mirror/ arkenfox-user.js
1
1
Fork 0
mirror of https://github.com/arkenfox/user.js.git synced 2024-05-23 16:56:13 +02:00
Code Issues Wiki
arkenfox-user.js/user.js

2271 lines
137 KiB
JavaScript
Raw Normal View History

Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/******
* name: ghacks user.js
65-beta
2019-02-09 11:05:45 +01:00
* date: 8 February 2019
* version 65-beta: Dancing with My Pants
start 65 commits
2019-01-17 06:19:11 +01:00
* "If I had the chance, I'd ask the world to dance, and I'll be dancing with my pants"
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* authors: v52+ github | v51- www.ghacks.net
* url: https://github.com/ghacksuserjs/ghacks-user.js
add license
2018-01-02 01:30:59 +01:00
* license: MIT: https://github.com/ghacksuserjs/ghacks-user.js/blob/master/LICENSE.txt
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* releases: These are end-of-stable-life-cycle legacy archives.
*Always* use the master branch user.js for a current up-to-date version.
url: https://github.com/ghacksuserjs/ghacks-user.js/releases
* README:
Tor-related warnings (#551) Also reworded some stuff.
2018-11-24 06:19:24 +01:00
0. Consider using Tor Browser if it meets your needs or fits your threat model better
* https://www.torproject.org/about/torusers.html.en
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
1. READ the full README
* https://github.com/ghacksuserjs/ghacks-user.js/blob/master/README.md
2. READ this
* https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.3-Implementation
3. If you skipped steps 1 and 2 above (shame on you), then here is the absolute minimum
new terminology https://wiki.mozilla.org/Add-ons/Terminology . The only "Web Extension" or "WebExtension" or "Add-on" references left are due to UI wording or links or pref names
2017-09-09 06:18:16 +02:00
* Auto-installing updates for Firefox and extensions are disabled (section 0302's)
change cookies from block all to allow 1st party (#477) * change cookies from block all to allow 1st party see https://github.com/ghacksuserjs/ghacks-user.js/issues/439 * and fixup readme as well
2018-08-15 07:56:40 +02:00
* Some user data is erased on close (section 2800). Change this to suit your needs
readme: add RFP alt / deprecated info
2017-09-17 12:29:05 +02:00
* EACH RELEASE check:
- 4600s: reset prefs made redundant due to privacy.resistFingerprinting (RPF)
or enable them as an alternative to RFP or for ESR users
- 9999s: reset deprecated prefs in about:config or enable relevant section(s) for ESR
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* Site breakage WILL happen
- There are often trade-offs and conflicts between Security vs Privacy vs Anti-Fingerprinting
and these need to be balanced against Functionality & Convenience & Breakage
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* You will need to make changes, and to troubleshoot at times (choose wisely, there is always a trade-off).
While not 100% definitive, search for "[SETUP". If required, add each pref to your overrides section at
default values (or comment them out and reset them in about:config). Here are the main ones:
[SETUP-WEB] can cause some websites to break
[SETUP-CHROME] changes how Firefox itself behaves (i.e. NOT directly website related)
[SETUP-PERF] may impact performance
* [WARNING] tags are extra special and used sparingly, so heed them
2699: disable geolocation API
2017-07-15 09:37:27 +02:00
4. BACKUP your profile folder before implementing (and/or test in a new/cloned profile)
wiki link changes
2017-12-08 19:51:35 +01:00
5. KEEP UP TO DATE: https://github.com/ghacksuserjs/ghacks-user.js/wiki#small_orange_diamond-maintenance
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
add index #567
2018-12-04 07:03:11 +01:00
* INDEX:
0100: STARTUP
0200: GEOLOCATION
0300: QUIET FOX
0400: BLOCKLISTS / SAFE BROWSING / TRACKING PROTECTION
0500: SYSTEM ADD-ONS / EXPERIMENTS
0600: BLOCK IMPLICIT OUTBOUND
0700: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc
0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS
0900: PASSWORDS
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
1000: CACHE / SESSION (RE)STORE / FAVICONS
move 1260 to 122x (#591) * move 1260 to 122x "disable or limit SHA-1 certificates" is about certs, not ciphers. Because CERTS is 1st in the title I moved it to the 1st item there because it's arguably also the most important of the lot (and renumbered the rest) We can also drop HSTS from the subgroup title because there's nothing HSTS left atm.
2018-12-12 12:52:49 +01:00
1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS)
add index #567
2018-12-04 07:03:11 +01:00
1400: FONTS
1600: HEADERS / REFERERS
1700: CONTAINERS
1800: PLUGINS
2000: MEDIA / CAMERA / MIC
2200: WINDOW MEDDLING & LEAKS / POPUPS
2300: WEB WORKERS
2400: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT
2500: HARDWARE FINGERPRINTING
2600: MISCELLANEOUS
2700: PERSISTENT STORAGE
2800: SHUTDOWN
section naming convention consistency
2018-12-04 09:27:52 +01:00
4000: FPI (FIRST PARTY ISOLATION)
4500: RFP (RESIST FINGERPRINTING)
4600: RFP ALTERNATIVES
4700: RFP ALTERNATIVES (NAVIGATOR / USER AGENT (UA) SPOOFING)
add index #567
2018-12-04 07:03:11 +01:00
5000: PERSONAL
9999: DEPRECATED / REMOVED / LEGACY / RENAMED
remove extra spaces
2018-08-28 09:57:21 +02:00
******/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
Update user.js
2018-07-11 13:59:52 +02:00
/* START: internal custom pref to test for syntax errors
FF60+ parrot info
2018-05-15 17:44:37 +02:00
* [NOTE] In FF60+, not all syntax errors cause parsing to abort i.e. reaching the last debug
* pref no longer necessarily means that all prefs have been applied. Check the console right
* after startup for any warnings/error messages related to non-applied prefs
* [1] https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "START: Oh yes, the Norwegian Blue... what's wrong with it?");
Update user.js
2018-01-29 14:05:13 +01:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0100]: STARTUP ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!");
0101: cleanup `laterrun` #434
2018-05-29 18:09:02 +02:00
/* 0101: disable default browser check
* [SETTING] General>Startup>Always check if Firefox is your default browser ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.shell.checkDefaultBrowser", false);
0100s: startpage, home+newwindow, newtab FF61 introduced quite a few changes, including removing the ability to set a blank startpage in the UI, and a new Home options tab with unified Activity Stream (AS) defaults and dropdown options. Because the only way to stop AS on startup is to enforce a blank page (pref 0102), and setting this auto changes `home+newwindow` (0103) and `newtab` (0104) to a blank page, then we're just going to go ahead and enforce that on all of them. For more info see the discussion in #426
2018-07-05 17:32:19 +02:00
/* 0102: set START page (0=blank, 1=home, 2=last visited page, 3=resume previous session)
0102 add SR info #575
2018-12-11 18:18:26 +01:00
* [NOTE] Session Restore is not used in PB mode (0110) and is cleared with history (2803, 2804)
update [SETTING] info (#538)
2018-11-19 00:56:12 +01:00
* [SETTING] General>Startup>Restore previous session ***/
0100s: startpage, home+newwindow, newtab FF61 introduced quite a few changes, including removing the ability to set a blank startpage in the UI, and a new Home options tab with unified Activity Stream (AS) defaults and dropdown options. Because the only way to stop AS on startup is to enforce a blank page (pref 0102), and setting this auto changes `home+newwindow` (0103) and `newtab` (0104) to a blank page, then we're just going to go ahead and enforce that on all of them. For more info see the discussion in #426
2018-07-05 17:32:19 +02:00
user_pref("browser.startup.page", 0);
/* 0103: set HOME+NEWWINDOW page
Activity Stream is no longer a System Add-on
2018-11-19 04:00:40 +01:00
* about:home=Activity Stream (default, see 0105), custom URL, about:blank
0100s: startpage, home+newwindow, newtab FF61 introduced quite a few changes, including removing the ability to set a blank startpage in the UI, and a new Home options tab with unified Activity Stream (AS) defaults and dropdown options. Because the only way to stop AS on startup is to enforce a blank page (pref 0102), and setting this auto changes `home+newwindow` (0103) and `newtab` (0104) to a blank page, then we're just going to go ahead and enforce that on all of them. For more info see the discussion in #426
2018-07-05 17:32:19 +02:00
* [SETTING] Home>New Windows and Tabs>Homepage and new windows ***/
user_pref("browser.startup.homepage", "about:blank");
/* 0104: set NEWTAB page
Activity Stream is no longer a System Add-on
2018-11-19 04:00:40 +01:00
* true=Activity Stream (default, see 0105), false=blank page
0100s: startpage, home+newwindow, newtab FF61 introduced quite a few changes, including removing the ability to set a blank startpage in the UI, and a new Home options tab with unified Activity Stream (AS) defaults and dropdown options. Because the only way to stop AS on startup is to enforce a blank page (pref 0102), and setting this auto changes `home+newwindow` (0103) and `newtab` (0104) to a blank page, then we're just going to go ahead and enforce that on all of them. For more info see the discussion in #426
2018-07-05 17:32:19 +02:00
* [SETTING] Home>New Windows and Tabs>New tabs ***/
user_pref("browser.newtabpage.enabled", false);
user_pref("browser.newtab.preload", false);
Activity Stream is no longer a System Add-on
2018-11-19 04:00:40 +01:00
/* 0105: disable Activity Stream stuff (AS)
* AS is the default homepage/newtab in FF57+, based on metadata and browsing behavior.
* **NOT LISTING ALL OF THESE: USE THE PREFERENCES UI**
* [SETTING] Home>Firefox Home Content>... to show/hide what you want ***/
/* 0105a: disable Activity Stream telemetry ***/
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry.ping.endpoint", "");
0105s: description s/be self explanatory #578 when filtered and 0105a is not shown, AS doesn't mean anything
2018-12-16 18:37:42 +01:00
/* 0105b: disable Activity Stream Snippets
move 0370 to 0105b (#586)
2018-12-11 16:40:29 +01:00
* Runs code received from a server (aka Remote Code Execution) and sends information back to a metrics server
* [1] https://abouthome-snippets-service.readthedocs.io/ ***/
0105b: kill snippets endpoint #528 it's too hard to follow AS changes, and work out if disabling showing items (basic toggling of show/hide sections etc) actually stops downloading a localized local copy etc. For items we actually want to block, let the endpoint slaughter begin.
2018-12-17 10:36:26 +01:00
user_pref("browser.aboutHomeSnippets.updateUrl", "");
user_pref("browser.newtabpage.activity-stream.asrouter.providers.snippets", "");
Activity Stream is no longer a System Add-on
2018-11-19 04:00:40 +01:00
user_pref("browser.newtabpage.activity-stream.disableSnippets", true);
0105* remove // has setting
2018-12-12 12:58:48 +01:00
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
0105s: description s/be self explanatory #578 when filtered and 0105a is not shown, AS doesn't mean anything
2018-12-16 18:37:42 +01:00
/* 0105c: disable Activity Stream Top Stories, Pocket-based and/or sponsored content ***/
0105* remove // has setting
2018-12-12 12:58:48 +01:00
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
user_pref("browser.newtabpage.activity-stream.showSponsored", false);
0105s: description s/be self explanatory #578 when filtered and 0105a is not shown, AS doesn't mean anything
2018-12-16 18:37:42 +01:00
/* 0105d: disable Activity Stream recent Highlights in the Library [FF57+] ***/
Activity Stream is no longer a System Add-on
2018-11-19 04:00:40 +01:00
// user_pref("browser.library.activity-stream.enabled", false);
move PB mode into STARTUP section #567
2018-12-04 09:51:19 +01:00
/* 0110: start Firefox in PB (Private Browsing) mode
* [NOTE] In this mode *all* windows are "private windows" and the PB mode icon is not displayed
* [WARNING] The P in PB mode is misleading: it means no "persistent" local storage of history,
* caches, searches or cookies (which you can achieve in normal mode). In fact, it limits or
* removes the ability to control these, and you need to quit Firefox to clear them. PB is best
* used as a one off window (File>New Private Window) to provide a temporary self-contained
* new instance. Closing all Private Windows clears all traces. Repeat as required. PB also does
* not allow indexedDB which breaks many Extensions that use it including uBlock Origin and uMatrix
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode
PB Mode: ref added
2019-01-16 03:07:06 +01:00
* [1] https://wiki.mozilla.org/Private_Browsing
* [2] https://spreadprivacy.com/is-private-browsing-really-private/ ***/
move PB mode into STARTUP section #567
2018-12-04 09:51:19 +01:00
// user_pref("browser.privatebrowsing.autostart", true);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0200]: GEOLOCATION ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!");
4609 + 4612: move back to 0200s geolocation blocking via RFP will be removed (see https://bugzilla.mozilla.org/show_bug.cgi?id=1441295), and since either way you look at it (those who use RFP or not) the user.js blocks geo, so we might as well move this stuff back to section 0200
2018-03-01 13:26:10 +01:00
/* 0201: disable Location-Aware Browsing
* [1] https://www.mozilla.org/firefox/geolocation/ ***/
geo changes, fixes #415 NOTE: RFP still blocks geo, but this will be reverted at some stage: see https://bugzilla.mozilla.org/show_bug.cgi?id=1441295
2018-05-06 15:10:30 +02:00
// user_pref("geo.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0201b: set a default permission for Location [FF58+]
* 0=always ask (default), 1=allow, 2=block
update cookie settings info
2019-02-04 14:00:19 +01:00
* [NOTE] Best left at default "always ask", fingerprintable via Permissions API
geo changes, fixes #415 NOTE: RFP still blocks geo, but this will be reverted at some stage: see https://bugzilla.mozilla.org/show_bug.cgi?id=1441295
2018-05-06 15:10:30 +02:00
* [SETTING] to add site exceptions: Page Info>Permissions>Access Your Location
nits (#423)
2018-05-16 18:31:28 +02:00
* [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Location>Settings ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("permissions.default.geo", 2);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0202: disable GeoIP-based search results
* [NOTE] May not be hidden if Firefox has changed your settings due to your locale
4609 + 02xx cleanup Only `geo.enabled` is covered by RFP, keep the other prefs under 0200 and do some cleanup - 0202: the /en-US/ in link [2] is necessary for the anchor to work! - `browser.search.geoip.timeout;1` is unnecessary when `browser.search.geoip.url` is empty string: https://dxr.mozilla.org/mozilla-central/source/toolkit/components/search/nsSearchService.js#576
2017-10-03 17:37:50 +02:00
* [1] https://trac.torproject.org/projects/tor/ticket/16254
* [2] https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.search.region", "US"); // [HIDDEN PREF]
4609 + 02xx cleanup Only `geo.enabled` is covered by RFP, keep the other prefs under 0200 and do some cleanup - 0202: the /en-US/ in link [2] is necessary for the anchor to work! - `browser.search.geoip.timeout;1` is unnecessary when `browser.search.geoip.url` is empty string: https://dxr.mozilla.org/mozilla-central/source/toolkit/components/search/nsSearchService.js#576
2017-10-03 17:37:50 +02:00
user_pref("browser.search.geoip.url", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0205: set OS & APP locale [FF59+]
0205: intl.locale.requested FF59+
2018-01-22 06:49:39 +01:00
* If set to empty, the OS locales are used. If not set at all, default locale is used ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("intl.locale.requested", "en-US"); // [HIDDEN PREF]
misc typos #178 Thanks Just-me-ghacks
2017-07-23 20:50:55 +02:00
/* 0206: disable geographically specific results/search engines e.g. "browser.search.*.US"
misc grammar for nerds #178 Thanks Just-me-ghacks
2017-07-24 19:15:37 +02:00
* i.e. ignore all of Mozilla's various search engines in multiple locales ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.search.geoSpecificDefaults", false);
user_pref("browser.search.geoSpecificDefaults.url", "");
/* 0207: set language to match ***/
user_pref("intl.accept_languages", "en-US, en");
/* 0208: enforce US English locale regardless of the system locale
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/867501 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("javascript.use_us_english_locale", true); // [HIDDEN PREF]
0209: remove trailing space @Just-me-ghacks :kiss:
2018-12-13 12:14:44 +01:00
/* 0209: use APP locale over OS locale in regional preferences [FF56+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1379420,1364789 ***/
0209: fixup regional pref OS locale I think I need a break
2017-09-19 17:23:10 +02:00
user_pref("intl.regional_prefs.use_os_locales", false);
0210 tweak
2017-10-03 20:53:12 +02:00
/* 0210: use Mozilla geolocation service instead of Google when geolocation is enabled
4609 + 02xx cleanup Only `geo.enabled` is covered by RFP, keep the other prefs under 0200 and do some cleanup - 0202: the /en-US/ in link [2] is necessary for the anchor to work! - `browser.search.geoip.timeout;1` is unnecessary when `browser.search.geoip.url` is empty string: https://dxr.mozilla.org/mozilla-central/source/toolkit/components/search/nsSearchService.js#576
2017-10-03 17:37:50 +02:00
* Optionally enable logging to the console (defaults to false) ***/
user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("geo.wifi.logging.enabled", true); // [HIDDEN PREF]
some more 65+ diffs, #610
2019-02-07 14:41:15 +01:00
/* 0211: disable using the OS's geolocation service ***/
user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
user_pref("geo.provider.use_corelocation", false); // [MAC]
user_pref("geo.provider.use_gpsd", false); // [LINUX]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0300]: QUIET FOX
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
We choose to not disable auto-CHECKs (0301's) but to disable auto-INSTALLs (0302's).
There are many legitimate reasons to turn off auto-INSTALLS, including hijacked or
monetized extensions, time constraints, legacy issues, and fear of breakage/bugs.
It is still important to do updates for security reasons, please do so manually. ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!");
clarify themes info, closes #648
2019-02-17 04:34:34 +01:00
/* 0301b: disable auto-CHECKING for extension and theme updates ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("extensions.update.enabled", false);
clarify themes info, closes #648
2019-02-17 04:34:34 +01:00
/* 0302a: disable auto-INSTALLING Firefox updates [NON-WINDOWS FF65+]
FF65 removals (#624)
2019-01-30 13:27:53 +01:00
* [NOTE] In FF65+ on Windows this SETTING (below) is now stored in a file and the pref was removed
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
* [SETTING] General>Firefox Updates>Check for updates but let you choose... ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("app.update.auto", false);
clarify themes info, closes #648
2019-02-17 04:34:34 +01:00
/* 0302b: disable auto-INSTALLING extension and theme updates (after the check in 0301b)
FF56+ redesigned preferences UI + [SETTING] tags
2017-10-01 22:32:27 +02:00
* [SETTING] about:addons>Extensions>[cog-wheel-icon]>Update Add-ons Automatically (toggle) ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("extensions.update.autoUpdateDefault", false);
/* 0303: disable background update service [WINDOWS]
remove [SETTING-ESR52] lines (#475)
2018-08-09 05:30:57 +02:00
* [SETTING] General>Firefox Updates>Use a background service to install updates ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("app.update.service.enabled", false);
/* 0304: disable background update staging ***/
user_pref("app.update.staging.enabled", false);
/* 0305: enforce update information is displayed
* This is the update available, downloaded, error and success information ***/
user_pref("app.update.silent", false);
0306 => inactive, closes #615 whatever we thought it may have done in the past, it doesn't do that now as far as we know. And it's not an issue since we allow extension update-CHECKs anyway.
2019-02-04 07:39:29 +01:00
/* 0306: disable extension metadata
0306: extension metadata, closes #615
2019-02-05 05:51:07 +01:00
* used when installing/updating an extension, and in daily background update checks: if false, it
* hides the expanded text description (if it exists) when you "show more details about an addon" ***/
0306 => inactive, closes #615 whatever we thought it may have done in the past, it doesn't do that now as far as we know. And it's not an issue since we allow extension update-CHECKs anyway.
2019-02-04 07:39:29 +01:00
// user_pref("extensions.getAddons.cache.enabled", false);
clarify themes info, closes #648
2019-02-17 04:34:34 +01:00
/* 0307: disable auto updating of lightweight themes (LWT)
* Not to be confused with themes in 0301* + 0302*, which use the FF55+ Theme API
* Mozilla plan to convert existing LWTs and remove LWT support in the future, see [1]
* [1] https://blog.mozilla.org/addons/2018/09/20/future-themes-here/ ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("lightweightThemes.update.enabled", false);
/* 0308: disable search update
update [SETTING] info (#538)
2018-11-19 00:56:12 +01:00
* [SETTING] General>Firefox Updates>Automatically update search engines ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.search.update", false);
/* 0309: disable sending Flash crash reports ***/
user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled", false);
/* 0310: disable sending the URL of the website where a plugin crashed ***/
user_pref("dom.ipc.plugins.reportCrashURL", false);
grammar, case, etc, closes #594 thanks @Just-me-ghacks
2018-12-13 16:49:50 +01:00
/* 0320: disable about:addons' Get Add-ons panel (uses Google Analytics) ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
0320 - disable Get Add-ons panel
2017-09-15 01:47:54 +02:00
user_pref("extensions.webservice.discoverURL", "");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0330: disable telemetry
* the pref (.unified) affects the behaviour of the pref (.enabled)
* IF unified=false then .enabled controls the telemetry module
* IF unified=true then .enabled ONLY controls whether to record extended data
* so make sure to have both set as false
0330: telemetry changes 58+ #271
2017-11-15 01:51:20 +01:00
* [NOTE] FF58+ `toolkit.telemetry.enabled` is now LOCKED to reflect prerelease
* or release builds (true and false respectively), see [2]
* [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html
* [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("toolkit.telemetry.unified", false);
0330: telemetry changes 58+ #271
2017-11-15 01:51:20 +01:00
user_pref("toolkit.telemetry.enabled", false); // see [NOTE] above FF58+
0330: missing comma
2018-02-24 11:54:16 +01:00
user_pref("toolkit.telemetry.server", "data:,");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("toolkit.telemetry.archive.enabled", false);
0330: amalgamate telemetry prefs, add two new ones
2017-07-24 20:43:12 +02:00
user_pref("toolkit.telemetry.cachedClientID", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+]
user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+]
user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+]
user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter
user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+]
user_pref("toolkit.telemetry.hybridContent.enabled", false); // [FF59+]
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
/* 0331: disable Telemetry Coverage
* [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/
user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF]
user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF]
user_pref("toolkit.coverage.endpoint.base", "");
/* 0340: disable Health Reports
Options> and [settings] (#388) * Options> and [settings] While I'm at it, I'm changing the 21 instances of - `[SETTING-56+]` to just `[SETTING]` - `[SETTING-ESR]` to `[SETTING-ESR52]` because we'll leave those in until 62 (yes I know they may apply to earlier ESRs, but people should be upgraded). Thus no ambiguity with ESR60 vs ESR52 users for the overlap
2018-03-26 21:49:39 +02:00
* [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send technical... data ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("datareporting.healthreport.uploadEnabled", false);
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
/* 0341: disable new data submission, master kill switch [FF41+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* If disabled, no policy is shown or upload takes place, ever
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1195552 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("datareporting.policy.dataSubmissionEnabled", false);
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
/* 0342: disable Studies (see 0503)
* [NOTE] This pref has no effect when Health Reports (0340) are disabled
* [SETTING] Privacy & Security>Firefox Data Collection & Use>...>Allow Firefox to install and run studies ***/
user_pref("app.shield.optoutstudies.enabled", false);
0343: even MOAR clarification
2019-02-08 12:38:17 +01:00
/* 0343: disable Extension Recommendations in about:addons and AMO [FF65+]
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
* [NOTE] This pref has no effect when Health Reports (0340) are disabled
* [SETTING] Privacy & Security>Firefox Data Collection & Use>...>Allow Firefox to make personalized extension rec.
