README.md

   1 # user.js
   2
   3 **Firefox configuration hardening**
   4
   5 A [user.js](http://kb.mozillazine.org/User.js_file) configuration file for [Mozilla Firefox](https://www.mozilla.org/en-US/firefox/new/) designed to harden browser settings and make it more secure.
   6
   7 **This is a default template with every possible hardening measure enforced. See the [relaxed branch](https://github.com/pyllyukko/user.js/tree/relaxed) for a variant providing more usability**
   8
   9 [![Build Status](https://github.com/pyllyukko/user.js/actions/workflows/ci.yml/badge.svg)](https://github.com/pyllyukko/user.js/actions)
  10
  11 ### Main goals
  12
  13 * Limit the possibilities to track the user through [web analytics](https://en.wikipedia.org/wiki/Web_analytics).
  14 * Harden the browser against known data disclosure or code execution vulnerabilities.
  15 * Limit the browser from storing anything even remotely sensitive persistently.
  16 * Make sure the browser doesn't reveal too much information to [shoulder surfers](https://en.wikipedia.org/wiki/Shoulder_surfing_%28computer_security%29).
  17 * Harden the browser's encryption (cipher suites, protocols).
  18 * Limit possibilities to uniquely identify the browser/device using [browser fingerprinting](https://en.wikipedia.org/wiki/Device_fingerprint).
  19 * Hopefully limit the attack surface by disabling various features.
  20 * Still be usable in daily use.
  21
  22 ### How to achieve this?
  23
  24 There are several parts to all this and they are:
  25
  26 * [Downloading](#download) and [installing](#installation) the `user.js` file.
  27 * Reading about and applying [further hardening](#further-hardening) techniques.
  28 * _Optional:_ Modifying `user.js` to adapt it to your web browser usage.
  29
  30 ----------------------------------------------
  31
  32 * [Download](#download)
  33 * [Installation](#installation)
  34 * [What does it do?](#what-does-it-do)
  35 * [Further hardening](#further-hardening)
  36 * [Known problems and limitations](#known-problems-and-limitations)
  37 * [FAQ](#faq)
  38 * [Contributing](#contributing)
  39 * [Online tests](#online-tests)
  40 * [References](#references)
  41 * [Maintenance](#maintenance)
  42
  43
  44 ----------------------------------------------
  45
  46 ## Download
  47
  48 Different download methods are available:
  49
  50  * Clone using git: `git clone https://github.com/pyllyukko/user.js`
  51  * Download and extract the [ZIP file](https://github.com/pyllyukko/user.js/archive/master.zip) containing the latest version.
  52  * Download the latest `user.js` [directly](https://raw.githubusercontent.com/pyllyukko/user.js/master/user.js)
  53
  54 ## Installation
  55
  56 ### Backups
  57
  58 Do note that these settings alter your browser behaviour quite a bit, so it is recommended to either create a completely new [profile][15] for Firefox or backup your existing [profile directory](http://kb.mozillazine.org/Profile_folder_-_Firefox) before putting the `user.js` file in place.
  59
  60 To enable the Profile Manager, run Firefox with [command-line arguments](http://kb.mozillazine.org/Command_line_arguments): `firefox --no-remote -P`
  61
  62 ### Single profile installation
  63
  64 Copy `user.js` in your current user profile directory, or (recommended) to a fresh, newly created Firefox profile directory.
  65
  66 The file should be located at:
  67
  68 | OS                         | Path                                                                                                                                          |
  69 | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
  70 | Windows 7                  | `%APPDATA%\Mozilla\Firefox\Profiles\XXXXXXXX.your_profile_name\user.js`                                                                       |
  71 | Linux                      | `~/.mozilla/firefox/XXXXXXXX.your_profile_name/user.js`                                                                                       |
  72 | OS X                       | `~/Library/Application Support/Firefox/Profiles/XXXXXXXX.your_profile_name`                                                                   |
  73 | Android                    | `/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name` and see [issue #14](https://github.com/pyllyukko/user.js/issues/14) |
  74 | Sailfish OS + Alien Dalvik | `/opt/alien/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name`                                                           |
  75 | Windows (portable)         | `[firefox directory]\Data\profile\`                                                                                                           |
  76
  77 With this installation method, if you change any of `user.js` settings through [`about:config`](http://kb.mozillazine.org/About:config) or Firefox preferences dialogs, they will be reset to the `user.js` defined values after you restart Firefox. This makes sure they're always back to secure defaults when starting the browser. However this prevents persistently changing settings you don't consider appropriate. Either edit `user.js` directly, or use the system-wide installation method described below.
