13 ms·

Firefox Configuration Guide for Privacy Freaks and Performance Buffs

321 points by bigbugbag 9y ago

TD-Linux 9y ago
This isn't the most unreasonable list I've seen, but beware you will break many websites with this, so you need to be prepared to deal with the fallout. Notably, a lot of the breakage is hidden in user.js, including: * No WebGL or WebRTC * Aggressive TLS settings (will break many websites) * Mixed-content upgrading (Nightly ran an experiment on this recently and it also broke a lot of websites) * No history The text warns about this, but it should at least be clear why Mozilla doesn't ship this as default.
- ams6110 9y ago
  Yeah I've tried some of these extremely hardened configurations but ultimately there's too much breakage. My config now is basically: - uBlock Origin in default configuration - No 3rd party cookies (breaks some things, but not too many) - Clear history and cookies on exit Combined with an /etc/hosts file, and rather frequent browser restarts (generally daily).
  - suprfnk 9y ago
    > Clear history [..] on exit Why the history? That's not readable by anyone except you, right? > Clear [..] cookies on exit So do you have to keep logging in to websites daily? Isn't that very annoying?
    - maxerickson 9y ago
      You can whitelist exceptions. Which of course trades off against privacy.
    - KozmoNau7 9y ago
      I use Cookie AutoDelete, which autocleans cookies shortly after closing tabs. I whitelist sites where I want to stay logged in or save settings.
    - pieter_mj 9y ago
      > Why the history? That's not readable by anyone except you, right? history sniffing
    - Spivak 9y ago
      I'm a person who clears cookies on exit. With a password manager with autofill it's not much of a burden but it does ensure that people can't resurrect old sessions and can't access my accounts without my password DB unlocked.
    - mikedelfino 9y ago
      I'm someone who clear cookies on exit to the sole purpose of having to login again every time. And I don't even use a password manager. It does get annoying because I have to type my credentials all the time, but it just takes a few seconds so it's not a big deal. I'm sure this is not preventing me from doing anything better with my time.
  - chrisan 9y ago
    > Combined with an /etc/hosts file Check out pi-hole and manage that for your whole family
    - tedcrilly 9y ago
      If you're using OpenWRT/Lede you can implement this with the adblock package: https://github.com/openwrt/packages/tree/master/net/adblock/files https://github.com/openwrt/packages/tree/master/net/adblock/...
    - driverdan 9y ago
      /etc/hosts travels with you. A LAN DNS server does not. It's a good idea to use both.
dblohm7 9y ago
More like a Firefox Footgun Guide.
feelin_googley 9y ago
An opinion: The most serious threats to user privacy from advertising companies are the "features" of the browser that allow data to be sent to or from the users computer without any input from the user. In other words, the features that let developers of websites trigger GET and POST, to "push" media to the users computer and allowing "pulling" user data indiscrinately, without explicit consent and sometimes without the knowledge of the user. For example, there is the feature of automatically loading resources, such as images. No user input required. There is the feature of automatically loading the contents of iframes. No user input required. There is the feature of cookie headers sent automatically. No user input required. There is the feature of XMLHttpRequest triggered through Javascript. No user input required. There is support for HTTP/2. Imagine websites pushing media to users computers with greater efficiency than ever before (advertisers rejoice). No user input required. If one is serious about regaining control over the sending of user data to these corporations and websites ("privacy"), then IMO one needs a browser that either lacks or can disable the features above and any others that allow media to be "pushed" to the user without any user input. Such a browser would only execute GET or POST upon user input, not upon input from other sources, such as websites. Perhaps users could have two browsers: one for commercial activity and running "web apps" and another for non-commercial activity, which may not need to be default compatible with "web apps" that push media to the user. This is an alternative to having to become an expert in browser settings. Instead of disabling features or installing add-ons, the later browser is incapable of pushing unsolicited media or leaking user data because it lacks the necessary features to do so. (I have been using such a browser for many years now. While this is probably not for everybody, I like it.)
- cjcfjrf 9y ago
  Check out umatrix, from the creator of unlock origin and original creator of unlock
- lucideer 9y ago
  This is a great post, and is exactly the line I've been thinking along for a long time. I currently use uMatrix for this and it implements this almost perfectly. However, it's scope is too narrow: it only controls requests within the webpage, so doesn't have access to it many requests the browser will make outside of that scope. If you start by broadening the scope from webpage to browser, you eventually get to the operating system level, at which point we're really just talking about a firewall/proxy tool with granular control. I've used things like privoxy and proxomitron for this in the past; little snitch is the best I've used in terms of UX and control, but it's still nowhere near as good as the uMatrix interface. There are a number of challenges with making such a tool, the primary two being: (1) mitming secure connections, (2) contextual control, differentiating iframe, js, css, image, etc. requests becomes more difficult once you're working at a global level. Given these limitations, uMatrix in combination with a good, strict about:config that allows granular control over everything may be the best we can ask for in the short term.
sohkamyung 9y ago
One thing not mentioned in the list is Firefox Multi-Account Containers [1]. It helps by segregating your on-line information (cookies) into separate containers that you set up. It doesn't stop sites pulling all cookies, but it reduces the amount of information being sent: only the information in the same container is accessible. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...
- milofeynman 9y ago
  There is a new config in Firefox under privacy.firstpartyisolation that is similar. But I can't use it or the various referer about:configs with my work mac because they break JIRA. First party isolation was made for Tor and privacy and keeps all cookies in containers in some fashion.
  - r3bl 9y ago
    There's First Party Isolation add-on[0] that allows you to enable it by default, and then disable it for a period of five minutes by clicking on an icon. That way, you could click on it when you're using JIRA and have first party isolation when you're not using JIRA. [0] https://addons.mozilla.org/en-US/firefox/addon/first-party-isolation/ https://addons.mozilla.org/en-US/firefox/addon/first-party-i...
  - sleavey 9y ago
    It's a promising idea but has issues currently. In recent Nightly builds I found it completely broke websites that override control keys [1], which is loads (GitHub, Facebook, Google Docs, etc.). It'll be great when they iron out all the bugs, because this guards against all sorts of the more advanced, sinister ways of deanonymising people. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1433592 https://bugzilla.mozilla.org/show_bug.cgi?id=1433592
- acqq 9y ago
