michel_ouba/FF_arkenfox_user.js
michel_ouba
/
FF_arkenfox_user.js
1
0
Fork 0
Code Releases Activity

bugzilla ref changes #375 

note: picked up a leading space on 2206. Please double check for any errors or missed opportunities (I scanned it three times), 1221 is about the only one that's a bit messy I think
This commit is contained in:
Thorin-Oakenpants 2018-03-15 02:22:58 +13:00 committed by GitHub
parent 517e40703f
commit 14456b5a29
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 127 additions and 138 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

265
user.js
View File

@ -104,10 +104,10 @@ user_pref("browser.search.geoSpecificDefaults.url", "");
/* 0207: set language to match ***/
user_pref("intl.accept_languages", "en-US, en");
/* 0208: enforce US English locale regardless of the system locale
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=867501 ***/
* [1] https://bugzilla.mozilla.org/867501 ***/
user_pref("javascript.use_us_english_locale", true); // (hidden pref)
/* 0209: use APP locale over OS locale in regional preferences (FF56+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1379420 [also 1364789] ***/
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1379420,1364789 ***/
user_pref("intl.regional_prefs.use_os_locales", false);
/* 0210: use Mozilla geolocation service instead of Google when geolocation is enabled
* Optionally enable logging to the console (defaults to false) ***/
@ -188,7 +188,7 @@ user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // (FF57+)
user_pref("datareporting.healthreport.uploadEnabled", false);
/* 0334: disable new data submission, master kill switch (FF41+)
* If disabled, no policy is shown or upload takes place, ever
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1195552 ***/
* [1] https://bugzilla.mozilla.org/1195552 ***/
user_pref("datareporting.policy.dataSubmissionEnabled", false);
/* 0350: disable crash reports ***/
user_pref("breakpad.reportURL", "");
@ -277,7 +277,7 @@ user_pref("browser.safebrowsing.provider.google4.reportPhishMistakeURL", ""); //
/* 0416: disable 'ignore this warning' on Safe Browsing warnings which when clicked
* bypasses the block for that session. This is a means for admins to enforce SB
* [TEST] see github wiki APPENDIX C: Test Sites: Section 5
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1226490 ***/
* [1] https://bugzilla.mozilla.org/1226490 ***/
// user_pref("browser.safebrowsing.allowOverride", false);
/* 0417: disable data sharing (FF58+) ***/
user_pref("browser.safebrowsing.provider.google4.dataSharing.enabled", false);
@ -301,7 +301,7 @@ user_pref("privacy.trackingprotection.ui.enabled", true);
// user_pref("urlclassifier.trackingTable", "test-track-simple,base-track-digest256,content-track-digest256"); // strict
/* 0423: disable Mozilla's blocklist for known Flash tracking/fingerprinting (FF48+)
* [1] https://www.ghacks.net/2016/07/18/firefox-48-blocklist-against-plugin-fingerprinting/
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1237198 ***/
* [2] https://bugzilla.mozilla.org/1237198 ***/
// user_pref("browser.safebrowsing.blockedURIs.enabled", false);
/* 0424: disable Mozilla's tracking protection and Flash blocklist updates ***/
// user_pref("browser.safebrowsing.provider.mozilla.gethashURL", "");
@ -310,8 +310,7 @@ user_pref("privacy.trackingprotection.ui.enabled", true);
* Passive TP annotates channels to lower the priority of network loads for resources on the tracking protection list
* [NOTE] It has no effect if TP is enabled, but keep in mind that by default TP is only enabled in Private Windows
* This is included for people who want to completely disable Tracking Protection.
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1170190
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1141814 ***/
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1170190,1141814 ***/
// user_pref("privacy.trackingprotection.annotate_channels", false);
// user_pref("privacy.trackingprotection.lower_network_priority", false);
@ -377,7 +376,7 @@ user_pref("browser.library.activity-stream.enabled", false); // (FF57+)
* [NOTE] Onboarding uses Google Analytics [2], and leaks resource://URIs [3]
* [1] https://wiki.mozilla.org/Firefox/Onboarding
* [2] https://github.com/mozilla/onboard/commit/db4d6c8726c89a5d6a241c1b1065827b525c5baf
* [3] https://bugzilla.mozilla.org/show_bug.cgi?id=863246#c154 ***/
* [3] https://bugzilla.mozilla.org/863246#c154 ***/
user_pref("browser.onboarding.enabled", false);
/* 0517: disable Form Autofill (FF55+)
* [SETTING-56+] Options>Privacy & Security>Forms & Passwords>Enable Profile Autofill
@ -463,11 +462,11 @@ user_pref("network.http.altsvc.oe", false);
* [2] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
user_pref("network.proxy.socks_remote_dns", true);
/* 0705: disable DNS requests for hostnames with a .onion TLD (FF45+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1228457 ***/
* [1] https://bugzilla.mozilla.org/1228457 ***/
user_pref("network.dns.blockDotOnion", true);
/* 0706: remove paths when sending URLs to PAC scripts (FF51+)
* CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1255474 ***/
* [1] https://bugzilla.mozilla.org/1255474 ***/
user_pref("network.proxy.autoconfig_url.include_path", false);
/*** 0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS [SETUP]
@ -502,7 +501,7 @@ user_pref("browser.sessionhistory.max_entries", 10);
* only in 'certain circumstances', also see latest comments in [2]
* [TEST] http://lcamtuf.coredump.cx/yahh/ (see github wiki APPENDIX C on how to use)
* [1] https://dbaron.org/mozilla/visited-privacy
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=147777
* [2] https://bugzilla.mozilla.org/147777
* [3] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector ***/
user_pref("layout.css.visited_links_enabled", false);
/* 0806: disable displaying javascript in history URLs - SECURITY ***/
@ -516,10 +515,10 @@ user_pref("browser.search.suggest.enabled", false);
user_pref("browser.urlbar.suggest.searches", false);
user_pref("browser.urlbar.userMadeSearchSuggestionsChoice", true); // (FF41+)
/* 0809: disable location bar suggesting "preloaded" top websites (FF54+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1211726 ***/