  78
  79 ### System-wide installation (all platforms)
  80
  81 Generate a file suitable for system-wide installation, by running `make` with one of the following targets:
  82
  83 * `systemwide_user.js`: (the value will be used as default value for all Firefox Profiles where it is not explicitly set, it can be changed in `about:config` and is kept across browser sessions)
  84 * `locked_user.js`: (the value will be used as default value on Firefox profile creation, will be locked and can't be changed) in `user.js` or in Firefox's `about:config` or settings.
  85 * `debian_locked.js`: Debian specific. Users are not able to override preferences. See [#415](https://github.com/pyllyukko/user.js/issues/415).
  86
  87 Copy the produced file to the Firefox installation directory. The file should be located at:
  88
  89 | OS                        | Path                                                                         |
  90 | ------------------------- | ---------------------------------------------------------------------------- |
  91 | Windows                   | `C:\Program Files (x86)\Mozilla Firefox\mozilla.cfg`                         |
  92 | Linux                     | `/etc/firefox/syspref.js`, for older versions: `/etc/firefox/firefox.js`     |
  93 | Linux (Debian)            | `/etc/firefox-esr/firefox-esr.js`                                            |
  94 | Linux (Gentoo, Archlinux) | `/usr/lib/firefox/mozilla.cfg`, might also be `/usr/lib32/` or `/usr/lib64/` |
  95 | OS X                      | `/Applications/Firefox.app/Contents/Resources/mozilla.cfg`                   |
  96
  97 #### Additional installation steps for Windows / OS X / Gentoo / Archlinux
  98
  99 Create `local-settings.js` in Firefox installation directory, with the following contents:
 100
 101 ```
 102 pref("general.config.obscure_value", 0);
 103 pref("general.config.filename", "mozilla.cfg");
 104 ```
 105
 106 This file should be located at:
 107
 108 | OS                        | Path                                                                            |
 109 | ------------------------- | ------------------------------------------------------------------------------- |
 110 | Windows                   | `C:\Program Files (x86)\Mozilla Firefox\defaults\pref\`                         |
 111 | OS X                      | `/Applications/Firefox.app/Contents/Resources/defaults/pref`                    |
 112 | Linux (Gentoo, Archlinux) | `/usr/lib/firefox/defaults/pref/`, might also be `/usr/lib32/` or `/usr/lib64/` |
 113
 114 If `mozilla.cfg` still fails to load, you must add a blank comment to the top of `mozilla.cfg` like so:
 115 ```
 116 //
 117 ```
 118
 119
 120 ### Additional settings (policies)
 121
 122 Not all Firefox settings can be changed through `user.js` - some must be set in a separate **policies.json** file [[1]](https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise). These policies apply system-wide.
 123
 124 To install [policies.json](policies.json) from this repository, simply copy it to the appropriate directory (create it if it does not exist):
 125
 126 | OS                        | Path                                                                            |
 127 | ------------------------- | ------------------------------------------------------------------------------- |
 128 | Windows                   | `C:\Program Files (x86)\Mozilla Firefox\distribution\`                          |
 129 | OS X                      | `/Applications/Firefox.app/distribution\`                                       |
 130 | Linux (Debian)            | `/etc/firefox-esr/policies/`                                                    |
 131
 132 Note that JSON does not support comments, hence settings are documented in custom `*_comment` keys. Mozilla maintains a list of available policies: [[1]](https://mozilla.github.io/policy-templates/) [[2]](https://github.com/mozilla/policy-templates). The [Enterprise Policy Generator](https://addons.mozilla.org/en-US/firefox/addon/enterprise-policy-generator/) add-on can be used to generate `policies.json` files from a graphical interface.
 133
 134
 135 ### Updating using git
 136
 137 For any of the above methods, you can keep your browser's `user.js` with the latest version available here: Clone the repository, and create a symbolic link from the appropriate location to the `user.js` file in the repository. Just run `git pull` in the repository when you want to update, then restart Firefox:
 138
 139 ```
 140 cd ~/.mozilla/firefox
 141 git clone 'https://github.com/pyllyukko/user.js.git'
 142 cd XXXXXXXX.your_profile_name
 143 ln -s ../user.js/user.js user.js
 144 ```
 145
 146 ### Verifying
 147
 148 Verify that the settings are effective from [about:support](http://kb.mozillazine.org/Troubleshooting_Information_report#Modified_Preferences) (check the "Important Modified Preferences" and "user.js Preferences" sections).
 149
 150 Verify that policies are effective from [about:policies](https://support.mozilla.org/en-US/kb/see-active-policies-firefox-enterprise).
 151
 152 --------------------------------------------
 153
 154 ## What does it do?