  And what you don‘t mention is that that privacy extenson now also has more telemetry. Sad.
TheAceOfHearts 9y ago
Wow, this is a great post. Thank you for taking the time to write this up. I've been using Firefox for a while now, but kept most settings fairly close to the defaults. I'm unhappy with many of their defaults, but hadn't been motivated to start tweaking stuff. I'll note that disabling custom fonts breaks certain sites. I don't consider it a deal-breaker, but it's worth being aware. Many sites abuse fonts for icons. Developers, please consider using SVG icons instead. Another comment mentioned how user.js disables WebGL and WebRTC. IMO, that and many other browser features should be disabled by default. If a site requires their functionality, I should be able to whitelist it. Safari used to let you conditionally enable WebGL access for only certain sites, showing a prompt when the functionality was accessed. It's a damn shame they removed the feature. I don't think most sites should have full access to all these browser APIs. Heck, all the storage APIs should probably be limited to the current session by default, with the option of requesting longer-term persistence for trusted services. I'd really love it if we had an easy way to create fully isolated containers for each web service or group of web services, with varying tweaks in their security preferences. Since we're already on the topic of configuring Firefox, I have a tangential question. Does anyone know how to configure Firefox to automatically save rar files? You usually receive the option to always save different file types, but the choice isn't available for rar files, so you always receive a download popup. It's quite annoying, and I have no idea why it happening. A cursory search didn't reveal any useful information on the matter. It's perplexing, because tar and zip files can be set to automatically save without any problem. I hadn't seen uMatrix before, but it looks promising. Does anyone know of any user-friendly OS tools that lets you monitor and inspect requests? On macOS I used Little Snitch for a long time, but I'm trying to shift away from closed-source tools (no problem with paying, but I want to be able to compile it myself), especially for something so critical. Also, it doesn't let you inspect requests.
- Santosh83 9y ago
  > Since we're already on the topic of configuring Firefox, I have a tangential question. Does anyone know how to configure Firefox to automatically save rar files? You usually receive the option to always save different file types, but the choice isn't available for rar files, so you always receive a download popup. Maybe I'm missing something but for me, going to the Options tab, selecting General tab, then going to the Applications section and modifying the entry for RAR file in the list from 'Always Ask' to 'Save file' does the job. Does it work for you? For your second question, how about Wireshark? It's open source and does let you inspect the traffic.
peterwwillis 9y ago
Privacy used to be a hobby for people with tinfoil hats or the monicker 'cypherpunk', but soon even Grandma will be going through a key signing ritual while muttering something about a return to the gold standard.
- FullMetalBitch 9y ago
  It's actually sad how so many people don't care about their privacy, sure you can give a little but it should be an option not mandatory and in many aspects it is mandatory or done without the person knowledge. The least thing they could do is ask for it... Edit: I shouldn't write early in the morning, tons of grammar mistakes.
  - Hextinium 9y ago
    I am consistently surprised why this isn't a bigger deal giving the gravity of what is happening. I see news headlining all the time for very transient things but have yet to see an easily accessible version that I could hand my mother of why privacy is so important if anyone could show me one I would greatly appreciate it
    - deleted 9y ago
      [deleted]
Nux 9y ago
Why are those concerned with privacy "freaks", but those concerned about performance "buffs"? As a person who cares about privacy I find this a bit offensive and it's not helping the privacy debate. Nice article otherwise and I have to congratulate the web designer - what a beautiful, readable site!
- 12bytes 9y ago
  i meant no offense - i used the term "freaks" because a lot of people who don't give a crap about privacy may consider us 'privacy freaks' - sine the article is about privacy however, i think it's obvious that it's just a poke in the ribs, if you will
genghizkhan 9y ago
For the user.js bit, I prefer pyllyukko's relaxed branch[1]. I've got a setup quite close to it[2] and it works very well with next to no breakage. Also, using both uBlock Origin and uMatrix is somewhat redundant. Gorhill himself has advocated using per-domain permissions in uMatrix and not having different settings for each element type in uMatrix (if I remember correctly, I can't be bothered to look up the source right now) which is easily done in uBlock Origin using Advanced Mode. One can also replace Neat URL and Skip Redirect with Request Control[3], which is a more flexible solution, imo, though it requires one make their own rules. [1] https://github.com/pyllyukko/user.js/tree/relaxed https://github.com/pyllyukko/user.js/tree/relaxed [2] https://github.com/savyajha/dotfiles/blob/master/Firefox/user.js https://github.com/savyajha/dotfiles/blob/master/Firefox/use... [3] https://addons.mozilla.org/en-US/firefox/addon/requestcontrol/ https://addons.mozilla.org/en-US/firefox/addon/requestcontro...
HenryBemis 9y ago
Very thorough and useful, thank you! A non-firefox-related but privacy addition I will suggest is a strong hosts file [1] [1]: http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/
esseti 9y ago
Nice, I haven't seen uMatrix before (I user uBlock) and I'm used to use NoScript. NoScript is kind of "complex" to use and many website will not work or require a lot of setup to make videos or other media running. with uMatrix it seems a bit easier.
PudgePacket 9y ago
Just a general comment, the author mentions and links a vpn provider several times and the links contain referral codes, though the author never mentions it.
- 12bytes 9y ago
  i recommend Air because i actually use their service that said, i don't disagree with your comment and so when i update the article again, i will state that they are affil links in the interest of transparency
rhn_mk1 9y ago
> NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript This is a mistake. uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself. NoScript stops script execution completely. NoScript also activates `<noscript>` tags which will allow content to render on Medium. And which break Twitter by redirecting away just after it loads... Caveat emptor: NoScript is somewhat buggy in its WebExt form. Sometimes it needs a click on the global revoke button to render `<noscript>` again. Sometimes it pops up blank windows. I'm not aware of any alternative though.
- sohkamyung 9y ago
  > NoScript also activates `<noscript>` tags Ah, that explains why I occasionally see <noscript> on links. I use NoScript too, but only allow scripts from a select list.
- 12bytes 9y ago
  > NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript > This is a mistake. thanks for bringing this up - i couldn't quickly find info regarding how uM handles inline scripts, but i see that uBO does have that specific option - this has caused me to look deeper into uBO and i'm now considering revising the guide and dumping uM completely since i personally don't require all the granularity of uM (i always allow images/css globally for example) so although there may be some caveats with not using NS, it seems that uBO can basically eliminate the need for NS, at least for those of us that just want stuff to work for the most part
