6 ms·

So ... it is a fork of Mozilla Firefox with privacy-friendly settings by default, some script blocking, and dns lookups done via Mullvads encrypted dns service

So ... it is a fork of Mozilla Firefox with privacy-friendly settings by default, some script blocking, and dns lookups done via Mullvads encrypted dns service Sounds ok to me, I have a longish and probably out of date list of settings that I like to chance in a new instance of firefox. I trust mullvad to not log dns more than I trust my ISP and I live in the UK so unencrypted dns here is being logged and stored by order of the government. Keeping a fork of firefox in sync with mainline firefox to get security fixes is a load of work, it is good that somebody is doing it, in this case I think the tor project is doing a lot of the work.

tomxor 4y ago
> I have a longish and probably out of date list of settings that I like to chance in a new instance of firefox Not a user but part of the purpose of the TOR fork is settings, anything that is detectable via JS is supposed to remain default to prevent fingerprinting. It's partly why it's not widely popular, I don't know if this is still true but it used to be that it was supposed to be run at a specific viewport resolution regardless of your device. All in the name of making your fingerprint as close to the same as all other TOR browser users.
- encryptluks2 4y ago
  [dead]
- dathinab 4y ago
  > run at a specific viewport resolution regardless of your device. It's more like pretending to the website that your screen has a "common" resolution etc. which is nearly but not quite the same as what you said. In the past they semi required you to keep your tor window in a specific window size for this, which just didn't work well in practice. By now they better integrated that in the browser from what I heard, so you can resize it however you want but websites might have an "empty" border are to the left/right/bottom depending on you screen resolution, windows size etc. from what I have heard. With a typical maximized window on 1080p you won't really notice it, on 4k you might notice that it's just "dump" up scaled from 1080p, but the person I spoke with wasn't sure if maybe they have a set of supported common resolutions instead of just one. And on a 4:3 screen he said it's quite noticeable.
  - alkonaut 4y ago
    Not sure how it's designed but if I was designing a system of reducing detectable entropy from viewport size, I'd make a fixed list of available resolutions. First all the common resolutions (1920x1080, 2550x14540 and so on), and in addition to that maybe just "snapped" grid sizes in 64p pixel increments. If you use a window size that doesn't match, it should just render the viewport to the closest smaller allowed size, and fill the border with something (e.g. the background color of the page). Perhaps that's exactly how it works?
    - medstrom 4y ago
      Yes, that's how it works, if you're talking about the setting privacy.resistFingerprinting.letterboxing. To my memory, the list is any multiple of 200 on width and any multiple of 100 on height. So at this moment my viewport is, I believe, exactly 1200x900. Bear in mind that it's a minority of people that hit F11 to browse fullscreen, they still have toolbars, so it's not as common as you'd think for the viewport to match a common screen resolution like 1920x1080.
      - alkonaut 4y ago
        Yeah the ones you want I guess would be 1920x1200 with the height reduced by common (say Windows 10/11) taskbar and tooobars. It's never going to be perfect but you'd at least want to minimize letterboxing for the most common fullscreen setups on the most common platform(s). But you could throw in 1920x1200 full screen as well for good measure. Perhaps it would be better to letterbox randomly with say 20px width and 20px height, so it's just 1 chance in 400 to even return to the same reported screen size? That way you'd be even harder to track than if you are the only person running exactly 1000x800.
prox 4y ago
Sounds great for the audience it’s probably intended for.
dathinab 4y ago
AFIK it's a "fork" of the tor-browser (which is a fork of Firefox) but instead of connecting to the tor network you connect to a VPN. So you get all the in-browser tracking protection Firefox has (e.g. against fingerprinting) + the ones only the Tor browser has but without the drawbacks of the tor network and in turn without onion security.
- rtpg 4y ago
  Does the tor browser fork stay up to date quickly? I would be quite worried about stale browsers in this day and age, to an extent at least
  - pabs3 4y ago
    Tor Browser updates often come the same day as Mozilla releases, sometimes a bit longer.
  - notpushkin 4y ago
    I believe Tor is collaborating with Mozilla very closely, to the point that Mozilla includes patches from Tor Browser now: https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift
    - JoachimS 4y ago
      And Mullvad is a Tor project sponsor.
      - notRobot 4y ago
        And Mozilla's partner for the Mozilla VPN.
        seanw444 4y ago
        Dang, it's a tight-knit group.
    - 4y ago
chiefalchemist 4y ago
Speaking of which, anyone have / seen an updated list of which FF to change and how? I presume the last one I bookmarked is dated. Dear Santa...please stop making a safe & private internet so gosh darn friction-y :(
anonymousnotme 4y ago
I was thinking about that very thing is keeping up with patches. I suspect that tor is probably a couple of months behind firefox and then mullvad will probably be a month or two behind tor. It is easier to check between tor browser and mullvad browser because they both use git. firefox uses mercurial, so is probably harder.

