14 ms·
Firefox about:config privacy settings
- a-ve 8y agohttps://ffprofile.com https://ffprofile.com does almost the same thing, albeit without the memory stuff described in this gist.
- seanalltogether 8y agowhat are the reasons for disabling memory and disk cache, and lowering dns caching?
- woodrowbarlow 8y agotiming attacks, maybe? a script could make a request and measure the response time to heuristically determine whether a given resource is cached locally.
- arayh 8y agoI assume the less data your browser stores about your browsing history, the better your privacy is (at least in terms of someone snooping around your computer applications to determine your day-to-day behaviour)
- mike-cardwell 8y agohttps://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache https://www.grepular.com/Preventing_Web_Tracking_via_the_Bro...
- ct0 8y agoconfig.trim_on_minimize = true Reduce memory usage when minimized. (Windows only) -This really helped for me
- cpeterso 8y agoThe config.trim_on_minimize preference no longer exists, as it was Windows XP's own behavior that Firefox was suppressing: https://bugzilla.mozilla.org/show_bug.cgi?id=660367 https://bugzilla.mozilla.org/show_bug.cgi?id=660367 // Our internal trim prevention logic is effective on 2K/XP at maintaining // the working set when windows are minimized, but on Vista and up it has // little to no effect. Since this feature has been the source of numerous // bugs over the years, disable it (sTrimOnMinimize=1) on Vista and up.
- Uh7seidu 8y ago> dom.event.contextmenu.enabled = false This is a blunt tool. Some sites uses context menu events in a benign way. A better alternative is to simply bypass context handlers with shift-rightclick when necessary. > webgl.force-enabled This isn't really a performance improvement. If webgl is disabled it's due to troublesome drivers. Forcing it on can crash things. > layers.offmainthreadcomposition.enabled = true > layers.offmainthreadcomposition.async-animations = true Those are the defaults anyway on supported platforms
- zamadatix 8y agoIf only shift would override userselect: none; as well
- sp332 8y agoHey I didn't know about shift-rightclick. For me, disabling dom.event.contextmenu.enabled gives me both menus at once, then I tap Alt to get rid of the browser's menu if I want to use the app's menu underneath it. But I won't have to do that anymore.
- ocdtrekkie 8y agoI was thinking about summarizing some of my own changes for this as well, but I realized I didn't realize what a lot of these settings actually did. One setting I read about recently I wanted changed was to turn off URL trimming, so http:// http:// still displays and the like: browser.urlbar.trimURLs
- zamadatix 8y agoIt makes me sad that a lot of the privacy are as damaging as the thing you are trying to avoid for no reason. Examples: - With right clicks I want sites to be able to supplement options but the only options are "complete replacement" or "no modification at all". - I don't want to disable sending MIME information when I paste to prevent a site from being able to block me from copying. - Why do I have to make the url unreadable to have special characters emphasized?
- parliament32 8y agoFor the first one, just leave it on and use shift+rclick to bypass site handling of right click.
- pcwalton 8y agoI don't like encouraging mucking around in about:config, but I might as well mention this one. If you don't mind your window losing vibrancy and rounded corners, you should be able to significantly improve battery life on macOS by setting "gfx.compositor.glcontext.opaque" to true. This makes WindowServer stop drawing whatever is behind the Firefox window. This bug tracks the proper solution: https://bugzilla.mozilla.org/show_bug.cgi?id=1429522 https://bugzilla.mozilla.org/show_bug.cgi?id=1429522
- bmurphy1976 8y agoI have a new 2018 MBP with an i9. I've noticed I can squeeze upwards of six hours battery out of it using Safari. With Firefox I'm lucky to get three. I made this change just to see. So far it does appear to have lowered the energy impact score a bit, but I'm not sure it's enough to matter yet. I guess we'll know in a couple hours. Edit: 20 minutes in and I've watched my Time Remaining estimate creep up from 3 hours to 5.5 hours. Seems like a solid win so far (other than it looks like crap).
- greggarious 8y agoI use Firefox. I've found the big battery hit has come from streaming services (Netflix, Pandora, Spotify, Youtube, etc). One small change I made was streaming music to my phone, and that had a big impact. I know that streaming will use some battery life, but the amount of CPU being used by say, Pandora, was rather extreme.
- bmurphy1976 8y agoSure, those will kill battery usage, but that's not what I'm doing. Typically I'm bouncing between the browser with about 10 informational tabs open, terminal, and sublime text all day long. There's a night and day difference using Safari vs Firefox for just regular browsing. I'm not the only one who experiences this either, I have a coworker who complains about the same issue with his couple year old MBP. Firefox is a battery vampire.