- gorhill 9y ago
  > uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself You are mistaken. You could have taken a few seconds to try for yourself before making this erroneous claim. > NoScript also activates `<noscript>` tags which will allow content to render on Medium. uMatrix can also "activate" the `noscript` tags, and this can be disabled/enabled on a per-site basis.
huhtenberg 9y ago
> C:\Program Files\Mozilla Firefox\browser\features\ WOAH. That's some genuinely nasty stuff that no one would normally want on their machines AND visible only from an obscure about:support page AND with no clear way of disabling it, save for deleting .xpi files: followonsearch@mozilla.com.xpi [1] shield-recipe-client@mozilla.org.xpi [2] There are also these two that explicitly disrespect and ignore one's updating preferences: aushelper@mozilla.org webcompat@mozilla.org.xpi These appear to be a way for Mozilla to push "urgent" patches bypassing the normal update mechanism and user consent. --- This is completely unacceptable. This sort of functionality should be in the main UI and it should be possible to disable it with one click, permanently. [1] https://blog.mozilla.org/data/2017/06/05/measuring-search-in-firefox/ https://blog.mozilla.org/data/2017/06/05/measuring-search-in... [2] https://wiki.mozilla.org/Firefox/Shield https://wiki.mozilla.org/Firefox/Shield - generalized engine for running "study" recipes.
- CJefferson 9y ago
  While I understand you not wanting Mozilla to be able to push urgent patches, this is (in my) opinion necessary in sufficently serious cases. Imagine a remote code execution hole in Firefox, being actively attacked through ad networks. In that situation, every minute counts, and an attack could perform serious damage.
  - eps 9y ago
    "The road to hell is paved with good intentions." It's not about denying Mozilla an option of pushing zero-day patches. It's about the fact that it's a built-in always-on _concealed_ feature.
    - Sylos 9y ago
      The source code is public, there's probably been a blog post about it, there's an about-page for it, and there actually is a setting for it in the main-UI. I really don't see how it's particularly concealed. If they actually tried to conceal it, you would not know about it at all.
- 9y ago
cpeterso 9y ago
Also check out Firefox's "privacy.resistFingerprinting" [1] and "privacy.firstparty.isolate" [2] prefs in about:config. These are Tor privacy features that Tor and Mozilla are merging into Firefox. resistFingerprinting reduces the uniqueness of various Firefox properties that are visible to JavaScript and web servers. First-party isolation will isolate third-party cookies by first-party domain. So Facebook Like buttons on cnn.com will see different cookies than Facebook Like buttons on nytimes.com. Both of these features can break some websites. [1] https://www.ghacks.net/2018/03/01/a-history-of-fingerprinting-protection-in-firefox/ https://www.ghacks.net/2018/03/01/a-history-of-fingerprintin... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 https://bugzilla.mozilla.org/show_bug.cgi?id=1299996
- QasimK 9y ago
  Is there any reason not to just block third-party cookies ("Accept third-party cookies: Never" in settings) all-together? I've never encountered anything breaking as a result of doing this.
  - rockdoe 9y ago
    Some sites do break. The problem is that by the time you run into one you'll have forgotten you changed this setting.
  - Santosh83 9y ago
    That's what I do too. Deny all third-party cookies, plus uBlock Origin with a sizable filter list and prefetching and link auditing blocked, video autoplay disabled gets me most of the security benefits with minimal setup and cognitive load. Privacy is not much better than running vanilla because although 3rd party cookies are blocked, most sites can still identify by device fingerprinting. That can only be blocked by not running Javascript, but that's personally too much of a hassle to handle and unbreak for practically every site out there.
  - bzbarsky 9y ago
    I've encountered several sites that broken with blocked third-party cookies. Most of the website for one local bank around here and a payment form for a local puppet theater are the ones that come to mind offhand. Typically, it'll be small sites that are outsourcing part of their site to a third party but don't want to open a separate tab for that which will be affected by this, obviously. If you only browse major sites doing everything in-house you're not going to run into problems.
bon0r 9y ago
gotta love the fact that guide for privacy freaks is served via plain http :)
hazeii 9y ago
For privacy, on a linux box are there any downsides to simply creating one or more extra accounts, and running Firefox in them for privacy ('DISPLAY=:0 firefox')?. I use this approach to set up firefox as I like it on a spare account, then copy '.mozilla' to '.mozilla-base'. Then it's just a simple case of 'su -l guest' and (via a script) 'rm -fr ~/.mozilla; cp -a ~/.mozilla_base .mozilla; DISPLAY=:0 firefox; rm -fr ~/.mozilla' (actually the script deletes the local cache as well). Net effect is that firefox starts exactly as I like, but forgets everything that happened in the session ('groundhog-day mode'). Edit: added 'su -l' step. Edit: As an adendum, note that this technique can be extended to the complete 'guest' accounts as well, e.g. 'cd /home; rm -fr guest; cp -a guest.base guest; su -l guest'; the entire 'guest' account is then 'groundhog-dayed'. #!/bin/sh # export DISPLAY=:0 # Set up clean copy cd ~ rm -fr .mozilla cp -a .mozilla_base .mozilla cd - > /dev/null # /usr/local/bin/firefox $@ # echo "Holding...." sleep 2 echo "Cleaning...." # Clean out junk (so we start clean next time) cd ~ rm -fr .mozilla .cache/mozilla* rm -fr .adobe rm -fr .macromedia cd - > /dev/null
- QasimK 9y ago
  Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?
  - hazeii 9y ago
    I'm not familiar with Firefox Multi-account containers; do they use separate Unix accounts? (since my approach means Firefox is running as a completely diffrent user, a simple firefox compromise or bug shouldn't be able to access anything sensitive on the main account - like SSH keys, say).
    - regecks 9y ago
      They're not containers as in Linux containers, they're "contextual identities" within the same Firefox process, that isolate things like cookies. Much weaker isolation (technologically) than process/user privilege separation, but OTOH highly usable. (Well, there's the e10s process separation, but nothing anything extra for multi-account containers, as far as I understand). What things it isolates are listed here: https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers#Implementation_Details https://wiki.mozilla.org/Security/Contextual_Identity_Projec... FWIW they work great.
alwillis 9y ago