 155
 156 There's a whole lot of settings that this modifies and they are divided in the following sections.
 157
 158 Some of the settings in this `user.js` file might seem redundant, as some of them are already set to the same values by default. We chose to explicitely set their values, which ensures these settings are enforced if a future Firefox update changes the default value.
 159
 160 <!-- BEGIN SECTION -->
 161
 162 ### HTML5 / APIs / DOM
 163
 164 HTML5 / [APIs](https://wiki.mozilla.org/WebAPI) / [DOM](https://en.wikipedia.org/wiki/Document_Object_Model) related settings. Mozilla is keen to implement every new HTML5 feature, which have had unforeseen security or privacy implications. This section disables many of those new and yet to be proven technologies.
 165 * Disable Service Workers [ [1](https://developer.mozilla.org/en-US/docs/Web/API/Worker) [2](https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker_API) [3](https://wiki.mozilla.org/Firefox/Push_Notifications#Service_Workers) ]
 166 * Disable web notifications [ [1](https://support.mozilla.org/en-US/questions/1140439) ]
 167 * Disable DOM timing API [ [1](https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI) [2](https://www.w3.org/TR/navigation-timing/#privacy) ]
 168 * Disable resource timing API [ [1](https://www.w3.org/TR/resource-timing/#privacy-security) ]
 169 * Make sure the User Timing API does not provide a new high resolution timestamp [ [1](https://trac.torproject.org/projects/tor/ticket/16336) [2](https://www.w3.org/TR/2013/REC-user-timing-20131212/#privacy-security) ]
 170 * Disable Web Audio API [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1288359) ]
 171 * Disable Location-Aware Browsing (geolocation) [ [1](https://www.mozilla.org/en-US/firefox/geolocation/) ]
 172 * When geolocation is enabled, use Mozilla geolocation service instead of Google [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=689252) ]
 173 * When geolocation is enabled, don't log geolocation requests to the console
 174 * Disable raw TCP socket support (mozTCPSocket) [ [1](https://trac.torproject.org/projects/tor/ticket/18863) [2](https://www.mozilla.org/en-US/security/advisories/mfsa2015-97/) [3](https://developer.mozilla.org/docs/Mozilla/B2G_OS/API/TCPSocket) ]
 175 * Disable leaking network/browser connection information via Javascript
 176 * Disable network API (Firefox < 32) [ [1](https://developer.mozilla.org/en-US/docs/Web/API/Connection/onchange) [2](https://www.torproject.org/projects/torbrowser/design/#fingerprinting-defenses) ]
 177 * Disable WebRTC entirely to prevent leaking internal IP addresses (Firefox < 42)
 178 * Don't reveal your internal IP when WebRTC is enabled (Firefox >= 42) [ [1](https://wiki.mozilla.org/Media/WebRTC/Privacy) [2](https://github.com/beefproject/beef/wiki/Module%3A-Get-Internal-IP-WebRTC) ]
 179 * Disable WebRTC getUserMedia, screen sharing, audio capture, video capture [ [1](https://wiki.mozilla.org/Media/getUserMedia) [2](https://blog.mozilla.org/futurereleases/2013/01/12/capture-local-camera-and-microphone-streams-with-getusermedia-now-enabled-in-firefox/) [3](https://developer.mozilla.org/en-US/docs/Web/API/Navigator) ]
 180 * Disable battery API (Firefox < 52) [ [1](https://developer.mozilla.org/en-US/docs/Web/API/BatteryManager) [2](https://bugzilla.mozilla.org/show_bug.cgi?id=1313580) ]
 181 * Disable telephony API [ [1](https://wiki.mozilla.org/WebAPI/Security/WebTelephony) ]
 182 * Disable "beacon" asynchronous HTTP transfers (used for analytics) [ [1](https://developer.mozilla.org/en-US/docs/Web/API/navigator.sendBeacon) ]
 183 * Disable clipboard event detection (onCut/onCopy/onPaste) via Javascript [ [1](https://web.archive.org/web/20210416195937/https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/dom.event.clipboardevents.enabled) [2](https://github.com/pyllyukko/user.js/issues/287) ]
 184 * Disable "copy to clipboard" functionality via Javascript (Firefox >= 41) [ [1](https://hg.mozilla.org/mozilla-central/rev/2f9f8ea4b9c3) [2](https://github.com/pyllyukko/user.js/issues/287) ]
 185 * Disable speech recognition [ [1](https://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html) [2](https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition) [3](https://wiki.mozilla.org/HTML5_Speech_API) ]