* [1] https://bugzilla.mozilla.org/1211726 ***/
user_pref("browser.urlbar.usepreloadedtopurls.enabled", false);
/* 0810: disable location bar making speculative connections (FF56+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1348275 ***/
* [1] https://bugzilla.mozilla.org/1348275 ***/
user_pref("browser.urlbar.speculativeConnect.enabled", false);
/* 0850a: disable location bar autocomplete and suggestion types
* If you enforce any of the suggestion types, you MUST enforce 'autocomplete'
@ -548,7 +547,7 @@ user_pref("browser.urlbar.autoFill.typed", false);
* [1] https://www.ghacks.net/2016/08/09/firefox-one-off-searches-address-bar/ ***/
user_pref("browser.urlbar.oneOffSearches", false);
/* 0850f: disable location bar suggesting local search history (FF57+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1181644 ***/
* [1] https://bugzilla.mozilla.org/1181644 ***/
user_pref("browser.urlbar.maxHistoricalSearchSuggestions", 0); // max. number of search suggestions
/* 0860: disable search and form history
* [SETTING-56+] Options>Privacy & Security>History>Custom Settings>Remember search and form history
@ -597,7 +596,7 @@ user_pref("signon.autofillForms", false);
* saved (such as banking sites). Set at true, informed users can make their own choice. ***/
user_pref("signon.storeWhenAutocompleteOff", true);
/* 0907: display warnings for logins on non-secure (non HTTPS) pages
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1217156 ***/
* [1] https://bugzilla.mozilla.org/1217156 ***/
user_pref("security.insecure_password.ui.enabled", true);
/* 0908: remove user & password info when attempting to fix an entered URL (i.e. 0802 is true)
* e.g. //user:password@foo -> //user@(prefix)foo(suffix) NOT //user:password@(prefix)foo(suffix) ***/
@ -606,12 +605,11 @@ user_pref("browser.fixup.hide_user_pass", true);
user_pref("signon.formlessCapture.enabled", false);
/* 0910: disable autofilling saved passwords on HTTP pages and show warning (FF52+)
* [1] https://www.fxsitecompat.com/en-CA/docs/2017/insecure-login-forms-now-disable-autofill-show-warning-beneath-input-control/
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1217152
* [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1319119 ***/
* [2] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1217152,1319119 ***/
user_pref("signon.autofillForms.http", false);
user_pref("security.insecure_field_warning.contextual.enabled", true);
/* 0911: prevent cross-origin images from triggering an HTTP-Authentication prompt (FF55+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1357835 ***/
* [1] https://bugzilla.mozilla.org/1357835 ***/
user_pref("network.auth.subresource-img-cross-origin-http-auth-allow", false);
/*** 1000: CACHE [SETUP] ***/
@ -638,7 +636,7 @@ user_pref("browser.cache.disk_cache_ssl", false);
// user_pref("browser.sessionhistory.max_total_viewers", 0);
/* 1006: disable permissions manager from writing to disk [RESTART]
* [NOTE] This means any permission changes are session only
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=967812 ***/
* [1] https://bugzilla.mozilla.org/967812 ***/
// user_pref("permissions.memory_only", true); // (hidden pref)
/* 1007: disable randomized FF HTTP cache decay experiments
* [1] https://trac.torproject.org/projects/tor/ticket/13575 ***/
@ -665,7 +663,7 @@ user_pref("browser.sessionstore.resume_from_crash", false);
* [WARNING] This can also affect entries in the "Recently Closed Tabs" feature:
* i.e. the longer the interval the more chance a quick tab open/close won't be captured.
* This longer interval *may* affect history but we cannot replicate any history not recorded
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1304389 ***/
* [1] https://bugzilla.mozilla.org/1304389 ***/
user_pref("browser.sessionstore.interval", 30000);
/** FAVICONS ***/
/* 1030: disable favicons in shortcuts
@ -715,7 +713,7 @@ user_pref("security.tls.version.max", 4); // 4 = allow up to and including TLS 1
* Since the ID is unique, web servers can (and do) use it for tracking. If set to true,
* this disables sending SSL Session IDs and TLS Session Tickets to prevent session tracking
* [1] https://tools.ietf.org/html/rfc5077
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=967977 ***/
* [2] https://bugzilla.mozilla.org/967977 ***/
user_pref("security.ssl.disable_session_identifiers", true); // (hidden pref)
/* 1204: disable SSL Error Reporting
* [1] https://firefox-source-docs.mozilla.org/browser/base/sslerrorreport/preferences.html ***/
@ -758,8 +756,8 @@ user_pref("security.family_safety.mode", 0);
* [WARNING] This affects login/cert/key dbs. The effect is all credentials are session-only.
* Saved logins and passwords are not available. Reset the pref and restart to return them.
* [TEST] https://fiprinca.0x90.eu/poc/
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1334485 - related bug
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1216882 - related bug (see comment 9) ***/
* [1] https://bugzilla.mozilla.org/1334485 - related bug
* [2] https://bugzilla.mozilla.org/1216882 - related bug (see comment 9) ***/
// user_pref("security.nocertdb", true); // (hidden pref)
/* 1222: enforce strict pinning
* PKP (Public Key Pinning) 0=disabled 1=allow user MiTM (such as your antivirus), 2=strict
@ -843,7 +841,7 @@ user_pref("browser.display.use_document_fonts", 0);
// user_pref("font.name.monospace.x-unicode", "Lucida Console");
// user_pref("font.name.monospace.x-western", "Lucida Console"); // default Courier New
/* 1403: enable icon fonts (glyphs) (FF41+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=789788 ***/
* [1] https://bugzilla.mozilla.org/789788 ***/
user_pref("gfx.downloadable_fonts.enabled", true); // default: true
/* 1404: disable rendering of SVG OpenType fonts
* [1] https://wiki.mozilla.org/SVGOpenTypeFonts - iSECPartnersReport recommends to disable this ***/
@ -866,7 +864,7 @@ user_pref("gfx.font_rendering.graphite.enabled", false);
* [NOTE] Creating your own probably highly-unique whitelist will raise your entropy. If
* you block sites choosing fonts in 1401, this preference is irrelevant. In future,
* privacy.resistFingerprinting (see 4500) may cover this, and 1401 can be relaxed.
