
// Disable widevine CDM (Content Decryption Module)
|
||||
// [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV
|
||||
user_pref("media.gmp-widevinecdm.enabled", false);
|
||||
user_pref("media.gmp-manager.url", "");
|
||||
user_pref("media.gmp-manager.url.override", "");
|
||||
// -------------------------------------
|
||||
// Disable all DRM content (EME: Encryption Media Extension)
|
||||
// [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV
|
||||
// [SETTING] General>DRM Content>Play DRM-controlled content
|
||||
// [TEST] https://bitmovin.com/demos/drm
|
||||
// https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next
|
||||
user_pref("media.eme.enabled", false);
|
||||
//
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
// MEDIA / CAMERA / MIC
|
||||
// PLUGINS / MEDIA / WEBRTC
|
||||
// >>>>>>>>>>>>>>>>>>>>>
|
||||
// Disable WebRTC (Web Real-Time Communication)
|
||||
// [SETUP-WEB] WebRTC can leak your IP address from behind your VPN, but if this is not
|
||||
|
|
@ -1129,8 +1106,21 @@ user_pref("media.getusermedia.audiocapture.enabled", false);
|
|||
user_pref("permissions.default.camera", 2);
|
||||
user_pref("permissions.default.microphone", 2);
|
||||
// -------------------------------------
|
||||
// Disable GMP (Gecko Media Plugins)
|
||||
// https://wiki.mozilla.org/GeckoMediaPlugins
|
||||
// user_pref("media.gmp-provider.enabled", false);
|
||||
// Disable widevine CDM (Content Decryption Module)
|
||||
// [NOTE] This is covered by the EME master switch
|
||||
// user_pref("media.gmp-widevinecdm.enabled", false);
|
||||
// Disable all DRM content (EME: Encryption Media Extension)
|
||||
// [SETUP-WEB] e.g. Netflix, Amazon Prime, Hulu, HBO, Disney+, Showtime, Starz, DirectTV
|
||||
// [SETTING] General>DRM Content>Play DRM-controlled content
|
||||
// [TEST] https://bitmovin.com/demos/drm
|
||||
// https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next
|
||||
user_pref("media.eme.enabled", false);
|
||||
// -------------------------------------
|
||||
// Disable autoplay of HTML5 media [FF63+]
|
||||
// 0=Allow all, 1=Block non-muted media (default in FF67+), 2=Prompt (removed in FF66), 5=Block all (FF69+)
|
||||
// 0=Allow all, 1=Block non-muted media (default), 5=Block all
|
||||
// [NOTE] You can set exceptions under site permissions
|
||||
// [SETTING] Privacy & Security>Permissions>Autoplay>Settings>Default for all websites
|
||||
// user_pref("media.autoplay.default", 5);
|
||||
|
|
@ -1145,33 +1135,6 @@ user_pref("media.autoplay.blocking_policy", 2);
|
|||
// user_pref("image.avif.enabled", false);
|
||||
//
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
// WINDOW MEDDLING & LEAKS / POPUPS
|
||||
// >>>>>>>>>>>>>>>>>>>>>
|
||||
// Prevent scripts from moving and resizing open windows
|
||||
user_pref("dom.disable_window_move_resize", true);
|
||||
// -------------------------------------
|
||||
// Open links targeting new windows in a new tab instead
|
||||
// Stops malicious window sizes and some screen resolution leaks
|
||||
// You can still right-click a link and open in a new window
|
||||
// [TEST] https://arkenfox.github.io/TZP/tzp.html#screen
|
||||
// https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881
|
||||
user_pref("browser.link.open_newwindow", 3); // 1=most recent window or tab 2=new window, 3=new tab
|
||||
user_pref("browser.link.open_newwindow.restriction", 0);
|
||||
// -------------------------------------
|
||||
// Disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
|
||||
// [NOTE] You can still manually toggle the browser's fullscreen state (F11),
|
||||
