Might wanna disable JIT, MathML, SVG, Graphite font rendering, asm.js, webgl, webgpu, hyperlink auditing, and native regexp while you're at it. Here's what torb

Might wanna disable JIT, MathML, SVG, Graphite font rendering, asm.js, webgl, webgpu, hyperlink auditing, and native regexp while you're at it. Here's what torbutton disables, for reference: https://gitweb.torproject.org/torbutton.git/tree/modules/security-prefs.js https://gitweb.torproject.org/torbutton.git/tree/modules/sec... Note that this will make you quite fingerprintable on sites with JS enabled. I'd rather split browsing across three browsers: one heavily neutered FF with the above prefs and my own personal customizations, one chromium (built properly with all mitigations, i.e. using is_official_build and not a distro package) for secure JS-enabled browsing (jitless and with all telemetry disabled/blocked, of course), and the Tor browser for anonymous browsing. Avoid ungoogled-chromium; its patches significantly weaken the browser's security by disabling component updates, and you'll have to build it yourself if you want all the exploit migigations included (since none of the available builds are built properly). I'd avoid extensions if at all possible since they very heavily weaken the browser security model. Chromium lets you enable extensions on a per-site basis, which I find helpful. Extensions that inject content also make fingerprinting quite trivial: without any JS I can uniquely identify, e.g., a Canvas Fingerprinting Defender user by eyeballing a CSP report log against an access log, no JS needed.