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1121643 ***/
* [1] https://bugzilla.mozilla.org/1121643 ***/
// user_pref("font.system.whitelist", ""); // (hidden pref)
/*** 1600: HEADERS / REFERERS
@ -911,7 +909,7 @@ user_pref("network.http.referer.defaultPolicy.pbmode", 2); // (FF59+) default: 2
/* 1607: TOR: hide (not spoof) referrer when leaving a .onion domain (FF54+)
* [NOTE] Firefox cannot access .onion sites by default. We recommend you use
* TBB (Tor Browser Bundle) which is specifically designed for the dark web
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1305144 ***/
* [1] https://bugzilla.mozilla.org/1305144 ***/
user_pref("network.http.referer.hideOnionSource", true);
/* 1610: ALL: disable the DNT HTTP header, which is essentially USELESS
* It is voluntary and most ad networks do not honor it. DNT is *NOT* how you stop being data mined.
@ -930,7 +928,7 @@ user_pref("privacy.donottrackheader.enabled", false);
***/
user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!");
/* 1701: enable Container Tabs setting in preferences (see 1702) (FF50+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1279029 ***/
* [1] https://bugzilla.mozilla.org/1279029 ***/
// user_pref("privacy.userContext.ui.enabled", true);
/* 1702: enable Container Tabs (FF50+)
* [SETTING-56+] Options>Privacy & Security>Tabs>Enable Container Tabs
@ -942,7 +940,7 @@ user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!");
* 0=disables long press, 1=when clicked, the menu is shown
* 2=the menu is shown after X milliseconds
* [NOTE] The menu does not contain a non-container tab option
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1328756 ***/
* [1] https://bugzilla.mozilla.org/1328756 ***/
// user_pref("privacy.userContext.longPressBehavior", 2);
/*** 1800: PLUGINS ***/
@ -997,9 +995,8 @@ user_pref("media.peerconnection.turn.disable", true);
user_pref("media.peerconnection.ice.tcp", false);
user_pref("media.navigator.video.enabled", false); // video capability for WebRTC
/* 2002: limit WebRTC IP leaks if using WebRTC
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1189041
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1297416
* [3] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1189041,1297416
* [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/
user_pref("media.peerconnection.ice.default_address_only", true); // (FF42-FF50)
user_pref("media.peerconnection.ice.no_host", true); // (FF51+)
/* 2010: disable WebGL (Web Graphics Library), force bare minimum feature set if used & disable WebGL extensions
@ -1011,7 +1008,7 @@ user_pref("webgl.min_capability_mode", true);
user_pref("webgl.disable-extensions", true);
user_pref("webgl.disable-fail-if-major-performance-caveat", true);
/* 2011: disable WebGL debug info being available to websites
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1171228
* [1] https://bugzilla.mozilla.org/1171228
* [2] https://developer.mozilla.org/docs/Web/API/WEBGL_debug_renderer_info ***/
user_pref("webgl.enable-debug-renderer-info", false);
/* 2012: disable two more webgl preferences (FF51+) ***/
@ -1078,7 +1075,7 @@ user_pref("dom.disable_beforeunload", true);
/* 2206: open new windows in a new tab instead
* 1=current window, 2=new window, 3=most recent window
* [SETTING] Options>General>Tabs>Open new windows in a new tab instead ***/
user_pref("browser.link.open_newwindow", 3);
user_pref("browser.link.open_newwindow", 3);
/*** 2300: WEB WORKERS [SETUP]
A worker is a JS "background task" running in a global context, i.e. it is different from
@ -1135,7 +1132,7 @@ user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!
user_pref("dom.event.clipboardevents.enabled", false);
/* 2403: disable clipboard commands (cut/copy) from "non-privileged" content (FF41+)
* this disables document.execCommand("cut"/"copy") to protect your clipboard
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1170911 ***/
* [1] https://bugzilla.mozilla.org/1170911 ***/
user_pref("dom.allow_cut_copy", false); // (hidden pref)
/* 2414: disable shaking the screen ***/
user_pref("dom.vibrator.enabled", false);
@ -1170,7 +1167,7 @@ user_pref("javascript.options.wasm", false);
* ad network API for "ad viewability checks" down to a pixel level
* [1] https://developer.mozilla.org/docs/Web/API/Intersection_Observer_API
* [2] https://w3c.github.io/IntersectionObserver/
* [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1243846 ***/
* [3] https://bugzilla.mozilla.org/1243846 ***/
user_pref("dom.IntersectionObserver.enabled", false);
/* 2427: disable Shared Memory (Spectre mitigation)
* [1] https://github.com/tc39/ecmascript_sharedmem/blob/master/TUTORIAL.md
@ -1196,7 +1193,7 @@ user_pref("media.navigator.enabled", false);
// user_pref("gfx.direct2d.disabled", true); // [WINDOWS]
user_pref("layers.acceleration.disabled", true);
/* 2510: disable Web Audio API (FF51+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1288359 ***/
* [1] https://bugzilla.mozilla.org/1288359 ***/
user_pref("dom.webaudio.enabled", false);
/*** 2600: MISCELLANEOUS ***/
@ -1210,7 +1207,7 @@ user_pref("browser.download.folderList", 2);
/* 2603: enforce user interaction for security by always asking the user where to download ***/
user_pref("browser.download.useDownloadDir", false);
/* 2604: remove temp files opened with an external application
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=302433 ***/
* [1] https://bugzilla.mozilla.org/302433 ***/
user_pref("browser.helperApps.deleteTempFileOnExit", true);
/* 2605: disable adding downloads to the system's "recent documents" list ***/
user_pref("browser.download.manager.addToRecentDocs", false);
@ -1223,8 +1220,7 @@ user_pref("browser.pagethumbnails.capturing_disabled", true); // (hidden pref)
user_pref("network.jar.open-unsafe-types", false);
/* 2609: disable exposure of system colors to CSS or canvas (FF44+)
* [NOTE] see [2] bug may cause black on black for elements with undefined colors
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=232227
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1330876 ***/
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=232227,1330876 ***/
user_pref("ui.use_standins_for_native_colors", true); // (hidden pref)
/* 2610: remove special permissions for certain mozilla domains (FF35+)
* [1] resource://app/defaults/permissions ***/
@ -1276,7 +1272,7 @@ user_pref("general.useragent.compatMode.firefox", false); // default: false
user_pref("browser.uitour.enabled", false);
user_pref("browser.uitour.url", "");
/* 2629: disable remote JAR files being opened, regardless of content type (FF42+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1173171
* [1] https://bugzilla.mozilla.org/1173171
* [2] https://www.fxsitecompat.com/en-CA/docs/2015/jar-protocol-support-has-been-disabled-by-default/ ***/
user_pref("network.jar.block-remote-files", true);
/* 2630: prevent accessibility services from accessing your browser [RESTART]
@ -1285,7 +1281,7 @@ user_pref("network.jar.block-remote-files", true);
user_pref("accessibility.force_disabled", 1);
/* 2631: block web content in file processes (FF55+)
* [WARNING] [SETUP] You may want to disable this for corporate or developer environments
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1343184 ***/
* [1] https://bugzilla.mozilla.org/1343184 ***/
user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
/* 2632: disable websites overriding Firefox's keyboard shortcuts (FF58+)
* [SETTING] to add site exceptions: Page Info>Permissions>Override Keyboard Shortcuts
@ -1295,11 +1291,11 @@ user_pref("browser.tabs.remote.allowLinkedWebInFileUriProcess", false);
* This is very useful to enable when the browser is sandboxed (e.g. via AppArmor)
* in such a way that it is forbidden to run external applications.
