5 ms·

> For me the differentiator is privacy [...] for that I trust only Mozilla [...] (and I use some add-ons). What FF add-ons and/or configuration do you recommen

by mastazi 10y ago

> For me the differentiator is privacy [...] for that I trust only Mozilla [...] (and I use some add-ons). What FF add-ons and/or configuration do you recommend? I use Privacy Badger, AdBlock Plus and HTTPS Everywhere. In Firefox Options, I clear cookies at the end of every session. If I had Private Mode always active, then I could use Firefox's own Tracking Protection, but I thought Privacy Badger is enough and is made by the EFF which I trust.

incompatible 10y ago
Self-destructing cookies is nice.
hackuser 10y ago
I'm assuming you are an advanced user who can understand and manage these add-ons, and also diagnose the occasional website malfunctions that they cause. Here are some of the most useful I know about: --- * uMatrix: Use this for five minutes and I think you'll be sold on it. Essentially an application-level firewall for your web browser, which replaces several other add-ons. Controls cookies, JavaScript, plugins, frames, provides connection-level privacy blacklists, and all at a granular level, using firewall-style rules for local (to the website) & remote pairs: e.g., * * * DENY # Deny all default cnn.com googleapis.com javascript ALLOW But the most impressive part is the GUI, the "matrix", which allows you to visualize as well as create/remove rules very efficiently, with a click (though you can still write them manually if you like). Like a well-made car, it's so well-designed and executed that it's a pleasure to drive. Real firewalls should use this GUI. --- * NoScript: Does far more than block JavaScript, and provides a bunch of security that uMatrix does not: https://news.ycombinator.com/item?id=12624596 https://news.ycombinator.com/item?id=12624596 --- * Decentraleyes: A local cache of common CDNs and other resources. It protects privacy by minimizing connections to CDNs, should reduce bandwidth, and can help performance in some cases. From their documentation: - Supported Networks: Google Hosted Libraries, Microsoft Ajax CDN, CDNJS (Cloudflare), jQuery CDN (MaxCDN), jsDelivr (MaxCDN), Yandex CDN, Baidu CDN, Sina Public Resources, and UpYun Libraries. - Bundled Resources: AngularJS, Backbone.js, Dojo, Ember.js, Ext Core, jQuery, jQuery UI, Modernizr, MooTools, Prototype, Scriptaculous, SWFObject, Underscore.js, and Web Font Loader. --- * HTTPS Everywhere: For the reference of others reading this comment, it's an EFF project that uses a whitelist of websites which accept https connections and forces the browser to connect to them over the secure protocol. --- * CsFire: CSRF detection and protection. Also technically interesting. https://distrinet.cs.kuleuven.be/software/CsFire/ https://distrinet.cs.kuleuven.be/software/CsFire/
JoshMnem 10y ago
Try Self-destructing Cookies, BetterPrivacy, Decentraleyes, Google Search Link Fix, Random Agent Spoofer, and RefControl. Chrome gives far less control over privacy. (Consider the business motivations of Mozilla vs. Google.) You can also add a file called user.js to your Firefox profile folder with these settings to make it better: https://gist.github.com/j127/8627698e47612eaf9d2bf4c633bbbb46 https://gist.github.com/j127/8627698e47612eaf9d2bf4c633bbbb4... Anything in about:config can be overridden in user.js. You can use multiple Firefox profiles to launch separate browser profiles, each with different extensions. (I have an alias for that: `alias ff="firefox -P"`) Ctrl-shift-p is a fast way to enter private browsing mode, which, by default, will keep your privacy extensions enabled. (You can ctrl-shift-n in Chromium/Chrome if you need to turn off all extensions for a quick look at something.) Firefox for Android is also the only mobile browser that allows add-ons, so you can get your privacy tools and customizations there too. Also check out the Firefox developer console. Go into settings and check the boxes until it's how you want it.
- ryuuchin 10y ago
  > (You can ctrl-shift-n in Chromium/Chrome if you need to turn off all extensions for a quick look at something.) You can keep extensions enabled in Chrome as well when using incognito. You just have to explicitly enable it on the extensions menu for which extensions you want to keep enabled.
  - JoshMnem 10y ago
    I generally don't do that, because I want one way to open a browser that has no extensions. So I can go to Chrome (alt-6 to get to that virtual desktop) and then ctrl-shift-n to get a plain browser. Firefox keeps the extensions on by default, so if I need to login to one site with different accounts, I can use ctrl-shift-p for a private window, or `$ firefox -P` for a different browser profile.
Maakuth 10y ago
You might want to consider replacing ABP with µBlock Origin. It does the blocking more cleverly so it performs a lot better.
- ryuuchin 10y ago
  Just one thing worth mentioning. If you use the exact same filter lists in ABP and uBlock Origin[1] then the end result should be IDENTICAL (if it's not it's a bug) save for the fact that uBlock does things faster and more efficient. Some people seem to get thrown off that uBlock might block more but that's only because it enables a few more filter lists by default. That being said the default are still designed to minimize false positives. [1] https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
ryuuchin 10y ago
> If I had Private Mode always active, then I could use Firefox's own Tracking Protection, but I thought Privacy Badger is enough and is made by the EFF which I trust. If you enable uBlock Origin's Disconnect filters then Firefox's own tracking protection becomes redundant since the latter uses the Disconnect filter lists. [1] https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
scns 10y ago
i would recommend uBlock for Adblocking, saves CPUcycles and has no shady Businessmodel
ionised 10y ago
- HTTPS Everywhere - UMatrix - NoScript (for XSS/ABE etc.) - Self-Destructing Cookies - Better Privacy (for flash cookies) - Calomel SSL Validation - Disable WebRTC (can do this without the extension though) - Canvas Blocker (prevents canvas fingerprinting)

by mastazi 10y ago

incompatible 10y ago

Self-destructing cookies is nice.