// but this pref will disable embedded video/game fullscreen controls, e.g. youtube
|
||||
// [TEST] https://arkenfox.github.io/TZP/tzp.html#screen
|
||||
// user_pref("full-screen-api.enabled", false);
|
||||
// -------------------------------------
|
||||
// Block popup windows
|
||||
// [SETTING] Privacy & Security>Permissions>Block pop-up windows
|
||||
user_pref("dom.disable_open_during_load", true);
|
||||
// -------------------------------------
|
||||
// Limit events that can cause a popup [SETUP-WEB]
|
||||
user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown");
|
||||
//
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
// WEB WORKERS
|
||||
// >>>>>>>>>>>>>>>>>>>>>
|
||||
// Disable service workers [FF32, FF44-compat]
|
||||
|
|
@ -1236,6 +1199,17 @@ user_pref("dom.allow_cut_copy", false);
|
|||
// https://developer.mozilla.org/docs/Web/Events/beforeunload
|
||||
user_pref("dom.disable_beforeunload", true);
|
||||
// -------------------------------------
|
||||
// Prevent scripts from moving and resizing open windows
|
||||
user_pref("dom.disable_window_move_resize", true);
|
||||
// Block popup windows
|
||||
// [SETTING] Privacy & Security>Permissions>Block pop-up windows
|
||||
user_pref("dom.disable_open_during_load", true);
|
||||
// Limit events that can cause a popup [SETUP-WEB]
|
||||
user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown");
|
||||
// Enable (limited but sufficient) window.opener protection [FF65+]
|
||||
// Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set
|
||||
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+]
|
||||
// -------------------------------------
|
||||
// Disable shaking the screen
|
||||
user_pref("dom.vibrator.enabled", false);
|
||||
// -------------------------------------
|
||||
|
|
@ -1267,10 +1241,6 @@ user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN
|
|||
// https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly
|
||||
// https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes
|
||||
user_pref("javascript.options.wasm", false);
|
||||
// -------------------------------------
|
||||
// Enable (limited but sufficient) window.opener protection [FF65+]
|
||||
// Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set
|
||||
user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+]
|
||||
//
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
// HARDWARE FINGERPRINTING
|
||||
|
|
@ -1279,7 +1249,7 @@ user_pref("dom.targetBlankNoOpener.enabled", true); // [DEFAULT: true FF79+]
|
|||
// Initially a Linux issue (high precision readout) that was fixed.
|
||||
// However, it is still another metric for fingerprinting, used to raise entropy.
|
||||
// e.g. do you have a battery or not, current charging status, charge level, times remaining etc
|
||||
// [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code
|
||||
// FF52+ Battery Status API is only available in chrome/privileged code
|
||||
// https://bugzilla.mozilla.org/1313580
|
||||
user_pref("dom.battery.enabled", false);
|
||||
// -------------------------------------
|
||||
|
|
@ -1318,6 +1288,23 @@ user_pref("webgl.enable-webgl2", false);
|
|||
// -------------------------------------
|
||||
// Limit WebGL
|
||||
user_pref("webgl.disable-fail-if-major-performance-caveat", true); // [DEFAULT: true FF86+]
|
||||
// -------------------------------------
|
||||
// Enforce no system colors
|
||||
// [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors
|
||||
user_pref("browser.display.use_system_colors", false); // [DEFAULT: false]
|
||||
// Open links targeting new windows in a new tab instead
|
||||
// Stops malicious window sizes and some screen resolution leaks.