* [SETUP] This may interfere with some users' workflow or methods
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1281959 ***/
* [1] https://bugzilla.mozilla.org/1281959 ***/
user_pref("browser.download.forbid_open_with", true);
/* 2663: disable MathML (Mathematical Markup Language) (FF51+)
* [TEST] http://browserspy.dk/mathml.php
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1173199 ***/
* [1] https://bugzilla.mozilla.org/1173199 ***/
user_pref("mathml.disabled", true);
/* 2664: disable DeviceStorage API
* [1] https://wiki.mozilla.org/WebAPI/DeviceStorageAPI ***/
@ -1317,12 +1313,12 @@ user_pref("devtools.chrome.enabled", false);
user_pref("extensions.enabledScopes", 1); // (hidden pref)
user_pref("extensions.autoDisableScopes", 15);
/* 2670: disable "image/" mime types bypassing CSP (FF51+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1288361 ***/
* [1] https://bugzilla.mozilla.org/1288361 ***/
user_pref("security.block_script_with_wrong_mime", true);
/* 2671: disable in-content SVG (Scalable Vector Graphics) (FF53+)
* [WARNING] SVG is fairly common (~15% of the top 10K sites), so will cause some breakage
* including youtube player controls. Best left for "hardened" or specific profiles.
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1216893 ***/
* [1] https://bugzilla.mozilla.org/1216893 ***/
// user_pref("svg.disabled", true);
/* 2672: enforce Punycode for Internationalized Domain Names to eliminate possible spoofing security risk
* Firefox has *some* protections to mitigate the risk, but it is better to be safe
@ -1339,11 +1335,10 @@ user_pref("network.IDN_show_punycode", true);
* [1] https://developer.mozilla.org/docs/Web/HTTP/CSP ***/
user_pref("security.csp.enable", true); // default: true
/* 2674: enable CSP 1.1 experimental hash-source directive (FF29+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=855326
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=883975 ***/
* [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=855326,883975 ***/
user_pref("security.csp.experimentalEnabled", true);
/* 2675: block top level window data: URIs (FF56+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1331351
* [1] https://bugzilla.mozilla.org/1331351
* [2] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/
* [3] https://www.fxsitecompat.com/en-CA/docs/2017/data-url-navigations-on-top-level-window-will-be-blocked/ ***/
user_pref("security.data_uri.block_toplevel_data_uri_navigations", true);
@ -1355,7 +1350,7 @@ user_pref("security.data_uri.block_toplevel_data_uri_navigations", true);
indexedDB : profile\storage\default
appCache : profile\OfflineCache
serviceWorkers :
***/
***/
user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!");
/* 2701: disable cookies on all sites [SETUP]
* You can set exceptions under site permissions or use an extension
@ -1390,7 +1385,7 @@ user_pref("network.cookie.leave-secure-alone", true); // default: true
/* 2711: clear localStorage and UUID when an extension is uninstalled
* [NOTE] Both preferences must be the same
* [1] https://developer.mozilla.org/Add-ons/WebExtensions/API/storage/local
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1213990 ***/
* [2] https://bugzilla.mozilla.org/1213990 ***/
user_pref("extensions.webextensions.keepStorageOnUninstall", false);
user_pref("extensions.webextensions.keepUuidOnUninstall", false);
/* 2720: disable JS storing data permanently [SETUP]
@ -1402,7 +1397,7 @@ user_pref("extensions.webextensions.keepUuidOnUninstall", false);
user_pref("browser.cache.offline.enable", false);
/* 2731: enforce websites to ask to store data for offline use
* [1] https://support.mozilla.org/questions/1098540
* [2] https://bugzilla.mozilla.org/show_bug.cgi?id=959985 ***/
* [2] https://bugzilla.mozilla.org/959985 ***/
user_pref("offline-apps.allow_by_default", false);
/* 2732: display a notification when websites ask to store data for offline use
* [SETTING-56+] Options>Privacy & Security>Offline Web Content and User Data>Tell you when a website asks...
