6 ms·

I'm always incredibly skeptical of any set of tweaks that is supposed to take off-the-shelf software and make it more private (how?) or secure (from what?). I'm

I'm always incredibly skeptical of any set of tweaks that is supposed to take off-the-shelf software and make it more private (how?) or secure (from what?). I'm sure some of these tweaks do that, but can't help but think they increase your attack surface over all (unless you have the time to read and think carefully about each settings change- in which case, you probably could have just changed the settings yourself).

ygjb 3y ago
They do modify the attack surface, but since these prefs cover code that ships in the release version of Firefox, they should be reasonably well tested. Most of the preferences in this will actually reduce the target-able attack surface, and disable some features that could be footguns, but at the same time disable some optimizations that aim to reduce cognitive load on users (which in turns reduces the likelihood that mistakes will be made).
- bzmrgonz 3y ago
  Additionally, do keep in mind that browser dev's, in addition to their ulterior harvesting agenda, have the burden of universal appeal/usability, which makes niche installs impossible. If this is a NixOS-type of configure-your-own-browser, I'm all for it. This is the reason why Consumer wireless-Router configuration sucks, because manufacturers are trying to appeal to the masses and don't want to generate a call-for-support nightmare. So yeah, if we can *nixify(I'm claiming coinage here) all things produced in bulk and for the masses, by all means!!!
- mattstir 3y ago
  > Most of the preferences in this will actually reduce the target-able attack surface Can you point to anything specific that reduces the attack surface? When looking at the "securefox" config, it does a bunch of strange things, like enabling embedded TikTok links (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f45296a4f63c0bf362512d72f/Securefox.js#L60 https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) and disabling UITour (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f45296a4f63c0bf362512d72f/Securefox.js#L158 https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) which Firefox uses to highlight menus and is only accessible by approved Mozilla domains (https://searchfox.org/mozilla-central/source/browser/app/permissions https://searchfox.org/mozilla-central/source/browser/app/per...). It's a very strange mix of configs.
  - autoexec 3y ago
    > Can you point to anything specific that reduces the attack surface? I haven't had a chance to dig though those configs yet, but disabling things like service workers, webgl, normandy/experiments, pocket, and webrtc would be a good start at reducing attack surface
    - throwaway290 3y ago
      All of that also makes you easier to fingerprint. How many people disable WebGL?
      - Beldin 3y ago
        Enabling WebGL makes you a lot more fingerprintable than having it disabled. See e.g. How gullible are web measurement tools? A case study analysing and strengthening OpenWPM’s reliability. B. Krumnow, H. Jonker and S. Karsch. In Proc. 18th International Conference on emerging Networking EXperiments and Technologies (CoNEXT’22). ACM, pp. 171–186, 2022. (Table 3).
  - yokoffing 3y ago
    The section "Securefox" should probably be renamed "Privatefox", but labels are misleading. It's best to read the project files to understand the balance taken with security, privacy, and functionality. Let's make it simple: Want a mix of speed and privacy, while retaining functionality? Use Betterfox user.js. Want more privacy and security at the expense of site functionality? Use Arkenfox user.js. Want Tor prefs but without using its nodes/relays? Use Mullvad Browser. Want anonymity? Use Tor Browser.
belinder 3y ago
Another way to look at it is, you may not be aware of all the settings out there, and a set like this will help you discover them
- 1vuio0pswjnm7 3y ago
  Another way to illustrate the point: Do you read other peoples' code before you run it, or do you just blindly run it.
  - hkt 3y ago
    People who install Betterfox without reading the code are only blindly trusting one more piece of code than everyone else, really.
altairprime 3y ago
For specific example, this particular one disables the bookmarks toolbar, reader mode, Firefox Sync, and screen reader accessibility. Opinionated does not imply “Better”, even if the name claims otherwise.
- mst 3y ago
  I appreciated that the accessibility thing is called out as the top entry on the list of changes it makes you may want to override. If it's genuinely just munching CPU if you don't use it, then turning it off by default with a warning that it's going to do that seems pretty reasonable. (I've not tried their user.js and probably won't, but "realising the accessibility tools thing was important enough to go at the top even if the vast majority of users will care more about other entries in the list" seems like an indication that at least some thought has gone into this)
- yokoffing 3y ago
  The first two prefs are commented out (using //) and are not in the user.js itself, and the latter two are in the user.js but are 1) easy to re-enable and 2) the repo indicates how to enable them if you need them. Please read the Github page.
  - altairprime 3y ago
    There’s two user js files. One has all four. The other has two of four. Note the comments at the top if you’d like to distinguish between them, though certainly others will not. I also see a disable for 0RTT; why? (Probably for the same reason that disabling TLS 1.2 was popular a few years ago.) Webrender is force-enabled; anyone that this causes startup crashes for is out of luck. Autofill and password saving is disabled; hope you migrated to a third-party app before using this. I reiterate: Opinionated does not mean Better. It just means opinionated.
lillywastaken 3y ago
This is generally the case imo. Installing hardening tweaks/extensions/... to make yourself "more secure" and "more private" often just ends in increasing the viable attack surface and making yourself more identifiable (because such extensions/settings are very uncommon)
- autoexec 3y ago
  It's okay to have a unique fingerprint when it changes all the time. It's far better to always show up as someone new than to try to blend in with the crowd and pray that none of the countless and ever-changing ways to ID you individually doesn't give you away.
- Beldin 3y ago
  In this case, it only toggles settings already baked in to the original software. That should not increase your attack surface unless the settings are poorly tested. Moreover, it would not decrease your privacy unless: 1. The number of people messing with the setting is very small, AND 2. The default for the setting gives you at least as much privacy as flipping it does. The second point is not often the case. For example, turning off WebGL provides 1 bit of info ("turned off WebGL"). Leaving WebGL on allows a website to measure your WebGL setup, which is typically far more revealing. Not everyone uses the same GPU hardware and screen, after all. In general, flipping a setting to off reveals 1 bit of information - but it might indeed be 1 bit that few others know of, thereby reducing your anonymity group in that respect. Leaving a setting on allows a website to probe you further and find out things related to the setting. See for example amIunique.org -- it tests 4 WebGL parameters, which, for me, have a similarity ratio of 1.17%, 0.94%, 2.68%, and 0.53%. Those are quite horrible numbers and would likely identify me uniquely unless they almost completely overlap.
lakomen 3y ago
Took the words right out my mouth, as I wanted to post a very similar comment beginning with I'm always skeptical. Is it because we've seen so many let downs? Probably. Can't trust anything or anyone anymore.
- yazzku 3y ago
  I think it's justified in this case. Mozilla suffers from a schizophrenic existence where they are simultaneously non-profit and for-profit, and Firefox privacy-friendly and unfriendly. For example, Firefox supports HTTPS-only mode and DNS over HTTPS, but they are not on by default. It also ships with DuckDuckGo and other search engines in the setting drop-down, but alas, that $10M/year or whatever they get from Google is too good, so fuck your privacy. You then have to manually turn all that shit on, because they won't, to the point where installing a fresh Firefox on a system now requires a bit of a rite of passage before you can get a useful browser. Do all these things I mentioned really increase your attack surface? Also, mandatory mention: https://librewolf.net/ https://librewolf.net/
  - marcosdumay 3y ago
    I wonder if you are on the group that think that DNS over HTTPS is obviously and unambiguously a benefit for security and privacy, and of course nobody disagrees; or in the group that thinks that it is obviously and unambiguously a threat for security and privacy, and of course nobody disagrees.
    - yazzku 3y ago
      Neither? That setting is perhaps not a clear default among the ones I mentioned, especially because I personally wouldn't want to send my DNS requests to fucking Cloudflare or something based in the US. But I still stand by my comment that Firefox's defaults suck. At the very least they could have a useful one-time wizard that doesn't just ask you to import your bookmarks from Chrome.