hackuser 10y ago

I'm assuming you are an advanced user who can understand and manage these add-ons, and also diagnose the occasional website malfunctions that they cause. Here are some of the most useful I know about: --- * uMatrix: Use this for five minutes and I think you'll be sold on it. Essentially an application-level firewall for your web browser, which replaces several other add-ons. Controls cookies, JavaScript, plugins, frames, provides connection-level privacy blacklists, and all at a granular level, using firewall-style rules for local (to the website) & remote pairs: e.g., * * * DENY # Deny all default cnn.com googleapis.com javascript ALLOW But the most impressive part is the GUI, the "matrix", which allows you to visualize as well as create/remove rules very efficiently, with a click (though you can still write them manually if you like). Like a well-made car, it's so well-designed and executed that it's a pleasure to drive. Real firewalls should use this GUI. --- * NoScript: Does far more than block JavaScript, and provides a bunch of security that uMatrix does not: https://news.ycombinator.com/item?id=12624596 https://news.ycombinator.com/item?id=12624596 --- * Decentraleyes: A local cache of common CDNs and other resources. It protects privacy by minimizing connections to CDNs, should reduce bandwidth, and can help performance in some cases. From their documentation: - Supported Networks: Google Hosted Libraries, Microsoft Ajax CDN, CDNJS (Cloudflare), jQuery CDN (MaxCDN), jsDelivr (MaxCDN), Yandex CDN, Baidu CDN, Sina Public Resources, and UpYun Libraries. - Bundled Resources: AngularJS, Backbone.js, Dojo, Ember.js, Ext Core, jQuery, jQuery UI, Modernizr, MooTools, Prototype, Scriptaculous, SWFObject, Underscore.js, and Web Font Loader. --- * HTTPS Everywhere: For the reference of others reading this comment, it's an EFF project that uses a whitelist of websites which accept https connections and forces the browser to connect to them over the secure protocol. --- * CsFire: CSRF detection and protection. Also technically interesting. https://distrinet.cs.kuleuven.be/software/CsFire/ https://distrinet.cs.kuleuven.be/software/CsFire/

JoshMnem 10y ago

Try Self-destructing Cookies, BetterPrivacy, Decentraleyes, Google Search Link Fix, Random Agent Spoofer, and RefControl. Chrome gives far less control over privacy. (Consider the business motivations of Mozilla vs. Google.) You can also add a file called user.js to your Firefox profile folder with these settings to make it better: https://gist.github.com/j127/8627698e47612eaf9d2bf4c633bbbb46 https://gist.github.com/j127/8627698e47612eaf9d2bf4c633bbbb4... Anything in about:config can be overridden in user.js. You can use multiple Firefox profiles to launch separate browser profiles, each with different extensions. (I have an alias for that: `alias ff="firefox -P"`) Ctrl-shift-p is a fast way to enter private browsing mode, which, by default, will keep your privacy extensions enabled. (You can ctrl-shift-n in Chromium/Chrome if you need to turn off all extensions for a quick look at something.) Firefox for Android is also the only mobile browser that allows add-ons, so you can get your privacy tools and customizations there too. Also check out the Firefox developer console. Go into settings and check the boxes until it's how you want it.

ryuuchin 10y ago
> (You can ctrl-shift-n in Chromium/Chrome if you need to turn off all extensions for a quick look at something.) You can keep extensions enabled in Chrome as well when using incognito. You just have to explicitly enable it on the extensions menu for which extensions you want to keep enabled.
- JoshMnem 10y ago
  I generally don't do that, because I want one way to open a browser that has no extensions. So I can go to Chrome (alt-6 to get to that virtual desktop) and then ctrl-shift-n to get a plain browser. Firefox keeps the extensions on by default, so if I need to login to one site with different accounts, I can use ctrl-shift-p for a private window, or `$ firefox -P` for a different browser profile.

Maakuth 10y ago

You might want to consider replacing ABP with µBlock Origin. It does the blocking more cleverly so it performs a lot better.

ryuuchin 10y ago
Just one thing worth mentioning. If you use the exact same filter lists in ABP and uBlock Origin[1] then the end result should be IDENTICAL (if it's not it's a bug) save for the fact that uBlock does things faster and more efficient. Some people seem to get thrown off that uBlock might block more but that's only because it enables a few more filter lists by default. That being said the default are still designed to minimize false positives. [1] https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock

ryuuchin 10y ago

> If I had Private Mode always active, then I could use Firefox's own Tracking Protection, but I thought Privacy Badger is enough and is made by the EFF which I trust. If you enable uBlock Origin's Disconnect filters then Firefox's own tracking protection becomes redundant since the latter uses the Disconnect filter lists. [1] https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock

scns 10y ago

i would recommend uBlock for Adblocking, saves CPUcycles and has no shady Businessmodel

ionised 10y ago

- HTTPS Everywhere - UMatrix - NoScript (for XSS/ABE etc.) - Self-Destructing Cookies - Better Privacy (for flash cookies) - Calomel SSL Validation - Disable WebRTC (can do this without the extension though) - Canvas Blocker (prevents canvas fingerprinting)