|
||||
// You can still right-click a link and open in a new window
|
||||
// [TEST] https://arkenfox.github.io/TZP/tzp.html#screen
|
||||
// https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881
|
||||
user_pref("browser.link.open_newwindow", 3); // 1=most recent window or tab 2=new window, 3=new tab
|
||||
user_pref("browser.link.open_newwindow.restriction", 0);
|
||||
// Enforce non-native widget theme
|
||||
// Security: removes/reduces system API calls, e.g. win32k API
|
||||
// Fingerprinting: provides a uniform look and feel across platforms
|
||||
// https://bugzilla.mozilla.org/1381938
|
||||
// https://bugzilla.mozilla.org/1411425
|
||||
user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true FF89+]
|
||||
//
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
// MISCELLANEOUS
|
||||
|
|
@ -1409,10 +1396,6 @@ user_pref("pdfjs.enableScripting", false); // [FF86+]
|
|||
// Disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS]
|
||||
user_pref("network.protocol-handler.external.ms-windows-store", false);
|
||||
// -------------------------------------
|
||||
// Enforce no system colors; they can be fingerprinted
|
||||
// [SETTING] General>Language and Appearance>Fonts and Colors>Colors>Use system colors
|
||||
user_pref("browser.display.use_system_colors", false); // [DEFAULT: false]
|
||||
// -------------------------------------
|
||||
// Disable permissions delegation [FF73+]
|
||||
// Currently applies to cross-origin geolocation, camera, mic and screen-sharing
|
||||
// permissions, and fullscreen requests. Disabling delegation means any prompts
|
||||
|
|
@ -1430,12 +1413,11 @@ user_pref("privacy.window.name.update.enabled", true);
|
|||
// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1659530,1681331
|
||||
user_pref("extensions.postDownloadThirdPartyPrompt", false);
|
||||
// -------------------------------------
|
||||
// Enforce non-native widget theme
|
||||
// * Security: removes/reduces system API calls, e.g. win32k API
|
||||
// * Fingerprinting: provides a uniform look and feel across platforms
|
||||
// * https://bugzilla.mozilla.org/1381938
|
||||
// * https://bugzilla.mozilla.org/1411425 ***/
|
||||
user_pref("widget.non-native-theme.enabled", true); // [DEFAULT: true FF89+]
|
||||
// Disable Fullscreen API (requires user interaction)
|
||||
// [NOTE] You can still toggle fullscreen with F11
|
||||
// [WARNING] This is fingerprintable and will break embedded video/game FS controls, e.g. youtube
|
||||
// [TEST] https://arkenfox.github.io/TZP/tzp.html#screen
|
||||
// user_pref("full-screen-api.enabled", false);
|
||||
//
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
// DOWNLOADS
|
||||
|
|
@ -1520,10 +1502,6 @@ user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+]
|
|||
// [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Firefox is closed
|
||||
user_pref("network.cookie.lifetimePolicy", 2);
|
||||
// -------------------------------------
|
||||
// Disable DOM (Document Object Model) Storage
|
||||
// [WARNING] This will break lots of sites and extensions!
|
||||
// user_pref("dom.storage.enabled", false);
|
||||
// -------------------------------------
|
||||
// Disable offline cache (appCache)
|
||||
// [NOTE] In FF90+ the storage capability has been removed.
|
||||
// [WARNING] The API is easily fingerprinted, do not disable ***/
|
||||
|
|
@ -1548,7 +1526,7 @@ user_pref("network.cookie.lifetimePolicy", 2);
|
|||
// user_pref("dom.storage_access.enabled", false);
|
||||
// -------------------------------------
|
||||
// Enable Local Storage Next Generation (LSNG) [FF65+]
|
||||
user_pref("dom.storage.next_gen", true);
|
||||
user_pref("dom.storage.next_gen", true); // [DEFAULT: true FF92+]
|
||||
//
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
// SHUTDOWN
|
||||
|
|
@ -1559,7 +1537,8 @@ user_pref("privacy.sanitize.sanitizeOnShutdown", true);
|
|||
// -------------------------------------
|
||||
// Set what items to clear on shutdown [SETUP-CHROME]
|
||||
// [NOTE] If "history" is true, downloads will also be cleared
|
||||
// [NOTE] Active Logins does not refer to logins via cookies, but rather HTTP Basic Authentication
|
||||
// [NOTE] Active Logins: does not refer to logins via cookies, but rather HTTP Basic Authentication
|
||||
// [NOTE] Offline Website Data: localStorage, service worker cache, QuotaManager (IndexedDB, asm-cache)
|
||||
// [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes>Settings
|
||||
// https://en.wikipedia.org/wiki/Basic_access_authentication
|
||||
user_pref("privacy.clearOnShutdown.cache", true);
|
||||
|
|
@ -1632,7 +1611,7 @@ user_pref("privacy.partition.network_state", true);
|
|||
// RFP (RESIST FINGERPRINTING)
|
||||
// >>>>>>>>>>>>>>>>>>>>>
|
||||
// Enable privacy.resistFingerprinting [FF41+]
|
||||
// [SETUP-WEB] RFP can some cause website breakage: mainly canvas, use a site exception via the urlbar
|
||||
// [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a site exception via the urlbar
|
||||
// RFP also has a few side effects: mainly timezone is UTC0, and websites will prefer light theme
|
||||
// https://bugzilla.mozilla.org/418986
|
||||
user_pref("privacy.resistFingerprinting", true);
|
||||
|
|
|
|||
Loading…
Reference in New Issue