ygjb 3y ago

They do modify the attack surface, but since these prefs cover code that ships in the release version of Firefox, they should be reasonably well tested. Most of the preferences in this will actually reduce the target-able attack surface, and disable some features that could be footguns, but at the same time disable some optimizations that aim to reduce cognitive load on users (which in turns reduces the likelihood that mistakes will be made).

bzmrgonz 3y ago
Additionally, do keep in mind that browser dev's, in addition to their ulterior harvesting agenda, have the burden of universal appeal/usability, which makes niche installs impossible. If this is a NixOS-type of configure-your-own-browser, I'm all for it. This is the reason why Consumer wireless-Router configuration sucks, because manufacturers are trying to appeal to the masses and don't want to generate a call-for-support nightmare. So yeah, if we can *nixify(I'm claiming coinage here) all things produced in bulk and for the masses, by all means!!!
mattstir 3y ago
> Most of the preferences in this will actually reduce the target-able attack surface Can you point to anything specific that reduces the attack surface? When looking at the "securefox" config, it does a bunch of strange things, like enabling embedded TikTok links (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f45296a4f63c0bf362512d72f/Securefox.js#L60 https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) and disabling UITour (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f45296a4f63c0bf362512d72f/Securefox.js#L158 https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) which Firefox uses to highlight menus and is only accessible by approved Mozilla domains (https://searchfox.org/mozilla-central/source/browser/app/permissions https://searchfox.org/mozilla-central/source/browser/app/per...). It's a very strange mix of configs.
- autoexec 3y ago
  > Can you point to anything specific that reduces the attack surface? I haven't had a chance to dig though those configs yet, but disabling things like service workers, webgl, normandy/experiments, pocket, and webrtc would be a good start at reducing attack surface
  - throwaway290 3y ago
    All of that also makes you easier to fingerprint. How many people disable WebGL?
    - Beldin 3y ago
      Enabling WebGL makes you a lot more fingerprintable than having it disabled. See e.g. How gullible are web measurement tools? A case study analysing and strengthening OpenWPM’s reliability. B. Krumnow, H. Jonker and S. Karsch. In Proc. 18th International Conference on emerging Networking EXperiments and Technologies (CoNEXT’22). ACM, pp. 171–186, 2022. (Table 3).
- yokoffing 3y ago
  The section "Securefox" should probably be renamed "Privatefox", but labels are misleading. It's best to read the project files to understand the balance taken with security, privacy, and functionality. Let's make it simple: Want a mix of speed and privacy, while retaining functionality? Use Betterfox user.js. Want more privacy and security at the expense of site functionality? Use Arkenfox user.js. Want Tor prefs but without using its nodes/relays? Use Mullvad Browser. Want anonymity? Use Tor Browser.