Great article. However, the days when we could install some plugins and tweak a few settings to restore our privacy are, unfortunately, pretty much over. There’s only so much a plugin can do when it doesn’t have access to the core APIs of the rendering engine or the network stack. As long as Google and Firefox are incentivized to make money by ads, user tracking and all of the rest, they won’t stop. Long story short: the business model of the web has to change from one where the default state is to monetize the invasion of our privacy to one where we can control who gets to advertise to us and that our attention is valuable; we should be paid for it. In short, that’s what the Brave browser is all about: https://brave.com/com465 https://brave.com/com465. By default, it blocks ads, tracking scripts, fingerprinting and 3rd party cookies in such a way that most pages don’t break. It even blocks those cryptocurrency mining scripts that some sites like Salon are using: https://www.cnbc.com/2018/02/14/salon-disable-ad-blocker-or-let-us-mine-cryptocurrency-monero.html https://www.cnbc.com/2018/02/14/salon-disable-ad-blocker-or-.... Brave allows you to pay content creators with a cryptocurrency called Basic Attention Token (BAT) based on the amount of time spent on their sites or as a percentage of a monthly contribution. BAT is based on the Ethereum token standard. Later this year, Brave users will be able to opt-in to getting paid to watch high quality, relevant ads if they wish. How? By using zero knowledge proofs, Brave can show you these ads without leaking your personal information, based on your browsing history, that never leaves your machine. Be aware: Brave is in beta; it’s not done yet. It’s based on Chromium but the rest of the tech is under heavy development. It has come a long way in the 3-4 months I’ve been using it regularly. And there are lots of good things in store, including Tor on a per-tab basis, which I’m looking forward to: https://github.com/brave/browser-laptop/wiki/Brave-Tor-Support https://github.com/brave/browser-laptop/wiki/Brave-Tor-Suppo... Brave runs on macOS, Windows, Linux, iOS and Android; even if Brendan Eich of Javascript and Mozilla fame weren’t involved, I’d feel this is the spiritual successor to Firefox: https://brave.com/com465 https://brave.com/com465.
- patrickbolle 9y ago
  This sounds 100% like an ad just FYI
  - alwillis 9y ago
pksadiq 9y ago
> Firefox Configuration Guide for Privacy Freaks and Performance Buffs I'm surprised that this post is linked to a non-https URL while the website supports https. I wish HN have some policy/recommendation to prefer https URLs to non-https one (if the URL support both).
rockdoe 9y ago
What I don't understand is why someone would go to the problems of essentially spending a lot of time breaking their Firefox installation instead of using Tor directly when they care about privacy. Most of the tweaks boil down to turning Firefox defaults into Tor defaults, but without the benefit of actual anonymity, unless you're going to go ahead and install and trust the VPN provider which you also need. The majority of these settings aren't the default because they cause significant site breakage (uBlock is maybe the exception). If they could have been enabled by default, they would have. Mozilla has been taking gradual steps in that direction, and backed off/reverted a few times when too much stuff broke. Use Tor Browser. If a site breaks, at least you'll know why, and you have the choice of whether it warrants lowering your privacy.
- syshum 9y ago
  >>Mozilla has been taking gradual steps in that direction I disagree with this.. I do not see Mozilla taking any steps toward privacy at all, infact in many ways they are taking steps AWAY from privacy with many of their recent actions and blunders. From their use of opt-out rather than opt-in for various privacy invading features, their pushing adware to all users via what was suppose to be a QA/Feedback feature, their purchasing and invest in certain companies... No the Mozilla Foundation from the 90's is long dead, it has been replaced by the Mozilla Corporation, which is really no different than the Google Corporation or the Microsoft Corporation
  - a_imho 9y ago
    Indeed, Moz://a revenue stream is at odds with privacy.
  - bzbarsky 9y ago
    > I do not see Mozilla taking any steps toward privacy at all https://bugzilla.mozilla.org/showdependencytree.cgi?id=1260929&hide_resolved=0 https://bugzilla.mozilla.org/showdependencytree.cgi?id=12609... are some concrete steps being taken. Or the containers work. Or the tracking protection work. If you're not seeing those, it's because you're not looking.
- 9y ago
paol 9y ago
A much shorter guide that will get you 80% of the value for 2% of the effort: * Install extension "uBlock Origin" * Install extension "Cookie AutoDelete" * Go into Preferences -> Privacy & Security, set "Accept 3rd party cookies" to "Never" Done.
- robinhood 9y ago
  Also, block all tracking servers at the hosts level by adding rules in your /etc/hosts. I've been using https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts for a few years now and it's incredibly useful.
  - kaskavalci 9y ago
    How do you automate its updates?
    - AlecSchueler 9y ago
      Cron and git would be my idea.
elorant 9y ago
The one thing I'd like configurable in FF Quantum is the amount of processes it spawns. I run Selenium tests and if I choose to run five or six instances I end up with two dozen processes. Fucking hell.
- severine 9y ago
  But it is configurable! Preferences > General > Performance > Uncheck the box next to Use recommended performance settings. You will then be able to change the following settings: - Use hardware acceleration when available - Content process limit
  - elorant 9y ago
    Nope, that doesn't work. I have it at one (default) and it's still spawning too many processes. I guess it's part of how things work now with FF. You get a snappier experience in exchange of higher memory usage because it's multitasking. If only we could turn that thing off.
    - severine 9y ago
      My bad, sorry... What about this, from [1,2]? > To disable e10s/multiprocess go to about:config by typing it in your URL bar. Search for browser.tabs.remote.autostart using the search box on about:config. There may be multiple results. Set them all to false and restart the browser (if there are no entries, create it as a boolean and set it to false). [1] https://support.mozilla.org/es/questions/1191898 https://support.mozilla.org/es/questions/1191898 [2] https://support.mozilla.org/es/questions/1191898 https://support.mozilla.org/es/questions/1191898
      - elorant 9y ago
        Yeap, that did the trick. Thanks a million dude.
    - Sylos 9y ago
      The setting that Severine mentioned controls the number of content processes, which is the number of processes that Firefox uses for its tabs. It will still have another process that controls all the UI and all those browser tab processes, a process for sandboxing extensions/plugins and then even more processes for miscellaneous things, for example I think asynchronous scrolling has another process and when doing performance improvements, they often just stuck long operations into a separate process.
paulie_a 9y ago
I like a lot of the suggestions in the article and the comments here but at the same I feel like attempting to evade is a battle already lost. Ruining the analytics is a better tactic in my opinion. Flood the tracking with useless data
pieter_mj 9y ago
While searching on github for more user.js privacy and security hardening modifications (https://github.com/search?q=%22user.js%22&type=Repositories https://github.com/search?q=%22user.js%22&type=Repositories ) i've added https://raw.githubusercontent.com/CHEF-KOCH/NSABlocklist/master/HOSTS https://raw.githubusercontent.com/CHEF-KOCH/NSABlocklist/mas... to uBlock. take that NSA! Also check out https://www.privacy-handbuch.de/handbuch_21.htm https://www.privacy-handbuch.de/handbuch_21.htm for more interesting firefox modifications (german site).
hsivonen 9y ago
Getting pwned via plain C++-induced memory-unsafety bugs can also lead to privacy trouble, so recommending turning off security updates or recommending forks that aren't staffed well enough to fully track Gecko security patches is not great advice.