tomxor 4y ago

> I have a longish and probably out of date list of settings that I like to chance in a new instance of firefox Not a user but part of the purpose of the TOR fork is settings, anything that is detectable via JS is supposed to remain default to prevent fingerprinting. It's partly why it's not widely popular, I don't know if this is still true but it used to be that it was supposed to be run at a specific viewport resolution regardless of your device. All in the name of making your fingerprint as close to the same as all other TOR browser users.

encryptluks2 4y ago
[dead]
dathinab 4y ago
> run at a specific viewport resolution regardless of your device. It's more like pretending to the website that your screen has a "common" resolution etc. which is nearly but not quite the same as what you said. In the past they semi required you to keep your tor window in a specific window size for this, which just didn't work well in practice. By now they better integrated that in the browser from what I heard, so you can resize it however you want but websites might have an "empty" border are to the left/right/bottom depending on you screen resolution, windows size etc. from what I have heard. With a typical maximized window on 1080p you won't really notice it, on 4k you might notice that it's just "dump" up scaled from 1080p, but the person I spoke with wasn't sure if maybe they have a set of supported common resolutions instead of just one. And on a 4:3 screen he said it's quite noticeable.
- alkonaut 4y ago
  Not sure how it's designed but if I was designing a system of reducing detectable entropy from viewport size, I'd make a fixed list of available resolutions. First all the common resolutions (1920x1080, 2550x14540 and so on), and in addition to that maybe just "snapped" grid sizes in 64p pixel increments. If you use a window size that doesn't match, it should just render the viewport to the closest smaller allowed size, and fill the border with something (e.g. the background color of the page). Perhaps that's exactly how it works?
  - medstrom 4y ago
    Yes, that's how it works, if you're talking about the setting privacy.resistFingerprinting.letterboxing. To my memory, the list is any multiple of 200 on width and any multiple of 100 on height. So at this moment my viewport is, I believe, exactly 1200x900. Bear in mind that it's a minority of people that hit F11 to browse fullscreen, they still have toolbars, so it's not as common as you'd think for the viewport to match a common screen resolution like 1920x1080.
    - alkonaut 4y ago
      Yeah the ones you want I guess would be 1920x1200 with the height reduced by common (say Windows 10/11) taskbar and tooobars. It's never going to be perfect but you'd at least want to minimize letterboxing for the most common fullscreen setups on the most common platform(s). But you could throw in 1920x1200 full screen as well for good measure. Perhaps it would be better to letterbox randomly with say 20px width and 20px height, so it's just 1 chance in 400 to even return to the same reported screen size? That way you'd be even harder to track than if you are the only person running exactly 1000x800.

prox 4y ago

Sounds great for the audience it’s probably intended for.

dathinab 4y ago

AFIK it's a "fork" of the tor-browser (which is a fork of Firefox) but instead of connecting to the tor network you connect to a VPN. So you get all the in-browser tracking protection Firefox has (e.g. against fingerprinting) + the ones only the Tor browser has but without the drawbacks of the tor network and in turn without onion security.

rtpg 4y ago
Does the tor browser fork stay up to date quickly? I would be quite worried about stale browsers in this day and age, to an extent at least
- pabs3 4y ago
  Tor Browser updates often come the same day as Mozilla releases, sometimes a bit longer.
- notpushkin 4y ago
  I believe Tor is collaborating with Mozilla very closely, to the point that Mozilla includes patches from Tor Browser now: https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift
  - JoachimS 4y ago
    And Mullvad is a Tor project sponsor.
    - notRobot 4y ago
      And Mozilla's partner for the Mozilla VPN.
      - seanw444 4y ago
        Dang, it's a tight-knit group.
  - 4y ago

chiefalchemist 4y ago

Speaking of which, anyone have / seen an updated list of which FF to change and how? I presume the last one I bookmarked is dated. Dear Santa...please stop making a safe & private internet so gosh darn friction-y :(

anonymousnotme 4y ago

I was thinking about that very thing is keeping up with patches. I suspect that tor is probably a couple of months behind firefox and then mullvad will probably be a month or two behind tor. It is easier to check between tor browser and mullvad browser because they both use git. firefox uses mercurial, so is probably harder.