@ -1501,11 +1496,11 @@ user_pref("privacy.sanitize.timeSpan", 0);
user_pref("_user.js.parrot", "4000 syntax error: the parrot's pegged out");
/* 4001: enable First Party Isolation (FF51+)
* [WARNING] May break cross-domain logins and site functionality until perfected
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1260931 ***/
* [1] https://bugzilla.mozilla.org/1260931 ***/
user_pref("privacy.firstparty.isolate", true);
/* 4002: enforce FPI restriction for window.opener (FF54+)
* [NOTE] Setting this to false may reduce the breakage in 4001
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1319773#c22 ***/
* [1] https://bugzilla.mozilla.org/1319773#c22 ***/
user_pref("privacy.firstparty.isolate.restrict_opener_access", true);
/*** 4500: privacy.resistFingerprinting (RFP)
@ -1517,7 +1512,7 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true);
** 418986 - limit window.screen & CSS media queries leaking identifiable info (FF41+)
[POC] http://ip-check.info/?lang=en (screen, usable screen, and browser window will match)
[NOTE] Does not cover everything yet - https://bugzilla.mozilla.org/show_bug.cgi?id=1216800
[NOTE] Does not cover everything yet - https://bugzilla.mozilla.org/1216800
[NOTE] This will probably make your values pretty unique until you resize or snap the
inner window width + height into standard/common resolutions (such as 1366x768)
To set a size, open a XUL (chrome) page (such as about:config) which is at 100% zoom, hit
@ -1561,17 +1556,17 @@ user_pref("privacy.firstparty.isolate.restrict_opener_access", true);
***/
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
/* 4501: enable privacy.resistFingerprinting (FF41+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=418986 ***/
* [1] https://bugzilla.mozilla.org/418986 ***/
user_pref("privacy.resistFingerprinting", true); // (hidden pref) (not hidden FF55+)
/* 4502: set new window sizes to round to hundreds (FF55+) [SETUP]
* [NOTE] Width will round down to multiples of 200s and height to 100s, to fit your screen.
* The override values are a starting point to round from if you want some control
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1330882
* [1] https://bugzilla.mozilla.org/1330882
* [2] https://hardware.metrics.mozilla.com/ ***/
// user_pref("privacy.window.maxInnerWidth", 1600); // (hidden pref)
// user_pref("privacy.window.maxInnerHeight", 900); // (hidden pref)
/* 4503: disable mozAddonManager Web API (FF57+)
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1384330 ***/
* [1] https://bugzilla.mozilla.org/1384330 ***/
// user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // (hidden pref)
/*** 4600: RFP (4500) ALTERNATIVES [SETUP]
@ -1585,7 +1580,7 @@ user_pref("_user.js.parrot", "4600 syntax error: the parrot's crossed the Jordan
// FF55+
// 4601: [2514] spoof (or limit?) number of CPU cores (FF48+)
// [WARNING] *may* affect core chrome/Firefox performance, will affect content.
// [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1008453
// [1] https://bugzilla.mozilla.org/1008453
// [2] https://trac.torproject.org/projects/tor/ticket/21675
// [3] https://trac.torproject.org/projects/tor/ticket/22127
// [4] https://html.spec.whatwg.org/multipage/workers.html#navigator.hardwareconcurrency
@ -1601,8 +1596,7 @@ user_pref("dom.enable_performance", false);
// [WARNING] [SETUP] Optional protection depending on your device
// [1] https://trac.torproject.org/projects/tor/ticket/15758
// [2] https://blog.lukaszolejnik.com/stealing-sensitive-browser-data-with-the-w3c-ambient-light-sensor-api/
// [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1357733
// [4] https://bugzilla.mozilla.org/show_bug.cgi?id=1292751
// [3] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1357733,1292751
// user_pref("device.sensors.enabled", false);
// 4605: [2515] disable site specific zoom
// Zoom levels affect screen res and are highly fingerprintable. This does not stop you using
@ -1617,7 +1611,7 @@ user_pref("browser.zoom.siteSpecific", false);
// e.g. bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none
// [1] https://developer.mozilla.org/docs/Web/API/Network_Information_API
// [2] https://wicg.github.io/netinfo/
// [3] https://bugzilla.mozilla.org/show_bug.cgi?id=960426
// [3] https://bugzilla.mozilla.org/960426
user_pref("dom.netinfo.enabled", false);
// 4608: [2021] disable the SpeechSynthesis (Text-to-Speech) part of the Web Speech API
// [1] https://developer.mozilla.org/docs/Web/API/Web_Speech_API
@ -1628,7 +1622,7 @@ user_pref("media.webspeech.synth.enabled", false);
// FF57+
// 4610: [2506] disable video statistics - JS performance fingerprinting (FF25+)
// [1] https://trac.torproject.org/projects/tor/ticket/15757
// [2] https://bugzilla.mozilla.org/show_bug.cgi?id=654550
// [2] https://bugzilla.mozilla.org/654550
user_pref("media.video_stats.enabled", false);
// 4611: [2509] disable touch events
// fingerprinting attack vector - leaks screen res & actual screen coordinates
@ -1666,7 +1660,7 @@ user_pref("_user.js.parrot", "4700 syntax error: the parrot's taken 'is last bow
// user_pref("general.useragent.override", "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0"); // (hidden pref)
/* 4702: navigator.buildID (see gecko.buildID in about:config) reveals build time
* down to the second which defeats user agent spoofing and can compromise OS etc
* [1] https://bugzilla.mozilla.org/show_bug.cgi?id=583181 ***/
* [1] https://bugzilla.mozilla.org/583181 ***/
// user_pref("general.buildID.override", "20100101"); // (hidden pref)
/* 4703: navigator.appName ***/
// user_pref("general.appname.override", "Netscape"); // (hidden pref)
@ -1720,101 +1714,101 @@ user_pref("_user.js.parrot", "5000 syntax error: this is an ex-parrot!");
user_pref("_user.js.parrot", "9999 syntax error: the parrot's deprecated!");
/* FF42 and older
// 2607: (25+) disable page thumbnails - replaced by browser.pagethumbnails.capturing_disabled
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=897811
// [-] https://bugzilla.mozilla.org/897811
user_pref("pageThumbs.enabled", false);
// 2503: (31+) disable network API - replaced by dom.netinfo.enabled
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=960426
// [-] https://bugzilla.mozilla.org/960426
user_pref("dom.network.enabled", false);
// 2620: (35+) disable WebSockets
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1091016