321 points by bigbugbag 9y ago

This isn't the most unreasonable list I've seen, but beware you will break many websites with this, so you need to be prepared to deal with the fallout. Notably, a lot of the breakage is hidden in user.js, including: * No WebGL or WebRTC * Aggressive TLS settings (will break many websites) * Mixed-content upgrading (Nightly ran an experiment on this recently and it also broke a lot of websites) * No history The text warns about this, but it should at least be clear why Mozilla doesn't ship this as default.

ams6110 9y ago
Yeah I've tried some of these extremely hardened configurations but ultimately there's too much breakage. My config now is basically: - uBlock Origin in default configuration - No 3rd party cookies (breaks some things, but not too many) - Clear history and cookies on exit Combined with an /etc/hosts file, and rather frequent browser restarts (generally daily).
- suprfnk 9y ago
  > Clear history [..] on exit Why the history? That's not readable by anyone except you, right? > Clear [..] cookies on exit So do you have to keep logging in to websites daily? Isn't that very annoying?
  - maxerickson 9y ago
    You can whitelist exceptions. Which of course trades off against privacy.
  - KozmoNau7 9y ago
    I use Cookie AutoDelete, which autocleans cookies shortly after closing tabs. I whitelist sites where I want to stay logged in or save settings.
  - pieter_mj 9y ago
    > Why the history? That's not readable by anyone except you, right? history sniffing
  - Spivak 9y ago
    I'm a person who clears cookies on exit. With a password manager with autofill it's not much of a burden but it does ensure that people can't resurrect old sessions and can't access my accounts without my password DB unlocked.
  - mikedelfino 9y ago
    I'm someone who clear cookies on exit to the sole purpose of having to login again every time. And I don't even use a password manager. It does get annoying because I have to type my credentials all the time, but it just takes a few seconds so it's not a big deal. I'm sure this is not preventing me from doing anything better with my time.
- chrisan 9y ago
  > Combined with an /etc/hosts file Check out pi-hole and manage that for your whole family
  - tedcrilly 9y ago
    If you're using OpenWRT/Lede you can implement this with the adblock package: https://github.com/openwrt/packages/tree/master/net/adblock/files https://github.com/openwrt/packages/tree/master/net/adblock/...
  - driverdan 9y ago
    /etc/hosts travels with you. A LAN DNS server does not. It's a good idea to use both.

dblohm7 9y ago

More like a Firefox Footgun Guide.

feelin_googley 9y ago

An opinion: The most serious threats to user privacy from advertising companies are the "features" of the browser that allow data to be sent to or from the users computer without any input from the user. In other words, the features that let developers of websites trigger GET and POST, to "push" media to the users computer and allowing "pulling" user data indiscrinately, without explicit consent and sometimes without the knowledge of the user. For example, there is the feature of automatically loading resources, such as images. No user input required. There is the feature of automatically loading the contents of iframes. No user input required. There is the feature of cookie headers sent automatically. No user input required. There is the feature of XMLHttpRequest triggered through Javascript. No user input required. There is support for HTTP/2. Imagine websites pushing media to users computers with greater efficiency than ever before (advertisers rejoice). No user input required. If one is serious about regaining control over the sending of user data to these corporations and websites ("privacy"), then IMO one needs a browser that either lacks or can disable the features above and any others that allow media to be "pushed" to the user without any user input. Such a browser would only execute GET or POST upon user input, not upon input from other sources, such as websites. Perhaps users could have two browsers: one for commercial activity and running "web apps" and another for non-commercial activity, which may not need to be default compatible with "web apps" that push media to the user. This is an alternative to having to become an expert in browser settings. Instead of disabling features or installing add-ons, the later browser is incapable of pushing unsolicited media or leaking user data because it lacks the necessary features to do so. (I have been using such a browser for many years now. While this is probably not for everybody, I like it.)

cjcfjrf 9y ago
Check out umatrix, from the creator of unlock origin and original creator of unlock
lucideer 9y ago
This is a great post, and is exactly the line I've been thinking along for a long time. I currently use uMatrix for this and it implements this almost perfectly. However, it's scope is too narrow: it only controls requests within the webpage, so doesn't have access to it many requests the browser will make outside of that scope. If you start by broadening the scope from webpage to browser, you eventually get to the operating system level, at which point we're really just talking about a firewall/proxy tool with granular control. I've used things like privoxy and proxomitron for this in the past; little snitch is the best I've used in terms of UX and control, but it's still nowhere near as good as the uMatrix interface. There are a number of challenges with making such a tool, the primary two being: (1) mitming secure connections, (2) contextual control, differentiating iframe, js, css, image, etc. requests becomes more difficult once you're working at a global level. Given these limitations, uMatrix in combination with a good, strict about:config that allows granular control over everything may be the best we can ask for in the short term.

sohkamyung 9y ago

One thing not mentioned in the list is Firefox Multi-Account Containers [1]. It helps by segregating your on-line information (cookies) into separate containers that you set up. It doesn't stop sites pulling all cookies, but it reduces the amount of information being sent: only the information in the same container is accessible. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...

milofeynman 9y ago
There is a new config in Firefox under privacy.firstpartyisolation that is similar. But I can't use it or the various referer about:configs with my work mac because they break JIRA. First party isolation was made for Tor and privacy and keeps all cookies in containers in some fashion.
- r3bl 9y ago
  There's First Party Isolation add-on[0] that allows you to enable it by default, and then disable it for a period of five minutes by clicking on an icon. That way, you could click on it when you're using JIRA and have first party isolation when you're not using JIRA. [0] https://addons.mozilla.org/en-US/firefox/addon/first-party-isolation/ https://addons.mozilla.org/en-US/firefox/addon/first-party-i...
- sleavey 9y ago
  It's a promising idea but has issues currently. In recent Nightly builds I found it completely broke websites that override control keys [1], which is loads (GitHub, Facebook, Google Docs, etc.). It'll be great when they iron out all the bugs, because this guards against all sorts of the more advanced, sinister ways of deanonymising people. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1433592 https://bugzilla.mozilla.org/show_bug.cgi?id=1433592
acqq 9y ago
And what you don‘t mention is that that privacy extenson now also has more telemetry. Sad.