* [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/
user_pref("browser.discovery.enabled", false);
/* 0350: disable Crash Reports ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("breakpad.reportURL", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+]
user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+]
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
/* 0351: disable backlogged Crash Reports
* [SETTING] Privacy & Security>Firefox Data Collection & Use>Allow Firefox to send backlogged crash reports ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [FF58+]
Pocket: 0510->0370 Pocket is no longer a System Add-on in FF64+
2018-12-12 09:25:25 +01:00
/* 0370: disable Pocket [FF46+]
* Pocket is a third party (now owned by Mozilla) "save for later" cloud service
* [1] https://en.wikipedia.org/wiki/Pocket_(application)
* [2] https://www.gnu.gl/blog/Posts/multiple-vulnerabilities-in-pocket/ ***/
user_pref("extensions.pocket.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0380: disable Browser Error Reporter [FF60+]
change last commit to number 0380 note to self: listen to earthlng more
2018-04-13 19:27:45 +02:00
* [1] https://support.mozilla.org/en-US/kb/firefox-nightly-error-collection
* [2] https://firefox-source-docs.mozilla.org/browser/browser/BrowserErrorReporter.html ***/
user_pref("browser.chrome.errorReporter.enabled", false);
user_pref("browser.chrome.errorReporter.submitUrl", "");
move shit around
2019-02-07 15:41:23 +01:00
/* 0390: disable Captive Portal detection
* [1] https://en.wikipedia.org/wiki/Captive_portal
* [2] https://wiki.mozilla.org/Necko/CaptivePortal
* [3] https://trac.torproject.org/projects/tor/ticket/21790 ***/
user_pref("captivedetect.canonicalURL", "");
user_pref("network.captive-portal-service.enabled", false); // [FF52+]
/* 0391: disable Network Connectivity checks [FF65+]
* [1] https://bugzilla.mozilla.org/1460537 ***/
user_pref("network.connectivity-service.enabled", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0400]: BLOCKLISTS / SAFE BROWSING / TRACKING PROTECTION
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
This section has security & tracking protection implications vs privacy concerns vs effectiveness
vs 3rd party 'censorship'. We DO NOT advocate no protection. If you disable Tracking Protection (TP)
and/or Safe Browsing (SB), then SECTION 0400 REQUIRES YOU HAVE uBLOCK ORIGIN INSTALLED.
misc typos #178 Thanks Just-me-ghacks
2017-07-23 20:50:55 +02:00
Safe Browsing is designed to protect users from malicious sites. Tracking Protection is designed
to lessen the impact of third parties on websites to reduce tracking and to speed up your browsing.
misc grammar for nerds #178 Thanks Just-me-ghacks
2017-07-24 19:15:37 +02:00
These do rely on 3rd parties (Google for SB and Disconnect for TP), but many steps, which are
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
continually being improved, have been taken to preserve privacy. Disable at your own risk.
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** BLOCKLISTS ***/
/* 0401: enable Firefox blocklist, but sanitize blocklist url
* [NOTE] It includes updates for "revoked certificates"
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
* [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [2] https://trac.torproject.org/projects/tor/ticket/16931 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("extensions.blocklist.url", "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%APP_ID%/%APP_VERSION%/");
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
/* 0403: disable individual unwanted/unneeded parts of the Kinto blocklists
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications
* As Firefox transitions to Kinto, the blocklists have been broken down into entries for certs to be
new terminology https://wiki.mozilla.org/Add-ons/Terminology . The only "Web Extension" or "WebExtension" or "Add-on" references left are due to UI wording or links or pref names
2017-09-09 06:18:16 +02:00
* revoked, extensions and plugins to be disabled, and gfx environments that cause problems or crashes ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("services.blocklist.onecrl.collection", ""); // revoked certificates
// user_pref("services.blocklist.addons.collection", "");
// user_pref("services.blocklist.plugins.collection", "");
// user_pref("services.blocklist.gfx.collection", "");
add empty lines for subgroups in 0400 + 1200 (#482)
2018-08-12 05:11:23 +02:00
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** SAFE BROWSING (SB)
0410s: SBv4 & cookies, #520
2018-10-25 02:13:50 +02:00
This sub-section has been redesigned to differentiate between "real-time"/"user initiated" data
being sent to Google from all other settings such as using local blocklists/whitelists and updating
those lists. There are NO privacy issues here. *IF* required, a full url is never sent to Google,
only a PART-hash of the prefix, and this is hidden with noise of other real PART-hashes. Google also
swear it is anonymized and only used to flag malicious sites/activity. Firefox also takes measures
such as striping out identifying parameters and storing safe browsing cookies in a separate jar.
SB v4 (FF57+) doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
#Required reading [#] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/
[1] https://wiki.mozilla.org/Security/Safe_Browsing ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0410: disable "Block dangerous and deceptive content"
* This covers deceptive sites such as phishing and social engineering
* [SETTING] Privacy & Security>Security>Deceptive Content and Software Protection ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.safebrowsing.malware.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("browser.safebrowsing.phishing.enabled", false); // [FF50+]
/* 0411: disable "Block dangerous downloads"
* This covers malware and PUPs (potentially unwanted programs)
* [SETTING] Privacy & Security>Security>Deceptive Content and Software Protection ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.safebrowsing.downloads.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0412: disable "Warn me about unwanted and uncommon software"
* [SETTING] Privacy & Security>Security>Deceptive Content and Software Protection ***/
// user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false); // [FF48+]
// user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false); // [FF48+]
// user_pref("browser.safebrowsing.downloads.remote.block_dangerous", false); // [FF49+]
// user_pref("browser.safebrowsing.downloads.remote.block_dangerous_host", false); // [FF49+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0413: disable Google safebrowsing updates ***/
// user_pref("browser.safebrowsing.provider.google.updateURL", "");
// user_pref("browser.safebrowsing.provider.google.gethashURL", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("browser.safebrowsing.provider.google4.updateURL", ""); // [FF50+]
// user_pref("browser.safebrowsing.provider.google4.gethashURL", ""); // [FF50+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0414: disable binaries NOT in local lists being checked by Google (real-time checking) ***/
user_pref("browser.safebrowsing.downloads.remote.enabled", false);
user_pref("browser.safebrowsing.downloads.remote.url", "");
/* 0415: disable reporting URLs ***/
user_pref("browser.safebrowsing.provider.google.reportURL", "");
user_pref("browser.safebrowsing.reportPhishURL", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.safebrowsing.provider.google4.reportURL", ""); // [FF50+]
user_pref("browser.safebrowsing.provider.google.reportMalwareMistakeURL", ""); // [FF54+]
user_pref("browser.safebrowsing.provider.google.reportPhishMistakeURL", ""); // [FF54+]
user_pref("browser.safebrowsing.provider.google4.reportMalwareMistakeURL", ""); // [FF54+]
user_pref("browser.safebrowsing.provider.google4.reportPhishMistakeURL", ""); // [FF54+]
/* 0416: disable 'ignore this warning' on Safe Browsing warnings
* If clicked, it bypasses the block for that session. This is a means for admins to enforce SB
fix wiki test info on SB
2018-04-28 09:30:47 +02:00
* [TEST] see github wiki APPENDIX A: Test Sites: Section 5
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1226490 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.safebrowsing.allowOverride", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0417: disable data sharing [FF58+] ***/
0417: disable SB data sharing
2018-01-17 05:33:45 +01:00
user_pref("browser.safebrowsing.provider.google4.dataSharing.enabled", false);
user_pref("browser.safebrowsing.provider.google4.dataSharingURL", "");
add empty lines for subgroups in 0400 + 1200 (#482)
2018-08-12 05:11:23 +02:00
remove 0426 content blocking
2018-11-13 16:01:35 +01:00
/** TRACKING PROTECTION (TP)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
There are NO privacy concerns here, but we strongly recommend to use uBlock Origin as well,
as it offers more comprehensive and specialized lists. It also allows per domain control. ***/
/* 0420: enable Tracking Protection in all windows
1610 DNT & 0420 TP clarify conflicts #163
2017-07-06 09:03:36 +02:00
* [NOTE] TP sends DNT headers regardless of the DNT pref (see 1610)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://wiki.mozilla.org/Security/Tracking_protection
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [2] https://support.mozilla.org/kb/tracking-protection-firefox ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("privacy.trackingprotection.pbmode.enabled", true); // [DEFAULT: true]
fixup // default syntax
2018-03-26 21:44:15 +02:00
// user_pref("privacy.trackingprotection.enabled", true);
0422: TP block lists: deduplicate, fixes #434
2018-05-25 17:44:27 +02:00
/* 0422: set which Tracking Protection block list to use
* [WARNING] We don't recommend enforcing this from here, as available block lists can change
update [SETTING] info (#538)
2018-11-19 00:56:12 +01:00
* [SETTING] Privacy & Security>Content Blocking>All Detected Trackers>Change block list ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("urlclassifier.trackingTable", "test-track-simple,base-track-digest256"); // basic
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0423: disable Mozilla's blocklist for known Flash tracking/fingerprinting [FF48+]
update ghacks.net links to use https
2017-07-09 18:49:39 +02:00
* [1] https://www.ghacks.net/2016/07/18/firefox-48-blocklist-against-plugin-fingerprinting/
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [2] https://bugzilla.mozilla.org/1237198 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.safebrowsing.blockedURIs.enabled", false);
/* 0424: disable Mozilla's tracking protection and Flash blocklist updates ***/
// user_pref("browser.safebrowsing.provider.mozilla.gethashURL", "");
// user_pref("browser.safebrowsing.provider.mozilla.updateURL", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0425: disable passive Tracking Protection [FF53+]
0425: passive TP
2017-08-19 03:35:27 +02:00
* Passive TP annotates channels to lower the priority of network loads for resources on the tracking protection list
* [NOTE] It has no effect if TP is enabled, but keep in mind that by default TP is only enabled in Private Windows
* This is included for people who want to completely disable Tracking Protection.
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1170190,1141814 ***/
0425: passive TP
2017-08-19 03:35:27 +02:00
// user_pref("privacy.trackingprotection.annotate_channels", false);
// user_pref("privacy.trackingprotection.lower_network_priority", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0500]: SYSTEM ADD-ONS / EXPERIMENTS
0500s: System Add-ons not system extensions they're still called System Add-ons: https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html Thanks!
2018-03-20 16:53:53 +01:00
System Add-ons are a method for shipping extensions, considered to be
add 0500s system add-ons / experiments #172 new items will have their own commits
2017-07-18 19:55:03 +02:00
built-in features to Firefox, that are hidden from the about:addons UI.
0500s: System Add-ons not system extensions they're still called System Add-ons: https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html Thanks!
2018-03-20 16:53:53 +01:00
To view your System Add-ons go to about:support, they are listed under "Firefox Features"
0505: system add-on URL
2017-07-22 23:01:36 +02:00
0500s: System Add-ons not system extensions they're still called System Add-ons: https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html Thanks!
2018-03-20 16:53:53 +01:00
Some System Add-ons have no on-off prefs. Instead you can manually remove them. Note that app
0505: system add-on URL
2017-07-22 23:01:36 +02:00
updates will restore them. They may also be updated and possibly restored automatically (see 0505)
* Portable: "...\App\Firefox64\browser\features\" (or "App\Firefox\etc" for 32bit)
* Windows: "...\Program Files\Mozilla\browser\features" (or "Program Files (X86)\etc" for 32bit)
0500s" fix Mac directory info
2017-08-08 04:43:39 +02:00
* Mac: "...\Applications\Firefox\Contents\Resources\browser\features\"
0500s: system add-ons: add Mac info
2017-08-06 19:33:26 +02:00
[NOTE] On Mac you can right-click on the application and select "Show Package Contents"
0500: add Linux path Looks weird: portable, windows, mac using `\` and Linux using `/` :)
2017-09-17 09:58:54 +02:00
* Linux: "/usr/lib/firefox/browser/features" (or similar)
0505: system add-on URL
2017-07-22 23:01:36 +02:00
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
[1] https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html
add 0500s system add-ons / experiments #172 new items will have their own commits
2017-07-18 19:55:03 +02:00
[2] https://dxr.mozilla.org/mozilla-central/source/browser/extensions
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "0500 syntax error: the parrot's cashed in 'is chips!");
add 0500s system add-ons / experiments #172 new items will have their own commits
2017-07-18 19:55:03 +02:00
/* 0502: disable Mozilla permission to silently opt you into tests ***/
user_pref("network.allow-experiments", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0503: disable Normandy/Shield [FF60+]
0500s: shield->normandy info, fixes #381
2018-03-20 16:29:37 +01:00
* Shield is an telemetry system (including Heartbeat) that can also push and test "recipes"
* [1] https://wiki.mozilla.org/Firefox/Shield
* [2] https://github.com/mozilla/normandy ***/
user_pref("app.normandy.enabled", false);
user_pref("app.normandy.api_url", "");
disable System Add-on updates (#595) remember the new Coverage Telemetry shit? with a **hidden** opt-out pref? guess what, they are already collecting for 3 months ... https://bugzilla.mozilla.org/show_bug.cgi?id=1487578 - **3 months ago**: "I see data coming in that looks reasonable" guess what else ... "It has also replaced the previous version that was there (from bug 1480194)" and oh, surprise surprise, 1480194 is ACCESS DENIED! they're not just using private tickets to hide security critical information from potential hackers and blackhats, no they also use it to hide shady AF things. Things that they fully know are shady as fuck and that they absolutely know a lot of people would not like. There's simply no other reason why they'd do that but wait, that's not all. If you think an opt-out pref that 99% of people wouldn't know about even if it showed up in about:config BUT ALSO HAPPENS TO BE HIDDEN is kind of questionable, well ... the system addon that they use for this shit apparently looked or still looks for `toolkit.telemetry.coverage.opt-out` [1] instead of `toolkit.coverage.opt-out` as their documentation [2] claims [1] https://github.com/mozilla/one-off-system-add-ons/pull/131/files#diff-6e0cbf76986d04383ccb32a29ef27a7aR25 [2] https://hg.mozilla.org/mozilla-central/file/tip/toolkit/components/telemetry/docs/data/coverage-ping.rst#l32 It's time to opt out of all that shit for good. Disable system addon updates and kill it at the root > In FF61 and lower, you will not get any System Add-on updates except when you update Firefox on its own that's not true. You will get SA updates unless you disable app update checks + auto install. Let's just remove that as well.
2018-12-13 15:21:57 +01:00
/* 0505: disable System Add-on updates ***/
user_pref("extensions.systemAddon.update.enabled", false); // [FF62+]
user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0506: disable PingCentre telemetry (used in several System Add-ons) [FF57+]
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
* Currently blocked by 'datareporting.healthreport.uploadEnabled' (see 0340) ***/
0506: disable PingCenter telemetry
2017-11-16 16:06:04 +01:00
user_pref("browser.ping-centre.telemetry", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0515: disable Screenshots
0515: uploading to Screenshots server
2018-04-29 15:42:02 +02:00
* alternatively in FF60+, disable uploading to the Screenshots server
0515+0516 - screenshots already bundled with FF54 moved screenshots up to 0515 and added the FF54 pref. I know I said we can remove that pref but the item needs to be for FF54+ regardless. To make it less confusing I added the pref back in.
2017-07-28 18:31:46 +02:00
* [1] https://github.com/mozilla-services/screenshots
* [2] https://www.ghacks.net/2017/05/28/firefox-screenshots-integrated-in-firefox-nightly/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("extensions.screenshots.disabled", true); // [FF55+]
// user_pref("extensions.screenshots.upload-disabled", true); // [FF60+]
/* 0517: disable Form Autofill
0517: disable Form Autofill #171
2017-07-26 13:37:45 +02:00
* [NOTE] Stored data is NOT secure (uses a JSON file)
* [NOTE] Heuristics controls Form Autofill on forms without @autocomplete attributes
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [SETTING] Privacy & Security>Forms & Passwords>Autofill addresses
0517: disable Form Autofill #171
2017-07-26 13:37:45 +02:00
* [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill
* [2] https://www.ghacks.net/2017/05/24/firefoxs-new-form-autofill-is-awesome/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+]
user_pref("extensions.formautofill.available", "off"); // [FF56+]
user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+]
user_pref("extensions.formautofill.heuristics.enabled", false); // [FF55+]
/* 0518: disable Web Compatibility Reporter [FF56+]
0518: disable Web Compatibility Reporter #171
2017-07-21 08:23:14 +02:00
* Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla ***/
user_pref("extensions.webcompat-reporter.enabled", false);
add 0500s system add-ons / experiments #172 new items will have their own commits
2017-07-18 19:55:03 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0601: disable link prefetching
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.prefetch-next", false);
/* 0602: disable DNS prefetching
update ghacks.net links to use https
2017-07-09 18:49:39 +02:00
* [1] https://www.ghacks.net/2013/04/27/firefox-prefetching-what-you-need-to-know/
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.dns.disablePrefetch", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.dns.disablePrefetchFromHTTPS", true); // [HIDDEN PREF]
move shit around
2019-02-07 15:41:23 +01:00
/* 0603: disable Seer/Necko
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Mozilla/Projects/Necko ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.predictor.enabled", false);
/* 0605: disable link-mouseover opening connection to linked server
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
* [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests
* [2] https://www.ghacks.net/2015/08/16/block-firefox-from-connecting-to-sites-when-you-hover-over-links/ ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.http.speculative-parallel-limit", 0);
/* 0606: disable pings (but enforce same host in case)
* [1] http://kb.mozillazine.org/Browser.send_pings
* [2] http://kb.mozillazine.org/Browser.send_pings.require_same_host ***/
user_pref("browser.send_pings", false);
user_pref("browser.send_pings.require_same_host", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0608: disable predictor / prefetching [FF48+] ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.predictor.enable-prefetch", false);
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0700]: HTTP* / TCP/IP / DNS / PROXY / SOCKS etc ***/
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!");
0701: disable IPv6, closes #437
2018-08-17 09:15:47 +02:00
/* 0701: disable IPv6
* IPv6 can be abused, especially regarding MAC addresses. They also do not play nice
infos about default values (#504) * more infos * add colons not all EOL comments for defaults start with `// default` (23). The common string is `default:` (27 incl. these ones) with or without preceding or trailing spaces
2018-09-13 00:17:56 +02:00
* with VPNs. That's even assuming your ISP and/or router and/or website can handle it
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [NOTE] This is just an application level fallback. Disabling IPv6 is best done
0701: IPv6 info tweak, closes #437
2018-08-25 08:09:28 +02:00
* at an OS/network level, and/or configured properly in VPN setups
* [TEST] http://ipv6leak.com/
0701: disable IPv6, closes #437
2018-08-17 09:15:47 +02:00
* [1] https://github.com/ghacksuserjs/ghacks-user.js/issues/437#issuecomment-403740626
* [2] https://www.internetsociety.org/tag/ipv6-security/ (see Myths 2,4,5,6) ***/
user_pref("network.dns.disableIPv6", true);
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
/* 0702: disable HTTP2 (which was based on SPDY which is now deprecated)
* HTTP2 raises concerns with "multiplexing" and "server push", does nothing to enhance
* privacy, and in fact opens up a number of server-side fingerprinting opportunities
http2, altsvc, ssl session ids vs FPI vs TB #571
2018-12-18 16:54:57 +01:00
* [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the
* consequences. FPI isolates these, but it was designed with the Tor protocol in mind,
* and the Tor Browser has extra protection, including enhanced sanitizing per Identity.
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
* [1] https://http2.github.io/faq/
reference: http->https
2018-03-14 12:19:09 +01:00
* [2] https://blog.scottlogic.com/2014/11/07/http-2-a-quick-look.html
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
* [3] https://queue.acm.org/detail.cfm?id=2716278
* [4] https://github.com/ghacksuserjs/ghacks-user.js/issues/107 ***/
user_pref("network.http.spdy.enabled", false);
user_pref("network.http.spdy.enabled.deps", false);
user_pref("network.http.spdy.enabled.http2", false);
0702: http2 websockets might as well add it: needs t be taken into consideration when looking at the whole http2 thing. Will be interesting to see what Tor Browser does with it in ESR68
2019-01-30 15:09:39 +01:00
user_pref("network.http.spdy.websockets", false); // [FF65+]
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0703: disable HTTP Alternative Services [FF37+]
http2, altsvc, ssl session ids vs FPI vs TB #571
2018-12-18 16:54:57 +01:00
* [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the
* consequences. FPI isolates these, but it was designed with the Tor protocol in mind,
* and the Tor Browser has extra protection, including enhanced sanitizing per Identity.
0703 atl-svc, better ref, #571
2018-12-05 21:36:20 +01:00
* [1] https://tools.ietf.org/html/rfc7838#section-9
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
* [2] https://www.mnot.net/blog/2016/03/09/alt-svc ***/
user_pref("network.http.altsvc.enabled", false);
user_pref("network.http.altsvc.oe", false);
/* 0704: enforce the proxy server to do any DNS lookups when using SOCKS
Tor-related warnings (#551) Also reworded some stuff.