- danjoc 8y agoGood grief that's a long list. I'd rather just use a browser like Brave with privacy and ad blocks enabled by default.
- neilsimp1 8y agoI disagree, but I don't see why you were downvoted.
- subsection1h 8y agoYeah, and Emacs has a long manual. I'd rather just use a text editor with toolbars and menus I can clicky click.
- driverdan 8y agoSome of these are strange choices and conflict. For example, disabling caching and then changing the cache size. Or disabling caching at all since it will have a significant negative performance impact. If you're concerned about what caching leaves behind use memory caching only.
- xenophonf 8y agoIf you're interested in hardening your Firefox profile, check out this repository of user.js settings: https://github.com/pyllyukko/user.js https://github.com/pyllyukko/user.js This does things like blocking analytics and browser fingerprinting, and it's a simple to install or revert---just drop the user.js file in your Firefox profile directory.
- rapnie 8y agoWow, this looks quite thorough. Thank you!
- magicalist 8y agoBefore anyone tries this, I really really really encourage you to read the `Known problems and limitations`. eg it'll erase all your saved passwords, bullet point 23 (at least it's in bold :/) https://github.com/pyllyukko/user.js/issues/27#issuecomment-123461838 https://github.com/pyllyukko/user.js/issues/27#issuecomment-...
- colecut 8y agoI noticed recently that unless I manually went in and set a master password, anyone can easily go into the FireFox settings and view all saved passwords.. I've been using FireFox Quantum as my primary browser for 3 or 4 months now and am really trying to love it, but chrome is just so much snappier..
- SubiculumCode 8y agothat has been true since forever, btw. I feel like Fireifox should make this more clear to users
- nathancahill 8y agoIsn't that true for any browser though?
- all_factz 8y agoOne thing that's frustrated me about FF (and kept me using Chrome) is that local development is a pain in general... for example, when I type `localhost` in my nav bar, Chrome autofills the port; FF doesn't (it just puts `localhost/`, which is useless). Next, FF interacts oddly with NGINX, telling me `The plain HTTP request was sent to HTTPS port`, whereas Chrome just passes me right along, giving me a little `Not Secure` text next to the URL. Given I have to go to this website about 1000x per day, you can see why using FF is painful... Anyone have any advice (on config, for example) for fixing this? And if anyone on the FF team is listening... I'd like to use your browser, but this has kept me from doing so.
- TrisMcC 8y agoCreate a bookmark with a easily type-able name. The bar will autocomplete your bookmarks.
- daleharvey 8y agoWhat port? If I $ sudo python -m SimpleHTTPServer 80 Then type localhost into the firefox url bar, I get the directory listing
- kbenson 8y agoIt must be a different port, otherwise localhost without a port number would work fine. Presumably 8080 or something, which is common for user apps to use since without privileges you can't open a port below 1024 normally.
- daleharvey 8y agoBut what port would firefox connect to, and how would it know? Chrome doesnt do this either as far as I can tell.
- nathancahill 8y ago> "Chrome autofills the port" Sounds like they'd visited the URL in the past and had it in their history.
- shabbyrobe 8y agotoolkit.telemetry.cachedClientID will be repopulated by Firefox even after you clear it. I have just locked the preference [1], hopefully this stops it. [1]: http://kb.mozillazine.org/Locking_preferences http://kb.mozillazine.org/Locking_preferences
- nerdponx 8y agoI frequently see recommendations to disable "safe browsing" features. Why?
- dao- 8y agoHysteria or ignorance, as with other items in this list. Safe browsing is designed not to compromise privacy.
- gsnedders 8y agoNotably, the Safe Browsing Update API never sends the URL itself to the server: it does a local lookup with hash prefixes of the URL, and only if that finds some threat does it then send the hash prefix to Google (which gives some degree of deniability, given they never know what actual URL you've visited, and only rarely get anything).
- deleted 8y ago[deleted]
- hnaccy 8y agoMaybe I just don't want to send Google any info.
- nerdponx 8y agoWhat other items do you think fall into this category?
- dao- 8y agoFor instance, disabling geolocation. You need to explicitly approve geolocation requests anyway. If you're sure you'll never ever want to share your location with a site, sure, disable it globally. But recommending this to others as a way to protect their privacy is a bit silly.
- Drdrdrq 8y agoWell, I for one appreciate the recommendation and will follow it to get rid of annoying messages. To each their own.
