Updated: August 24, 2020
As we know, Firefox is the choice of browser for daily browsing with decent privacy. There are further steps we can take to make things better. I would like to share the so called "tweaks" I use and request any recommendations/corrections.
I have divided it into three four five sections based on where we are making changes:
We want to avoid Firefox calling their servers unnecessarily
General Section:
- Uncheck Recommend extensions as you browse
- Uncheck Recommend features as you browse
Home section:
- Homepage and new windows: Blank
- New tabs: Blank
- Firefox Home Content: Uncheck Everything
Search section:
- Search engine:
SearX(self hosted) orDuckDuckGOorMojeek
Privacy and Security Section:
- Uncheck everything under "Firefox Data Collection and Use"
- Check "Delete cookies and site data when Firefox is closed" and manually added exceptions for the websites I want to keep.
- Check "Enable HTTPS-Only Mode in all windows" under HTTPS mode
- Firefox Containers: Isolate specific sites within tabs which do not see settings from other sites; use containers for WORK, PERSONAL, etc. (Also, manually configure the websites to open in certain container so it never opens in other container even by mistake)
- uBlock Origin: Blocks undesired scripts from loading.
Enabled "I am an advanced user " and enabled lists (mostly all) under "Filter lists" section. Also, you can use the Usermode:Medium. You might have to manually whitelist few websites/login pages which might not work with Medium mode.
UBlock Medium Mode
LocalCDN: Protects you against tracking through "free", centralized, content delivery.
(Removed Decentraleyes since it is obsolete)
Canvas Blocker: It allows users to prevent websites from using some Javascript APIs to fingerprint them.
Privacy Badger: Privacy Badger automatically learns to block invisible trackers.
ClearURLs: Remove tracking elements from URLs
NOTE: You might have to enable/disable few things as per convenience. Sometimes the website break because of LocalCDN (very rare), so you might have to turn it off for that particular website. 2.1 Beauty of Firefox Containers:
The Multi-Account Containers from Mozilla is absolute gold. It allows you to separate your browsing without needing to clear your history, log in and out, or use multiple browsers. The two important use cases are:
To open two different microsoft/reddit wtc. accounts which doesn't allow multiple user sessions. I used to have one work and one personal Microsoft account back then, the only way to use both was spin two different browser sessions (but no more!!)
and
Assign separate slice of browser storage to a set of websites. All site preferences, logged-in sessions, and advertising tracking data of a container are isolated from others. For example, if for some reason you want to use Google/DDG search and don't want them to see what other services you are using or logged in, you can create a dedicated search container and use it solely for search. You can even go a step ahead and force something like www.duckduckgo.com to always open in that particular container.
To execute 2. scenario, follow the below steps:
- Go to Manage containers, create a new container named search
- Now, from new tab menu pr container's menu, open the search container.
- Inside the container, go to www.duckduckgo.com.
- While on DDG, click the container add-on menu and select "Always open in this site in search"
- Almost done, now close this tab and go to any other container (or standar) tab and type in www.duckduckgo.com
- You will be prompted to confirm about assigned tab (search ), select "Remember my decision" and then click on "Open in search container"
- Now, Anytime you try to connect to www.duckduckgo.com, regardless of what container you are in, Firefox will redirect your request and open a new search tab to complete your connection. so, even by mistake you don't go to any other container.
Of course, above scenario are similar but they are unique as well.
3.1. There are lots we can do here, but some or the other website used to break or not work, with the setting below, no website breaks so far (even google ones):
geo.enabled: FALSE: This disables Firefox from sharing your location.
dom.battery.enabled: FALSE: Another technique used by website operators to track you is to view your exact battery levels. This setting blocks this information.
extensions.pocket.enabled: FALSE: This disables the proprietary Pocket service.
dom.event.clipboardevents.enabled: FALSE: Disables that websites can get notifications if you copy, paste, or cut something from a web page, and it lets them know which part of the page had been selected.
beacon.enabled: FALSE: Disables sending additional analytics to web servers.
3.2. Additional tweaks which generally doesn't break anything, but you might have to add few websites to whitelist. These will help us in avoiding fingerprinting.
privacy.resistFingerprinting: TRUE
privacy.trackingprotection.fingerprinting.enabled: TRUE
privacy.trackingprotection.cryptomining.enabled: TRUE
privacy.trackingprotection.enabled: TRUE
browser.send_pings: FALSE
browser.urlbar.speculativeConnect.enabled: FALSE
network.IDN_show_punycode: TRUE
webgl.disabled: TRUE
browser.sessionstore.privacy_level: 2
network.dns.echconfig.enabled: TRUE
network.dns.use_https_rr_as_altsvc: TRUE
3.3. Now, there are additional setting which mostly break the google related websites like google meet. I have to use Gsuite services for my work sometimes. So, I have a a separate work profile in FF with all above settings. For personal use, I use the default profile, instead of all above I do a bit more and add the below tweaks as well:
browser.safebrowsing.phishing.enabled: FALSE: This setting disables Google's "Safe Browsing" and phishing protection. If this setting is "true" Google will be able to scan (and store) the sites that you visit for the presence of malware.
browser.safebrowsing.malware.enabled: FALSE: Again, this disables Google's ability to monitor your web traffic for malware, storing the sites you visit.
media.navigator.enabled: FALSE: Website operators will identify your computer as unique to enable tracking around the web. One such tactic is to track the status of your webcam and microphone (ON/OFF). This disables the ability to website operators to see this information.
network.trr.mode: Change from O to 2. This will be used for encrypted DNS
The tweaks from about:config section is taken from Michael Bazell's Intel Techniques.
3.4. There is one more problem of WebRTC leaks, for that I use recommended VPN (from privacytools) which takes care of it otherwise there are setting you can do in about:config as well but they tend to break websites for me
I have tried few combinations and ended up getting a combination which gives "partial protection" with a proper usabilty as well. Hardly anything breaks, and even if it breaks it is mostly because of Ublock Origin Medium Mode (see solution in link mentioned above).
ETP Mode: Firefox Enhanced Tracking Protection
| Extensions | about:config | ETP Mode | Fingerprint (EFF) |
|---|---|---|---|
| None | None | Standard | Nearly-Unique |
| None | None | Strict | Nearly-Unique |
| UBlock | None | Strict | Nearly-Unique |
| UBlock + All Filters | None | Strict | Nearly-Unique |
| UBlock + All Filters Canvas Blocker | None | Strict | Nearly-Unique |
| UBlock + All Filters Canvas Blocker ClearURL | None | Strict | Nearly-Unique |
| UBlock + All Filters Canvas Blocker ClearURL LocalCDN | None | Strict | Nearly-Unique |
| UBlock + All Filters UBlock Medium Mode Canvas Blocker ClearURL LocalCDN | None | Strict | Nearly-Unique |
| UBlock + All Filters UBlock Medium Mode Canvas Blocker ClearURL LocalCDN Privacy Badger | None | Strict | Nearly-Unique |
| UBlock + All Filters UBlock Medium Mode Canvas Blocker ClearURL LocalCDN Privacy Badger | 3.1 | Strict | Nearly-Unique |
| UBlock + All Filters UBlock Medium Mode Canvas Blocker ClearURL LocalCDN Privacy Badger | 3.1 + 3.2 | Strict | Partial Protection |
Firefox ETP Strict mode does the job for me.
There is another tweak:
privacy.firstparty.isolate: TRUE
It won't allow you to retain logins and it will break some websites as well. I don't use it, **use it if you know what you are doing.
Any suggestion / feedback /recommendation is highly appreciated.
Original text by u/nazgulc and the r/privacytoolsIO community.