2018-11-24 06:19:24 +01:00
* e.g. in Tor, this stops your local DNS server from knowing your Tor destination
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
* as a remote Tor node will handle the DNS request
* [1] http://kb.mozillazine.org/Network.proxy.socks_remote_dns
* [2] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
user_pref("network.proxy.socks_remote_dns", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0706: remove paths when sending URLs to PAC scripts [FF51+]
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
* CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1255474 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.proxy.autoconfig_url.include_path", false); // [DEFAULT: false]
/* 0707: disable (or setup) DNS-over-HTTPS (DoH) [FF60+]
0707: DoH, fixes #410
2018-05-07 16:57:42 +02:00
* TRR = Trusted Recursive Resolver
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
* .mode: 0=off, 1=race, 2=TRR first, 3=TRR only, 4=race for stats but always use native result
0707: DoH, fixes #410
2018-05-07 16:57:42 +02:00
* [WARNING] DoH bypasses hosts and gives info to yet another party (e.g. Cloudflare)
0707: added ref link
2018-06-01 06:32:52 +02:00
* [1] https://www.ghacks.net/2018/04/02/configure-dns-over-https-in-firefox/
* [2] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ ***/
0707: DoH, fixes #410
2018-05-07 16:57:42 +02:00
// user_pref("network.trr.mode", 0);
// user_pref("network.trr.bootstrapAddress", "");
// user_pref("network.trr.uri", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0708: disable FTP [FF60+]
add network.ftp.enabled
2018-05-11 18:14:40 +02:00
* [1] https://www.ghacks.net/2018/02/20/firefox-60-with-new-preference-to-disable-ftp/ ***/
// user_pref("network.ftp.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0709: disable using UNC (Uniform Naming Convention) paths [FF61+]
disable UNC paths
2018-07-04 11:15:44 +02:00
* [1] https://trac.torproject.org/projects/tor/ticket/26424 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF]
0710: disable GIO... #442
2018-10-14 14:11:56 +02:00
/* 0710: disable GIO as a potential proxy bypass vector
* Gvfs/GIO has a set of supported protocols like obex, network, archive, computer, dav, cdda,
* gphoto2, trash, etc. By default only smb and sftp protocols are accepted so far (as of FF64)
* [1] https://bugzilla.mozilla.org/1433507
* [2] https://trac.torproject.org/23044
* [3] https://en.wikipedia.org/wiki/GVfs
* [4] https://en.wikipedia.org/wiki/GIO_(software) ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF]
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS [SETUP-CHROME]
Make Firefox Great Again (#626) * location bar changes * if the dropdown is going to be used, then no point hiding search engines on the bottom line
2019-01-30 16:06:32 +01:00
Change items 0850 and above to suit for privacy vs convenience and functionality. Consider
your environment (no unwanted eyeballs), your device (restricted access), your device's
unattended state (locked, encrypted, forensic hardened). Likewise, you may want to check
the items cleared on shutdown in section 2800.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
[NOTE] The urlbar is also commonly referred to as the location bar and address bar
#Required reading [#] https://xkcd.com/538/
remove extra spaces
2018-08-28 09:57:21 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0801: disable location bar using search
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* don't leak typos to a search engine, give an error message instead ***/
user_pref("keyword.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0802: disable location bar domain guessing
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* domain guessing intercepts DNS "hostname not found errors" and resends a
misc typos #178 Thanks Just-me-ghacks
2017-07-23 20:50:55 +02:00
* request (e.g. by adding www or .com). This is inconsistent use (e.g. FQDNs), does not work
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* via Proxy Servers (different error), is a flawed use of DNS (TLDs: why treat .com
* as the 411 for DNS errors?), privacy issues (why connect to sites you didn't
typo: missed one #178
2017-07-23 20:57:33 +02:00
* intend to), can leak sensitive data (e.g. query strings: e.g. Princeton attack),
misc typos #178 Thanks Just-me-ghacks
2017-07-23 20:50:55 +02:00
* and is a security risk (e.g. common typos & malicious sites set up to exploit this) ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.fixup.alternate.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0803: display all parts of the url in the location bar ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.urlbar.trimURLs", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0804: limit history leaks via enumeration (PER TAB: back/forward)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* This is a PER TAB session history. You still have a full history stored under all history
* default=50, minimum=1=currentpage, 2 is the recommended minimum as some pages
misc typos #178 Thanks Just-me-ghacks
2017-07-23 20:50:55 +02:00
* use it as a means of referral (e.g. hotlinking), 4 or 6 or 10 may be more practical ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.sessionhistory.max_entries", 10);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0805: disable CSS querying page history - CSS history leak
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [NOTE] This has NEVER been fully "resolved": in Mozilla/docs it is stated it's
* only in 'certain circumstances', also see latest comments in [2]
* [TEST] http://lcamtuf.coredump.cx/yahh/ (see github wiki APPENDIX C on how to use)
* [1] https://dbaron.org/mozilla/visited-privacy
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [2] https://bugzilla.mozilla.org/147777
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [3] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("layout.css.visited_links_enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0806: disable displaying javascript in history URLs ***/
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
user_pref("browser.urlbar.filter.javascript", true); // [DEFAULT: true]
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0807: disable search bar LIVE search suggestions
Options> and [settings] (#388) * Options> and [settings] While I'm at it, I'm changing the 21 instances of - `[SETTING-56+]` to just `[SETTING]` - `[SETTING-ESR]` to `[SETTING-ESR52]` because we'll leave those in until 62 (yes I know they may apply to earlier ESRs, but people should be upgraded). Thus no ambiguity with ESR60 vs ESR52 users for the overlap
2018-03-26 21:49:39 +02:00
* [SETTING] Search>Provide search suggestions ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.search.suggest.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0808: disable location bar LIVE search suggestions (requires 0807 = true)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* Also disable the location bar prompt to enable/disable or learn more about it.
Options> and [settings] (#388) * Options> and [settings] While I'm at it, I'm changing the 21 instances of - `[SETTING-56+]` to just `[SETTING]` - `[SETTING-ESR]` to `[SETTING-ESR52]` because we'll leave those in until 62 (yes I know they may apply to earlier ESRs, but people should be upgraded). Thus no ambiguity with ESR60 vs ESR52 users for the overlap
2018-03-26 21:49:39 +02:00
* [SETTING] Search>Show search suggestions in address bar results ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.urlbar.suggest.searches", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.urlbar.userMadeSearchSuggestionsChoice", true); // [FF41+]
/* 0809: disable location bar suggesting "preloaded" top websites [FF54+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1211726 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0810: disable location bar making speculative connections [FF56+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1348275 ***/
0810: disable speculative connects #175
2017-07-22 17:11:56 +02:00
user_pref("browser.urlbar.speculativeConnect.enabled", false);
FF65 removals (#624)
2019-01-30 13:27:53 +01:00
/* 0850a: disable location bar suggestion types
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [SETUP-CHROME] If all three suggestion types are false, search engine keywords are disabled
* [SETTING] Privacy & Security>Address Bar>When using the address bar, suggest ***/
Make Firefox Great Again (#626) * location bar changes * if the dropdown is going to be used, then no point hiding search engines on the bottom line
2019-01-30 16:06:32 +01:00
// user_pref("browser.urlbar.suggest.history", false);
// user_pref("browser.urlbar.suggest.bookmark", false);
// user_pref("browser.urlbar.suggest.openpage", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0850c: disable location bar dropdown
* This value controls the total number of entries to appear in the location bar dropdown
* [NOTE] Items (bookmarks/history/openpages) with a high "frecency"/"bonus" will always
* be displayed (no we do not know how these are calculated or what the threshold is),
* and this does not affect the search by search engine suggestion (see 0808)
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [NOTE] This setting is only useful if you want to enable search engine keywords
fixes #308
2017-12-08 18:13:40 +01:00
* (i.e. at least one of 0850a suggestion types must be true) but you want to *limit* suggestions shown ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.urlbar.maxRichResults", 0);
/* 0850d: disable location bar autofill
* [1] http://kb.mozillazine.org/Inline_autocomplete ***/
and the rest of the 0850's The location bar dropdown cannot be disabled via prefs except with css, in which case the whole thing is hidden regardless of he above prefs. So there is no point in making any of them active. This is also in line with what we can achieve with relaxed and hardened tags / sticky issues - that is we can find a better balance, Shoulder surfers is a low risk, not even Tor Browser disables this stuff. People need to take responsibility and/or use common sense. Sure, we can leave em in for users to know about and enable if they want. End of story. userChrome.css code is ```css /* locationbar dropdown FF65+ */ #PopupAutoCompleteRichResult {display: none!important;} ```
2019-01-30 16:44:08 +01:00
// user_pref("browser.urlbar.autoFill", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0850e: disable location bar one-off searches [FF51+]
update ghacks.net links to use https
2017-07-09 18:49:39 +02:00
* [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ ***/
Make Firefox Great Again (#626) * location bar changes * if the dropdown is going to be used, then no point hiding search engines on the bottom line
2019-01-30 16:06:32 +01:00
// user_pref("browser.urlbar.oneOffSearches", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0860: disable search and form history
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [NOTE] You can clear formdata on exiting Firefox (see 2803)
* [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history ***/
0860+0861: disable form history => Active #186
2017-08-05 18:40:49 +02:00
user_pref("browser.formfill.enable", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0862: disable browsing and download history
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [NOTE] You can clear history and downloads on exiting Firefox (see 2803)
* [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("places.history.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0864: disable date/time picker
add 0864: dom.forms.datetime, closes #495
2018-09-11 18:43:18 +02:00
* This can leak your locale if not en-US
* [1] https://trac.torproject.org/projects/tor/ticket/21787 ***/
user_pref("dom.forms.datetime", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0870: disable Windows jumplist [WINDOWS] ***/
user_pref("browser.taskbar.lists.enabled", false);
user_pref("browser.taskbar.lists.frequent.enabled", false);
user_pref("browser.taskbar.lists.recent.enabled", false);
user_pref("browser.taskbar.lists.tasks.enabled", false);
/* 0871: disable Windows taskbar preview [WINDOWS] ***/
user_pref("browser.taskbar.previews.enable", false);
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 0900]: PASSWORDS ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0901: disable saving passwords
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [NOTE] This does not clear any passwords already saved
* [SETTING] Privacy & Security>Forms & Passwords>Ask to save logins and passwords for websites ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("signon.rememberSignons", false);
/* 0902: use a master password (recommended if you save passwords)
* There are no preferences for this. It is all handled internally.
Options> and [settings] (#388) * Options> and [settings] While I'm at it, I'm changing the 21 instances of - `[SETTING-56+]` to just `[SETTING]` - `[SETTING-ESR]` to `[SETTING-ESR52]` because we'll leave those in until 62 (yes I know they may apply to earlier ESRs, but people should be upgraded). Thus no ambiguity with ESR60 vs ESR52 users for the overlap
2018-03-26 21:49:39 +02:00
* [SETTING] Privacy & Security>Forms & Passwords>Use a master password
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://support.mozilla.org/kb/use-master-password-protect-stored-logins ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0903: set how often Firefox should ask for the master password
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
* 0=the first time (default), 1=every time it's needed, 2=every n minutes (see 0904) ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("security.ask_for_password", 2);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0904: set how often in minutes Firefox should ask for the master password (see 0903)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* in minutes, default is 30 ***/
user_pref("security.password_lifetime", 5);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0905: disable auto-filling username & password form fields
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* can leak in cross-site forms AND be spoofed
* [NOTE] Password will still be auto-filled after a user name is manually entered
* [1] http://kb.mozillazine.org/Signon.autofillForms ***/
user_pref("signon.autofillForms", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0906: disable websites' autocomplete="off" [FF30+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* Don't let sites dictate use of saved logins and passwords. Increase security through
* stronger password use. The trade-off is the convenience. Some sites should never be
* saved (such as banking sites). Set at true, informed users can make their own choice. ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("signon.storeWhenAutocompleteOff", true); // [DEFAULT: true]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 0907: display warnings for logins on non-secure (non HTTPS) pages
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1217156 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("security.insecure_password.ui.enabled", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0909: disable formless login capture for Password Manager [FF51+] ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("signon.formlessCapture.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 0910: disable autofilling saved passwords on HTTP pages and show warning [FF52+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://www.fxsitecompat.com/en-CA/docs/2017/insecure-login-forms-now-disable-autofill-show-warning-beneath-input-control/
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [2] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1217152,1319119 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("signon.autofillForms.http", false);
user_pref("security.insecure_field_warning.contextual.enabled", true);
0912: HTTP Auth sub-resources #585 (#602)
2018-12-17 13:41:37 +01:00
/* 0912: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+]
* hardens against potential credentials phishing
* 0=don't allow sub-resources to open HTTP authentication credentials dialogs
* 1=don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs
* 2=allow sub-resources to open HTTP authentication credentials dialogs (default)
* [1] https://www.fxsitecompat.com/en-CA/docs/2015/http-auth-dialog-can-no-longer-be-triggered-by-cross-origin-resources/ ***/
user_pref("network.auth.subresource-http-auth-allow", 1);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
/*** [SECTION 1000]: CACHE / SESSION (RE)STORE / FAVICONS [SETUP-CHROME]
1000s: cache header section #496
2018-09-13 07:09:07 +02:00
ETAG [1] and other [2][3] cache tracking/fingerprinting techniques can be averted by
1000s: cache description/info, closes #436
2018-08-28 10:27:45 +02:00
disabling *BOTH* disk (1001) and memory (1003) cache. ETAGs can also be neutralized
1000s: cache header section #496
2018-09-13 07:09:07 +02:00
by modifying response headers [4]. Another solution is to use a hardened configuration
with Temporary Containers [5]. Alternatively, you can *LIMIT* exposure by clearing
1000s: cache description/info, closes #436
2018-08-28 10:27:45 +02:00
cache on close (2803). or on a regular basis manually or with an extension.
[1] https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
[2] https://robertheaton.com/2014/01/20/cookieless-user-tracking-for-douchebags/
1000s: cache header section #496
2018-09-13 07:09:07 +02:00
[3] https://www.grepular.com/Preventing_Web_Tracking_via_the_Browser_Cache
[4] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.4-Header-Editor
[5] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
1000s: cache description/info, closes #436
2018-08-28 10:27:45 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** CACHE ***/
/* 1001: disable disk cache ***/
user_pref("browser.cache.disk.enable", false);
user_pref("browser.cache.disk.capacity", 0);
user_pref("browser.cache.disk.smart_size.enabled", false);
user_pref("browser.cache.disk.smart_size.first_run", false);
/* 1002: disable disk cache for SSL pages
* [1] http://kb.mozillazine.org/Browser.cache.disk_cache_ssl ***/
user_pref("browser.cache.disk_cache_ssl", false);
/* 1003: disable memory cache
* [NOTE] Not recommended due to performance issues ***/
// user_pref("browser.cache.memory.enable", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("browser.cache.memory.capacity", 0); // [HIDDEN PREF]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1005: disable fastback cache
* To improve performance when pressing back/forward Firefox stores visited pages
* so they don't have to be re-parsed. This is not the same as memory cache.
* 0=none, -1=auto (that's minus 1), or for other values see [1]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [WARNING] Not recommended unless you know what you're doing
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] http://kb.mozillazine.org/Browser.sessionhistory.max_total_viewers ***/
// user_pref("browser.sessionhistory.max_total_viewers", 0);
tidy up info on prefs that require a restart this is not all prefs, just some that we already documented
2018-01-17 04:40:39 +01:00
/* 1006: disable permissions manager from writing to disk [RESTART]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [NOTE] This means any permission changes are session only
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/967812 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("permissions.memory_only", true); // [HIDDEN PREF]
Tor-related warnings (#551) Also reworded some stuff.
2018-11-24 06:19:24 +01:00
/* 1008: set DNS cache and expiration time (default 400 and 60, same as Tor Browser) ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("network.dnsCacheEntries", 400);
// user_pref("network.dnsCacheExpiration", 60);
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** SESSIONS & SESSION RESTORE ***/
1020: remove max_windows #575
2018-12-11 17:43:11 +01:00
/* 1020: exclude "Undo Closed Tabs" in Session Restore ***/
// user_pref("browser.sessionstore.max_tabs_undo", 0);
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 1021: disable storing extra session data [SETUP-CHROME]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* extra session data contains contents of forms, scrollbar positions, cookies and POST data
* define on which sites to save extra session data:
* 0=everywhere, 1=unencrypted sites, 2=nowhere ***/
user_pref("browser.sessionstore.privacy_level", 2);
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
/* 1022: disable resuming session from crash ***/
1022: resume from crash=>inactive, closes #575
2018-12-11 18:28:21 +01:00
// user_pref("browser.sessionstore.resume_from_crash", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1023: set the minimum interval between session save operations
* Increasing this can help on older machines and some websites, as well as reducing writes, see [1]
grammar, case, etc, closes #594 thanks @Just-me-ghacks
2018-12-13 16:49:50 +01:00
* Default is 15000 (15 secs). Try 30000 (30 secs), 60000 (1 min) etc
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-CHROME] This can also affect entries in the "Recently Closed Tabs" feature:
misc grammar for nerds #178 Thanks Just-me-ghacks
2017-07-24 19:15:37 +02:00
* i.e. the longer the interval the more chance a quick tab open/close won't be captured.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* This longer interval *may* affect history but we cannot replicate any history not recorded
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1304389 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.sessionstore.interval", 30000);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1024: disable automatic Firefox start and session restore after reboot [FF62+] [WINDOWS]
1024: toolkit.winRegisterApplicationRestart
2018-09-09 22:46:35 +02:00
* [1] https://bugzilla.mozilla.org/603903 ***/
user_pref("toolkit.winRegisterApplicationRestart", false);
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** FAVICONS ***/
/* 1030: disable favicons in shortcuts
* URL shortcuts use a cached randomly named .ico file which is stored in your
* profile/shortcutCache directory. The .ico remains after the shortcut is deleted.
* If set to false then the shortcuts use a generic Firefox icon ***/
user_pref("browser.shell.shortcutFavicons", false);
/* 1031: disable favicons in tabs and new bookmarks
update 1031 description
2018-09-30 17:30:32 +02:00
* bookmark favicons are stored as data blobs in favicons.sqlite ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.chrome.site_icons", false);
/* 1032: disable favicons in web notifications ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("alerts.showFavicons", false); // [DEFAULT: false]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
move 1260 to 122x (#591) * move 1260 to 122x "disable or limit SHA-1 certificates" is about certs, not ciphers. Because CERTS is 1st in the title I moved it to the 1st item there because it's arguably also the most important of the lot (and renumbered the rest) We can also drop HSTS from the subgroup title because there's nothing HSTS left atm.
2018-12-12 12:52:49 +01:00
/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP / CIPHERS)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
Note that your cipher and other settings can be used server side as a fingerprint attack
vector, see [1] (It's quite technical but the first part is easy to understand
and you can stop reading when you reach the second section titled "Enter Bro")
move 1260 to 122x (#591) * move 1260 to 122x "disable or limit SHA-1 certificates" is about certs, not ciphers. Because CERTS is 1st in the title I moved it to the 1st item there because it's arguably also the most important of the lot (and renumbered the rest) We can also drop HSTS from the subgroup title because there's nothing HSTS left atm.
2018-12-12 12:52:49 +01:00
Option 1: Use defaults for ciphers (1260's). There is nothing *weak* about these, but
due to breakage, browsers can't deprecate them until the web stops using them
1200s: ciphers=>inactive #237
2017-09-15 20:20:00 +02:00
Option 2: Disable the ciphers in 1261, 1262 and 1263. These shouldn't break anything.
Optionally, disable the ciphers in 1264.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
[1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
remove extra spaces
2018-08-28 09:57:21 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/
1201: SSL renegotiation -> active, closes #519
2018-10-16 13:57:32 +02:00
/* 1201: disable old SSL/TLS "insecure" renegotiation (vulnerable to a MiTM attack)
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-WEB] <2% of secure sites do NOT support the newer "secure" renegotiation, see [2]
1201: SSL renegotiation -> active, closes #519
2018-10-16 13:57:32 +02:00
* [1] https://wiki.mozilla.org/Security:Renegotiation
* [2] https://www.ssllabs.com/ssl-pulse/ ***/
user_pref("security.ssl.require_safe_negotiation", true);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1202: control TLS versions with min and max
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
* 1=TLS 1.0, 2=TLS 1.1, 3=TLS 1.2, 4=TLS 1.3
1202: TLS min raised to 1.2 #167
2017-07-09 20:22:52 +02:00
* [NOTE] Jul-2017: Telemetry indicates approx 2% of TLS web traffic uses 1.0 or 1.1
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] http://kb.mozillazine.org/Security.tls.version.*
1202: TLS min raised to 1.2 #167
2017-07-09 20:22:52 +02:00
* [2] https://www.ssl.com/how-to/turn-off-ssl-3-0-and-tls-1-0-in-your-browser/
* [2] archived: https://archive.is/hY2Mm ***/
1202: tls.min => inactive #533 TLS 1.0 and 1.1 are still secure. Sure, later versions are more secure, but 98% of the web is already upgraded - less than 2% of sites use < v1.2. So it's not very likely you would come across a site that requires it, but if you did, what's the point in breaking it. Mozilla and Chrome already have plans to deprecate TLS 1.0 & 1.1, and force that last 2% of sites. TLS settings can be FP'ed without JS. By sticking with the defaults, I do not see any security issues, but an increase in potential anti-FPing. TBH, the chances of either (i.e being FP'ed with TLS as a entropy point, or being compromised due to TLS<1.2) are slim to non anyway. Any arguments, please see @earthlng
2018-11-13 17:19:23 +01:00
// user_pref("security.tls.version.min", 3);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("security.tls.version.max", 4);
/* 1203: disable SSL session tracking [FF36+]
http2, altsvc, ssl session ids vs FPI vs TB #571
2018-12-18 16:54:57 +01:00
* SSL Session IDs are unique, last up to 24hrs in Firefox, and can be used for tracking
* [SETUP-PERF] Relax this if you have FPI enabled (see 4000) *AND* you understand the
* consequences. FPI isolates these, but it was designed with the Tor protocol in mind,
* and the Tor Browser has extra protection, including enhanced sanitizing per Identity.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://tools.ietf.org/html/rfc5077
http2, altsvc, ssl session ids vs FPI vs TB #571
2018-12-18 16:54:57 +01:00
* [2] https://bugzilla.mozilla.org/967977
* [3] https://arxiv.org/abs/1810.07304 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("security.ssl.disable_session_identifiers", true); // [HIDDEN PREF]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1204: disable SSL Error Reporting
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
* [1] https://firefox-source-docs.mozilla.org/browser/base/sslerrorreport/preferences.html ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("security.ssl.errorReporting.automatic", false);
user_pref("security.ssl.errorReporting.enabled", false);
user_pref("security.ssl.errorReporting.url", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1205: disable TLS1.3 0-RTT (round-trip time) [FF51+]
1205: disable TLS1.3 0-RTT
2017-08-18 03:58:30 +02:00
* [1] https://github.com/tlswg/tls13-spec/issues/1001
* [2] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("security.tls.enable_0rtt_data", false);
add empty lines for subgroups in 0400 + 1200 (#482)
2018-08-12 05:11:23 +02:00
1210's: OCSP add reference
2017-07-06 14:09:54 +02:00
/** OCSP (Online Certificate Status Protocol)
#Required reading [#] https://scotthelme.co.uk/revocation-is-broken/ ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1210: enable OCSP Stapling
* [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ ***/
user_pref("security.ssl.enable_ocsp_stapling", true);
1211+1212: clarify things better, fixes #334
2018-01-15 18:51:21 +01:00
/* 1211: control when to use OCSP fetching (to confirm current validity of certificates)
1211+1212: OCSP info tweaking, fixes #334
2018-01-11 17:26:42 +01:00
* 0=disabled, 1=enabled (default), 2=enabled for EV certificates only
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority)
* It's a trade-off between security (checking) and privacy (leaking info to the CA)
1211+1212: OCSP info tweaking, fixes #334
2018-01-11 17:26:42 +01:00
* [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://en.wikipedia.org/wiki/Ocsp ***/
user_pref("security.OCSP.enabled", 1);
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail [SETUP-WEB]
1211+1212: OCSP info tweaking, fixes #334
2018-01-11 17:26:42 +01:00
* When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail)
* Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail)
1211+1212: clarify things better, fixes #334
2018-01-15 18:51:21 +01:00
* It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it
* could have been revoked) and/or you could be under attack (e.g. malicious blocking of OCSP servers)
1211+1212: OCSP info tweaking, fixes #334
2018-01-11 17:26:42 +01:00
* [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
* [2] https://www.imperialviolet.org/2014/04/19/revchecking.html ***/
1212: turn on OCSP
2017-07-07 19:12:52 +02:00
user_pref("security.OCSP.require", true);
add empty lines for subgroups in 0400 + 1200 (#482)
2018-08-12 05:11:23 +02:00
move 1260 to 122x (#591) * move 1260 to 122x "disable or limit SHA-1 certificates" is about certs, not ciphers. Because CERTS is 1st in the title I moved it to the 1st item there because it's arguably also the most important of the lot (and renumbered the rest) We can also drop HSTS from the subgroup title because there's nothing HSTS left atm.
2018-12-12 12:52:49 +01:00
/** CERTS / HPKP (HTTP Public Key Pinning) ***/
/* 1220: disable or limit SHA-1 certificates
* 0=all SHA1 certs are allowed
* 1=all SHA1 certs are blocked
* 2=deprecated option that now maps to 1
* 3=only allowed for locally-added roots (e.g. anti-virus)
* 4=only allowed for locally-added roots or for certs in 2015 and earlier
* [SETUP-CHROME] When disabled, some man-in-the-middle devices (e.g. security scanners and
* antivirus products, may fail to connect to HTTPS sites. SHA-1 is *almost* obsolete.
* [1] https://blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ ***/
user_pref("security.pki.sha1_enforcement_level", 1);
/* 1221: disable Windows 8.1's Microsoft Family Safety cert [FF50+] [WINDOWS]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* 0=disable detecting Family Safety mode and importing the root
* 1=only attempt to detect Family Safety mode (don't import the root)
* 2=detect Family Safety mode and import the root
* [1] https://trac.torproject.org/projects/tor/ticket/21686 ***/
user_pref("security.family_safety.mode", 0);
move 1260 to 122x (#591) * move 1260 to 122x "disable or limit SHA-1 certificates" is about certs, not ciphers. Because CERTS is 1st in the title I moved it to the 1st item there because it's arguably also the most important of the lot (and renumbered the rest) We can also drop HSTS from the subgroup title because there's nothing HSTS left atm.