 186 * Disable speech synthesis [ [1](https://developer.mozilla.org/en-US/docs/Web/API/SpeechSynthesis) ]
 187 * Disable sensor API [ [1](https://wiki.mozilla.org/Sensor_API) ]
 188 * Disable pinging URIs specified in HTML <a> ping= attributes [ [1](http://kb.mozillazine.org/Browser.send_pings) ]
 189 * When browser pings are enabled, only allow pinging the same host as the origin page [ [1](http://kb.mozillazine.org/Browser.send_pings.require_same_host) ]
 190 * Disable gamepad API to prevent USB device enumeration [ [1](https://www.w3.org/TR/gamepad/) [2](https://trac.torproject.org/projects/tor/ticket/13023) ]
 191 * Disable virtual reality devices APIs [ [1](https://developer.mozilla.org/en-US/Firefox/Releases/36#Interfaces.2FAPIs.2FDOM) [2](https://developer.mozilla.org/en-US/docs/Web/API/WebVR_API) ]
 192 * Disable vibrator API
 193 * Disable Archive API (Firefox < 54) [ [1](https://wiki.mozilla.org/WebAPI/ArchiveAPI) [2](https://bugzilla.mozilla.org/show_bug.cgi?id=1342361) ]
 194 * Disable webGL [ [1](https://en.wikipedia.org/wiki/WebGL) [2](https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/) ]
 195 * When webGL is enabled, use the minimum capability mode
 196 * When webGL is enabled, disable webGL extensions [ [1](https://developer.mozilla.org/en-US/docs/Web/API/WebGL_API#WebGL_debugging_and_testing) ]
 197 * When webGL is enabled, force enabling it even when layer acceleration is not supported [ [1](https://trac.torproject.org/projects/tor/ticket/18603) ]
 198 * When webGL is enabled, do not expose information about the graphics driver [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1171228) [2](https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug_renderer_info) ]
 199 * Spoof dual-core CPU [ [1](https://trac.torproject.org/projects/tor/ticket/21675) [2](https://bugzilla.mozilla.org/show_bug.cgi?id=1360039) ]
 200 * Disable WebAssembly [ [1](https://webassembly.org/) [2](https://en.wikipedia.org/wiki/WebAssembly) [3](https://trac.torproject.org/projects/tor/ticket/21549) ]
 201
 202 ### Misc
 203
 204 Settings that do not belong to other sections or are user specific preferences.
 205 * Disable face detection
 206 * Disable GeoIP lookup on your address to set default search engine region [ [1](https://trac.torproject.org/projects/tor/ticket/16254) [2](https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine) ]
 207 * Set Accept-Language HTTP header to en-US regardless of Firefox localization [ [1](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language) ]
 208 * Don't use OS values to determine locale, force using Firefox locale setting [ [1](http://kb.mozillazine.org/Intl.locale.matchOS) ]
 209 * Don't use Mozilla-provided location-specific search engines
 210 * Do not automatically send selection to clipboard on some Linux platforms [ [1](http://kb.mozillazine.org/Clipboard.autocopy) ]
 211 * Prevent leaking application locale/date format using JavaScript [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=867501) [2](https://hg.mozilla.org/mozilla-central/rev/52d635f2b33d) ]
 212 * Do not submit invalid URIs entered in the address bar to the default search engine [ [1](http://kb.mozillazine.org/Keyword.enabled) ]
 213 * Don't trim HTTP off of URLs in the address bar. [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=665580) ]
 214 * Disable preloading of autocomplete URLs. [ [1](https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks) ]
 215 * Don't try to guess domain names when entering an invalid domain name in URL bar [ [1](http://www-archive.mozilla.org/docs/end-user/domain-guessing.html) ]
 216 * When browser.fixup.alternate.enabled is enabled, strip password from 'user:password@...' URLs [ [1](https://github.com/pyllyukko/user.js/issues/290#issuecomment-303560851) ]
 217 * Send DNS request through SOCKS when SOCKS proxying is in use [ [1](https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers) ]
 218 * Don't monitor OS online/offline connection state [ [1](https://trac.torproject.org/projects/tor/ticket/18945) ]