TheAceOfHearts 9y ago

Wow, this is a great post. Thank you for taking the time to write this up. I've been using Firefox for a while now, but kept most settings fairly close to the defaults. I'm unhappy with many of their defaults, but hadn't been motivated to start tweaking stuff. I'll note that disabling custom fonts breaks certain sites. I don't consider it a deal-breaker, but it's worth being aware. Many sites abuse fonts for icons. Developers, please consider using SVG icons instead. Another comment mentioned how user.js disables WebGL and WebRTC. IMO, that and many other browser features should be disabled by default. If a site requires their functionality, I should be able to whitelist it. Safari used to let you conditionally enable WebGL access for only certain sites, showing a prompt when the functionality was accessed. It's a damn shame they removed the feature. I don't think most sites should have full access to all these browser APIs. Heck, all the storage APIs should probably be limited to the current session by default, with the option of requesting longer-term persistence for trusted services. I'd really love it if we had an easy way to create fully isolated containers for each web service or group of web services, with varying tweaks in their security preferences. Since we're already on the topic of configuring Firefox, I have a tangential question. Does anyone know how to configure Firefox to automatically save rar files? You usually receive the option to always save different file types, but the choice isn't available for rar files, so you always receive a download popup. It's quite annoying, and I have no idea why it happening. A cursory search didn't reveal any useful information on the matter. It's perplexing, because tar and zip files can be set to automatically save without any problem. I hadn't seen uMatrix before, but it looks promising. Does anyone know of any user-friendly OS tools that lets you monitor and inspect requests? On macOS I used Little Snitch for a long time, but I'm trying to shift away from closed-source tools (no problem with paying, but I want to be able to compile it myself), especially for something so critical. Also, it doesn't let you inspect requests.

Santosh83 9y ago
> Since we're already on the topic of configuring Firefox, I have a tangential question. Does anyone know how to configure Firefox to automatically save rar files? You usually receive the option to always save different file types, but the choice isn't available for rar files, so you always receive a download popup. Maybe I'm missing something but for me, going to the Options tab, selecting General tab, then going to the Applications section and modifying the entry for RAR file in the list from 'Always Ask' to 'Save file' does the job. Does it work for you? For your second question, how about Wireshark? It's open source and does let you inspect the traffic.

peterwwillis 9y ago

Privacy used to be a hobby for people with tinfoil hats or the monicker 'cypherpunk', but soon even Grandma will be going through a key signing ritual while muttering something about a return to the gold standard.

FullMetalBitch 9y ago
It's actually sad how so many people don't care about their privacy, sure you can give a little but it should be an option not mandatory and in many aspects it is mandatory or done without the person knowledge. The least thing they could do is ask for it... Edit: I shouldn't write early in the morning, tons of grammar mistakes.
- Hextinium 9y ago
  I am consistently surprised why this isn't a bigger deal giving the gravity of what is happening. I see news headlining all the time for very transient things but have yet to see an easily accessible version that I could hand my mother of why privacy is so important if anyone could show me one I would greatly appreciate it
  - deleted 9y ago
    [deleted]

Nux 9y ago

Why are those concerned with privacy "freaks", but those concerned about performance "buffs"? As a person who cares about privacy I find this a bit offensive and it's not helping the privacy debate. Nice article otherwise and I have to congratulate the web designer - what a beautiful, readable site!

12bytes 9y ago
i meant no offense - i used the term "freaks" because a lot of people who don't give a crap about privacy may consider us 'privacy freaks' - sine the article is about privacy however, i think it's obvious that it's just a poke in the ribs, if you will

genghizkhan 9y ago

For the user.js bit, I prefer pyllyukko's relaxed branch[1]. I've got a setup quite close to it[2] and it works very well with next to no breakage. Also, using both uBlock Origin and uMatrix is somewhat redundant. Gorhill himself has advocated using per-domain permissions in uMatrix and not having different settings for each element type in uMatrix (if I remember correctly, I can't be bothered to look up the source right now) which is easily done in uBlock Origin using Advanced Mode. One can also replace Neat URL and Skip Redirect with Request Control[3], which is a more flexible solution, imo, though it requires one make their own rules. [1] https://github.com/pyllyukko/user.js/tree/relaxed https://github.com/pyllyukko/user.js/tree/relaxed [2] https://github.com/savyajha/dotfiles/blob/master/Firefox/user.js https://github.com/savyajha/dotfiles/blob/master/Firefox/use... [3] https://addons.mozilla.org/en-US/firefox/addon/requestcontrol/ https://addons.mozilla.org/en-US/firefox/addon/requestcontro...

HenryBemis 9y ago

Very thorough and useful, thank you! A non-firefox-related but privacy addition I will suggest is a strong hosts file [1] [1]: http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/

esseti 9y ago

Nice, I haven't seen uMatrix before (I user uBlock) and I'm used to use NoScript. NoScript is kind of "complex" to use and many website will not work or require a lot of setup to make videos or other media running. with uMatrix it seems a bit easier.

PudgePacket 9y ago

Just a general comment, the author mentions and links a vpn provider several times and the links contain referral codes, though the author never mentions it.

12bytes 9y ago
i recommend Air because i actually use their service that said, i don't disagree with your comment and so when i update the article again, i will state that they are affil links in the interest of transparency

rhn_mk1 9y ago

> NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript This is a mistake. uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself. NoScript stops script execution completely. NoScript also activates `<noscript>` tags which will allow content to render on Medium. And which break Twitter by redirecting away just after it loads... Caveat emptor: NoScript is somewhat buggy in its WebExt form. Sometimes it needs a click on the global revoke button to render `<noscript>` again. Sometimes it pops up blank windows. I'm not aware of any alternative though.

sohkamyung 9y ago
> NoScript also activates `<noscript>` tags Ah, that explains why I occasionally see <noscript> on links. I use NoScript too, but only allow scripts from a select list.
12bytes 9y ago
> NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript > This is a mistake. thanks for bringing this up - i couldn't quickly find info regarding how uM handles inline scripts, but i see that uBO does have that specific option - this has caused me to look deeper into uBO and i'm now considering revising the guide and dumping uM completely since i personally don't require all the granularity of uM (i always allow images/css globally for example) so although there may be some caveats with not using NS, it seems that uBO can basically eliminate the need for NS, at least for those of us that just want stuff to work for the most part
gorhill 9y ago
> uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself You are mistaken. You could have taken a few seconds to try for yourself before making this erroneous claim. > NoScript also activates `<noscript>` tags which will allow content to render on Medium. uMatrix can also "activate" the `noscript` tags, and this can be disabled/enabled on a per-site basis.

huhtenberg 9y ago

> C:\Program Files\Mozilla Firefox\browser\features\ WOAH. That's some genuinely nasty stuff that no one would normally want on their machines AND visible only from an obscure about:support page AND with no clear way of disabling it, save for deleting .xpi files: followonsearch@mozilla.com.xpi [1] shield-recipe-client@mozilla.org.xpi [2] There are also these two that explicitly disrespect and ignore one's updating preferences: aushelper@mozilla.org webcompat@mozilla.org.xpi These appear to be a way for Mozilla to push "urgent" patches bypassing the normal update mechanism and user consent. --- This is completely unacceptable. This sort of functionality should be in the main UI and it should be possible to disable it with one click, permanently. [1] https://blog.mozilla.org/data/2017/06/05/measuring-search-in-firefox/ https://blog.mozilla.org/data/2017/06/05/measuring-search-in... [2] https://wiki.mozilla.org/Firefox/Shield https://wiki.mozilla.org/Firefox/Shield - generalized engine for running "study" recipes.