2018-12-12 12:52:49 +01:00
/* 1222: disable intermediate certificate caching (fingerprinting attack vector) [RESTART]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* Saved logins and passwords are not available. Reset the pref and restart to return them.
1221 - test site works again
2017-09-15 14:44:05 +02:00
* [TEST] https://fiprinca.0x90.eu/poc/
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1334485 - related bug
* [2] https://bugzilla.mozilla.org/1216882 - related bug (see comment 9) ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("security.nocertdb", true); // [HIDDEN PREF]
move 1260 to 122x (#591) * move 1260 to 122x "disable or limit SHA-1 certificates" is about certs, not ciphers. Because CERTS is 1st in the title I moved it to the 1st item there because it's arguably also the most important of the lot (and renumbered the rest) We can also drop HSTS from the subgroup title because there's nothing HSTS left atm.
2018-12-12 12:52:49 +01:00
/* 1223: enforce strict pinning
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict
* [WARNING] If you rely on an AV (antivirus) to protect your web browsing
* by inspecting ALL your web traffic, then leave at current default=1
* [1] https://trac.torproject.org/projects/tor/ticket/16206 ***/
user_pref("security.cert_pinning.enforcement_level", 2);
add empty lines for subgroups in 0400 + 1200 (#482)
2018-08-12 05:11:23 +02:00
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** MIXED CONTENT ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1240: disable insecure active content on https pages
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://trac.torproject.org/projects/tor/ticket/21323 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("security.mixed_content.block_active_content", true); // [DEFAULT: true]
/* 1241: disable insecure passive content (such as images) on https pages ***/
1241->active: block mixed passive content #326
2018-01-04 21:02:59 +01:00
user_pref("security.mixed_content.block_display_content", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1243: block unencrypted requests from Flash on encrypted pages to mitigate MitM attacks [FF59+]
saving the world bytes at a time
2018-11-15 16:47:21 +01:00
* [1] https://bugzilla.mozilla.org/1190623 ***/
1243: mixed OBJECT_SUBREQUESTS
2018-11-15 08:06:34 +01:00
user_pref("security.mixed_content.block_object_subrequest", true);
add empty lines for subgroups in 0400 + 1200 (#482)
2018-08-12 05:11:23 +02:00
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** CIPHERS [see the section 1200 intro] ***/
/* 1261: disable 3DES (effective key size < 128)
* [1] https://en.wikipedia.org/wiki/3des#Security
* [2] http://en.citizendium.org/wiki/Meet-in-the-middle_attack
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
* [3] https://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html ***/
1200s: ciphers=>inactive #237
2017-09-15 20:20:00 +02:00
// user_pref("security.ssl3.rsa_des_ede3_sha", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1262: disable 128 bits ***/
1200s: ciphers=>inactive #237
2017-09-15 20:20:00 +02:00
// user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
// user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1263: disable DHE (Diffie-Hellman Key Exchange)
* [1] https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH ***/
1200s: ciphers=>inactive #237
2017-09-15 20:20:00 +02:00
// user_pref("security.ssl3.dhe_rsa_aes_128_sha", false);
// user_pref("security.ssl3.dhe_rsa_aes_256_sha", false);
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 1264: disable the remaining non-modern cipher suites as of FF52 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("security.ssl3.rsa_aes_128_sha", false);
// user_pref("security.ssl3.rsa_aes_256_sha", false);
add empty lines for subgroups in 0400 + 1200 (#482)
2018-08-12 05:11:23 +02:00
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/** UI (User Interface) ***/
1270: link to 1201, #519
2018-10-16 14:01:42 +02:00
/* 1270: display warning (red padlock) for "broken security" (see 1201)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://wiki.mozilla.org/Security:Renegotiation ***/
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
/* 1271: control "Add Security Exception" dialog on SSL warnings
0205: intl.locale.requested FF59+
2018-01-22 06:49:39 +01:00
* 0=do neither 1=pre-populate url 2=pre-populate url + pre-fetch cert (default)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://github.com/pyllyukko/user.js/issues/210 ***/
user_pref("browser.ssl_override_behavior", 1);
/* 1272: display advanced information on Insecure Connection warning pages
* only works when it's possible to add an exception
misc grammar for nerds #178 Thanks Just-me-ghacks
2017-07-24 19:15:37 +02:00
* i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [TEST] https://expired.badssl.com/ ***/
user_pref("browser.xul.error_pages.expert_bad_cert", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1273: display "insecure" icon and "Not Secure" text on HTTP sites ***/
user_pref("security.insecure_connection_icon.enabled", true); // [FF59+]
user_pref("security.insecure_connection_text.enabled", true); // [FF60+]
// user_pref("security.insecure_connection_icon.pbmode.enabled", true); // [FF59+] private windows only
// user_pref("security.insecure_connection_text.pbmode.enabled", true); // [FF60+] private windows only
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 1400]: FONTS ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "1400 syntax error: the parrot's bereft of life!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1401: disable websites choosing fonts (0=block, 1=allow)
* If you disallow fonts, this drastically limits/reduces font
* enumeration (by JS) which is a high entropy fingerprinting vector.
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [NOTE] Disabling fonts can uglify the web a fair bit.
* [SETTING] General>Language and Appearance>Fonts & Colors>Advanced>Allow pages to choose... ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.display.use_document_fonts", 0);
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 1402: set more legible default fonts
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [NOTE] Example below for Windows/Western only
* [SETTING] General>Language and Appearance>Fonts & Colors>Advanced>Serif|Sans-serif|Monospace ***/
1404->1402: default fonts => inactive #237 Inactive as this actually can cause problems on Linux with tofu (I think arial on debian causes tofu - ask nodiscc) . Also incomplete with non-Western settings
2017-09-18 18:54:52 +02:00
// user_pref("font.name.serif.x-unicode", "Georgia");
fixup // default syntax
2018-03-26 21:44:15 +02:00
// user_pref("font.name.serif.x-western", "Georgia"); // default: Times New Roman
1404->1402: default fonts => inactive #237 Inactive as this actually can cause problems on Linux with tofu (I think arial on debian causes tofu - ask nodiscc) . Also incomplete with non-Western settings
2017-09-18 18:54:52 +02:00
// user_pref("font.name.sans-serif.x-unicode", "Arial");
fixup // default syntax
2018-03-26 21:44:15 +02:00
// user_pref("font.name.sans-serif.x-western", "Arial"); // default: Arial
1404->1402: default fonts => inactive #237 Inactive as this actually can cause problems on Linux with tofu (I think arial on debian causes tofu - ask nodiscc) . Also incomplete with non-Western settings
2017-09-18 18:54:52 +02:00
// user_pref("font.name.monospace.x-unicode", "Lucida Console");
fixup // default syntax
2018-03-26 21:44:15 +02:00
// user_pref("font.name.monospace.x-western", "Lucida Console"); // default: Courier New
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1403: disable icon fonts (glyphs) and local fallback rendering
1403: icon fonts: flip, make inactive, closes #521
2018-10-20 03:35:37 +02:00
* [1] https://bugzilla.mozilla.org/789788
* [2] https://trac.torproject.org/projects/tor/ticket/8455 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+]
1403: icon fonts: flip, make inactive, closes #521
2018-10-20 03:35:37 +02:00
// user_pref("gfx.downloadable_fonts.fallback_delay", -1);
1404->1402: default fonts => inactive #237 Inactive as this actually can cause problems on Linux with tofu (I think arial on debian causes tofu - ask nodiscc) . Also incomplete with non-Western settings
2017-09-18 18:54:52 +02:00
/* 1404: disable rendering of SVG OpenType fonts
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/
user_pref("gfx.font_rendering.opentype_svg.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1405: disable WOFF2 (Web Open Font Format) [FF35+] ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("gfx.downloadable_fonts.woff2.enabled", false);
/* 1406: disable CSS Font Loading API
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [NOTE] Disabling fonts can uglify the web a fair bit. ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("layout.css.font-loading-api.enabled", false);
tidy up info on prefs that require a restart this is not all prefs, just some that we already documented
2018-01-17 04:40:39 +01:00
/* 1407: disable special underline handling for a few fonts which you will probably never use [RESTART]
1407: restart info duplicity
2018-02-07 01:49:58 +01:00
* Any of these fonts on your system can be enumerated for fingerprinting.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] http://kb.mozillazine.org/Font.blacklist.underline_offset ***/
user_pref("font.blacklist.underline_offset", "");
/* 1408: disable graphite which FF49 turned back on by default
1408: graphite: update & add ref
2017-06-19 17:25:31 +02:00
* In the past it had security issues. Update: This continues to be the case, see [1]
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://www.mozilla.org/security/advisories/mfsa2017-15/#CVE-2017-7778 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("gfx.font_rendering.graphite.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1409: limit system font exposure to a whitelist [FF52+] [RESTART]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* If the whitelist is empty, then whitelisting is considered disabled and all fonts are allowed.
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
* [WARNING] Creating your own probably highly-unique whitelist will raise your entropy.
* Eventually privacy.resistFingerprinting (see 4500) will cover this (and 1401 can be relaxed)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1121643 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("font.system.whitelist", ""); // [HIDDEN PREF]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 1600]: HEADERS / REFERERS
minor edits
2018-02-07 00:50:30 +01:00
Only *cross domain* referers need controlling and XOriginPolicy (1603) is perfect for that. Thus we enforce
the default values for 1601, 1602, 1605 and 1606 to minimize breakage, and only tweak 1603 and 1604.
1600 cleanup and header-rewrite
2018-02-06 20:09:11 +01:00
Our default settings provide the best balance between protection and amount of breakage.
To harden it a bit more you can set XOriginPolicy (1603) to 2 (+ optionally 1604 to 1 or 2).
1600 info: fixes #404 , refixes #332
2018-04-21 18:22:04 +02:00
To fix broken sites (including your modem/router), temporarily set XOriginPolicy=0 and XOriginTrimmingPolicy=2 in about:config,
grammar, case, etc, closes #594 thanks @Just-me-ghacks
2018-12-13 16:49:50 +01:00
use the site and then change the values back. If you visit those sites regularly (e.g. vimeo), use an extension.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
full URI: https://example.com:8888/foo/bar.html?id=1234
scheme+host+path+port -> scheme+host+port+path (#530)
2018-11-04 15:44:20 +01:00
scheme+host+port+path: https://example.com:8888/foo/bar.html
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
scheme+host+port: https://example.com:8888
#Required reading [#] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/
remove extra spaces
2018-08-28 09:57:21 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1601: ALL: control when images/links send a referer
1600 cleanup and header-rewrite
2018-02-06 20:09:11 +01:00
* 0=never, 1=send only when links are clicked, 2=for links and images (default) ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.http.sendRefererHeader", 2);
/* 1602: ALL: control the amount of information to send
scheme+host+path+port -> scheme+host+port+path (#530)
2018-11-04 15:44:20 +01:00
* 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.http.referer.trimmingPolicy", 0);
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 1603: CROSS ORIGIN: control when to send a referer [SETUP-WEB]
1600 cleanup and header-rewrite
2018-02-06 20:09:11 +01:00
* 0=always (default), 1=only if base domains match, 2=only if hosts match ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.http.referer.XOriginPolicy", 1);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1604: CROSS ORIGIN: control the amount of information to send [FF52+]
scheme+host+path+port -> scheme+host+port+path (#530)
2018-11-04 15:44:20 +01:00
* 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.http.referer.XOriginTrimmingPolicy", 0);
/* 1605: ALL: disable spoofing a referer
proper case convention after tags Can't believe I did this. Out of 32 `[setup*` and 9 `[warning]` tags (excluding the readme), I let one capital letter get past me, the bastard!
2018-12-04 11:26:44 +01:00
* [WARNING] Do not set this to true, as spoofing effectively disables the anti-CSRF
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* (Cross-Site Request Forgery) protections that some sites may rely on ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false]
/* 1606: ALL: set the default Referrer Policy [FF59+]
1600 cleanup and header-rewrite
2018-02-06 20:09:11 +01:00
* 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [NOTE] This is only a default, it can be overridden by a site-controlled Referrer Policy
* [1] https://www.w3.org/TR/referrer-policy/
1600 cleanup and header-rewrite
2018-02-06 20:09:11 +01:00
* [2] https://developer.mozilla.org/docs/Web/HTTP/Headers/Referrer-Policy
* [3] https://blog.mozilla.org/security/2018/01/31/preventing-data-leaks-by-stripping-path-information-in-http-referrers/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.http.referer.defaultPolicy", 3); // [DEFAULT: 3]
user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2]
/* 1607: TOR: hide (not spoof) referrer when leaving a .onion domain [FF54+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [NOTE] Firefox cannot access .onion sites by default. We recommend you use
Tor-related warnings (#551) Also reworded some stuff.
2018-11-24 06:19:24 +01:00
* the Tor Browser which is specifically designed for hidden services
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1305144 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.http.referer.hideOnionSource", true);
enable DNT header by default pros and cons: see https://github.com/ghacksuserjs/ghacks-user.js/issues/422#issuecomment-392789507 + follow-up comments
2018-05-29 19:06:06 +02:00
/* 1610: ALL: enable the DNT (Do Not Track) HTTP header
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [NOTE] DNT is enforced with TP (see 0420) regardless of this pref
* [SETTING] Privacy & Security>Content Blocking>Send websites a "Do Not Track"... ***/
enable DNT header by default pros and cons: see https://github.com/ghacksuserjs/ghacks-user.js/issues/422#issuecomment-392789507 + follow-up comments
2018-05-29 19:06:06 +02:00
user_pref("privacy.donottrackheader.enabled", true);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 1700]: CONTAINERS
1700s: revamp Containers header #585 (#596)
2018-12-14 08:05:43 +01:00
If you want to *really* leverage containers, we highly recommend Temporary Containers [2].
Read the article by the extension author [3], and check out the github wiki/repo [4].
[1] https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers
[2] https://addons.mozilla.org/firefox/addon/temporary-containers/
[3] https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21
[4] https://github.com/stoically/temporary-containers/wiki
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1701: enable Container Tabs setting in preferences (see 1702) [FF50+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1279029 ***/
1700s: enable containers, #438 AFAIK there's no technical reasons for containers to be disabled in FF63+
2018-11-22 00:53:00 +01:00
user_pref("privacy.userContext.ui.enabled", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1702: enable Container Tabs [FF50+]
update [SETTING] info (#538)
2018-11-19 00:56:12 +01:00
* [SETTING] General>Tabs>Enable Container Tabs ***/
1700s: enable containers, #438 AFAIK there's no technical reasons for containers to be disabled in FF63+
2018-11-22 00:53:00 +01:00
user_pref("privacy.userContext.enabled", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 1703: enable a private container for thumbnail loads [FF51+] ***/
user_pref("privacy.usercontext.about_newtab_segregation.enabled", true); // [DEFAULT: true in FF61+]
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
/* 1704: set behaviour on "+ Tab" button to display container menu [FF53+] [SETUP-CHROME]
* 0=no menu (default), 1=show when clicked, 2=show on long press
* [NOTE] The menu does not contain a non-container tab option (use Ctrl+T to open non-container tab)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1328756 ***/
1700s: enable containers, #438 AFAIK there's no technical reasons for containers to be disabled in FF63+
2018-11-22 00:53:00 +01:00
user_pref("privacy.userContext.longPressBehavior", 2);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 1800]: PLUGINS ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "1800 syntax error: the parrot's pushing up daisies!");
misc grammar for nerds #178 Thanks Just-me-ghacks
2017-07-24 19:15:37 +02:00
/* 1801: set default plugin state (i.e. new plugins on discovery) to never activate
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* 0=disabled, 1=ask to activate, 2=active - you can override individual plugins ***/
user_pref("plugin.default.state", 0);
user_pref("plugin.defaultXpi.state", 0);
/* 1802: enable click to play and set to 0 minutes ***/
user_pref("plugins.click_to_play", true);
user_pref("plugin.sessionPermissionNow.intervalInMinutes", 0);
update 1803 after Java removal (#494)
2018-09-05 18:59:04 +02:00
/* 1803: disable Flash plugin (Add-ons>Plugins)
1803: flash/java/npapi fixes #433
2018-05-23 19:05:29 +02:00
* 0=deactivated, 1=ask, 2=enabled
* ESR52.x is the last branch to *fully* support NPAPI, FF52+ stable only supports Flash
update 1803 after Java removal (#494)
2018-09-05 18:59:04 +02:00
* [NOTE] You can still override individual sites via site permissions
update ghacks.net links to use https
2017-07-09 18:49:39 +02:00
* [1] https://www.ghacks.net/2013/07/09/how-to-make-sure-that-a-firefox-plugin-never-activates-again/ ***/
1803: flash/java/npapi fixes #433
2018-05-23 19:05:29 +02:00
user_pref("plugin.state.flash", 0);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 1805: disable scanning for plugins [WINDOWS]
* [1] http://kb.mozillazine.org/Plugin_scanning
* plid.all = whether to scan the directories specified in the Windows registry for PLIDs.
* Used to detect RealPlayer, Java, Antivirus etc, but since FF52 only covers Flash ***/
user_pref("plugin.scan.plid.all", false);
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 1820: disable all GMP (Gecko Media Plugins) [SETUP-WEB]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/
user_pref("media.gmp-provider.enabled", false);
user_pref("media.gmp.trial-create.enabled", false);
1800s: move gmp update prefs to 1820
2017-08-10 12:52:59 +02:00
user_pref("media.gmp-manager.url", "data:text/plain,");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("media.gmp-manager.url.override", "data:text/plain,"); // [HIDDEN PREF]
user_pref("media.gmp-manager.updateEnabled", false); // disable local fallback [HIDDEN PREF]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 1825: disable widevine CDM (Content Decryption Module) [SETUP-WEB] ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.gmp-widevinecdm.visible", false);
user_pref("media.gmp-widevinecdm.enabled", false);
user_pref("media.gmp-widevinecdm.autoupdate", false);
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 1830: disable all DRM content (EME: Encryption Media Extension) [SETUP-WEB]
1830: remove hiding the DRM UI out of interest, it no longer requires a restart
2018-11-19 01:34:56 +01:00
* [SETTING] General>DRM Content>Play DRM-controlled content
1830: ref for DRM / EME
2017-11-29 01:32:48 +01:00
* [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/
1830: remove hiding the DRM UI out of interest, it no longer requires a restart
2018-11-19 01:34:56 +01:00
user_pref("media.eme.enabled", false);
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
/* 1840: disable the OpenH264 Video Codec by Cisco to "Never Activate" [SETUP-WEB]
* This is the bundled codec used for video chat in WebRTC ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("media.gmp-gmpopenh264.enabled", false); // [HIDDEN PREF]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.gmp-gmpopenh264.autoupdate", false);
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 2000]: MEDIA / CAMERA / MIC ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 2001: disable WebRTC (Web Real-Time Communication)
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
* [1] https://www.privacytools.io/#webrtc ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.peerconnection.enabled", false);
/* 2002: limit WebRTC IP leaks if using WebRTC
2002 WebRTC tests #580 FYI, the https://www.privacytools.io/webrtc.html test in our wiki is 404, so I gave it a strikethru and added this one. This is also handy for 2001, but do we need to double up on it? We're only disabling WebRTC because of IP leaks, so I don't see the point in testing if WebRTC is disabled.
2018-12-11 01:40:03 +01:00
* [TEST] https://browserleaks.com/webrtc
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/
taking out the garbage (#590)
2018-12-12 14:02:38 +01:00
user_pref("media.peerconnection.ice.default_address_only", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("media.peerconnection.ice.no_host", true); // [FF51+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 2010: disable WebGL (Web Graphics Library), force bare minimum feature set if used & disable WebGL extensions
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
* [1] https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [2] https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern ***/
user_pref("webgl.disabled", true);
user_pref("pdfjs.enableWebGL", false);
user_pref("webgl.min_capability_mode", true);
user_pref("webgl.disable-extensions", true);
user_pref("webgl.disable-fail-if-major-performance-caveat", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2012: disable two more webgl preferences [FF51+] ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("webgl.dxgl.enabled", false); // [WINDOWS]
user_pref("webgl.enable-webgl2", false);
/* 2022: disable screensharing ***/
user_pref("media.getusermedia.screensharing.enabled", false);
user_pref("media.getusermedia.browser.enabled", false);
user_pref("media.getusermedia.audiocapture.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2024: set a default permission for Camera/Microphone [FF58+]
added 2024: default permissions camera/mic
2018-02-03 03:17:20 +01:00
* 0=always ask (default), 1=allow, 2=block
* [SETTING] to add site exceptions: Page Info>Permissions>Use the Camera/Microphone
nits (#423)
2018-05-16 18:31:28 +02:00
* [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Camera/Microphone>Settings ***/
added 2024: default permissions camera/mic
2018-02-03 03:17:20 +01:00
// user_pref("permissions.default.camera", 2);
// user_pref("permissions.default.microphone", 2);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2026: disable canvas capture stream [FF41+]
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/API/HTMLCanvasElement/captureStream ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("canvas.capturestream.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2027: disable camera image capture [FF35+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://trac.torproject.org/projects/tor/ticket/16339 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("dom.imagecapture.enabled", false); // [DEFAULT: false]
/* 2028: disable offscreen canvas [FF44+]
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/API/OffscreenCanvas ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("gfx.offscreencanvas.enabled", false); // [DEFAULT: false]
/* 2030: disable auto-play of HTML5 media [FF63+]
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
* 0=Allowed (default), 1=Blocked, 2=Prompt
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-WEB] This may break video playback on various sites ***/
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
user_pref("media.autoplay.default", 1);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2031: disable audio auto-play in non-active tabs [FF51+]
update ghacks.net links to use https
2017-07-09 18:49:39 +02:00
* [1] https://www.ghacks.net/2016/11/14/firefox-51-blocks-automatic-audio-playback-in-non-active-tabs/ ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.block-autoplay-until-in-foreground", true);
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 2200]: WINDOW MEDDLING & LEAKS / POPUPS ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "2200 syntax error: the parrot's 'istory!");
2200s: more tweaks
2018-03-26 19:04:31 +02:00
/* 2201: prevent websites from disabling new window features
clean up 2202+2203 #371
2018-03-25 12:07:27 +02:00
* [1] http://kb.mozillazine.org/Prevent_websites_from_disabling_new_window_features ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.disable_window_open_feature.close", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("dom.disable_window_open_feature.location", true); // [DEFAULT: true]
clean up 2202+2203 #371
2018-03-25 12:07:27 +02:00
user_pref("dom.disable_window_open_feature.menubar", true);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.disable_window_open_feature.minimizable", true);
2506: add bugzilla ref + 2203: grammar for nerds
2017-07-26 10:46:52 +02:00
user_pref("dom.disable_window_open_feature.personalbar", true); // bookmarks toolbar
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("dom.disable_window_open_feature.resizable", true); // [DEFAULT: true]
user_pref("dom.disable_window_open_feature.status", true); // [DEFAULT: true]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.disable_window_open_feature.titlebar", true);
clean up 2202+2203 #371
2018-03-25 12:07:27 +02:00
user_pref("dom.disable_window_open_feature.toolbar", true);
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
/* 2202: prevent scripts from moving and resizing open windows ***/
clean up 2202+2203 #371
2018-03-25 12:07:27 +02:00
user_pref("dom.disable_window_move_resize", true);
2203: undo sh*t This is so wrong: It is better to inform users that 3 **must** be used than rely on zero info as well as removing useful info on what the values do. All future issues with this will be directed to earthlng. Remove RFP info as RFP users should know this stuff if they turned it on. Non RFP users, who we told they can bypass it, will not have a reference to RFP now. Enforce will now be banned as a word because, "reasons".