// [-] https://bugzilla.mozilla.org/1091016
user_pref("network.websocket.enabled", false);
// 1610: (36+) set DNT "value" to "not be tracked" (FF21+)
// [1] http://kb.mozillazine.org/Privacy.donottrackheader.value
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1042135#c101
// [-] https://bugzilla.mozilla.org/1042135#c101
// user_pref("privacy.donottrackheader.value", 1);
// 2023: (37+) disable camera autofocus callback
// The API will be superseded by the WebRTC Capture and Stream API
// [1] https://developer.mozilla.org/docs/Archive/B2G_OS/API/CameraControl
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1107683
// [-] https://bugzilla.mozilla.org/1107683
user_pref("camera.control.autofocus_moving_callback.enabled", false);
// 0415: (41+) disable reporting URLs (safe browsing) - removed or replaced by various
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1109475
// [-] https://bugzilla.mozilla.org/1109475
user_pref("browser.safebrowsing.reportErrorURL", ""); // browser.safebrowsing.reportPhishMistakeURL
user_pref("browser.safebrowsing.reportGenericURL", ""); // removed
user_pref("browser.safebrowsing.reportMalwareErrorURL", ""); // browser.safebrowsing.reportMalwareMistakeURL
user_pref("browser.safebrowsing.reportMalwareURL", ""); // removed
user_pref("browser.safebrowsing.reportURL", ""); // removed
// 0702: (41+) disable HTTP2 (draft)
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1132357
// [-] https://bugzilla.mozilla.org/1132357
user_pref("network.http.spdy.enabled.http2draft", false);
// 1804: (41+) disable plugin enumeration
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1169945
// [-] https://bugzilla.mozilla.org/1169945
user_pref("plugins.enumerable_names", "");
// 2803: (42+) clear passwords on shutdown
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1102184
// [-] https://bugzilla.mozilla.org/1102184
// user_pref("privacy.clearOnShutdown.passwords", false);
// 5002: (42+) disable warning when a domain requests full screen
// replaced by setting full-screen-api.warning.timeout to zero
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1160017
// [-] https://bugzilla.mozilla.org/1160017
// user_pref("full-screen-api.approval-required", false);
// ***/
/* FF43
// 0410's: disable safebrowsing urls & updates - replaced by various
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1107372
// [-] https://bugzilla.mozilla.org/1107372
// user_pref("browser.safebrowsing.gethashURL", ""); // browser.safebrowsing.provider.google.gethashURL
// user_pref("browser.safebrowsing.updateURL", ""); // browser.safebrowsing.provider.google.updateURL
user_pref("browser.safebrowsing.malware.reportURL", ""); // browser.safebrowsing.provider.google.reportURL
// 0420's: disable tracking protection - replaced by various
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1107372
// [-] https://bugzilla.mozilla.org/1107372
// user_pref("browser.trackingprotection.gethashURL", ""); // browser.safebrowsing.provider.mozilla.gethashURL
// user_pref("browser.trackingprotection.updateURL", ""); // browser.safebrowsing.provider.mozilla.updateURL
// 1803: remove plugin finder service
// [1] http://kb.mozillazine.org/Pfs.datasource.url
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1202193
// [-] https://bugzilla.mozilla.org/1202193
user_pref("pfs.datasource.url", "");
// 5003: disable new search panel UI
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1119250
// [-] https://bugzilla.mozilla.org/1119250
// user_pref("browser.search.showOneOffButtons", false);
// ***/
/* FF44
// 0414: disable safebrowsing's real-time binary checking (google) (FF43+)
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1237103
// [-] https://bugzilla.mozilla.org/1237103
user_pref("browser.safebrowsing.provider.google.appRepURL", ""); // browser.safebrowsing.appRepURL
// 1200's: block rc4 whitelist
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1215796
// [-] https://bugzilla.mozilla.org/1215796
user_pref("security.tls.insecure_fallback_hosts.use_static_list", false);
// 2301: disable SharedWorkers
// [1] https://trac.torproject.org/projects/tor/ticket/15562
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1207635
// [-] https://bugzilla.mozilla.org/1207635
user_pref("dom.workers.sharedWorkers.enabled", false);
// 2403: disable scripts changing images
// [TEST] https://www.w3schools.com/jsref/tryit.asp?filename=tryjsref_img_src2
// [WARNING] Will break some sites such as Google Maps and a lot of web apps
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=773429
// [-] https://bugzilla.mozilla.org/773429
// user_pref("dom.disable_image_src_set", true);
// ***/
/* FF45
// 1021b: disable deferred level of storing extra session data 0=all 1=http-only 2=none
// extra session data contains contents of forms, scrollbar positions, cookies and POST data
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1235379
// [-] https://bugzilla.mozilla.org/1235379
user_pref("browser.sessionstore.privacy_level_deferred", 2);
// ***/
/* FF46
// 0333: disable health report
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1234526
// [-] https://bugzilla.mozilla.org/1234526
user_pref("datareporting.healthreport.service.enabled", false); // (hidden pref)
user_pref("datareporting.healthreport.documentServerURI", ""); // (hidden pref)
// 0334b: disable FHR (Firefox Health Report) v2 data being sent to Mozilla servers
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1234522
// [-] https://bugzilla.mozilla.org/1234522
user_pref("datareporting.policy.dataSubmissionEnabled.v2", false);
// 0414: disable safebrowsing pref - replaced by browser.safebrowsing.downloads.remote.url
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1239587
// [-] https://bugzilla.mozilla.org/1239587
user_pref("browser.safebrowsing.appRepURL", ""); // Google application reputation check
// 0420: disable polaris (part of Tracking Protection, never used in stable)
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1235565
// [-] https://bugzilla.mozilla.org/1235565
// user_pref("browser.polaris.enabled", false);
// 0510: disable "Pocket" - replaced by extensions.pocket.*
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1215694
// [-] https://bugzilla.mozilla.org/1215694
user_pref("browser.pocket.enabled", false);
user_pref("browser.pocket.api", "");