- kibwen 8y ago> These settings are best combined with your standard privacy extensions (HTTPS Everywhere, NoScript/Request Policy, uBlock origin, agent spoofing, Privacy Badger etc) Side question: how many of these ought to just be standard behavior of the browser? For example, will Firefox's new tracking protection make Privacy Badger obsolete? Should the HTTPS Everywhere extension, which attempts to route any HTTP request to an equivalent HTTPS, be the default behavior?
- gsnedders 8y agoI'm sure plenty of people on here would object to HTTPS Everywhere being default: "but the user typed the HTTP scheme, the browser should do what the user asked!". That said, the bigger problem is that too many things that HTTPS Everywhere tries to upgrade to HTTPS are only partial versions of the site; you'd probably need something more conservative to avoid too much breakage.
- BuckRogers 8y agoI moved from HTTPS Everywhere & Privacy Badger to DuckDuckGo Privacy Essentials. It does the job of both of those with one add-on. In response to HTTPS Everywhere breaking things, it does, and I've done tests comparing it and DDG PE and and found sites that would break using HTTPS Everywhere did not with DDG PE. They may simply be doing more testing.
- billysielu 8y agoFirst Party Isolation is the best flag you can set.
- darkstar999 8y agoI wish there was a setting to prevent changes to scroll behavior.
- forapurpose 8y agoHow do we, and more importantly how do adventurous end users, distinguish useful from useless from harmful configuration changes? Why should I trust this person? Why should I think it's worth my time? I find that these accumulated lists of security ideas are usually dangerous - in any domain, not just Firefox or browsers. They collect information and misinformation and add a veneer of legitimacy. Some settings don't behave as you think; some aren't documented; some are poorly implemented or tested by the vendor, who didn't design them for end users, and their malfunctions can create more security holes. Some are implemented for reasons you don't understand ('before you tear down a fence, know the reason it was put there'). Some are dependencies for other settings, features, and subsystems. It would have to be work by an expert in browsers or Firefox or security, such as a Mozilla engineer or someone like Giorgio Maone, for me to trust a list like this one.
- bobthedino 8y agoAm pleased to discover the "network.IDN_show_punycode" option and wonder why it doesn't default to true, given the way other browsers seem to handle this.
- gsnedders 8y agoOther browsers vary their behaviour depending on locale, if I'm not mistaken, so that people in countries where IDNs are common don't constantly see meaningless punycode.
- howeyc 8y agoDo these settings sync? Or do I need to do this on every one of my machines which has firefox installed?
- 8bitsrule 8y agoProbably not. OTOH, you can put the changes into a file called 'user.js'. Go to the folder of the FF profile you're using. Backup the file 'prefs.js' to restore in case you don't like the result. Then drop 'user.js' into that folder and restart. When you're sure you're happy with the changes, then you can just drop 'user.js' into the profile folder(s) on your other machines. The process is detailed here. https://www.ghacks.net/2015/08/18/a-comprehensive-list-of-firefox-privacy-and-security-settings/ https://www.ghacks.net/2015/08/18/a-comprehensive-list-of-fi... Edit: I haven't personally tested this past FF59.
- phyzome 8y agoThis list is somewhere between worthless and dangerous. Chesterton's Fence: Presumably Mozilla has already optimized the privacy and performance of Firefox as much as they've felt comfortable doing. If they could change each of those settings as recommended without tradeoffs to help the user, they would have done so. Without listing the tradeoffs for each one, this list cannot be relied upon.
- pcwalton 8y agoCorrect, and that's why I don't like encouraging messing with about:config. The few settings that can have any positive impact invariably come with drawbacks, which is why they're off by default.
- hnaccy 8y agoThere's little drawback to turning off Pocket unless you find the new tab content(and paid advertisements) compelling.
- jvehent 8y agoActually, I do.
- kiriakasis 8y agoI find it is an amazing service that suggest worthwhile readings, at least a few of the best articles I read in the last month came from pocket
- subsection1h 8y agoI've changed dozens of settings in about:config without issue ever since 2004 when about:config started being documented at MozillaZine: http://kb.mozillazine.org/About:config_entries http://kb.mozillazine.org/About:config_entries
- reitanqild 8y agoI guess there's a reason they're out of reach for most users - and a reason they're still available for people in crowds like hacker news* readers etc.