 219 * Enforce Mixed Active Content Blocking [ [1](https://support.mozilla.org/t5/Protect-your-privacy/Mixed-content-blocking-in-Firefox/ta-p/10990) [2](https://developer.mozilla.org/en-US/docs/Site_Compatibility_for_Firefox_23#Non-SSL_contents_on_SSL_pages_are_blocked_by_default) [3](https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/) ]
 220 * Enforce Mixed Passive Content blocking (a.k.a. Mixed Display Content)
 221 * Disable JAR from opening Unsafe File Types [ [1](http://kb.mozillazine.org/Network.jar.open-unsafe-types) ]
 222 * Set File URI Origin Policy [ [1](http://kb.mozillazine.org/Security.fileuri.strict_origin_policy) ]
 223 * Disable Displaying Javascript in History URLs [ [1](http://kb.mozillazine.org/Browser.urlbar.filter.javascript) ]
 224 * Disable asm.js [ [1](http://asmjs.org/) [2](https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/) [3](https://www.mozilla.org/en-US/security/advisories/mfsa2015-50/) [4](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2712) ]
 225 * Disable SVG in OpenType fonts [ [1](https://wiki.mozilla.org/SVGOpenTypeFonts) [2](https://github.com/iSECPartners/publications/tree/master/reports/Tor%20Browser%20Bundle) ]
 226 * Disable video stats to reduce fingerprinting threat [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=654550) [2](https://github.com/pyllyukko/user.js/issues/9#issuecomment-100468785) [3](https://github.com/pyllyukko/user.js/issues/9#issuecomment-148922065) ]
 227 * Don't reveal build ID
 228 * Don't use document specified fonts to prevent installed font enumeration (fingerprinting) [ [1](https://github.com/pyllyukko/user.js/issues/395) [2](https://browserleaks.com/fonts) [3](https://github.com/pyllyukko/user.js/issues/120) ]
 229 * Enable only whitelisted URL protocol handlers [ [1](http://kb.mozillazine.org/Network.protocol-handler.external-default) [2](http://kb.mozillazine.org/Network.protocol-handler.warn-external-default) [3](http://kb.mozillazine.org/Network.protocol-handler.expose.%28protocol%29) [4](https://news.ycombinator.com/item?id=13047883) [5](https://bugzilla.mozilla.org/show_bug.cgi?id=167475) [6](https://github.com/pyllyukko/user.js/pull/285#issuecomment-298124005) ]
 230
 231 ### Extensions / plugins
 232
 233 Harden preferences related to external plugins
 234 * Ensure you have a security delay when installing add-ons (milliseconds) [ [1](http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox) [2](http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/) ]
 235 * Require signatures [ [1](https://wiki.mozilla.org/Addons/Extension_Signing) ]
 236 * Opt-out of add-on metadata updates [ [1](https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/) ]
 237 * Opt-out of themes (Persona) updates [ [1](https://support.mozilla.org/t5/Firefox/how-do-I-prevent-autoamtic-updates-in-a-50-user-environment/td-p/144287) ]
 238 * Disable Flash Player NPAPI plugin [ [1](http://kb.mozillazine.org/Flash_plugin) ]
 239 * Disable Java NPAPI plugin
 240 * Disable sending Flash Player crash reports
 241 * When Flash crash reports are enabled, don't send the visited URL in the crash report
 242 * When Flash is enabled, download and use Mozilla SWF URIs blocklist [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1237198) [2](https://github.com/mozilla-services/shavar-plugin-blocklist) ]
 243 * Disable Gnome Shell Integration NPAPI plugin
 244 * Enable plugins click-to-play [ [1](https://wiki.mozilla.org/Firefox/Click_To_Play) [2](https://blog.mozilla.org/security/2012/10/11/click-to-play-plugins-blocklist-style/) ]
 245 * Updates addons automatically [ [1](https://blog.mozilla.org/addons/how-to-turn-off-add-on-updates/) ]
 246 * Enable add-on and certificate blocklists (OneCRL) from Mozilla [ [1](https://wiki.mozilla.org/Blocklisting) [2](https://blocked.cdn.mozilla.net/) [3](http://kb.mozillazine.org/Extensions.blocklist.enabled) [4](http://kb.mozillazine.org/Extensions.blocklist.url) [5](https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/) ]
 247 * Decrease system information leakage to Mozilla blocklist update servers [ [1](https://trac.torproject.org/projects/tor/ticket/16931) ]
 248 * Disable system add-on updates (hidden & always-enabled add-ons from Mozilla) [ [1](https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html) [2](https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/) [3](https://github.com/pyllyukko/user.js/issues/419) [4](https://dxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManager.jsm#1248-1257) ]