user_pref("browser.pocket.site", "");
@ -1823,14 +1817,14 @@ user_pref("browser.pocket.oAuthConsumerKey", "");
/* FF47
// 0330b: set unifiedIsOptIn to make sure telemetry respects OptIn choice and that telemetry
// is enabled ONLY for people that opted into it, even if unified Telemetry is enabled
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1236580
// [-] https://bugzilla.mozilla.org/1236580
user_pref("toolkit.telemetry.unifiedIsOptIn", true); // (hidden pref)
// 0333b: disable about:healthreport page UNIFIED
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1236580
// [-] https://bugzilla.mozilla.org/1236580
user_pref("datareporting.healthreport.about.reportUrlUnified", "data:text/plain,");
// 0807: disable history manipulation
// [1] https://developer.mozilla.org/docs/Web/API/History_API
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1249542
// [-] https://bugzilla.mozilla.org/1249542
user_pref("browser.history.allowPopState", false);
user_pref("browser.history.allowPushState", false);
user_pref("browser.history.allowReplaceState", false);
@ -1838,14 +1832,14 @@ user_pref("browser.history.allowReplaceState", false);
/* FF48
// 0806: disable 'unified complete': 'Search with [default search engine]'
// [-] http://techdows.com/2016/05/firefox-unified-complete-aboutconfig-preference-removed.html
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1181078
// [-] https://bugzilla.mozilla.org/1181078
user_pref("browser.urlbar.unifiedcomplete", false);
// ***/
/* FF49
// 0372: disable "Hello"
// [1] https://www.mozilla.org/privacy/archive/hello/2016-03/
// [2] https://security.stackexchange.com/questions/94284/how-secure-is-firefox-hello
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1287827
// [-] https://bugzilla.mozilla.org/1287827
user_pref("loop.enabled", false);
user_pref("loop.server", "");
user_pref("loop.feedback.formURL", "");
@ -1856,72 +1850,71 @@ user_pref("loop.facebook.fallbackUrl", "");
user_pref("loop.facebook.shareUrl", "");
user_pref("loop.logDomains", false);
// 2202: disable new window scrollbars being hidden
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1257887
// [-] https://bugzilla.mozilla.org/1257887
user_pref("dom.disable_window_open_feature.scrollbars", true);
// 2303: disable push notification (UDP wake-up)
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1265914
// [-] https://bugzilla.mozilla.org/1265914
user_pref("dom.push.udp.wakeupEnabled", false);
// ***/
/* FF50
// 0101: disable Windows10 intro on startup [WINDOWS]
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1274633
// [-] https://bugzilla.mozilla.org/1274633
user_pref("browser.usedOnWindows10.introURL", "");
// 0308: disable plugin update notifications
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1277905
// [-] https://bugzilla.mozilla.org/1277905
user_pref("plugins.update.notifyUser", false);
// 0410: disable "Block dangerous and deceptive content" - replaced by browser.safebrowsing.phishing.enabled
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1025965
// [-] https://bugzilla.mozilla.org/1025965
// user_pref("browser.safebrowsing.enabled", false);
// 1266: disable rc4 ciphers
// [1] https://trac.torproject.org/projects/tor/ticket/17369
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1268728
// [-] https://bugzilla.mozilla.org/1268728
// [-] https://www.fxsitecompat.com/en-CA/docs/2016/rc4-support-has-been-completely-removed/
user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha", false);
user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha", false);
user_pref("security.ssl3.rsa_rc4_128_md5", false);
user_pref("security.ssl3.rsa_rc4_128_sha", false);
// 1809: remove Mozilla's plugin update URL
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1277905
// [-] https://bugzilla.mozilla.org/1277905
user_pref("plugins.update.url", "");
// ***/
/* FF51
// 0702: disable SPDY
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1248197
// [-] https://bugzilla.mozilla.org/1248197
user_pref("network.http.spdy.enabled.v3-1", false);
// 1851: delay play of videos until they're visible
// [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1180563
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1262053
// [1] https://bugzilla.mozilla.org/1180563
// [-] https://bugzilla.mozilla.org/1262053
user_pref("media.block-play-until-visible", true);
// 2504: disable virtual reality devices
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1250244
// [-] https://bugzilla.mozilla.org/1250244
user_pref("dom.vr.oculus050.enabled", false);
// ***/
/* FF52
// 1601: disable referer from an SSL Website
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1308725
// [-] https://bugzilla.mozilla.org/1308725
user_pref("network.http.sendSecureXSiteReferrer", false);
// 1850: disable Adobe EME "Primetime CDM" (Content Decryption Module)
// [1] https://trac.torproject.org/projects/tor/ticket/16285
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1329538 // FF52
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1337121 // FF52
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1329543 // FF53
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1329538,1337121 // FF52
// [-] https://bugzilla.mozilla.org/1329543 // FF53
user_pref("media.gmp-eme-adobe.enabled", false);
user_pref("media.gmp-eme-adobe.visible", false);
user_pref("media.gmp-eme-adobe.autoupdate", false);
// 2405: disable WebTelephony API
// [1] https://wiki.mozilla.org/WebAPI/Security/WebTelephony
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1309719
// [-] https://bugzilla.mozilla.org/1309719
user_pref("dom.telephony.enabled", false);
// 2502: disable Battery Status API
// Initially a Linux issue (high precision readout) that was fixed.
// However, it is still another metric for fingerprinting, used to raise entropy.
// e.g. do you have a battery or not, current charging status, charge level, times remaining etc
// [1] https://techcrunch.com/2015/08/04/battery-attributes-can-be-used-to-track-web-users/
// [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1124127
// [2] https://bugzilla.mozilla.org/1124127
// [3] https://www.w3.org/TR/battery-status/
// [4] https://www.theguardian.com/technology/2016/aug/02/battery-status-indicators-tracking-online
// [NOTE] From FF52+ Battery Status API is only available in chrome/privileged code.