- Zooper 8y agoPlugin fingerprint protection was removed 3 years ago by a poorly-reasoned patch, favoring the large bug of unimpeded surveillance over the very tiny bug of sites looping through non-existent lists if and only if they need to interact with a plugin. Seeing the conversation, I'm looking for a different browser. "remove_plugins-enumerable_names.patch Bug 757726 hid most plugins from navigator.plugins enumeration to reduce fingerprinting. Plugin detection scripts could ask for a plugin or MIME type by name, but they couldn't get a list of all installed plugins. Unfortunately, the feature had to be disabled because it broke pretty much all plugin detection scripts because they naively search for the desired plugin using an O(n) loop instead of a O(1) query. This patch removes the disabled code because it is unlikely we could ever re-enable it. In addition to removing the obsolete navigator.plugin tests for detecting hidden plugins, it adds tests for detecting click-to-play and disabled plugins."
- gsnedders 8y agoNote with Firefox supporting only one NPAPI plugin now (Flash), as of https://bugzilla.mozilla.org/show_bug.cgi?id=1269807 https://bugzilla.mozilla.org/show_bug.cgi?id=1269807, the enumeration case is identical to the probe case.
- bzbarsky 8y agoThe site bug wasn't "sites looping through non-existent lists if and only if they need to interact with a plugin". It was sites trying to detect whether Flash is installed by looping over the list, deciding it's not installed, and not trying to play the video (or the game or whatever), instead pointing the user to a "Download Flash" page. This affected enough sites that it was a serious problem for users, not a "very tiny bug". In any case, at this point Firefox supports exactly one plug-in, so all enumeration can tell you is whether Flash is installed or not. That's still one bit of data, of course, but that bit could be extracted even with the "no enumeration" patch by explicitly querying whether Flash is supported.
- kodablah 8y ago> Disable Google Safe Browsing and malware and phishing protection. Stop sending links and downloading lists from google. To be clearer here, lists of partial hashes are downloaded and entire links are only sent after partial match. Still worth disabling for privacy reasons if you care more about that than safe browsing protection, but worth clarifying how it works lest one thinks all links are sent.
- magicalist 8y ago> and entire links are only sent after partial match. Only part of a hash of the url is sent to get an update for all the URLs in the partial match block. The actual url is never sent. The exception is when download malware protection is on. In that case, when downloading a file the actual URL is sent. That's a regular preference, though ("Block dangerous downloads"), doesn't need about:config changes, and is well described in the help docs. https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work?as=u&utm_source=inproduct#w_what-information-is-sent-to-mozilla-or-its-partners-when-phishing-and-malware-protection-are-enabled https://support.mozilla.org/en-US/kb/how-does-phishing-and-m...
- kodablah 8y agoYes, my mistake, I should correct to "only checked". Still makes an internet call to a third party (as does the original hash list download) which I think the OP is wanting to avoid w/ the settings updates, but yes, URL not sent to list maintainer.
- Drdrdrq 8y agoStill - it is unsettling that the only browser available that somewhat respects privacy, sends anything to some 3rd party, and completely unacceptable that they send it to Google.
- floatingatoll 8y agoSeriously, again? Applying all of the changes at this list will harm users and increase the chances of threats compromising the browser. Don’t be shortsighted and use this blindly. Especially do not punish some poor unwary non-tech user by altering these settings on their behalf.
- deleted 8y ago[deleted]
- jake_the_third 8y ago> Applying all of the changes at this list will harm users and increase the chances of threats compromising the browser. How so?
- floatingatoll 8y agobrowser.safebrowsing.phishing.enabled = false These instructions disable phishing lookups, rather than pointing users to a list of alternatives. This is unsafe and harmful to bury in this list. network.cookie.alwaysAcceptSessionCookies = false They will immediately lose the ability to login to their password manager, which requires session cookies. browser.cache.disk.enable = false browser.cache.memory.enable = false They will start loading every resource on a page on every visit to every page, as no resources will be cached. One hour of browsing will use a month's data quota and the glorious no-caching detail of every pageview will be closely observed by the server-side logging metrics that are so desperate these days to extract targetable marketing data. webgl.force-enabled = true Browsers disable WebGL in some scenarios to protect users from hardware, software, and/or driver bugs that cause crashes when WebGL is enabled. This setting overrides that which increases their risk of GPU, browser, and system crashes. Additionally all crashes are either "exploitable" or "not exploitable", so bypassing crash mitigation processes increases your risk of one such vector being used against your browser. network.dns.disableIPv6 = true Over the next ten years, the user will see that more and more of the web breaks down and mysteriously fails in their browser. Sites only load partially, videoconferencing never works properly, video streaming is jerky and slow. Providers shipped IPv6 to their customer endpoints years ago. Disabling it has potential downsides and no upsides either for "privacy settings" or anything else.