 249
 250 ### Firefox (anti-)features / components
 251
 252 Disable Firefox integrated metrics/reporting/experiments, disable potentially insecure/invasive/[undesirable](https://en.wikipedia.org/wiki/Feature_creep) features
 253 * Disable Extension recommendations (Firefox >= 65) [ [1](https://support.mozilla.org/en-US/kb/extension-recommendations) ]
 254 * Disable WebIDE [ [1](https://trac.torproject.org/projects/tor/ticket/16222) [2](https://developer.mozilla.org/docs/Tools/WebIDE) ]
 255 * Disable remote debugging [ [1](https://developer.mozilla.org/en-US/docs/Tools/Remote_Debugging/Debugging_Firefox_Desktop) [2](https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox#Advanced_settings) ]
 256 * Disable Mozilla telemetry/experiments [ [1](https://wiki.mozilla.org/Platform/Features/Telemetry) [2](https://wiki.mozilla.org/Privacy/Reviews/Telemetry) [3](https://wiki.mozilla.org/Telemetry) [4](https://www.mozilla.org/en-US/legal/privacy/firefox.html#telemetry) [5](https://support.mozilla.org/t5/Firefox-crashes/Mozilla-Crash-Reporter/ta-p/1715) [6](https://wiki.mozilla.org/Security/Reviews/Firefox6/ReviewNotes/telemetry) [7](https://gecko.readthedocs.io/en/latest/browser/experiments/experiments/manifest.html) [8](https://wiki.mozilla.org/Telemetry/Experiments) [9](https://support.mozilla.org/en-US/questions/1197144) [10](https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html#id1) ]
 257 * Disallow Necko to do A/B testing [ [1](https://trac.torproject.org/projects/tor/ticket/13170) ]
 258 * Disable sending Firefox crash reports to Mozilla servers [ [1](https://wiki.mozilla.org/Breakpad) [2](http://kb.mozillazine.org/Breakpad) [3](https://dxr.mozilla.org/mozilla-central/source/toolkit/crashreporter) [4](https://bugzilla.mozilla.org/show_bug.cgi?id=411490) ]
 259 * Disable sending reports of tab crashes to Mozilla (about:tabcrashed), don't nag user about unsent crash reports [ [1](https://hg.mozilla.org/mozilla-central/file/tip/browser/app/profile/firefox.js) ]
 260 * Disable FlyWeb (discovery of LAN/proximity IoT devices that expose a Web interface) [ [1](https://wiki.mozilla.org/FlyWeb) [2](https://wiki.mozilla.org/FlyWeb/Security_scenarios) [3](https://docs.google.com/document/d/1eqLb6cGjDL9XooSYEEo7mE-zKQ-o-AuDTcEyNhfBMBM/edit) [4](http://www.ghacks.net/2016/07/26/firefox-flyweb) ]
 261 * Disable the UITour backend [ [1](https://trac.torproject.org/projects/tor/ticket/19047#comment:3) ]
 262 * Enable Firefox Tracking Protection [ [1](https://wiki.mozilla.org/Security/Tracking_protection) [2](https://support.mozilla.org/en-US/kb/tracking-protection-firefox) [3](https://support.mozilla.org/en-US/kb/tracking-protection-pbm) [4](https://kontaxis.github.io/trackingprotectionfirefox/) [5](https://feeding.cloud.geek.nz/posts/how-tracking-protection-works-in-firefox/) ]
 263 * Enable contextual identity Containers feature (Firefox >= 52)
 264 * Enable Firefox's anti-fingerprinting mode ("resist fingerprinting" or RFP) (Tor Uplift project) [ [1](https://wiki.mozilla.org/Security/Tor_Uplift/Tracking) [2](https://bugzilla.mozilla.org/show_bug.cgi?id=1333933) [3](https://wiki.mozilla.org/Security/Fingerprinting) ]
 265 * disable mozAddonManager Web API [FF57+] [ [1](https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330) [2](https://bugzilla.mozilla.org/buglist.cgi?bug_id=1406795) [3](https://bugzilla.mozilla.org/buglist.cgi?bug_id=1415644) [4](https://bugzilla.mozilla.org/buglist.cgi?bug_id=1453988) [5](https://trac.torproject.org/projects/tor/ticket/26114) ]
 266 * disable showing about:blank/maximized window as soon as possible during startup [FF60+] [ [1](https://bugzilla.mozilla.org/1448423) ]
 267 * Disable the built-in PDF viewer [ [1](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2743) [2](https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/) [3](https://www.mozilla.org/en-US/security/advisories/mfsa2015-69/) ]
 268 * Disable collection/sending of the health report (healthreport.sqlite*) [ [1](https://support.mozilla.org/en-US/kb/firefox-health-report-understand-your-browser-perf) [2](https://gecko.readthedocs.org/en/latest/toolkit/components/telemetry/telemetry/preferences.html) ]