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1313580
// [-] https://bugzilla.mozilla.org/1313580
user_pref("dom.battery.enabled", false);
// ***/
@ -1929,57 +1922,54 @@ user_pref("dom.battery.enabled", false);
// [NOTE] replace the * with a slash in the line above to re-enable them if you're using ESR52.x.x
// FF53
// 1265: block rc4 fallback
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1130670
// [-] https://bugzilla.mozilla.org/1130670
user_pref("security.tls.unrestricted_rc4_fallback", false);
// 1806: disable Acrobat, Quicktime, WMP (the string = min version number allowed)
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1317109
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1317110
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1317108
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1317108,1317109,1317110
user_pref("plugin.scan.Acrobat", "99999");
user_pref("plugin.scan.Quicktime", "99999");
user_pref("plugin.scan.WindowsMediaPlayer", "99999");
// 2022: disable screensharing
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1329562
// [-] https://bugzilla.mozilla.org/1329562
user_pref("media.getusermedia.screensharing.allow_on_old_platforms", false);
// 2507: disable keyboard fingerprinting
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1322736
// [-] https://bugzilla.mozilla.org/1322736
user_pref("dom.beforeAfterKeyboardEvent.enabled", false);
// * * * /
// FF54
// 0415: disable reporting URLs (safe browsing)
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1288633
// [-] https://bugzilla.mozilla.org/1288633
user_pref("browser.safebrowsing.reportMalwareMistakeURL", "");
user_pref("browser.safebrowsing.reportPhishMistakeURL", "");
// 1830: block websites detecting DRM is disabled
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1242321
// [-] https://bugzilla.mozilla.org/1242321
user_pref("media.eme.apiVisible", false);
// 2425: disable Archive Reader API
// i.e. reading archive contents directly in the browser, through DOM file objects
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1342361
// [-] https://bugzilla.mozilla.org/1342361
user_pref("dom.archivereader.enabled", false);
// * * * /
// FF55
// 0209: disable geolocation on non-secure origins (FF54+)
// [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1269531
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1072859
// [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1269531,1072859
user_pref("geo.security.allowinsecure", false);
// 0336: disable "Heartbeat" (Mozilla user rating telemetry) (FF37+)
// [1] https://trac.torproject.org/projects/tor/ticket/18738
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1361578
// [-] https://bugzilla.mozilla.org/1361578
user_pref("browser.selfsupport.enabled", false); // (hidden pref)
user_pref("browser.selfsupport.url", "");
// 0360: disable new tab "pings"
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1241390
// [-] https://bugzilla.mozilla.org/1241390
user_pref("browser.newtabpage.directory.ping", "data:text/plain,");
// 0861: disable saving form history on secure websites
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1361220
// [-] https://bugzilla.mozilla.org/1361220
user_pref("browser.formfill.saveHttpsForms", false);
// 0863: disable Form Autofill (FF54+) - replaced by extensions.formautofill.*
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1364334
// [-] https://bugzilla.mozilla.org/1364334
user_pref("browser.formautofill.enabled", false);
// 2410: disable User Timing API
// [1] https://trac.torproject.org/projects/tor/ticket/16336
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1344669
// [-] https://bugzilla.mozilla.org/1344669
user_pref("dom.enable_user_timing", false);
// 2507: disable keyboard fingerprinting (FF38+) (physical keyboards)
// The Keyboard API allows tracking the "read parameter" of pressed keys in forms on
@ -1988,28 +1978,27 @@ user_pref("dom.enable_user_timing", false);
// [WARNING] Don't use if Android + physical keyboard
// [1] https://developer.mozilla.org/docs/Web/API/KeyboardEvent/code
// [2] https://www.privacy-handbuch.de/handbuch_21v.htm
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1352949
// [-] https://bugzilla.mozilla.org/1352949
user_pref("dom.keyboardevent.code.enabled", false);
// 5015: disable tab animation - replaced by toolkit.cosmeticAnimations.enabled
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1352069
// [-] https://bugzilla.mozilla.org/1352069
user_pref("browser.tabs.animate", false);
// 5016: disable fullscreeen animation - replaced by toolkit.cosmeticAnimations.enabled
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1352069
// [-] https://bugzilla.mozilla.org/1352069
user_pref("browser.fullscreen.animate", false);
// * * * /
// FF56
// 0515: disable Screenshots (rollout pref only) (FF54+)
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1386333
// [-] https://bugzilla.mozilla.org/1386333
// user_pref("extensions.screenshots.system-disabled", true);
// 0517: disable Form Autofill (FF55+) - replaced by extensions.formautofill.available
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1385201
// [-] https://bugzilla.mozilla.org/1385201
user_pref("extensions.formautofill.experimental", false);
// * * * /
// FF57
// 0374: disable "social" integration
// [1] https://developer.mozilla.org/docs/Mozilla/Projects/Social_API
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1388902
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1406193 (leftover prefs removed in FF58)
// [-] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388902,1406193 (some leftovers were removed in FF58)
user_pref("social.whitelist", "");
user_pref("social.toast-notifications.enabled", false);
user_pref("social.shareDirectory", "");
@ -2018,18 +2007,18 @@ user_pref("social.directories", "");
user_pref("social.share.activationPanelEnabled", false);
user_pref("social.enabled", false); // (hidden pref)
// 1830: disable DRM's EME WideVineAdapter
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1395468
// [-] https://bugzilla.mozilla.org/1395468
user_pref("media.eme.chromium-api.enabled", false); // (FF55+)
// 2611: disable WebIDE extension downloads (Valence)
// [1] https://trac.torproject.org/projects/tor/ticket/16222
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1393497
// [-] https://bugzilla.mozilla.org/1393497
user_pref("devtools.webide.autoinstallFxdtAdapters", false);
// 2612: disable SimpleServiceDiscovery - which can bypass proxy settings - e.g. Roku
// [1] https://trac.torproject.org/projects/tor/ticket/16222
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1393582
// [-] https://bugzilla.mozilla.org/1393582
user_pref("browser.casting.enabled", false);
// 5022: hide recently bookmarked items (you still have the original bookmarks) (FF49+)
// [-] https://bugzilla.mozilla.org/show_bug.cgi?id=1401238
// [-] https://bugzilla.mozilla.org/1401238
user_pref("browser.bookmarks.showRecentlyBookmarked", false);
// * * * /
// FF59
@ -2056,7 +2045,7 @@ user_pref("dom.flyweb.enabled", false);
// to be upgraded to HTTPS internally but disable sending out HSTS Priming requests, because
// those may cause noticeable delays e.g. requests time out or are not handled well by servers
// [NOTE] If you want to use the priming requests make sure 'use_hsts' is also true
// [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1246540#c145
// [1] https://bugzilla.mozilla.org/1246540#c145
// [-] https://bugzilla.mozilla.org/1424917
user_pref("security.mixed_content.use_hsts", true);
user_pref("security.mixed_content.send_hsts_priming", false);