belinder 3y ago

Another way to look at it is, you may not be aware of all the settings out there, and a set like this will help you discover them

1vuio0pswjnm7 3y ago
Another way to illustrate the point: Do you read other peoples' code before you run it, or do you just blindly run it.
- hkt 3y ago
  People who install Betterfox without reading the code are only blindly trusting one more piece of code than everyone else, really.

altairprime 3y ago

For specific example, this particular one disables the bookmarks toolbar, reader mode, Firefox Sync, and screen reader accessibility. Opinionated does not imply “Better”, even if the name claims otherwise.

mst 3y ago
I appreciated that the accessibility thing is called out as the top entry on the list of changes it makes you may want to override. If it's genuinely just munching CPU if you don't use it, then turning it off by default with a warning that it's going to do that seems pretty reasonable. (I've not tried their user.js and probably won't, but "realising the accessibility tools thing was important enough to go at the top even if the vast majority of users will care more about other entries in the list" seems like an indication that at least some thought has gone into this)
yokoffing 3y ago
The first two prefs are commented out (using //) and are not in the user.js itself, and the latter two are in the user.js but are 1) easy to re-enable and 2) the repo indicates how to enable them if you need them. Please read the Github page.
- altairprime 3y ago
  There’s two user js files. One has all four. The other has two of four. Note the comments at the top if you’d like to distinguish between them, though certainly others will not. I also see a disable for 0RTT; why? (Probably for the same reason that disabling TLS 1.2 was popular a few years ago.) Webrender is force-enabled; anyone that this causes startup crashes for is out of luck. Autofill and password saving is disabled; hope you migrated to a third-party app before using this. I reiterate: Opinionated does not mean Better. It just means opinionated.

lillywastaken 3y ago

This is generally the case imo. Installing hardening tweaks/extensions/... to make yourself "more secure" and "more private" often just ends in increasing the viable attack surface and making yourself more identifiable (because such extensions/settings are very uncommon)

autoexec 3y ago
It's okay to have a unique fingerprint when it changes all the time. It's far better to always show up as someone new than to try to blend in with the crowd and pray that none of the countless and ever-changing ways to ID you individually doesn't give you away.
Beldin 3y ago
In this case, it only toggles settings already baked in to the original software. That should not increase your attack surface unless the settings are poorly tested. Moreover, it would not decrease your privacy unless: 1. The number of people messing with the setting is very small, AND 2. The default for the setting gives you at least as much privacy as flipping it does. The second point is not often the case. For example, turning off WebGL provides 1 bit of info ("turned off WebGL"). Leaving WebGL on allows a website to measure your WebGL setup, which is typically far more revealing. Not everyone uses the same GPU hardware and screen, after all. In general, flipping a setting to off reveals 1 bit of information - but it might indeed be 1 bit that few others know of, thereby reducing your anonymity group in that respect. Leaving a setting on allows a website to probe you further and find out things related to the setting. See for example amIunique.org -- it tests 4 WebGL parameters, which, for me, have a similarity ratio of 1.17%, 0.94%, 2.68%, and 0.53%. Those are quite horrible numbers and would likely identify me uniquely unless they almost completely overlap.

lakomen 3y ago

Took the words right out my mouth, as I wanted to post a very similar comment beginning with I'm always skeptical. Is it because we've seen so many let downs? Probably. Can't trust anything or anyone anymore.

yazzku 3y ago
I think it's justified in this case. Mozilla suffers from a schizophrenic existence where they are simultaneously non-profit and for-profit, and Firefox privacy-friendly and unfriendly. For example, Firefox supports HTTPS-only mode and DNS over HTTPS, but they are not on by default. It also ships with DuckDuckGo and other search engines in the setting drop-down, but alas, that $10M/year or whatever they get from Google is too good, so fuck your privacy. You then have to manually turn all that shit on, because they won't, to the point where installing a fresh Firefox on a system now requires a bit of a rite of passage before you can get a useful browser. Do all these things I mentioned really increase your attack surface? Also, mandatory mention: https://librewolf.net/ https://librewolf.net/
- marcosdumay 3y ago
  I wonder if you are on the group that think that DNS over HTTPS is obviously and unambiguously a benefit for security and privacy, and of course nobody disagrees; or in the group that thinks that it is obviously and unambiguously a threat for security and privacy, and of course nobody disagrees.
  - yazzku 3y ago
    Neither? That setting is perhaps not a clear default among the ones I mentioned, especially because I personally wouldn't want to send my DNS requests to fucking Cloudflare or something based in the US. But I still stand by my comment that Firefox's defaults suck. At the very least they could have a useful one-time wizard that doesn't just ask you to import your bookmarks from Chrome.