- Uplink 8y agoWho do I tell my brand new, bright idea about IDN attack prevention? It goes like this: Display characters that are out of range of your selected language's character set in a different colour than the characters of your language. That way, when you go to раураӏ.com that last character shows up in red. Homework: select two languages (e.g. Chinese and English), and use three colours. Make the colour scheme colour-blind-friendly. (it just came to me, I haven't thought it through; I'd rather read different coloured characters than punycode)
- A2017U1 8y agoPunycode renders as ascii in chrome (not sure about ff), people will notice the malformed url and that something is wrong.
- tialaramex 8y agoColouring is not very universal, and so not generally a good choice. Browsers have taken different approaches to this, two popular ones are: * Identify TLD registry operators who have a sane approach that prohibits or otherwise is effective for controlling homographs, whitelist their TLDs, default to showing punycode (the A-labels used by the DNS system which are always just ASCII). This has the effect that if your name looks "wrong" that's a problem to take up with your TLD registry. Note that com doesn't have such policies at all, it's a vast sleazy market and it remains interesting to me that huge global brands would rather be in that market, trying to shout over the crowd, than leave it to rot. * Identify cases like you've described with "confusing" mixtures of scripts and display those as punycode. Both have problems. The former requires that you effectively police TLD registry operators. Find out what their policies are, check they actually implement those policies effectively, and take action if this changes. The latter requires you figure out how all the world's language communities use different scripts, and how that interacts with Unicode, in order to avoid penalising combinations lots of people want, while still detecting attacks.
- badrabbit 8y agoThey're supposed to display in punycode characters outside of your locale. Maybe whitelisting specific characters instead of only locale would be best. Your color idea is neat but look at it from the perspective of people that actually use idn domains and don't speak english. What if раураӏ.com was раураӏ.fans-ùøê.com where ùøê was part of the same charset as ӏ and the user speaks both locale. Even if you color it,it would be difficult to train users to pick up on that.
- OzzyB 8y agoSomewhat tangental but can someone explain why Firefox users need to explicitly enable new Streams API support? [1] Safari, Chrome implement these APIs out-of-the-box but FF wants users to open `about:config` (and ignore the ominous warning) and set `dom.streams.enabled` and `javascript.options.streams` to `true`. It seems a little backwards to me since this has been available since version 57 and their webpage is the first result when searching for this documentation! https://developer.mozilla.org/en-US/docs/Web/API/ReadableStream https://developer.mozilla.org/en-US/docs/Web/API/ReadableStr...
- gsnedders 8y agoQuality of implementation. https://bugzilla.mozilla.org/show_bug.cgi?id=1389628 https://bugzilla.mozilla.org/show_bug.cgi?id=1389628 is the tracking bug for enabling it by default.
- known 8y agohttps://wiki.archlinux.org/index.php/Firefox/Tweaks https://wiki.archlinux.org/index.php/Firefox/Tweaks i slick
- rk06 8y ago> PRIVACY SETTING > network.http.sendRefererHeader = 0 WARNING: twitter.com does not work with this setting default value is 2 Tested on FF 62, Win 10 Pro
- satysin 8y agoWhile talking about Firefox I have a quick question I am hoping someone here can help answer. One feature of Chrome I like a lot is the super simple per-site settings options. I use this to disable JS on a number of sites without impacting any other sites. As far as I can tell there is no option built into Firefox that allows me to do this. Does anyone know of a simple way to get per-site JS blocking? I have looked at a few extensions which works but I was wondering (hoping) for a hidden Firefox option to do such a thing. I hacve tried to get Firefox policies to work but they appear broken? Can anyone help?
- SSLy 8y agoThis is superfically not a simple way, but if you get uMatrix and spend 1 minute to change the default config to allow all, you can use it to block js on per site (and per origin) basis.
- Drdrdrq 8y agouMatrix lets you set policies per domain / subdomain, while being very easy to use (for someone who knows web technologies). Highly recommend it.
- yborg 8y agoAfter a number of experiments with Panopticlick, the single biggest fingerprint was ... screen depth and resolution. Even after disabling most of the other main fingerprinting mechanisms, my maximized browser window on a 30" display was a very small subset of the last 45 days test results. This was surprising to me.
- pgy 8y agoMy favorite about:config setting is browser.tabs.closeWindowWithLastTab=false, it keeps Firefox open when all the tabs are closed.