2018-03-26 21:33:46 +02:00
/* 2203: open links targeting new windows in a new tab instead
2200s: more tweaks
2018-03-26 19:04:31 +02:00
* This stops malicious window sizes and some screen resolution leaks.
minor edits, settings info
2018-03-26 23:08:20 +02:00
* You can still right-click a link and open in a new window.
revamp 2400s: fixes #371
2018-03-26 09:34:02 +02:00
* [TEST] https://people.torproject.org/~gk/misc/entire_desktop.html
* [1] https://trac.torproject.org/projects/tor/ticket/9881 ***/
2203: undo sh*t This is so wrong: It is better to inform users that 3 **must** be used than rely on zero info as well as removing useful info on what the values do. All future issues with this will be directed to earthlng. Remove RFP info as RFP users should know this stuff if they turned it on. Non RFP users, who we told they can bypass it, will not have a reference to RFP now. Enforce will now be banned as a word because, "reasons".
2018-03-26 21:33:46 +02:00
user_pref("browser.link.open_newwindow", 3);
revamp 2400s: fixes #371
2018-03-26 09:34:02 +02:00
user_pref("browser.link.open_newwindow.restriction", 0);
2204: FS API=>inactive, #533
2018-11-13 19:56:51 +01:00
/* 2204: disable Fullscreen API (requires user interaction) to prevent screen-resolution leaks
minor edits, settings info
2018-03-26 23:08:20 +02:00
* [NOTE] You can still manually toggle the browser's fullscreen state (F11),
revamp 2400s: fixes #371
2018-03-26 09:34:02 +02:00
* but this pref will disable embedded video/game fullscreen controls, e.g. youtube
* [TEST] https://developer.mozilla.org/samples/domref/fullscreen.html ***/
2204: FS API=>inactive, #533
2018-11-13 19:56:51 +01:00
// user_pref("full-screen-api.enabled", false);
2200s: tweaks
2018-03-26 18:01:30 +02:00
/* 2210: block popup windows
remove [SETTING-ESR52] lines (#475)
2018-08-09 05:30:57 +02:00
* [SETTING] Privacy & Security>Permissions>Block pop-up windows ***/
revamp 2400s: fixes #371
2018-03-26 09:34:02 +02:00
user_pref("dom.disable_open_during_load", true);
2200s: tweaks
2018-03-26 18:01:30 +02:00
/* 2211: set max popups from a single non-click event - default is 20! ***/
revamp 2400s: fixes #371
2018-03-26 09:34:02 +02:00
user_pref("dom.popup_maximum", 3);
2200s: tweaks
2018-03-26 18:01:30 +02:00
/* 2212: limit events that can cause a popup
revamp 2400s: fixes #371
2018-03-26 09:34:02 +02:00
* default is "change click dblclick mouseup pointerup notificationclick reset submit touchend"
* [1] http://kb.mozillazine.org/Dom.popup_allowed_events ***/
user_pref("dom.popup_allowed_events", "click dblclick");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 2300]: WEB WORKERS
misc grammar for nerds #178 Thanks Just-me-ghacks
2017-07-24 19:15:37 +02:00
A worker is a JS "background task" running in a global context, i.e. it is different from
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
the current window. Workers can spawn new workers (must be the same origin & scheme),
2300: *workers info fixup "Push and web notifications require service workers, which in turn require workers." - this is clearly not (or no longer) true. See #256 where workers are disabled, but service workers enabled, and service workers create IDB entries on Youtube
2017-10-31 08:17:26 +01:00
including service and shared workers. Shared workers can be utilized by multiple scripts and
communicate between browsing contexts (windows/tabs/iframes) and can even control your cache.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
[SETUP-WEB] Disabling "web workers" might break sites
60 deprecated/removed prefs
2018-05-04 18:56:14 +02:00
[UPDATE] uMatrix 1.2.0+ allows a per-scope control for workers (2301-deprecated) and service workers (2302)
workers/service workers uM workaround #326
2018-01-06 00:09:30 +01:00
#Required reading [#] https://github.com/gorhill/uMatrix/releases/tag/1.2.0
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
[1] Web Workers: https://developer.mozilla.org/docs/Web/API/Web_Workers_API
[2] Worker: https://developer.mozilla.org/docs/Web/API/Worker
[3] Service Worker: https://developer.mozilla.org/docs/Web/API/Service_Worker_API
[4] SharedWorker: https://developer.mozilla.org/docs/Web/API/SharedWorker
[5] ChromeWorker: https://developer.mozilla.org/docs/Web/API/ChromeWorker
[6] Notifications: https://support.mozilla.org/questions/1165867#answer-981820
remove extra spaces
2018-08-28 09:57:21 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "2300 syntax error: the parrot's off the twig!");
2302 FF version
2018-12-11 01:13:07 +01:00
/* 2302: disable service workers [FF32, FF44-compat]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* Service workers essentially act as proxy servers that sit between web apps, and the browser
* and network, are event driven, and can control the web page/site it is associated with,
* intercepting and modifying navigation and resource requests, and caching resources.
* [NOTE] Service worker APIs are hidden (in Firefox) and cannot be used when in PB mode.
* [NOTE] Service workers only run over HTTPS. Service Workers have no DOM access. ***/
user_pref("dom.serviceWorkers.enabled", false);
/* 2304: disable web notifications
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/API/Notifications_API ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("dom.webnotifications.enabled", false); // [FF22+]
user_pref("dom.webnotifications.serviceworker.enabled", false); // [FF44+]
/* 2305: set a default permission for Notifications (see 2304) [FF58+]
* 0=always ask (default), 1=allow, 2=block
update cookie settings info
2019-02-04 14:00:19 +01:00
* [NOTE] Best left at default "always ask", fingerprintable via Permissions API
added 2305: default permission Notifications
2018-02-03 04:56:16 +01:00
* [SETTING] to add site exceptions: Page Info>Permissions>Receive Notifications
nits (#423)
2018-05-16 18:31:28 +02:00
* [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Notifications>Settings ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("permissions.default.desktop-notification", 2);
/* 2306: disable push notifications [FF44+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* web apps can receive messages pushed to them from a server, whether or
* not the web app is in the foreground, or even currently loaded
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/API/Push_API ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.push.enabled", false);
user_pref("dom.push.connection.enabled", false);
user_pref("dom.push.serverURL", "");
user_pref("dom.push.userAgentID", "");
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) & JAVASCRIPT ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!");
2201+2205=>2400's #371 new numbers 2401 and 2404 do not exist anymore in the user.js so safe to use
2018-03-25 11:53:52 +02:00
/* 2401: disable website control over browser right-click context menu
2200s: tweaks
2018-03-26 18:01:30 +02:00
* [NOTE] Shift-Right-Click will always bring up the browser right-click context menu ***/
2201+2205=>2400's #371 new numbers 2401 and 2404 do not exist anymore in the user.js so safe to use
2018-03-25 11:53:52 +02:00
// user_pref("dom.event.contextmenu.enabled", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 2402: disable website access to clipboard events/content
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-WEB] This will break some sites functionality such as pasting into facebook, wordpress
misc grammar for nerds #178 Thanks Just-me-ghacks
2017-07-24 19:15:37 +02:00
* this applies to onCut, onCopy, onPaste events - i.e. you have to interact with
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* the website for it to look at the clipboard
update ghacks.net links to use https
2017-07-09 18:49:39 +02:00
* [1] https://www.ghacks.net/2014/01/08/block-websites-reading-modifying-clipboard-contents-firefox/ ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.event.clipboardevents.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2403: disable clipboard commands (cut/copy) from "non-privileged" content [FF41+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* this disables document.execCommand("cut"/"copy") to protect your clipboard
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1170911 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("dom.allow_cut_copy", false); // [HIDDEN PREF]
2201+2205=>2400's #371 new numbers 2401 and 2404 do not exist anymore in the user.js so safe to use
2018-03-25 11:53:52 +02:00
/* 2404: disable "Confirm you want to leave" dialog on page close
* Does not prevent JS leaks of the page close event.
* [1] https://developer.mozilla.org/docs/Web/Events/beforeunload
* [2] https://support.mozilla.org/questions/1043508 ***/
user_pref("dom.disable_beforeunload", true);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 2414: disable shaking the screen ***/
user_pref("dom.vibrator.enabled", false);
add PERF tags to wasm, asm.js, closes #599
2018-12-16 15:10:32 +01:00
/* 2420: disable asm.js [FF22+] [SETUP-PERF]
2420 + 2421
2018-02-16 18:39:01 +01:00
* [1] http://asmjs.org/
* [2] https://www.mozilla.org/security/advisories/mfsa2015-29/
* [3] https://www.mozilla.org/security/advisories/mfsa2015-50/
* [4] https://www.mozilla.org/security/advisories/mfsa2017-01/#CVE-2017-5375
* [5] https://www.mozilla.org/security/advisories/mfsa2017-05/#CVE-2017-5400
* [6] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("javascript.options.asmjs", false);
2421: baseline JIT update info
2018-02-13 08:13:59 +01:00
/* 2421: disable Ion and baseline JIT to help harden JS against exploits
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-PERF] If false, causes the odd site issue and there is also a performance loss
2420 + 2421
2018-02-16 18:39:01 +01:00
* [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("javascript.options.ion", false);
// user_pref("javascript.options.baselinejit", false);
add PERF tags to wasm, asm.js, closes #599
2018-12-16 15:10:32 +01:00
/* 2422: disable WebAssembly [FF52+] [SETUP-PERF]
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/WebAssembly ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("javascript.options.wasm", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2426: disable Intersection Observer API [FF53+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* Almost a year to complete, three versions late to stable (as default false),
* number #1 cause of crashes in nightly numerous times, and is (primarily) an
* ad network API for "ad viewability checks" down to a pixel level
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API
URL changes ##224 Part2 [Ch-ch-ch-ch-changes](https://en.wikipedia.org/wiki/Changes_(David_Bowie_song))
2017-08-30 08:17:06 +02:00
* [2] https://w3c.github.io/IntersectionObserver/
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [3] https://bugzilla.mozilla.org/1243846 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.IntersectionObserver.enabled", false);
2427: js shared memory MZ are flipping and a flopping on the value for a while now, lets enforce as false, specially since Spectre
2018-01-29 14:35:20 +01:00
/* 2427: disable Shared Memory (Spectre mitigation)
* [1] https://github.com/tc39/ecmascript_sharedmem/blob/master/TUTORIAL.md
* [2] https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ ***/
user_pref("javascript.options.shared_memory", false);
enforce DOMHighResTimeStamp API #491 flipped true in FF54: https://bugzilla.mozilla.org/show_bug.cgi?id=1026804 but unsure when the pref itself was introduced. note: other timing prefs were always in 2400's see 4602: [2411] disable resource/navigation timing / 4603: [2412] disable timing attacks
2018-12-04 11:34:02 +01:00
/* 2428: enforce DOMHighResTimeStamp API
* [WARNING] Required for normalization of timestamps and any timer resolution mitigations ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("dom.event.highrestimestamp.enabled", true); // [DEFAULT: true]
some more 65+ diffs, #610
2019-02-07 14:41:15 +01:00
/* 2429: enable (limited but sufficient) window.opener protection [FF65+]
* Makes rel=noopener implicit for target=_blank in anchor and area elements when no rel attribute is set ***/
user_pref("dom.targetBlankNoOpener.enabled", true);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 2500]: HARDWARE FINGERPRINTING ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "2500 syntax error: the parrot's shuffled off 'is mortal coil!");
move dom.battery.enabled back to 2500 from 9999 (#486) * move dom.battery.enabled back to 2500 from 9999 * make it inactive, clear out old links
2018-08-15 21:04:25 +02:00
/* 2502: disable Battery Status API
* Initially a Linux issue (high precision readout) that was fixed.
* However, it is still another metric for fingerprinting, used to raise entropy.
* e.g. do you have a battery or not, current charging status, charge level, times remaining etc
* [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code. see [1]
* [1] https://bugzilla.mozilla.org/1313580 ***/
// user_pref("dom.battery.enabled", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 2504: disable virtual reality devices
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* Optional protection depending on your connected devices
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/API/WebVR_API ***/
2500s: 4 h/w prefs=>inactive #237
2017-09-15 19:26:07 +02:00
// user_pref("dom.vr.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2505: disable media device enumeration [FF29+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [NOTE] media.peerconnection.enabled should also be set to false (see 2001)
* [1] https://wiki.mozilla.org/Media/getUserMedia
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/enumerateDevices ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.navigator.enabled", false);
/* 2508: disable hardware acceleration to reduce graphics fingerprinting
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-PERF] Affects text rendering (fonts will look different), impacts video performance,
2508: hardware acceleration #244 I guess we can revisit this when Tor ESR59 lands or even later when WebRender is fully implemented. For now, users can override it if they wish
2017-12-08 12:56:53 +01:00
* and parts of Quantum that utilize the GPU will also be affected as they are rolled out
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [SETTING] General>Performance>Custom>Use hardware acceleration when available
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://wiki.mozilla.org/Platform/GFX/HardwareAcceleration ***/
2508: gfx h/w #244 - In FF55 (windows) this no longer changes both prefs, only `layers.acceleration.disabled` - `gfx.direct2d.disabled` => inactive (I do not think it is used much if at all anymore - do a DXR search)
2017-09-27 19:12:19 +02:00
// user_pref("gfx.direct2d.disabled", true); // [WINDOWS]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("layers.acceleration.disabled", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2510: disable Web Audio API [FF51+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1288359 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.webaudio.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2517: disable Media Capabilities API [FF63+]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-PERF] This *may* affect media performance if disabled, no one is sure
2517 Media Capabilities => inactive see https://github.com/ghacksuserjs/ghacks-user.js/commit/f214e4bc4e69af62a031323142b3645bd0bad340#comments
2018-11-13 16:11:01 +01:00
* [1] https://github.com/WICG/media-capabilities
* [2] https://wicg.github.io/media-capabilities/#security-privacy-considerations ***/
// user_pref("media.media-capabilities.enabled", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 2600]: MISCELLANEOUS ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!");
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
/* 2601: prevent accessibility services from accessing your browser [RESTART]
* [SETTING] Privacy & Security>Permissions>Prevent accessibility services from accessing your browser
* [1] https://support.mozilla.org/kb/accessibility-services ***/
user_pref("accessibility.force_disabled", 1);
/* 2602: disable sending additional analytics to web servers
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/API/Navigator/sendBeacon ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("beacon.enabled", false);
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
/* 2603: remove temp files opened with an external application
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/302433 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.helperApps.deleteTempFileOnExit", true);
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
/* 2604: disable page thumbnail collection
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* look in profile/thumbnails directory - you may want to clean that out ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF]
/* 2605: block web content in file processes [FF55+]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-WEB] You may want to disable this for corporate or developer environments
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
* [1] https://bugzilla.mozilla.org/1343184 ***/
user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
user_pref("browser.uitour.enabled", false);
user_pref("browser.uitour.url", "");
/* 2607: disable various developer tools in browser context
* [SETTING] Devtools>Advanced Settings>Enable browser chrome and add-on debugging toolboxes
* [1] https://github.com/pyllyukko/user.js/issues/179#issuecomment-246468676 ***/
user_pref("devtools.chrome.enabled", false);
taking out the garbage (#590)
2018-12-12 14:02:38 +01:00
/* 2608: disable WebIDE to prevent remote debugging and ADB extension download
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://trac.torproject.org/projects/tor/ticket/16222 ***/
user_pref("devtools.debugger.remote-enabled", false);
user_pref("devtools.webide.enabled", false);
all Deprecations + new ADB extension prefs (#587)
2018-12-11 17:07:28 +01:00
user_pref("devtools.webide.autoinstallADBExtension", false); // [FF64+]
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2609: disable MathML (Mathematical Markup Language) [FF51+]
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
* [TEST] http://browserspy.dk/mathml.php
* [1] https://bugzilla.mozilla.org/1173199 ***/
user_pref("mathml.disabled", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2610: disable in-content SVG (Scalable Vector Graphics) [FF53+]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-WEB] Expect breakage incl. youtube player controls. Best left for a "hardened" profile.
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
* [1] https://bugzilla.mozilla.org/1216893 ***/
// user_pref("svg.disabled", true);
/* 2611: disable middle mouse click opening links from clipboard
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://trac.torproject.org/projects/tor/ticket/10089
* [2] http://kb.mozillazine.org/Middlemouse.contentLoadURL ***/
user_pref("middlemouse.contentLoadURL", false);
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
/* 2614: limit HTTP redirects (this does not control redirects with HTML meta tags or JS)
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [NOTE] A low setting of 5 or under will probably break some sites (e.g. gmail logins)
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
* To control HTML Meta tag and JS redirects, use an extension. Default is 20 ***/
user_pref("network.http.redirection-limit", 10);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+]
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
* 0 (default) or 1=allow, 2=block
2615: s/cut keys: bug fix in 66+
2019-01-11 06:09:14 +01:00
* [NOTE] In FF65 and under, causes issues with delete and backspace keys (see 1445942)
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* [SETTING] to add site exceptions: Page Info>Permissions>Override Keyboard Shortcuts ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("permissions.default.shortcuts", 2);
/* 2616: remove special permissions for certain mozilla domains [FF35+]
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
* [1] resource://app/defaults/permissions ***/
user_pref("permissions.manager.defaultsUrl", "");
/* 2617: remove webchannel whitelist ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("webchannel.allowObject.urlWhitelist", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2618: disable exposure of system colors to CSS or canvas [FF44+]
update cookie settings info
2019-02-04 14:00:19 +01:00
* [NOTE] See second listed bug: may cause black on black for elements with undefined colors
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("ui.use_standins_for_native_colors", true); // [HIDDEN PREF]
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
/* 2619: enforce Punycode for Internationalized Domain Names to eliminate possible spoofing
2672 punycode tweak #368
2018-05-06 18:57:00 +02:00
* Firefox has *some* protections, but it is better to be safe than sorry. The downside: it will also
* display legitimate IDN's punycoded, which might be undesirable for users of non-latin alphabets
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com)
2672 punycode tweak #368
2018-05-06 18:57:00 +02:00
* [1] https://wiki.mozilla.org/IDN_Display_Algorithm
* [2] https://en.wikipedia.org/wiki/IDN_homograph_attack
* [3] CVE-2017-5383: https://www.mozilla.org/security/advisories/mfsa2017-02/
* [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.IDN_show_punycode", true);
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* 2620: enable Firefox's built-in PDF reader
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
* This setting controls if the option "Display in Firefox" in the above setting is available
* and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With")
* PROS: pdfjs is lightweight, open source, and as secure/vetted as any pdf reader out there (more than most)
* Exploits are rare (1 serious case in 4 yrs), treated seriously and patched quickly.
* It doesn't break "state separation" of browser content (by not sharing with OS, independent apps).
* It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk.
* CONS: You may prefer a different pdf reader for security reasons
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* CAVEAT: JS can still force a pdf to open in-browser by bundling its own code (rare)
* [SETTING] General>Applications>Portable Document Format (PDF) ***/
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
user_pref("pdfjs.disabled", false);
move shit around
2019-02-07 15:41:23 +01:00
/* 2621: disable links launching Windows Store on Windows 8/8.1/10 [WINDOWS]
* [1] https://www.ghacks.net/2016/03/25/block-firefox-chrome-windows-store/ ***/
user_pref("network.protocol-handler.external.ms-windows-store", false);
2672 punycode tweak #368
2018-05-06 18:57:00 +02:00
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
/** DOWNLOADS ***/
2600s numbering part1
2018-05-07 17:51:50 +02:00
/* 2650: discourage downloading to desktop (0=desktop 1=downloads 2=last used)
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
* [SETTING] To set your default "downloads": General>Downloads>Save files to ***/
user_pref("browser.download.folderList", 2);
nits (#423)
2018-05-16 18:31:28 +02:00
/* 2651: enforce user interaction for security by always asking the user where to download
remove [SETTING-ESR52] lines (#475)
2018-08-09 05:30:57 +02:00
* [SETTING] General>Downloads>Always ask you where to save files ***/
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
user_pref("browser.download.useDownloadDir", false);
2600s numbering part1
2018-05-07 17:51:50 +02:00
/* 2652: disable adding downloads to the system's "recent documents" list ***/
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
user_pref("browser.download.manager.addToRecentDocs", false);
2600s numbering part1
2018-05-07 17:51:50 +02:00
/* 2653: disable hiding mime types (Options>General>Applications) not associated with a plugin ***/
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
user_pref("browser.download.hide_plugins_without_extensions", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2654: disable "open with" in download dialog [FF50+]
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
* This is very useful to enable when the browser is sandboxed (e.g. via AppArmor)
* in such a way that it is forbidden to run external applications.