 269 * Disable Shield/Heartbeat/Normandy (Mozilla user rating telemetry) [ [1](https://wiki.mozilla.org/Advocacy/heartbeat) [2](https://trac.torproject.org/projects/tor/ticket/19047) [3](https://trac.torproject.org/projects/tor/ticket/18738) [4](https://wiki.mozilla.org/Firefox/Shield) [5](https://github.com/mozilla/normandy) [6](https://support.mozilla.org/en-US/kb/shield) [7](https://bugzilla.mozilla.org/show_bug.cgi?id=1370801) [8](https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout) ]
 270 * Disable Firefox Hello metrics collection [ [1](https://groups.google.com/d/topic/mozilla.dev.platform/nyVkCx-_sFw/discussion) ]
 271 * Enforce checking for Firefox updates [ [1](http://kb.mozillazine.org/App.update.enabled) ]
 272 * Enable blocking reported web forgeries [ [1](https://wiki.mozilla.org/Security/Safe_Browsing) [2](http://kb.mozillazine.org/Safe_browsing) [3](https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work) [4](http://forums.mozillazine.org/viewtopic.php?f=39&t=2711237&p=12896849#p12896849) ]
 273 * Enable blocking reported attack sites [ [1](http://kb.mozillazine.org/Browser.safebrowsing.malware.enabled) ]
 274 * Disable querying Google Application Reputation database for downloaded binary files [ [1](https://www.mozilla.org/en-US/firefox/39.0/releasenotes/) [2](https://wiki.mozilla.org/Security/Application_Reputation) ]
 275 * Disable Pocket [ [1](https://support.mozilla.org/en-US/kb/save-web-pages-later-pocket-firefox) [2](https://github.com/pyllyukko/user.js/issues/143) ]
 276 * Disable "Recommended by Pocket" in Firefox Quantum
 277 * Enable Global Privacy Control (GPC) (Firefox >= 120) [ [1](https://support.mozilla.org/1/firefox/126.0/Linux/en-US/global-privacy-control) [2](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-GPC) [3](https://globalprivacycontrol.org/) ]
 278
 279 ### Automatic connections
 280
 281 Prevents the browser from [auto-connecting](https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections) to some Mozilla services, and from predictively opening connections to websites during browsing.
 282 * Disable prefetching of <link rel="next"> URLs [ [1](http://kb.mozillazine.org/Network.prefetch-next) [2](https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#Is_there_a_preference_to_disable_link_prefetching.3F) ]
 283 * Disable DNS prefetching [ [1](http://kb.mozillazine.org/Network.dns.disablePrefetch) [2](https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching) ]
 284 * Disable the predictive service (Necko) [ [1](https://wiki.mozilla.org/Privacy/Reviews/Necko) ]
 285 * Reject .onion hostnames before passing the to DNS [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1228457) ]
 286 * Disable search suggestions in the search bar [ [1](http://kb.mozillazine.org/Browser.search.suggest.enabled) ]
 287 * Disable "Show search suggestions in location bar results"
 288 * When using the location bar, don't suggest URLs from browsing history
 289 * Disable Firefox Suggest [ [1](https://www.ghacks.net/2021/09/09/how-to-disable-firefox-suggest/) [2](https://support.mozilla.org/en-US/kb/navigate-web-faster-firefox-suggest) ]
 290 * Disable SSDP [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1111967) ]
 291 * Disable automatic downloading of OpenH264 codec [ [1](https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_media-capabilities) [2](https://andreasgal.com/2014/10/14/openh264-now-in-firefox/) ]
 292 * Disable speculative pre-connections [ [1](https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_speculative-pre-connections) [2](https://bugzilla.mozilla.org/show_bug.cgi?id=814169) ]
 293 * Disable downloading homepage snippets/messages from Mozilla [ [1](https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_mozilla-content) [2](https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service) ]
 294 * Never check updates for search engines [ [1](https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_auto-update-checking) ]
 295 * Disable automatic captive portal detection (Firefox >= 52.0) [ [1](https://support.mozilla.org/en-US/questions/1157121) ]
 296 * Disable (parts of?) "TopSites"