CJefferson 9y ago
While I understand you not wanting Mozilla to be able to push urgent patches, this is (in my) opinion necessary in sufficently serious cases. Imagine a remote code execution hole in Firefox, being actively attacked through ad networks. In that situation, every minute counts, and an attack could perform serious damage.
- eps 9y ago
  "The road to hell is paved with good intentions." It's not about denying Mozilla an option of pushing zero-day patches. It's about the fact that it's a built-in always-on _concealed_ feature.
  - Sylos 9y ago
    The source code is public, there's probably been a blog post about it, there's an about-page for it, and there actually is a setting for it in the main-UI. I really don't see how it's particularly concealed. If they actually tried to conceal it, you would not know about it at all.
9y ago

cpeterso 9y ago

Also check out Firefox's "privacy.resistFingerprinting" [1] and "privacy.firstparty.isolate" [2] prefs in about:config. These are Tor privacy features that Tor and Mozilla are merging into Firefox. resistFingerprinting reduces the uniqueness of various Firefox properties that are visible to JavaScript and web servers. First-party isolation will isolate third-party cookies by first-party domain. So Facebook Like buttons on cnn.com will see different cookies than Facebook Like buttons on nytimes.com. Both of these features can break some websites. [1] https://www.ghacks.net/2018/03/01/a-history-of-fingerprinting-protection-in-firefox/ https://www.ghacks.net/2018/03/01/a-history-of-fingerprintin... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 https://bugzilla.mozilla.org/show_bug.cgi?id=1299996

QasimK 9y ago
Is there any reason not to just block third-party cookies ("Accept third-party cookies: Never" in settings) all-together? I've never encountered anything breaking as a result of doing this.
- rockdoe 9y ago
  Some sites do break. The problem is that by the time you run into one you'll have forgotten you changed this setting.
- Santosh83 9y ago
  That's what I do too. Deny all third-party cookies, plus uBlock Origin with a sizable filter list and prefetching and link auditing blocked, video autoplay disabled gets me most of the security benefits with minimal setup and cognitive load. Privacy is not much better than running vanilla because although 3rd party cookies are blocked, most sites can still identify by device fingerprinting. That can only be blocked by not running Javascript, but that's personally too much of a hassle to handle and unbreak for practically every site out there.
- bzbarsky 9y ago
  I've encountered several sites that broken with blocked third-party cookies. Most of the website for one local bank around here and a payment form for a local puppet theater are the ones that come to mind offhand. Typically, it'll be small sites that are outsourcing part of their site to a third party but don't want to open a separate tab for that which will be affected by this, obviously. If you only browse major sites doing everything in-house you're not going to run into problems.

bon0r 9y ago

gotta love the fact that guide for privacy freaks is served via plain http :)

hazeii 9y ago

For privacy, on a linux box are there any downsides to simply creating one or more extra accounts, and running Firefox in them for privacy ('DISPLAY=:0 firefox')?. I use this approach to set up firefox as I like it on a spare account, then copy '.mozilla' to '.mozilla-base'. Then it's just a simple case of 'su -l guest' and (via a script) 'rm -fr ~/.mozilla; cp -a ~/.mozilla_base .mozilla; DISPLAY=:0 firefox; rm -fr ~/.mozilla' (actually the script deletes the local cache as well). Net effect is that firefox starts exactly as I like, but forgets everything that happened in the session ('groundhog-day mode'). Edit: added 'su -l' step. Edit: As an adendum, note that this technique can be extended to the complete 'guest' accounts as well, e.g. 'cd /home; rm -fr guest; cp -a guest.base guest; su -l guest'; the entire 'guest' account is then 'groundhog-dayed'. #!/bin/sh # export DISPLAY=:0 # Set up clean copy cd ~ rm -fr .mozilla cp -a .mozilla_base .mozilla cd - > /dev/null # /usr/local/bin/firefox $@ # echo "Holding...." sleep 2 echo "Cleaning...." # Clean out junk (so we start clean next time) cd ~ rm -fr .mozilla .cache/mozilla* rm -fr .adobe rm -fr .macromedia cd - > /dev/null

QasimK 9y ago
Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?
- hazeii 9y ago
  I'm not familiar with Firefox Multi-account containers; do they use separate Unix accounts? (since my approach means Firefox is running as a completely diffrent user, a simple firefox compromise or bug shouldn't be able to access anything sensitive on the main account - like SSH keys, say).
  - regecks 9y ago
    They're not containers as in Linux containers, they're "contextual identities" within the same Firefox process, that isolate things like cookies. Much weaker isolation (technologically) than process/user privilege separation, but OTOH highly usable. (Well, there's the e10s process separation, but nothing anything extra for multi-account containers, as far as I understand). What things it isolates are listed here: https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers#Implementation_Details https://wiki.mozilla.org/Security/Contextual_Identity_Projec... FWIW they work great.

