2 ms·

You can’t leave it at that. What do you do to lock down FF?

autoexec 3y ago
We've got a document that outlines easily over 100 changes in about:config that need to be changed and locked (new ones are being added all the time), Nearly everything with a URL gets pulled out of the settings. Pocket is disabled, default plugins and the extensions that get installed for you automatically like screenshots@mozilla.org.xpi and pictureinpicture@mozilla.org.xpi get deleted, and we add noscript/ublock origin The idea is to reduce attack surface as much as possible, and disable features like searching/calculating from the address bar, service workers, wasm, prefetch, webgl, redirects, the PDF reader (no files ever just auto-download or open in anything by default), Firefox View, webrtc, network prediction, the social API, reader mode, there's some stuff about certificates, TLS and SSL etc. There's also a section for preventing fingerprinting, disabling telemetry/reporting/safebrowsing, all the stuff here: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... and to keep changes from being made so no auto-updates, and experiments/normandy/shield studies are disabled. There are a bunch of guides to harden firefox online, and ours seems to be some combination of several of them. The Tor browser guys do some great work keeping an eye on some of the changes that get made. In the end basically no active content of any kind is allowed by default. Some sites don't work at all with this stuff turned off or removed and it's a bit too locked down for day to day use but I'm surprised and how often things work well enough to get what you need at least. For example, an article might load just fine, but site navigation will be broken which isn't really an issue if you just wanted to read the article. Most of the sites that will get you infected just by visiting them require JS, so disabling that alone helps a ton. For something you know is really evil it's often best to just download and analyze the site offline, but for poking around even in highly questionable places it's pretty nice.
- huytersd 3y ago
  Thanks for the reply!

We've got a document that outlines easily over 100 changes in about:config that need to be changed and locked (new ones are being added all the time), Nearly everything with a URL gets pulled out of the settings. Pocket is disabled, default plugins and the extensions that get installed for you automatically like screenshots@mozilla.org.xpi and pictureinpicture@mozilla.org.xpi get deleted, and we add noscript/ublock origin The idea is to reduce attack surface as much as possible, and disable features like searching/calculating from the address bar, service workers, wasm, prefetch, webgl, redirects, the PDF reader (no files ever just auto-download or open in anything by default), Firefox View, webrtc, network prediction, the social API, reader mode, there's some stuff about certificates, TLS and SSL etc. There's also a section for preventing fingerprinting, disabling telemetry/reporting/safebrowsing, all the stuff here: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... and to keep changes from being made so no auto-updates, and experiments/normandy/shield studies are disabled. There are a bunch of guides to harden firefox online, and ours seems to be some combination of several of them. The Tor browser guys do some great work keeping an eye on some of the changes that get made. In the end basically no active content of any kind is allowed by default. Some sites don't work at all with this stuff turned off or removed and it's a bit too locked down for day to day use but I'm surprised and how often things work well enough to get what you need at least. For example, an article might load just fine, but site navigation will be broken which isn't really an issue if you just wanted to read the article. Most of the sites that will get you infected just by visiting them require JS, so disabling that alone helps a ton. For something you know is really evil it's often best to just download and analyze the site offline, but for poking around even in highly questionable places it's pretty nice.

huytersd 3y ago
Thanks for the reply!