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-CHROME] This may interfere with some users' workflow or methods
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
* [1] https://bugzilla.mozilla.org/1281959 ***/
user_pref("browser.download.forbid_open_with", true);
2672 punycode tweak #368
2018-05-06 18:57:00 +02:00
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
/** EXTENSIONS ***/
2600s numbering part1
2018-05-07 17:51:50 +02:00
/* 2660: lock down allowed extension directories
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-CHROME] This will break extensions that do not use the default XPI directories
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
* [1] https://mike.kaply.com/2012/02/21/understanding-add-on-scopes/
* [1] archived: https://archive.is/DYjAM ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("extensions.enabledScopes", 1); // [HIDDEN PREF]
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
user_pref("extensions.autoDisableScopes", 15);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2662: disable webextension restrictions on certain mozilla domains (also see 4503) [FF60+]
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
// user_pref("extensions.webextensions.restrictedDomains", "");
2600s numbering part1
2018-05-07 17:51:50 +02:00
/* 2663: enable warning when websites try to install add-ons
remove [SETTING-ESR52] lines (#475)
2018-08-09 05:30:57 +02:00
* [SETTING] Privacy & Security>Permissions>Warn you when websites try to install add-ons ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("xpinstall.whitelist.required", true); // [DEFAULT: true]
2672 punycode tweak #368
2018-05-06 18:57:00 +02:00
2600: downloads + extensions regroup (#417) * 2600: downloads + extensions regroup * fixup
2018-05-05 20:14:57 +02:00
/** SECURITY ***/
2600s numbering part1
2018-05-07 17:51:50 +02:00
/* 2680: enable CSP (Content Security Policy)
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
* [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("security.csp.enable", true); // [DEFAULT: true]
2682: put correct version back https://github.com/ghacksuserjs/ghacks-user.js/commit/0a67cdec8bac0d2172a2ffbf92af4e093c8e8275#comments
2018-12-10 20:35:41 +01:00
/* 2682: enable CSP 1.1 experimental hash-source directive [FF29+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=855326,883975 ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("security.csp.experimentalEnabled", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2683: block top level window data: URIs [FF56+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1331351
2675: block top level data: URIs note: I changed `data://` to `data:` in section 4000's 1300671 description
2017-09-28 16:06:22 +02:00
* [2] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/
* [3] https://www.fxsitecompat.com/en-CA/docs/2017/data-url-navigations-on-top-level-window-will-be-blocked/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("security.data_uri.block_toplevel_data_uri_navigations", true); // [DEFAULT: true]
2600s numbering part1
2018-05-07 17:51:50 +02:00
/* 2684: enforce a security delay on some confirmation dialogs such as install, open/save
2600: security regroup (#416) * 2600: security regroup * fixup
2018-05-05 18:21:21 +02:00
* [1] http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox
* [2] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("security.dialog_enable_delay", 700);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 2700]: PERSISTENT STORAGE
2700: header info
2017-11-26 22:14:55 +01:00
Data SET by websites including
2700: header formatting
2017-11-26 22:22:55 +01:00
cookies : profile\cookies.sqlite
2700: header fiddling
2017-11-28 01:32:49 +01:00
localStorage : profile\webappsstore.sqlite
indexedDB : profile\storage\default
appCache : profile\OfflineCache
2303->2700s serviceWorker cache #235
2017-11-29 04:21:17 +01:00
serviceWorkers :
up date info on what cookies control #622
2019-01-30 11:23:42 +01:00
[NOTE] indexedDB and serviceWorkers are not available in Private Browsing Mode
[NOTE] Blocking cookies also blocks websites access to: localStorage (incl. sessionStorage),
indexedDB, sharedWorker, and serviceWorker (and therefore service worker cache and notifications)
If you set a site exception for cookies (either "Allow" or "Allow for Session") then they become
accessible to websites except shared/service workers where the cookie setting *must* be "Allow"
remove extra spaces
2018-08-28 09:57:21 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!");
2701 again
2019-02-04 14:26:19 +01:00
/* 2701: disable 3rd-party cookies and site-data
* 0=Accept cookies and site data (default), 1=(Block) All third-party cookies, 2=(Block) All cookies,
* 3=(Block) Cookies from unvisited sites, 4=(Block) Third-party trackers (FF63+)
capital letter after [note]
2019-02-04 14:41:56 +01:00
* [NOTE] Value 4 is tied to the Tracking Protection lists
update cookie settings info
2019-02-04 14:00:19 +01:00
* [NOTE] You can set exceptions under site permissions or use an extension
2701: refix setting
2019-02-04 14:28:29 +01:00
* [SETTING] Privacy & Security>Content Blocking>Custom>Choose what to block>Cookies ***/
change cookies from block all to allow 1st party (#477) * change cookies from block all to allow 1st party see https://github.com/ghacksuserjs/ghacks-user.js/issues/439 * and fixup readme as well
2018-08-15 07:56:40 +02:00
user_pref("network.cookie.cookieBehavior", 1);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2702: set third-party cookies (i.e ALL) (if enabled, see 2701) to session-only
2706->2702 merge: 3rd party cookies + sessionOnly
2018-01-18 08:26:49 +01:00
and (FF58+) set third-party non-secure (i.e HTTP) cookies to session-only
[NOTE] .sessionOnly overrides .nonsecureSessionOnly except when .sessionOnly=false and
.nonsecureSessionOnly=true. This allows you to keep HTTPS cookies, but session-only HTTP ones
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [1] https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/
* [2] http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly ***/
user_pref("network.cookie.thirdparty.sessionOnly", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.cookie.thirdparty.nonsecureSessionOnly", true); // [FF58+]
update cookie settings info
2019-02-04 14:00:19 +01:00
/* 2703: delete cookies and site data on close
2703 again - description needs to stay changed from just cookies since it also clears site data - keep the info about n days out of it, it's just messy (ESR users should be on version 60) - get the values correct (I mixed them up earlier) - fixup [setting] path - leave in one (of two) extra [notes] I previously added
2019-02-04 14:40:45 +01:00
* 0=keep until they expire (default), 2=keep until you close Firefox
update cookie settings info
2019-02-04 14:00:19 +01:00
* [NOTE] The setting below is disabled (but not changed) if you block all cookies (2701 = 2)
2703 again - description needs to stay changed from just cookies since it also clears site data - keep the info about n days out of it, it's just messy (ESR users should be on version 60) - get the values correct (I mixed them up earlier) - fixup [setting] path - leave in one (of two) extra [notes] I previously added
2019-02-04 14:40:45 +01:00
* [SETTING] Privacy & Security>Cookies and Site Data>Delete cookies and site data when Firefox is closed ***/
// user_pref("network.cookie.lifetimePolicy", 2);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2705: disable HTTP sites setting cookies with the "secure" directive [FF52+]
2700's section revamp #235
2017-12-27 08:13:41 +01:00
* [1] https://developer.mozilla.org/Firefox/Releases/52#HTTP ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.cookie.leave-secure-alone", true); // [DEFAULT: true]
/* 2706: enable support for same-site cookies [FF60+]
2706: same-site cookies
2018-05-04 18:08:20 +02:00
* [1] https://bugzilla.mozilla.org/795346
* [2] https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/
* [3] https://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("network.cookie.same-site.enabled", true); // [DEFAULT: true]
2700's section revamp #235
2017-12-27 08:13:41 +01:00
/* 2710: disable DOM (Document Object Model) Storage
infos about default values (#504) * more infos * add colons not all EOL comments for defaults start with `// default` (23). The common string is `default:` (27 incl. these ones) with or without preceding or trailing spaces
2018-09-13 00:17:56 +02:00
* [WARNING] This will break a LOT of sites' functionality AND extensions!
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* You are better off using an extension for more granular control ***/
// user_pref("dom.storage.enabled", false);
2720: enforce IDB=enabled
2018-08-17 09:50:33 +02:00
/* 2720: enforce IndexedDB (IDB) as enabled
* IDB is required for extensions and Firefox internals (even before FF63 in [1])
* To control *website* IDB data, control allowing cookies and service workers, or use
* Temporary Containers. To mitigate *website* IDB, FPI helps (4001), and/or sanitize
* on close (Offline Website Data, see 2800) or on-demand (Ctrl-Shift-Del), or automatically
grammar, case, etc, closes #594 thanks @Just-me-ghacks
2018-12-13 16:49:50 +01:00
* via an extension. Note that IDB currently cannot be sanitized by host.
2720: enforce IDB=enabled
2018-08-17 09:50:33 +02:00
* [1] https://blog.mozilla.org/addons/2018/08/03/new-backend-for-storage-local-api/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("dom.indexedDB.enabled", true); // [DEFAULT: true]
remove old information (#531) Pants said "We do not need to keep anything for ESR users. ESR users are on v60, and we have an archived 60 for them." This isn't even affecting ESR60 but only older versions.
2018-11-07 16:14:32 +01:00
/* 2730: disable offline cache ***/
2730 + 2750: Storage API + Offline Cache ESR52.x doesn't use the new site storage UI. FF61+ the issue is resolved, so let's enforce offline cache (2730) as false again
2018-07-05 12:16:20 +02:00
user_pref("browser.cache.offline.enable", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2730b: disable offline cache on insecure sites [FF60+]
2730b: disable appCache on insecure sites FF60+
2018-04-12 19:38:22 +02:00
* [1] https://blog.mozilla.org/security/2018/02/12/restricting-appcache-secure-contexts/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.cache.offline.insecure.enable", false); // [DEFAULT: false in FF62+]
2700's section revamp #235
2017-12-27 08:13:41 +01:00
/* 2731: enforce websites to ask to store data for offline use
various => 2700 section #235 section 2700 will get a revamp, so not worried about numbering for now. Slight header tweak until we revamp
2017-11-25 04:12:29 +01:00
* [1] https://support.mozilla.org/questions/1098540
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [2] https://bugzilla.mozilla.org/959985 ***/
various => 2700 section #235 section 2700 will get a revamp, so not worried about numbering for now. Slight header tweak until we revamp
2017-11-25 04:12:29 +01:00
user_pref("offline-apps.allow_by_default", false);
2700's section revamp #235
2017-12-27 08:13:41 +01:00
/* 2740: disable service workers cache and cache storage
* [1] https://w3c.github.io/ServiceWorker/#privacy ***/
user_pref("dom.caches.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2750: disable Storage API [FF51+]
2700's section revamp #235
2017-12-27 08:13:41 +01:00
* The API gives sites the ability to find out how much space they can use, how much
* they are already using, and even control whether or not they need to be alerted
* before the user agent disposes of site data in order to make room for other things.
* [1] https://developer.mozilla.org/docs/Web/API/StorageManager
* [2] https://developer.mozilla.org/docs/Web/API/Storage_API
* [3] https://blog.mozilla.org/l10n/2017/03/07/firefox-l10n-report-aurora-54/ ***/
2730 + 2750: Storage API + Offline Cache ESR52.x doesn't use the new site storage UI. FF61+ the issue is resolved, so let's enforce offline cache (2730) as false again
2018-07-05 12:16:20 +02:00
// user_pref("dom.storageManager.enabled", false);
storage access api
2019-01-31 17:03:39 +01:00
/* 2755: disable Storage Access API [FF65+]
* [1] https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API ***/
dom.storage_access.enabled regardless of this pref setting: the permissions.sqlite file will still be abused to store a flag for this for every single site you connect to (as third party?) - fun.
2019-02-01 14:41:00 +01:00
// user_pref("dom.storage_access.enabled", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 2800]: SHUTDOWN [SETUP-CHROME]
change cookies from block all to allow 1st party (#477) * change cookies from block all to allow 1st party see https://github.com/ghacksuserjs/ghacks-user.js/issues/439 * and fixup readme as well
2018-08-15 07:56:40 +02:00
You should set the values to what suits you best.
2800 section header info
2018-04-04 12:21:40 +02:00
- "Offline Website Data" includes appCache (2730), localStorage (2710),
Service Worker cache (2740), and QuotaManager (IndexedDB (2720), asm-cache)
- In both 2803 + 2804, the 'download' and 'history' prefs are combined in the
Firefox interface as "Browsing & Download History" and their values will be synced
remove extra spaces
2018-08-28 09:57:21 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* 2802: enable Firefox to clear history items on shutdown
update [SETTING] info (#538)
2018-11-19 00:56:12 +01:00
* [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("privacy.sanitize.sanitizeOnShutdown", true);
/* 2803: set what history items to clear on shutdown
* [NOTE] If 'history' is true, downloads will also be cleared regardless of the value
* but if 'history' is false, downloads can still be cleared independently
* However, this may not always be the case. The interface combines and syncs these
make description & info & notes concurrent #574
2018-12-07 16:10:13 +01:00
* prefs when set from there, and the sanitize code may change at any time
* [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes>Settings ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("privacy.clearOnShutdown.cache", true);
change cookies from block all to allow 1st party (#477) * change cookies from block all to allow 1st party see https://github.com/ghacksuserjs/ghacks-user.js/issues/439 * and fixup readme as well
2018-08-15 07:56:40 +02:00
user_pref("privacy.clearOnShutdown.cookies", true);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("privacy.clearOnShutdown.downloads", true); // see note above
user_pref("privacy.clearOnShutdown.formdata", true); // Form & Search History
user_pref("privacy.clearOnShutdown.history", true); // Browsing & Download History
user_pref("privacy.clearOnShutdown.offlineApps", true); // Offline Website Data
user_pref("privacy.clearOnShutdown.sessions", true); // Active Logins
user_pref("privacy.clearOnShutdown.siteSettings", false); // Site Preferences
references to other prefs s/be explicit
2018-12-21 12:02:40 +01:00
/* 2804: reset default history items to clear with Ctrl-Shift-Del (to match 2803)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* This dialog can also be accessed from the menu History>Clear Recent History
2804: clarify Clear Recent History #237
2017-09-18 19:22:25 +02:00
* Firefox remembers your last choices. This will reset them when you start Firefox.
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [NOTE] Regardless of what you set privacy.cpd.downloads to, as soon as the dialog
* for "Clear Recent History" is opened, it is synced to the same as 'history' ***/
user_pref("privacy.cpd.cache", true);
change cookies from block all to allow 1st party (#477) * change cookies from block all to allow 1st party see https://github.com/ghacksuserjs/ghacks-user.js/issues/439 * and fixup readme as well
2018-08-15 07:56:40 +02:00
user_pref("privacy.cpd.cookies", true);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("privacy.cpd.downloads", true); // not used, see note above
user_pref("privacy.cpd.formdata", true); // Form & Search History
user_pref("privacy.cpd.history", true); // Browsing & Download History
user_pref("privacy.cpd.offlineApps", true); // Offline Website Data
user_pref("privacy.cpd.passwords", false); // this is not listed
user_pref("privacy.cpd.sessions", true); // Active Logins
user_pref("privacy.cpd.siteSettings", false); // Site Preferences
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 2805: privacy.*.openWindows (clear session restore data) [FF34+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* [NOTE] There is a years-old bug that these cause two windows when Firefox restarts.
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
* You do not need these anyway if session restore is cleared with history (see 2803) ***/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("privacy.clearOnShutdown.openWindows", true);
// user_pref("privacy.cpd.openWindows", true);
/* 2806: reset default 'Time range to clear' for 'Clear Recent History' (see 2804)
* Firefox remembers your last choice. This will reset the value when you start Firefox.
nits
2017-07-28 21:15:25 +02:00
* 0=everything, 1=last hour, 2=last two hours, 3=last four hours,
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
* 4=today, 5=last five minutes, 6=last twenty-four hours
* [NOTE] The values 5 + 6 are not listed in the dropdown, which will display a
* blank value if they are used, but they do work as advertised ***/
user_pref("privacy.sanitize.timeSpan", 0);
section naming convention consistency
2018-12-04 09:27:52 +01:00
/*** [SECTION 4000]: FPI (FIRST PARTY ISOLATION)
4000: FPI indexedDB info
2018-03-28 01:03:53 +02:00
** 1278037 - isolate indexedDB (FF51+)
2698 FPI -> 4000s
2017-09-14 05:25:32 +02:00
** 1277803 - isolate favicons (FF52+)
** 1264562 - isolate OCSP cache (FF52+)
** 1268726 - isolate Shared Workers (FF52+)
** 1316283 - isolate SSL session cache (FF52+)
** 1317927 - isolate media cache (FF53+)
** 1323644 - isolate HSTS and HPKP (FF54+)
** 1334690 - isolate HTTP Alternative Services (FF54+)
** 1334693 - isolate SPDY/HTTP2 (FF55+)
** 1337893 - isolate DNS cache (FF55+)
** 1344170 - isolate blob: URI (FF55+)
2675: block top level data: URIs note: I changed `data://` to `data:` in section 4000's 1300671 description
2017-09-28 16:06:22 +02:00
** 1300671 - isolate data:, about: URLs (FF55+)
FPI & IP addresses FF63+
2018-07-17 04:58:51 +02:00
** 1473247 - isolate IP addresses (FF63+)
FPI: isolate postMessage...
2018-10-28 17:46:22 +01:00
** 1492607 - isolate postMessage with targetOrigin "*" (requires 4002) (FF65+)
2698 FPI -> 4000s
2017-09-14 05:25:32 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 4001: enable First Party Isolation [FF51+]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-WEB] May break cross-domain logins and site functionality until perfected
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1260931 ***/
2698 FPI -> 4000s
2017-09-14 05:25:32 +02:00
user_pref("privacy.firstparty.isolate", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 4002: enforce FPI restriction for window.opener [FF54+]
2698 FPI -> 4000s
2017-09-14 05:25:32 +02:00
* [NOTE] Setting this to false may reduce the breakage in 4001
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
* FF65+ blocks postMessage with targetOrigin "*" if originAttributes don't match. But
FPI: isolate postMessage...
2018-10-28 17:46:22 +01:00
* to reduce breakage it ignores the 1st-party domain (FPD) originAttribute. (see [2],[3])
* The 2nd pref removes that limitation and will only allow communication if FPDs also match.
* [1] https://bugzilla.mozilla.org/1319773#c22
* [2] https://bugzilla.mozilla.org/1492607
* [3] https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("privacy.firstparty.isolate.restrict_opener_access", true); // [DEFAULT: true]
// user_pref("privacy.firstparty.isolate.block_post_message", true); // [HIDDEN PREF]
2698 FPI -> 4000s
2017-09-14 05:25:32 +02:00
section naming convention consistency
2018-12-04 09:27:52 +01:00
/*** [SECTION 4500]: RFP (RESIST FINGERPRINTING)
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
This master switch will be used for a wide range of items, many of which will
**override** existing prefs from FF55+, often providing a **better** solution
IMPORTANT: As existing prefs become redundant, and some of them WILL interfere
with how RFP works, they will be moved to section 4600 and made inactive
** 418986 - limit window.screen & CSS media queries leaking identifiable info (FF41+)
[POC] http://ip-check.info/?lang=en (screen, usable screen, and browser window will match)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
[NOTE] Does not cover everything yet - https://bugzilla.mozilla.org/1216800
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
[NOTE] This will probably make your values pretty unique until you resize or snap the
inner window width + height into standard/common resolutions (such as 1366x768)
To set a size, open a XUL (chrome) page (such as about:config) which is at 100% zoom, hit
Shift+F4 to open the scratchpad, type window.resizeTo(1366,768), hit Ctrl+R to run. Test
your window size, do some math, resize to allow for all the non inner window elements
[TEST] http://browserspy.dk/screen.php
** 1281949 - spoof screen orientation (FF50+)
** 1281963 - hide the contents of navigator.plugins and navigator.mimeTypes (FF50+)
4500: RFP info on plugins/mimetypes
2018-04-10 19:25:23 +02:00
FF53: Fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray (1324044)
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
** 1330890 - spoof timezone as UTC 0 (FF55+)
4500 RFP stuff
2018-02-27 12:31:03 +01:00
FF58: Date.toLocaleFormat deprecated (818634)
FF60: Date.toLocaleDateString and Intl.DateTimeFormat fixed (1409973)
4600: redundant prefs FF55 due to RFP
2017-09-14 07:43:24 +02:00
** 1360039 - spoof navigator.hardwareConcurrency as 2 (see 4601) (FF55+)
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
This spoof *shouldn't* affect core chrome/Firefox performance
** 1217238 - reduce precision of time exposed by javascript (FF55+)
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
** 1369303 - spoof/disable performance API (see 2410-deprecated, 4602, 4603) (FF56+)
4500: RFP UA spoof stuff Cleaning up the UA spoof stuff in the sticky, as a ticket was just closed (52 is now a temporary hard-coded value: 1418672 - I guess they're running out of time), so also cleaning up the info, and consistent layout Two issues: The code to determine the ESR number is out of whack (by one) since the next ESR is 60. 59 stable is almost here. So they have decided to hard-code the value as 52, for now. The second issue is that Aurora/Nightly are ahead of stable/ESR and can thus unmask themselves as Aurora/Nightly. The hard-coded value for now also solves this. If you follow the sticky for RFP, you will see there is a ticket for using the update channel information (eg stable, beta, dev, nightly etc) to determine when and how calculate the version spoof in future, and they'll also rejig the numbering algorithm to account for ESR being out by one. These are tickets https://bugzilla.mozilla.org/show_bug.cgi?id=1418162 and https://bugzilla.mozilla.org/show_bug.cgi?id=1428111
2018-02-28 13:10:05 +01:00
** 1333651 & 1383495 & 1396468 - spoof Navigator API (see section 4700) (FF56+)
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
FF56: The version number will be rounded down to the nearest multiple of 10
RFP: UA spoof is now 60+8's
2019-02-07 16:14:08 +01:00
FF57: The version number will match current ESR (1393283, 1418672, 1418162, 1511763)
4500: RFP UA spoof stuff Cleaning up the UA spoof stuff in the sticky, as a ticket was just closed (52 is now a temporary hard-coded value: 1418672 - I guess they're running out of time), so also cleaning up the info, and consistent layout Two issues: The code to determine the ESR number is out of whack (by one) since the next ESR is 60. 59 stable is almost here. So they have decided to hard-code the value as 52, for now. The second issue is that Aurora/Nightly are ahead of stable/ESR and can thus unmask themselves as Aurora/Nightly. The hard-coded value for now also solves this. If you follow the sticky for RFP, you will see there is a ticket for using the update channel information (eg stable, beta, dev, nightly etc) to determine when and how calculate the version spoof in future, and they'll also rejig the numbering algorithm to account for ESR being out by one. These are tickets https://bugzilla.mozilla.org/show_bug.cgi?id=1418162 and https://bugzilla.mozilla.org/show_bug.cgi?id=1428111
2018-02-28 13:10:05 +01:00
FF59: The OS will be reported as Windows, OSX, Android, or Linux (to reduce breakage) (1404608)
RFP: FF66 changes to UA HTTP Headers
2019-01-11 06:14:59 +01:00
FF66: The OS in HTTP Headers will be reduced to Windows or Android (1509829)
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
** 1369319 - disable device sensor API (see 4604) (FF56+)
** 1369357 - disable site specific zoom (see 4605) (FF56+)
** 1337161 - hide gamepads from content (see 4606) (FF56+)
** 1372072 - spoof network information API as "unknown" (see 4607) (FF56+)
** 1333641 - reduce fingerprinting in WebSpeech API (see 4608) (FF56+)
there is no spoon
2018-11-20 19:14:23 +01:00
** 1372069 & 1403813 & 1441295 - block geolocation requests (same as denying a site permission) (see 0201, 0201b) (FF56-62)
4600: redundant prefs due to RFP
2017-11-20 13:49:19 +01:00
** 1369309 - spoof media statistics (see 4610) (FF57+)
** 1382499 - reduce screen co-ordinate fingerprinting in Touch API (see 4611) (FF57+)
4500: RFP WebGL stuff
2018-02-28 13:19:36 +01:00
** 1217290 & 1409677 - enable fingerprinting resistance for WebGL (see 2010-12) (FF57+)
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
** 1382545 - reduce fingerprinting in Animation API (FF57+)
** 1354633 - limit MediaError.message to a whitelist (FF57+)
remove 2513: Presentaion API fixes #325
2018-01-29 15:37:36 +01:00
** 1382533 - enable fingerprinting resistance for Presentation API (FF57+)
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
This blocks exposure of local IP Addresses via mDNS (Multicast DNS)
4500: canvas extraction 967895
2017-10-28 18:11:43 +02:00
** 967895 - enable site permission prompt before allowing canvas data extraction (FF58+)
4500: RFP canvas 1376865 was back ported to 59, so canvas prompt fatigue will be reduced. Note: the default for non-prompts is the same as if you clicked "Don't Allow" - i.e it serves up a 10x10px white square
2018-03-01 05:32:12 +01:00
FF59: Added to site permissions panel (1413780) Only prompt when triggered by user input (1376865)
59 RFP Alternatives
2018-03-13 20:26:39 +01:00
** 1372073 - spoof/block fingerprinting in MediaDevices API (see 4612) (FF59+)
4500: RFP warn if language set to non en-US fixes #304
2017-12-15 17:21:08 +01:00
** 1039069 - warn when language prefs are set to non en-US (see 0207, 0208) (FF59+)
RFP: CTRL key fix backported to 59.0.2
2018-03-27 19:03:36 +02:00
** 1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59+)
4500: RFP keyboard events FF59+
2018-01-18 03:55:57 +01:00
Spoofing mimics the content language of the document. Currently it only supports en-US.
RFP: CTRL key fix backported to 59.0.2
2018-03-27 19:03:36 +02:00
Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected.
FF60: Fix keydown/keyup events (1438795)
4500s: RFP disable WebGL debug renderer info (60+)
2018-05-04 19:23:26 +02:00
** 1337157 - disable WebGL debug renderer info (see 4613) (FF60+)
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
** 1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62+)
pointer events -> RFP ALTS
2019-02-01 14:53:04 +01:00
** 1363508 - spoof/suppress Pointer Events (see 4614) (FF64+)
RFP: pointerEvent.pointerid
2018-11-20 18:36:04 +01:00
FF65: pointerEvent.pointerid (1492766)
RFP 67+
2019-02-06 17:59:28 +01:00
** 1485266 - disable exposure of system colors to CSS or canvas (see 2618) (FF67+)
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
/* 4501: enable privacy.resistFingerprinting [FF41+]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
* [SETUP-WEB] RFP is not ready for the masses, so expect some website breakage
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/418986 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("privacy.resistFingerprinting", true);
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
/* 4502: set new window sizes to round to hundreds [FF55+] [SETUP-CHROME]
* Width will round down to multiples of 200s and height to 100s, to fit your screen.