alwillis 9y ago

Great article. However, the days when we could install some plugins and tweak a few settings to restore our privacy are, unfortunately, pretty much over. There’s only so much a plugin can do when it doesn’t have access to the core APIs of the rendering engine or the network stack. As long as Google and Firefox are incentivized to make money by ads, user tracking and all of the rest, they won’t stop. Long story short: the business model of the web has to change from one where the default state is to monetize the invasion of our privacy to one where we can control who gets to advertise to us and that our attention is valuable; we should be paid for it. In short, that’s what the Brave browser is all about: https://brave.com/com465 https://brave.com/com465. By default, it blocks ads, tracking scripts, fingerprinting and 3rd party cookies in such a way that most pages don’t break. It even blocks those cryptocurrency mining scripts that some sites like Salon are using: https://www.cnbc.com/2018/02/14/salon-disable-ad-blocker-or-let-us-mine-cryptocurrency-monero.html https://www.cnbc.com/2018/02/14/salon-disable-ad-blocker-or-.... Brave allows you to pay content creators with a cryptocurrency called Basic Attention Token (BAT) based on the amount of time spent on their sites or as a percentage of a monthly contribution. BAT is based on the Ethereum token standard. Later this year, Brave users will be able to opt-in to getting paid to watch high quality, relevant ads if they wish. How? By using zero knowledge proofs, Brave can show you these ads without leaking your personal information, based on your browsing history, that never leaves your machine. Be aware: Brave is in beta; it’s not done yet. It’s based on Chromium but the rest of the tech is under heavy development. It has come a long way in the 3-4 months I’ve been using it regularly. And there are lots of good things in store, including Tor on a per-tab basis, which I’m looking forward to: https://github.com/brave/browser-laptop/wiki/Brave-Tor-Support https://github.com/brave/browser-laptop/wiki/Brave-Tor-Suppo... Brave runs on macOS, Windows, Linux, iOS and Android; even if Brendan Eich of Javascript and Mozilla fame weren’t involved, I’d feel this is the spiritual successor to Firefox: https://brave.com/com465 https://brave.com/com465.

patrickbolle 9y ago
This sounds 100% like an ad just FYI
- alwillis 9y ago

pksadiq 9y ago

> Firefox Configuration Guide for Privacy Freaks and Performance Buffs I'm surprised that this post is linked to a non-https URL while the website supports https. I wish HN have some policy/recommendation to prefer https URLs to non-https one (if the URL support both).

rockdoe 9y ago

What I don't understand is why someone would go to the problems of essentially spending a lot of time breaking their Firefox installation instead of using Tor directly when they care about privacy. Most of the tweaks boil down to turning Firefox defaults into Tor defaults, but without the benefit of actual anonymity, unless you're going to go ahead and install and trust the VPN provider which you also need. The majority of these settings aren't the default because they cause significant site breakage (uBlock is maybe the exception). If they could have been enabled by default, they would have. Mozilla has been taking gradual steps in that direction, and backed off/reverted a few times when too much stuff broke. Use Tor Browser. If a site breaks, at least you'll know why, and you have the choice of whether it warrants lowering your privacy.

syshum 9y ago
>>Mozilla has been taking gradual steps in that direction I disagree with this.. I do not see Mozilla taking any steps toward privacy at all, infact in many ways they are taking steps AWAY from privacy with many of their recent actions and blunders. From their use of opt-out rather than opt-in for various privacy invading features, their pushing adware to all users via what was suppose to be a QA/Feedback feature, their purchasing and invest in certain companies... No the Mozilla Foundation from the 90's is long dead, it has been replaced by the Mozilla Corporation, which is really no different than the Google Corporation or the Microsoft Corporation
- a_imho 9y ago
  Indeed, Moz://a revenue stream is at odds with privacy.
- bzbarsky 9y ago
  > I do not see Mozilla taking any steps toward privacy at all https://bugzilla.mozilla.org/showdependencytree.cgi?id=1260929&hide_resolved=0 https://bugzilla.mozilla.org/showdependencytree.cgi?id=12609... are some concrete steps being taken. Or the containers work. Or the tracking protection work. If you're not seeing those, it's because you're not looking.
9y ago

paol 9y ago

A much shorter guide that will get you 80% of the value for 2% of the effort: * Install extension "uBlock Origin" * Install extension "Cookie AutoDelete" * Go into Preferences -> Privacy & Security, set "Accept 3rd party cookies" to "Never" Done.

robinhood 9y ago
Also, block all tracking servers at the hosts level by adding rules in your /etc/hosts. I've been using https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts for a few years now and it's incredibly useful.
- kaskavalci 9y ago
  How do you automate its updates?
  - AlecSchueler 9y ago
    Cron and git would be my idea.

elorant 9y ago

The one thing I'd like configurable in FF Quantum is the amount of processes it spawns. I run Selenium tests and if I choose to run five or six instances I end up with two dozen processes. Fucking hell.

severine 9y ago
But it is configurable! Preferences > General > Performance > Uncheck the box next to Use recommended performance settings. You will then be able to change the following settings: - Use hardware acceleration when available - Content process limit
- elorant 9y ago
  Nope, that doesn't work. I have it at one (default) and it's still spawning too many processes. I guess it's part of how things work now with FF. You get a snappier experience in exchange of higher memory usage because it's multitasking. If only we could turn that thing off.
  - severine 9y ago
    My bad, sorry... What about this, from [1,2]? > To disable e10s/multiprocess go to about:config by typing it in your URL bar. Search for browser.tabs.remote.autostart using the search box on about:config. There may be multiple results. Set them all to false and restart the browser (if there are no entries, create it as a boolean and set it to false). [1] https://support.mozilla.org/es/questions/1191898 https://support.mozilla.org/es/questions/1191898 [2] https://support.mozilla.org/es/questions/1191898 https://support.mozilla.org/es/questions/1191898
    - elorant 9y ago
      Yeap, that did the trick. Thanks a million dude.
  - Sylos 9y ago
    The setting that Severine mentioned controls the number of content processes, which is the number of processes that Firefox uses for its tabs. It will still have another process that controls all the UI and all those browser tab processes, a process for sandboxing extensions/plugins and then even more processes for miscellaneous things, for example I think asynchronous scrolling has another process and when doing performance improvements, they often just stuck long operations into a separate process.

paulie_a 9y ago

I like a lot of the suggestions in the article and the comments here but at the same I feel like attempting to evade is a battle already lost. Ruining the analytics is a better tactic in my opinion. Flood the tracking with useless data

pieter_mj 9y ago

While searching on github for more user.js privacy and security hardening modifications (https://github.com/search?q=%22user.js%22&type=Repositories https://github.com/search?q=%22user.js%22&type=Repositories ) i've added https://raw.githubusercontent.com/CHEF-KOCH/NSABlocklist/master/HOSTS https://raw.githubusercontent.com/CHEF-KOCH/NSABlocklist/mas... to uBlock. take that NSA! Also check out https://www.privacy-handbuch.de/handbuch_21.htm https://www.privacy-handbuch.de/handbuch_21.htm for more interesting firefox modifications (german site).

hsivonen 9y ago

Getting pwned via plain C++-induced memory-unsafety bugs can also lead to privacy trouble, so recommending turning off security updates or recommending forks that aren't staffed well enough to fully track Gecko security patches is not great advice.