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
* The override values are a starting point to round from if you want some control
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
* [1] https://bugzilla.mozilla.org/1330882
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
* [2] https://hardware.metrics.mozilla.com/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("privacy.window.maxInnerWidth", 1600); // [HIDDEN PREF]
// user_pref("privacy.window.maxInnerHeight", 900); // [HIDDEN PREF]
/* 4503: disable mozAddonManager Web API [FF57+]
4503 mozAddonManager => active
2018-05-04 23:18:45 +02:00
* [NOTE] As a side-effect in FF57-59 this allowed extensions to work on AMO. In FF60+ you also need
2600s numbering part1
2018-05-07 17:51:50 +02:00
* to sanitize or clear extensions.webextensions.restrictedDomains (see 2662) to keep that side-effect
4503 mozAddonManager => active
2018-05-04 23:18:45 +02:00
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // [HIDDEN PREF]
/* 4504: disable showing about:blank as soon as possible during startup [FF60+]
4503: add bugzilla
2018-09-09 22:43:56 +02:00
* When default true (FF62+) this no longer masks the RFP resizing activity
* [1] https://bugzilla.mozilla.org/1448423 ***/
4504: browser.startup.blankWindow
2018-09-08 19:23:48 +02:00
user_pref("browser.startup.blankWindow", false);
2699 RFP -> 4500s
2017-09-14 05:57:42 +02:00
section naming convention consistency
2018-12-04 09:27:52 +01:00
/*** [SECTION 4600]: RFP ALTERNATIVES
create 4600s: RFP alternatives
2017-09-14 07:28:52 +02:00
* IF you DO use RFP (see 4500) then you DO NOT need these redundant prefs. In fact,
some even cause RFP to not behave as you would expect and alter your fingerprint.
Make sure they are RESET in about:config as per your Firefox version
4600: redundant prefs FF55 due to RFP
2017-09-14 07:43:24 +02:00
* IF you DO NOT use RFP or are on ESR... then turn on each ESR section below
create 4600s: RFP alternatives
2017-09-14 07:28:52 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan");
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
/* [SETUP-non-RFP] Non-RFP users replace the * with a slash on this line to enable these
4600: redundant prefs FF55 due to RFP
2017-09-14 07:43:24 +02:00
// FF55+
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 4601: [2514] spoof (or limit?) number of CPU cores [FF48+]
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
// [NOTE] *may* affect core chrome/Firefox performance, will affect content.
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [1] https://bugzilla.mozilla.org/1008453
4600: redundant prefs FF55 due to RFP
2017-09-14 07:43:24 +02:00
// [2] https://trac.torproject.org/projects/tor/ticket/21675
// [3] https://trac.torproject.org/projects/tor/ticket/22127
// [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency
4601: => inactive Are the possible/unknown downsides of this one FP measure really worth it for ESR users? - see earthlng
2017-09-15 08:39:43 +02:00
// user_pref("dom.maxHardwareConcurrency", 2);
create 4600s: RFP alternatives
2017-09-14 07:28:52 +02:00
// * * * /
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
// FF56+
4600s: add ref to old numbers
2017-10-06 10:44:19 +02:00
// 4602: [2411] disable resource/navigation timing
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
user_pref("dom.enable_resource_timing", false);
4600s: add ref to old numbers
2017-10-06 10:44:19 +02:00
// 4603: [2412] disable timing attacks
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
// [1] https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI
user_pref("dom.enable_performance", false);
4600s: add ref to old numbers
2017-10-06 10:44:19 +02:00
// 4604: [2512] disable device sensor API
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
// Optional protection depending on your device
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
// [1] https://trac.torproject.org/projects/tor/ticket/15758
// [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
// user_pref("device.sensors.enabled", false);
4600s: add ref to old numbers
2017-10-06 10:44:19 +02:00
// 4605: [2515] disable site specific zoom
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
// Zoom levels affect screen res and are highly fingerprintable. This does not stop you using
// zoom, it will just not use/remember any site specific settings. Zoom levels on new tabs
// and new windows are reset to default and only the current tab retains the current zoom
user_pref("browser.zoom.siteSpecific", false);
4600s: add ref to old numbers
2017-10-06 10:44:19 +02:00
// 4606: [2501] disable gamepad API - USB device ID enumeration
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
// Optional protection depending on your connected devices
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
// [1] https://trac.torproject.org/projects/tor/ticket/13023
// user_pref("dom.gamepad.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 4607: [2503] disable giving away network info [FF31+]
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
// e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none
// [1] https://developer.mozilla.org/docs/Web/API/Network_Information_API
// [2] https://wicg.github.io/netinfo/
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [3] https://bugzilla.mozilla.org/960426
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
user_pref("dom.netinfo.enabled", false);
typo used to be 2021 not 2012, see https://github.com/ghacksuserjs/ghacks-user.js/commit/908a8d66f4987568fc76649a7f47e8f61f8588f2
2017-11-16 06:46:35 +01:00
// 4608: [2021] disable the SpeechSynthesis (Text-to-Speech) part of the Web Speech API
4608 - remove media.webspeech.recognition.enable the 2nd part of the Web Speech API, SpeechRecognition, is not yet implemented on Desktop Firefox: https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition#Browser_compatibility > * [2] Can be enabled via the `media.webspeech.recognition.enable` flag in about:config **on mobile**. **Not implemented at all on Desktop Firefox** — see [bug 1248897](https://bugzilla.mozilla.org/show_bug.cgi?id=1248897).
2017-10-03 17:00:11 +02:00
// [1] https://developer.mozilla.org/docs/Web/API/Web_Speech_API
4600: redundant prefs FF55 due to RFP [Part1]
2017-09-30 09:15:41 +02:00
// [2] https://developer.mozilla.org/docs/Web/API/SpeechSynthesis
// [3] https://wiki.mozilla.org/HTML5_Speech_API
user_pref("media.webspeech.synth.enabled", false);
// * * * /
4600: redundant prefs due to RFP
2017-11-20 13:49:19 +01:00
// FF57+
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 4610: [2506] disable video statistics - JS performance fingerprinting [FF25+]
4600: redundant prefs due to RFP
2017-11-20 13:49:19 +01:00
// [1] https://trac.torproject.org/projects/tor/ticket/15757
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [2] https://bugzilla.mozilla.org/654550
4600: redundant prefs due to RFP
2017-11-20 13:49:19 +01:00
user_pref("media.video_stats.enabled", false);
// 4611: [2509] disable touch events
// fingerprinting attack vector - leaks screen res & actual screen coordinates
// 0=disabled, 1=enabled, 2=autodetect
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
// Optional protection depending on your device
4600: redundant prefs due to RFP
2017-11-20 13:49:19 +01:00
// [1] https://developer.mozilla.org/docs/Web/API/Touch_events
// [2] https://trac.torproject.org/projects/tor/ticket/10286
// user_pref("dom.w3c_touch_events.enabled", 0);
// * * * /
59 RFP Alternatives
2018-03-13 20:26:39 +01:00
// FF59+
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 4612: [2511] disable MediaDevices change detection [FF51+]
59 RFP Alternatives
2018-03-13 20:26:39 +01:00
// [1] https://developer.mozilla.org/docs/Web/Events/devicechange
// [2] https://developer.mozilla.org/docs/Web/API/MediaDevices/ondevicechange
user_pref("media.ondevicechange.enabled", false);
// * * * /
60 RFP Alternatives
2018-05-04 19:11:34 +02:00
// FF60+
// 4613: [2011] disable WebGL debug info being available to websites
// [1] https://bugzilla.mozilla.org/1171228
// [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info
user_pref("webgl.enable-debug-renderer-info", false);
// * * * /
pointer events -> RFP ALTS
2019-02-01 14:53:04 +01:00
// FF65+
// 4614: [2516] disable PointerEvents
// [1] https://developer.mozilla.org/en-US/docs/Web/API/PointerEvent
user_pref("dom.w3c_pointer_events.enabled", false);
// * * * /
create 4600s: RFP alternatives
2017-09-14 07:28:52 +02:00
// ***/
section naming convention consistency
2018-12-04 09:27:52 +01:00
/*** [SECTION 4700]: RFP ALTERNATIVES (NAVIGATOR / USER AGENT (UA) SPOOFING)
4700: revamp, closes #485
2018-08-17 11:09:01 +02:00
This is FYI ONLY. These prefs are INSUFFICIENT(a) on their own, you need
to use RFP (4500) or an extension, in which case they become POINTLESS.
(a) Many of the components that make up your UA can be derived by other means.
And when those values differ, you provide more bits and raise entropy.
Examples of leaks include navigator objects, date locale/formats, iframes,
headers, tcp/ip attributes, feature detection, and **many** more.
ALL values below intentionally left blank - use RFP, or get a vetted, tested
extension and mimic RFP values to *lower* entropy, or randomize to *raise* it
2697 spoofing -> 4700s
2017-09-14 07:00:55 +02:00
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow");
4700: revamp, closes #485
2018-08-17 11:09:01 +02:00
/* 4701: navigator.userAgent ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("general.useragent.override", ""); // [HIDDEN PREF]
4702: buildID cleanup, closes 518
2018-10-24 12:15:37 +02:00
/* 4702: navigator.buildID
* Revealed build time down to the second. In FF64+ it now returns a fixed timestamp
* [1] https://bugzilla.mozilla.org/583181
* [2] https://www.fxsitecompat.com/en-CA/docs/2018/navigator-buildid-now-returns-a-fixed-timestamp/ ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("general.buildID.override", ""); // [HIDDEN PREF]
2697 spoofing -> 4700s
2017-09-14 07:00:55 +02:00
/* 4703: navigator.appName ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("general.appname.override", ""); // [HIDDEN PREF]
2697 spoofing -> 4700s
2017-09-14 07:00:55 +02:00
/* 4704: navigator.appVersion ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("general.appversion.override", ""); // [HIDDEN PREF]
4700: revamp, closes #485
2018-08-17 11:09:01 +02:00
/* 4705: navigator.platform ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("general.platform.override", ""); // [HIDDEN PREF]
4700: revamp, closes #485
2018-08-17 11:09:01 +02:00
/* 4706: navigator.oscpu ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("general.oscpu.override", ""); // [HIDDEN PREF]
2697 spoofing -> 4700s
2017-09-14 07:00:55 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 5000]: PERSONAL
revamp 5000 fixes #360
2018-03-02 04:53:39 +01:00
Non-project related but useful. If any of these interest you, add them to your overrides ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
0101 welcomes+whatsnew -> 5000s #434
2018-05-29 04:25:54 +02:00
/* WELCOME & WHAT's NEW NOTICES ***/
// user_pref("browser.startup.homepage_override.mstone", "ignore"); // master switch
// user_pref("startup.homepage_welcome_url", "");
// user_pref("startup.homepage_welcome_url.additional", "");
// user_pref("startup.homepage_override_url", ""); // What's New page after updates
revamp 5000 fixes #360
2018-03-02 04:53:39 +01:00
/* WARNINGS ***/
// user_pref("browser.tabs.warnOnClose", false);
// user_pref("browser.tabs.warnOnCloseOtherTabs", false);
// user_pref("browser.tabs.warnOnOpen", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("full-screen-api.warning.delay", 0);
// user_pref("full-screen-api.warning.timeout", 0);
move 0000 to personal #567 it has zero to do with privacy etc, and in fact most users will only ever encounter it once (and check the box) when they first go to about:config, so it's not even useful as an override or a new profile IMO. This removes one of three numbers that don't have a section
2018-12-04 09:34:36 +01:00
// user_pref("general.warnOnAboutConfig", false);
revamp 5000 fixes #360
2018-03-02 04:53:39 +01:00
/* APPEARANCE ***/
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("browser.download.autohideButton", false); // [FF57+]
// user_pref("toolkit.cosmeticAnimations.enabled", false); // [FF55+]
revamp 5000 fixes #360
2018-03-02 04:53:39 +01:00
/* CONTENT BEHAVIOR ***/
// user_pref("accessibility.typeaheadfind", true); // enable "Find As You Type"
// user_pref("clipboard.autocopy", false); // disable autocopy default [LINUX]
// user_pref("layout.spellcheckDefault", 2); // 0=none, 1-multi-line, 2=multi-line & single-line
/* UX BEHAVIOR ***/
// user_pref("browser.backspace_action", 2); // 0=previous page, 1=scroll up, 2=do nothing
// user_pref("browser.tabs.closeWindowWithLastTab", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("browser.tabs.loadBookmarksInTabs", true); // open bookmarks in a new tab [FF57+]
grammar, case, etc, closes #594 thanks @Just-me-ghacks
2018-12-13 16:49:50 +01:00
// user_pref("browser.urlbar.decodeURLsOnCopy", true); // see bugzilla 1320061 [FF53+]
revamp 5000 fixes #360
2018-03-02 04:53:39 +01:00
// user_pref("general.autoScroll", false); // middle-click enabling auto-scrolling [WINDOWS] [MAC]
5000s: ui.key.menuAccessKey
2018-04-29 21:21:58 +02:00
// user_pref("ui.key.menuAccessKey", 0); // disable alt key toggling the menu bar [RESTART]
revamp 5000 fixes #360
2018-03-02 04:53:39 +01:00
/* OTHER ***/
// user_pref("browser.bookmarks.max_backups", 2);
dyslexia and/or dementia
2018-12-12 17:52:12 +01:00
// user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr", false); // disable CFR [FF64+]
5000s: disable CFR
2018-12-12 17:34:27 +01:00
// [SETTING] General>Browsing>Recommend extensions as you browse
// [1] https://support.mozilla.org/en-US/kb/extension-recommendations
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("identity.fxaccounts.enabled", false); // disable and hide Firefox Accounts and Sync [FF60+] [RESTART]
grammar, case, etc, closes #594 thanks @Just-me-ghacks
2018-12-13 16:49:50 +01:00
// user_pref("network.manage-offline-status", false); // see bugzilla 620472
revamp 5000 fixes #360
2018-03-02 04:53:39 +01:00
// user_pref("reader.parse-on-load.enabled", false); // "Reader View"
// user_pref("xpinstall.signatures.required", false); // enforced extension signing (Nightly/ESR)
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
tag sections #567
2018-12-04 08:03:19 +01:00
/*** [SECTION 9999]: DEPRECATED / REMOVED / LEGACY / RENAMED
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
Documentation denoted as [-]. Numbers may be re-used. See [1] for a link-clickable,
9999 - tweak for JS-comment re-grouping for ESR
2017-08-10 13:28:03 +02:00
viewer-friendly version of the deprecated bugzilla tickets. The original state of each pref
has been preserved, or changed to match the current setup, but you are advised to review them.
[NOTE] Up to FF53, to enable a section change /* FFxx to // FFxx
For FF53 on, we have bundled releases to cater for ESR. Change /* to // on the first line
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
[1] https://github.com/ghacksuserjs/ghacks-user.js/issues/123
***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
/* FF42 and older
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
// 2604: (25+) disable page thumbnails - replaced by browser.pagethumbnails.capturing_disabled
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/897811
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("pageThumbs.enabled", false);
// 2503: (31+) disable network API - replaced by dom.netinfo.enabled
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/960426
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.network.enabled", false);
nits (#423)
2018-05-16 18:31:28 +02:00
// 2600's: (35+) disable WebSockets
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1091016
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.websocket.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 1610: (36+) set DNT "value" to "not be tracked" [FF21+]
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// [1] http://kb.mozillazine.org/Privacy.donottrackheader.value
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1042135#c101
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("privacy.donottrackheader.value", 1);
// 2023: (37+) disable camera autofocus callback
spelling mistake
2018-02-08 16:33:05 +01:00
// The API will be superseded by the WebRTC Capture and Stream API
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
// [1] https://developer.mozilla.org/docs/Archive/B2G_OS/API/CameraControl
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1107683
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("camera.control.autofocus_moving_callback.enabled", false);
// 0415: (41+) disable reporting URLs (safe browsing) - removed or replaced by various
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1109475
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.safebrowsing.reportErrorURL", ""); // browser.safebrowsing.reportPhishMistakeURL
user_pref("browser.safebrowsing.reportGenericURL", ""); // removed
user_pref("browser.safebrowsing.reportMalwareErrorURL", ""); // browser.safebrowsing.reportMalwareMistakeURL
user_pref("browser.safebrowsing.reportMalwareURL", ""); // removed
user_pref("browser.safebrowsing.reportURL", ""); // removed
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
// 0702: (41+) disable HTTP2 (draft)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1132357
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
user_pref("network.http.spdy.enabled.http2draft", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// 1804: (41+) disable plugin enumeration
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1169945
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("plugins.enumerable_names", "");
// 2803: (42+) clear passwords on shutdown
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1102184
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("privacy.clearOnShutdown.passwords", false);
shove 3000s personal out to 5000s couple of number changes to get rid of alphabet soup: 3001a->5002, 3002->5003
2017-09-12 18:56:21 +02:00
// 5002: (42+) disable warning when a domain requests full screen
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// replaced by setting full-screen-api.warning.timeout to zero
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1160017
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("full-screen-api.approval-required", false);
// ***/
/* FF43
// 0410's: disable safebrowsing urls & updates - replaced by various
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1107372
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.safebrowsing.gethashURL", ""); // browser.safebrowsing.provider.google.gethashURL
// user_pref("browser.safebrowsing.updateURL", ""); // browser.safebrowsing.provider.google.updateURL
user_pref("browser.safebrowsing.malware.reportURL", ""); // browser.safebrowsing.provider.google.reportURL
// 0420's: disable tracking protection - replaced by various
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1107372
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.trackingprotection.gethashURL", ""); // browser.safebrowsing.provider.mozilla.gethashURL
// user_pref("browser.trackingprotection.updateURL", ""); // browser.safebrowsing.provider.mozilla.updateURL
// 1803: remove plugin finder service
// [1] http://kb.mozillazine.org/Pfs.datasource.url
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1202193
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("pfs.datasource.url", "");
shove 3000s personal out to 5000s couple of number changes to get rid of alphabet soup: 3001a->5002, 3002->5003
2017-09-12 18:56:21 +02:00
// 5003: disable new search panel UI
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1119250
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.search.showOneOffButtons", false);
// ***/
/* FF44
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0414: disable safebrowsing's real-time binary checking (google) [FF43+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1237103
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.safebrowsing.provider.google.appRepURL", ""); // browser.safebrowsing.appRepURL
// 1200's: block rc4 whitelist
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1215796
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("security.tls.insecure_fallback_hosts.use_static_list", false);
nits (#423)
2018-05-16 18:31:28 +02:00
// 2300's: disable SharedWorkers
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
// [1] https://trac.torproject.org/projects/tor/ticket/15562
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1207635
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.workers.sharedWorkers.enabled", false);
// 2403: disable scripts changing images
URL changes #224 Thanks Theemim. Double check, so far: 27 changes, 27 items checked in Theemim's list
2017-08-30 07:07:43 +02:00
// [TEST] https://www.w3schools.com/jsref/tryit.asp?filename=tryjsref_img_src2
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/773429
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("dom.disable_image_src_set", true);
// ***/
/* FF45
// 1021b: disable deferred level of storing extra session data 0=all 1=http-only 2=none
// extra session data contains contents of forms, scrollbar positions, cookies and POST data
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1235379
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.sessionstore.privacy_level_deferred", 2);
// ***/
/* FF46
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
// 0340: disable health report
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1234526
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("datareporting.healthreport.service.enabled", false); // [HIDDEN PREF]
user_pref("datareporting.healthreport.documentServerURI", ""); // [HIDDEN PREF]
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
// 0341: disable FHR (Firefox Health Report) v2 data being sent to Mozilla servers
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1234522
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("datareporting.policy.dataSubmissionEnabled.v2", false);
// 0414: disable safebrowsing pref - replaced by browser.safebrowsing.downloads.remote.url
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1239587
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.safebrowsing.appRepURL", ""); // Google application reputation check
// 0420: disable polaris (part of Tracking Protection, never used in stable)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1235565
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.polaris.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0510: disable "Pocket" [FF39+] - replaced by extensions.pocket.*
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1215694
miscellaneous Add missing parrot for 1100s, replace parrot for 1700 with a unique euphemism, a readme tweak (so it's technically correct), and deprecated pocket number change in prep for new system add-on section
2017-07-18 19:35:00 +02:00
user_pref("browser.pocket.enabled", false);
user_pref("browser.pocket.api", "");
user_pref("browser.pocket.site", "");
user_pref("browser.pocket.oAuthConsumerKey", "");
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// ***/
/* FF47
// 0330b: set unifiedIsOptIn to make sure telemetry respects OptIn choice and that telemetry
// is enabled ONLY for people that opted into it, even if unified Telemetry is enabled
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1236580
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("toolkit.telemetry.unifiedIsOptIn", true); // [HIDDEN PREF]
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
// 0340b: disable about:healthreport page UNIFIED
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1236580
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,");
// 0807: disable history manipulation
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
// [1] https://developer.mozilla.org/docs/Web/API/History_API
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1249542
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.history.allowPopState", false);
user_pref("browser.history.allowPushState", false);
user_pref("browser.history.allowReplaceState", false);
// ***/
/* FF48
// 0806: disable 'unified complete': 'Search with [default search engine]'
// [-] http://techdows.com/2016/05/firefox-unified-complete-aboutconfig-preference-removed.html
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1181078
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.urlbar.unifiedcomplete", false);
// ***/
/* FF49
// 0372: disable "Hello"
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
// [1] https://www.mozilla.org/privacy/archive/hello/2016-03/
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// [2] https://security.stackexchange.com/questions/94284/how-secure-is-firefox-hello
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1287827
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("loop.enabled", false);
user_pref("loop.server", "");
user_pref("loop.feedback.formURL", "");
user_pref("loop.feedback.manualFormURL", "");
user_pref("loop.facebook.appId", "");
user_pref("loop.facebook.enabled", false);
user_pref("loop.facebook.fallbackUrl", "");
user_pref("loop.facebook.shareUrl", "");
user_pref("loop.logDomains", false);
2200s: more tweaks
2018-03-26 19:04:31 +02:00
// 2201: disable new window scrollbars being hidden
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1257887
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.disable_window_open_feature.scrollbars", true);
// 2303: disable push notification (UDP wake-up)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1265914
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.push.udp.wakeupEnabled", false);
// ***/
/* FF50
// 0101: disable Windows10 intro on startup [WINDOWS]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1274633
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.usedOnWindows10.introURL", "");
// 0308: disable plugin update notifications
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1277905
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("plugins.update.notifyUser", false);
// 0410: disable "Block dangerous and deceptive content" - replaced by browser.safebrowsing.phishing.enabled
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1025965
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// user_pref("browser.safebrowsing.enabled", false);
// 1266: disable rc4 ciphers
// [1] https://trac.torproject.org/projects/tor/ticket/17369
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1268728
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// [-] https://www.fxsitecompat.com/en-CA/docs/2016/rc4-support-has-been-completely-removed/
user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);
user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);
user_pref("security.ssl3.rsa_rc4_128_md5", false);
user_pref("security.ssl3.rsa_rc4_128_sha", false);
// 1809: remove Mozilla's plugin update URL
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1277905
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("plugins.update.url", "");
// ***/
/* FF51
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
// 0702: disable SPDY
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1248197
section 0700 #368 This is a start to reducing section 2600 (which I renamed it to just miscellaneous). We can always revisit this new section and add to it down the track if required. Note: added a second ref [2] under 0703. Note: re-numbered & re-positioned deprecated prefs for SPDY
2018-03-13 10:04:54 +01:00
user_pref("network.http.spdy.enabled.v3-1", false);
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// 1851: delay play of videos until they're visible
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [1] https://bugzilla.mozilla.org/1180563
// [-] https://bugzilla.mozilla.org/1262053
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.block-play-until-visible", true);
// 2504: disable virtual reality devices
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1250244
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.vr.oculus050.enabled", false);
// ***/
/* FF52
// 1601: disable referer from an SSL Website
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1308725
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("network.http.sendSecureXSiteReferrer", false);
// 1850: disable Adobe EME "Primetime CDM" (Content Decryption Module)
// [1] https://trac.torproject.org/projects/tor/ticket/16285
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1329538,1337121 // FF52
// [-] https://bugzilla.mozilla.org/1329543 // FF53
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.gmp-eme-adobe.enabled", false);
user_pref("media.gmp-eme-adobe.visible", false);
user_pref("media.gmp-eme-adobe.autoupdate", false);
// 2405: disable WebTelephony API
// [1] https://wiki.mozilla.org/WebAPI/Security/WebTelephony
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1309719
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.telephony.enabled", false);
// ***/
remove ESR52 grouping in 9999 (#499)
2018-09-09 22:33:43 +02:00
/* FF53
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// 1265: block rc4 fallback
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1130670
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("security.tls.unrestricted_rc4_fallback", false);
// 1806: disable Acrobat, Quicktime, WMP (the string = min version number allowed)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1317108,1317109,1317110
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("plugin.scan.Acrobat", "99999");
user_pref("plugin.scan.Quicktime", "99999");
user_pref("plugin.scan.WindowsMediaPlayer", "99999");
// 2022: disable screensharing
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1329562
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.getusermedia.screensharing.allow_on_old_platforms", false);
// 2507: disable keyboard fingerprinting
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1322736
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.beforeAfterKeyboardEvent.enabled", false);
remove ESR52 grouping in 9999 (#499)
2018-09-09 22:33:43 +02:00
// ***/
/* FF54
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
// 0415: disable reporting URLs (safe browsing)
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1288633
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("browser.safebrowsing.reportMalwareMistakeURL", "");
user_pref("browser.safebrowsing.reportPhishMistakeURL", "");
// 1830: block websites detecting DRM is disabled
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1242321
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("media.eme.apiVisible", false);
// 2425: disable Archive Reader API
misc grammar for nerds #178 Thanks Just-me-ghacks
2017-07-24 19:15:37 +02:00
// i.e. reading archive contents directly in the browser, through DOM file objects
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1342361
Convert line endings to LF Added .gitattributes file to prevent CRLF from being committed in the future. Fixes #145
2017-06-17 09:13:14 +02:00
user_pref("dom.archivereader.enabled", false);
remove ESR52 grouping in 9999 (#499)
2018-09-09 22:33:43 +02:00
// ***/
/* FF55
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0209: disable geolocation on non-secure origins [FF54+]
bugzilla ref changes fixups #375
2018-03-14 15:03:04 +01:00
// [1] https://bugzilla.mozilla.org/1269531
// [-] https://bugzilla.mozilla.org/1072859
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("geo.security.allowinsecure", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0336: disable "Heartbeat" (Mozilla user rating telemetry) [FF37+]
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
// [1] https://trac.torproject.org/projects/tor/ticket/18738
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1361578
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.selfsupport.enabled", false); // [HIDDEN PREF]
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("browser.selfsupport.url", "");
// 0360: disable new tab "pings"
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1241390
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("browser.newtabpage.directory.ping", "data:text/plain,");
// 0861: disable saving form history on secure websites
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1361220
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("browser.formfill.saveHttpsForms", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0863: disable Form Autofill [FF54+] - replaced by extensions.formautofill.*
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1364334
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("browser.formautofill.enabled", false);
// 2410: disable User Timing API
// [1] https://trac.torproject.org/projects/tor/ticket/16336
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1344669
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("dom.enable_user_timing", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 2507: disable keyboard fingerprinting (physical keyboards) [FF38+]
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
// The Keyboard API allows tracking the "read parameter" of pressed keys in forms on
// web pages. These parameters vary between types of keyboard layouts such as QWERTY,
// AZERTY, Dvorak, and between various languages, e.g. German vs English.
// [WARNING] Don't use if Android + physical keyboard
URL changes #224 Part3 check: 49 items as per issue comment
2017-08-31 07:27:04 +02:00
// [1] https://developer.mozilla.org/docs/Web/API/KeyboardEvent/code
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
// [2] https://www.privacy-handbuch.de/handbuch_21v.htm
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1352949
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("dom.keyboardevent.code.enabled", false);
shove 3000s personal out to 5000s couple of number changes to get rid of alphabet soup: 3001a->5002, 3002->5003
2017-09-12 18:56:21 +02:00
// 5015: disable tab animation - replaced by toolkit.cosmeticAnimations.enabled
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1352069
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("browser.tabs.animate", false);
shove 3000s personal out to 5000s couple of number changes to get rid of alphabet soup: 3001a->5002, 3002->5003
2017-09-12 18:56:21 +02:00
// 5016: disable fullscreeen animation - replaced by toolkit.cosmeticAnimations.enabled
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1352069
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
user_pref("browser.fullscreen.animate", false);
remove ESR52 grouping in 9999 (#499)
2018-09-09 22:33:43 +02:00
// ***/
/* FF56
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0515: disable Screenshots (rollout pref only) [FF54+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1386333
FF56 deprecation
2017-09-28 10:27:40 +02:00
// user_pref("extensions.screenshots.system-disabled", true);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0517: disable Form Autofill [FF55+] - replaced by extensions.formautofill.available
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1385201
FF56 deprecation
2017-09-28 10:27:40 +02:00
user_pref("extensions.formautofill.experimental", false);
remove ESR52 grouping in 9999 (#499)
2018-09-09 22:33:43 +02:00
// ***/
/* FF57
9999: deprecated FF57
2017-11-16 05:03:08 +01:00
// 0374: disable "social" integration
// [1] https://developer.mozilla.org/docs/Mozilla/Projects/Social_API
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388902,1406193 (some leftovers were removed in FF58)
9999: deprecated FF57
2017-11-16 05:03:08 +01:00
user_pref("social.whitelist", "");
user_pref("social.toast-notifications.enabled", false);
user_pref("social.shareDirectory", "");
user_pref("social.remote-install.enabled", false);
user_pref("social.directories", "");
user_pref("social.share.activationPanelEnabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("social.enabled", false); // [HIDDEN PREF]
// 1830: disable DRM's EME WideVineAdapter [FF55+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1395468
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("media.eme.chromium-api.enabled", false);
2600s renumber/reorder #368
2018-05-07 18:13:53 +02:00
// 2608: disable WebIDE extension downloads (Valence)
9999: deprecated FF57
2017-11-16 05:03:08 +01:00
// [1] https://trac.torproject.org/projects/tor/ticket/16222
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1393497
9999: deprecated FF57
2017-11-16 05:03:08 +01:00
user_pref("devtools.webide.autoinstallFxdtAdapters", false);
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
user_pref("devtools.webide.adaptersAddonURL", "");
nits (#423)
2018-05-16 18:31:28 +02:00
// 2600's: disable SimpleServiceDiscovery - which can bypass proxy settings - e.g. Roku
9999: deprecated FF57
2017-11-16 05:03:08 +01:00
// [1] https://trac.torproject.org/projects/tor/ticket/16222
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1393582
9999: deprecated FF57
2017-11-16 05:03:08 +01:00
user_pref("browser.casting.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 5022: hide recently bookmarked items (you still have the original bookmarks) [FF49+]
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [-] https://bugzilla.mozilla.org/1401238
9999: deprecated FF57
2017-11-16 05:03:08 +01:00
user_pref("browser.bookmarks.showRecentlyBookmarked", false);
remove ESR52 grouping in 9999 (#499)
2018-09-09 22:33:43 +02:00
// ***/
0351: move *autoSubmit to deprecated https://github.com/ghacksuserjs/ghacks-user.js/issues/302#issuecomment-359245047
2018-11-19 01:12:07 +01:00
/* FF58
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0351: disable sending of crash reports [FF51+] - replaced by *.autoSubmit2
0351: move *autoSubmit to deprecated https://github.com/ghacksuserjs/ghacks-user.js/issues/302#issuecomment-359245047
2018-11-19 01:12:07 +01:00
// [-] https://bugzilla.mozilla.org/1424373
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.crashReports.unsubmittedCheck.autoSubmit", false);
0351: move *autoSubmit to deprecated https://github.com/ghacksuserjs/ghacks-user.js/issues/302#issuecomment-359245047
2018-11-19 01:12:07 +01:00
// ***/
remove ESR52 grouping in 9999 (#499)
2018-09-09 22:33:43 +02:00
/* FF59
59 deprecated/removed prefs [part 2] Note: I moved the (part`x`) bit to the end of the bugzilla from previous commit as I like the https* bit to all be in line = visually easier to parse IMO
2018-03-13 19:56:22 +01:00
// 0203: disable using OS locale, force APP locale - replaced by intl.locale.requested
// [-] https://bugzilla.mozilla.org/1414390
user_pref("intl.locale.matchOS", false);
// 0204: set APP locale - replaced by intl.locale.requested
// [-] https://bugzilla.mozilla.org/1414390
user_pref("general.useragent.locale", "en-US");
clean up "Firefox Data Collection & Use" (#627) * clean up "Firefox Data Collection & Use" - telemetry prefs to 330's - Firefox Data Collection & Use prefs to 340's (but leave crash reports in 350s) - move `app.shield.optoutstudies.enabled` to 330's - this is an internal pref which controls if you get the system addon - make notes that `datareporting.healthreport.uploadEnabled` controls studies and ext recommendations - split crash reports better to reflex the UI setting
2019-02-01 12:57:22 +01:00
// 0340b: disable about:healthreport page (which connects to Mozilla for locale/css+js+json)
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
// If you have disabled health reports, then this about page is useless - disable it
// If you want to see what health data is present, then this must be set at default
// [-] https://bugzilla.mozilla.org/1352497
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
user_pref("datareporting.healthreport.about.reportUrl", "data:,");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0511: disable FlyWeb [FF49+]
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
// Flyweb is a set of APIs for advertising and discovering local-area web servers
// [1] https://flyweb.github.io/
// [2] https://wiki.mozilla.org/FlyWeb/Security_scenarios
// [3] https://www.ghacks.net/2016/07/26/firefox-flyweb/
// [-] https://bugzilla.mozilla.org/1374574
user_pref("dom.flyweb.enabled", false);
move 1007 to 9999 (#493) `browser.cache.frecency_experiment` is a dead pref since FF59: https://bugzilla.mozilla.org/1430197 proof: https://dxr.mozilla.org/mozilla-esr60/search?q=frecency_experiment - the pref still exists but is not used anymore ie dead pref
2018-08-29 19:10:28 +02:00
// 1007: disable randomized FF HTTP cache decay experiments
// [1] https://trac.torproject.org/projects/tor/ticket/13575
// [-] https://bugzilla.mozilla.org/1430197
user_pref("browser.cache.frecency_experiment", -1);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 1242: enable Mixed-Content-Blocker to use the HSTS cache but disable the HSTS Priming requests [FF51+]
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
// Allow resources from domains with an existing HSTS cache record or in the HSTS preload list
// to be upgraded to HTTPS internally but disable sending out HSTS Priming requests, because
// those may cause noticeable delays e.g. requests time out or are not handled well by servers
// [NOTE] If you want to use the priming requests make sure 'use_hsts' is also true
bugzilla ref changes #375 note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
2018-03-14 14:22:58 +01:00
// [1] https://bugzilla.mozilla.org/1246540#c145
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
// [-] https://bugzilla.mozilla.org/1424917
user_pref("security.mixed_content.use_hsts", true);
user_pref("security.mixed_content.send_hsts_priming", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 1606: set the default Referrer Policy [FF53+] - replaced by network.http.referer.defaultPolicy
59 deprecated/removed prefs [part 2] Note: I moved the (part`x`) bit to the end of the bugzilla from previous commit as I like the https* bit to all be in line = visually easier to parse IMO
2018-03-13 19:56:22 +01:00
// [-] https://bugzilla.mozilla.org/587523
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("network.http.referer.userControlPolicy", 3);
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
// 1804: disable plugins using external/untrusted scripts with XPCOM or XPConnect
59 deprecated tweaks
2018-03-14 12:05:37 +01:00
// [-] (part8) https://bugzilla.mozilla.org/1416703#c21
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
user_pref("security.xpconnect.plugin.unrestricted", false);
59 deprecated/removed prefs [part 2] Note: I moved the (part`x`) bit to the end of the bugzilla from previous commit as I like the https* bit to all be in line = visually easier to parse IMO
2018-03-13 19:56:22 +01:00
// 2022: disable screensharing domain whitelist
59 deprecated tweaks
2018-03-14 12:05:37 +01:00
// [-] https://bugzilla.mozilla.org/1411742
59 deprecated/removed prefs [part 2] Note: I moved the (part`x`) bit to the end of the bugzilla from previous commit as I like the https* bit to all be in line = visually easier to parse IMO
2018-03-13 19:56:22 +01:00
user_pref("media.getusermedia.screensharing.allowed_domains", "");
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
// 2023: disable camera stuff
59 deprecated tweaks
2018-03-14 12:05:37 +01:00
// [-] (part7) https://bugzilla.mozilla.org/1416703#c21
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
user_pref("camera.control.face_detection.enabled", false);
2200s: more tweaks
2018-03-26 19:04:31 +02:00
// 2202: prevent scripts from changing the status text
59 deprecated/removed prefs [part 2] Note: I moved the (part`x`) bit to the end of the bugzilla from previous commit as I like the https* bit to all be in line = visually easier to parse IMO
2018-03-13 19:56:22 +01:00
// [-] https://bugzilla.mozilla.org/1425999
user_pref("dom.disable_window_status_change", true);
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
// 2416: disable idle observation
59 deprecated tweaks
2018-03-14 12:05:37 +01:00
// [-] (part7) https://bugzilla.mozilla.org/1416703#c21
59 deprecated/removed prefs [part 1]
2018-03-13 17:52:14 +01:00
user_pref("dom.idle-observers-api.enabled", false);
remove ESR52 grouping in 9999 (#499)
2018-09-09 22:33:43 +02:00
// ***/
/* FF60
60 deprecated/removed prefs
2018-05-04 18:56:14 +02:00
// 0360: disable new tab tile ads & preload & marketing junk
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1370930,1433133
user_pref("browser.newtabpage.directory.source", "data:text/plain,");
user_pref("browser.newtabpage.enhanced", false);
user_pref("browser.newtabpage.introShown", true);
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
// 0512: disable Shield [FF53+] - renamed to app.normandy.* (see 0503)
60 deprecated/removed part2
2018-05-04 23:42:47 +02:00
// Shield is an telemetry system (including Heartbeat) that can also push and test "recipes"
// [1] https://wiki.mozilla.org/Firefox/Shield
// [2] https://github.com/mozilla/normandy
// [-] https://bugzilla.mozilla.org/1436113
user_pref("extensions.shield-recipe-client.enabled", false);
user_pref("extensions.shield-recipe-client.api_url", "");
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0514: disable Activity Stream [FF54+]
60 deprecated/removed prefs
2018-05-04 18:56:14 +02:00
// [-] https://bugzilla.mozilla.org/1433324
user_pref("browser.newtabpage.activity-stream.enabled", false);
// 2301: disable workers
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
// [SETUP-WEB] Disabling workers *will* break sites (e.g. Google Street View, Twitter)
60 deprecated/removed prefs
2018-05-04 18:56:14 +02:00
// [NOTE] CVE-2016-5259, CVE-2016-2812, CVE-2016-1949, CVE-2016-5287 (fixed)
// [-] https://bugzilla.mozilla.org/1434934
user_pref("dom.workers.enabled", false);
nits (#423)
2018-05-16 18:31:28 +02:00
// 5000's: open "page/selection source" in a new window
60 deprecated/removed prefs
2018-05-04 18:56:14 +02:00
// [-] https://bugzilla.mozilla.org/1418403
// user_pref("view_source.tab", false);
Update user.js - should check if 0360 `user_pref("browser.newtabpage.directory.source", "data:text/plain,");` is still around since the ping pref is gone. - A bit iffy about 2507 - this spilts two prefs and there's a lot of text. Not sure if FF38+ refers to the second one. We should investigate the still active 2507 and fix that up with some info and version
2017-08-07 08:43:47 +02:00
// ***/
ESR parrot a deprecated parrot.. seems apt... and that's it, no more parrots, please.. I'm all parroted out
2017-09-15 19:43:45 +02:00
61 deprecated/removed prefs
2018-07-04 11:41:30 +02:00
/* ESR60.x still uses all the following prefs
// [NOTE] replace the * with a slash in the line above to re-enable them
// FF61
// 0501: disable experiments
// [1] https://wiki.mozilla.org/Telemetry/Experiments
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1420908,1450801
user_pref("experiments.enabled", false);
user_pref("experiments.manifest.uri", "");
user_pref("experiments.supported", false);
user_pref("experiments.activeExperiment", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 2612: disable remote JAR files being opened, regardless of content type [FF42+]
61 deprecated/removed prefs
2018-07-04 11:41:30 +02:00
// [1] https://bugzilla.mozilla.org/1173171
// [2] https://www.fxsitecompat.com/en-CA/docs/2015/jar-protocol-support-has-been-disabled-by-default/
Update user.js
2018-07-11 13:59:52 +02:00
// [-] https://bugzilla.mozilla.org/1427726
61 deprecated/removed prefs
2018-07-04 11:41:30 +02:00
user_pref("network.jar.block-remote-files", true);
// 2613: disable JAR from opening Unsafe File Types
Update user.js
2018-07-11 13:59:52 +02:00
// [-] https://bugzilla.mozilla.org/1427726
61 deprecated/removed prefs
2018-07-04 11:41:30 +02:00
user_pref("network.jar.open-unsafe-types", false);
// * * * /
62 deprecated/removed prefs
2018-09-05 11:30:42 +02:00
// FF62
// 1803: disable Java plugin
// [-] (part5) https://bugzilla.mozilla.org/1461243
user_pref("plugin.state.java", 0);
// * * * /
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
// FF63
// 0202: disable GeoIP-based search results
// [NOTE] May not be hidden if Firefox has changed your settings due to your locale
// [-] https://bugzilla.mozilla.org/1462015
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
user_pref("browser.search.countryCode", "US"); // [HIDDEN PREF]
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
// 0301a: disable auto-update checks for Firefox
// [SETTING] General>Firefox Updates>Never check for updates
// [-] https://bugzilla.mozilla.org/1420514
// user_pref("app.update.enabled", false);
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0402: enable Kinto blocklist updates [FF50+]
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
// What is Kinto?: https://wiki.mozilla.org/Firefox/Kinto#Specifications
// As Firefox transitions to Kinto, the blocklists have been broken down into entries for certs to be
// revoked, extensions and plugins to be disabled, and gfx environments that cause problems or crashes
// [-] https://bugzilla.mozilla.org/1458917
minor wording changes (#583)
2018-12-10 23:23:00 +01:00
user_pref("services.blocklist.update_enabled", true); // [DEFAULT: true]
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// 0503: disable "Savant" Shield study [FF61+]
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
// [-] https://bugzilla.mozilla.org/1457226
user_pref("shield.savant.enabled", false);
// 1031: disable favicons in tabs and new bookmarks - merged into browser.chrome.site_icons
// [-] https://bugzilla.mozilla.org/1453751
// user_pref("browser.chrome.favicons", false);
// 2030: disable auto-play of HTML5 media - replaced by media.autoplay.default
TAG! You're it! #545
2018-12-04 06:36:03 +01:00
// [SETUP-WEB] This may break video playback on various sites
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
// [-] https://bugzilla.mozilla.org/1470082
user_pref("media.autoplay.enabled", false);
// 2704: set cookie lifetime in days (see 2703)
// [-] https://bugzilla.mozilla.org/1457170
#578 cleanups (#576) - cleanup of tags placement, order consistency, and to use square brackets (allows usage elsewhere to not get tagged, eg 1402) - other bits and bobs
2018-12-10 19:18:26 +01:00
// user_pref("network.cookie.lifetime.days", 90); // [DEFAULT: 90]
removed, renamed or hidden in v63.0 (#523) * removed, renamed or hidden in v63.0 - 0301a - do you want to add the `[NOTE] Firefox currently checks every 12 hrs ...` to `0302a` ? The problem is it also checks for updates every time you open/reload about:preferences and in Menu>Help>About Firefox regardless of when the last check was. - 0513 - removed because follow-on-search is no longer a deletable system addon - 2703 - do we just remove `3=for n days` or add a [NOTE] that value 3 was remove in FF63 or something? - `browser.ctrlTab.recentlyUsedOrder` replaces `browser.ctrlTab.previews` but it now defaults to true. No need to list the new one under 5000 IMO * Update user.js * 1031 add more info https://bugzilla.mozilla.org/show_bug.cgi?id=1453751#c28 * 0301a: remove update-check timing info * 2703: add version deprecation for value 3
2018-10-23 17:45:31 +02:00
// 5000's: enable "Ctrl+Tab cycles through tabs in recently used order" - replaced by browser.ctrlTab.recentlyUsedOrder
// [-] https://bugzilla.mozilla.org/1473595
// user_pref("browser.ctrlTab.previews", true);
// * * * /
all Deprecations + new ADB extension prefs (#587)
2018-12-11 17:07:28 +01:00
// FF64
// 0516: disable Onboarding [FF55+]
// Onboarding is an interactive tour/setup for new installs/profiles and features. Every time
// about:home or about:newtab is opened, the onboarding overlay is injected into that page
// [NOTE] Onboarding uses Google Analytics [2], and leaks resource://URIs [3]
// [1] https://wiki.mozilla.org/Firefox/Onboarding
// [2] https://github.com/mozilla/onboard/commit/db4d6c8726c89a5d6a241c1b1065827b525c5baf
// [3] https://bugzilla.mozilla.org/863246#c154
// [-] https://bugzilla.mozilla.org/1462415
user_pref("browser.onboarding.enabled", false);
// 2608: disable WebIDE ADB extension downloads - both renamed
// [1] https://trac.torproject.org/projects/tor/ticket/16222
// [-] https://bugzilla.mozilla.org/1491315
user_pref("devtools.webide.autoinstallADBHelper", false);
user_pref("devtools.webide.adbAddonURL", "");
// 2681: disable CSP violation events [FF59+]
// [1] https://developer.mozilla.org/docs/Web/API/SecurityPolicyViolationEvent
// [-] https://bugzilla.mozilla.org/1488165
user_pref("security.csp.enable_violation_events", false);
// * * * /
FF65 removals (#624)
2019-01-30 13:27:53 +01:00
// FF65
// 0850a: disable location bar autocomplete and suggestion types
// If you enforce any of the suggestion types (see the other 0850a), you MUST enforce 'autocomplete'
// - If *ALL* of the suggestion types are false, 'autocomplete' must also be false
// - If *ANY* of the suggestion types are true, 'autocomplete' must also be true
// [-] https://bugzilla.mozilla.org/1502392
user_pref("browser.urlbar.autocomplete.enabled", false);
// 0908: remove user & password info when attempting to fix an entered URL (i.e. 0802 is true)
// e.g. //user:password@foo -> //user@(prefix)foo(suffix) NOT //user:password@(prefix)foo(suffix)
// [-] https://bugzilla.mozilla.org/1510580
user_pref("browser.fixup.hide_user_pass", true); // [DEFAULT: true]
// * * * /
61 deprecated/removed prefs
2018-07-04 11:41:30 +02:00
// ***/
ESR parrot a deprecated parrot.. seems apt... and that's it, no more parrots, please.. I'm all parroted out
2017-09-15 19:43:45 +02:00
/* END: internal custom pref to test for syntax errors ***/
parrot pref name change #237
2017-09-16 00:28:22 +02:00
user_pref("_user.js.parrot", "SUCCESS: No no he's not dead, he's, he's restin'!");