 297
 298 ### HTTP
 299
 300 HTTP protocol related entries. This affects cookies, the user agent, referer and others.
 301 * Disallow NTLMv1 [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=828183) ]
 302 * Enable CSP 1.1 script-nonce directive support [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=855326) ]
 303 * Enable Content Security Policy (CSP) [ [1](https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy) [2](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) ]
 304 * Enable Subresource Integrity [ [1](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) [2](https://wiki.mozilla.org/Security/Subresource_Integrity) ]
 305 * Don't send referer headers when following links across different domains [ [1](https://github.com/pyllyukko/user.js/issues/227) [2](https://github.com/pyllyukko/user.js/issues/328) [3](https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/) [4](https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks) ]
 306 * Trim HTTP referer headers to only send the scheme, host, and port [ [1](https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks) ]
 307 * When sending Referer across domains, only send scheme, host, and port in the Referer header [ [1](https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks) ]
 308 * Accept Only 1st Party Cookies [ [1](http://kb.mozillazine.org/Network.cookie.cookieBehavior#1) ]
 309 * Enable first-party isolation [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1299996) [2](https://bugzilla.mozilla.org/show_bug.cgi?id=1260931) [3](https://wiki.mozilla.org/Security/FirstPartyIsolation) ]
 310 * Make sure that third-party cookies (if enabled) never persist beyond the session. [ [1](https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/) [2](http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly) [3](https://developer.mozilla.org/en-US/docs/Cookies_Preferences_in_Mozilla#network.cookie.thirdparty.sessionOnly) ]
 311
 312 ### Caching
 313
 314 Enable and configure private browsing mode, don't store information locally during the browsing session
 315 * Permanently enable private browsing mode [ [1](https://support.mozilla.org/en-US/kb/Private-Browsing) [2](https://wiki.mozilla.org/PrivateBrowsing) ]
 316 * Do not download URLs for the offline cache [ [1](http://kb.mozillazine.org/Browser.cache.offline.enable) ]
 317 * Clear history when Firefox closes [ [1](https://support.mozilla.org/en-US/kb/Clear%20Recent%20History#w_how-do-i-make-firefox-clear-my-history-automatically) ]
 318 * Set time range to "Everything" as default in "Clear Recent History"
 319 * Clear everything but "Site Preferences" in "Clear Recent History"
 320 * Don't remember browsing history
 321 * Don't remember recently closed tabs
 322 * Disable disk cache [ [1](http://kb.mozillazine.org/Browser.cache.disk.enable) ]
 323 * Disable Caching of SSL Pages
 324 * Disable download history
 325 * Disable password manager (use an external password manager!)
 326 * Disable form autofill, don't save information entered in web page forms and the Search Bar
 327 * Cookies expires at the end of the session (when the browser closes) [ [1](http://kb.mozillazine.org/Network.cookie.lifetimePolicy#2) ]
 328 * Require manual intervention to autofill known username/passwords sign-in forms [ [1](http://kb.mozillazine.org/Signon.autofillForms) [2](https://www.torproject.org/projects/torbrowser/design/#identifier-linkability) ]
 329 * Disable formless login capture [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1166947) ]
 330 * When username/password autofill is enabled, still disable it on non-HTTPS sites [ [1](https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317) ]
 331 * Show in-content login form warning UI for insecure login fields [ [1](https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317) ]
 332 * Delete Search and Form History
 333 * Clear SSL Form Session Data [ [1](http://kb.mozillazine.org/Browser.sessionstore.privacy_level#2) ]
 334 * Delete temporary files on exit [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=238789) ]
 335 * Do not create screenshots of visited pages (relates to the "new tab page" feature) [ [1](https://support.mozilla.org/en-US/questions/973320) [2](https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/browser.pagethumbnails.capturing_disabled) ]
 336 * Don't fetch and permanently store favicons for Windows .URL shortcuts created by drag and drop
 337 * Disable bookmarks backups (default: 15) [ [1](http://kb.mozillazine.org/Browser.bookmarks.max_backups) ]
 338 * Disable downloading of favicons in response to favicon fingerprinting techniques [ [1](https://github.com/jonasstrehle/supercookie) [2](http://kb.mozillazine.org/Browser.chrome.site_icons) [3](https://blog.mozilla.org/security/2021/01/26/supercookie-protections/) ]
 339
 340 ### UI related
 341
 342 Improve visibility of security-related elements, mitigate shoulder-surfing
 343 * Enable insecure password warnings (login forms in non-HTTPS pages) [ [1](https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-over-http-please/) [2](https://bugzilla.mozilla.org/show_bug.cgi?id=1319119) [3](https://bugzilla.mozilla.org/show_bug.cgi?id=1217156) ]
 344 * Disable "Are you sure you want to leave this page?" popups on page close [ [1](https://support.mozilla.org/en-US/questions/1043508) ]
 345 * Disable Downloading on Desktop
 346 * Always ask the user where to download [ [1](https://developer.mozilla.org/en/Download_Manager_preferences (obsolete)) ]
 347 * Disable the "new tab page" feature and show a blank tab instead [ [1](https://wiki.mozilla.org/Privacy/Reviews/New_Tab) [2](https://support.mozilla.org/en-US/kb/new-tab-page-show-hide-and-customize-top-sites#w_how-do-i-turn-the-new-tab-page-off) ]
 348 * Disable Snippets [ [1](https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service) [2](https://support.mozilla.org/en-US/kb/snippets-firefox-faq) ]
 349 * Disable Activity Stream [ [1](https://wiki.mozilla.org/Firefox/Activity_Stream) ]
 350 * Disable new tab tile ads & preload [ [1](http://www.thewindowsclub.com/disable-remove-ad-tiles-from-firefox) [2](http://forums.mozillazine.org/viewtopic.php?p=13876331#p13876331) [3](https://wiki.mozilla.org/Tiles/Technical_Documentation#Ping) [4](https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-source) [5](https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-ping) ]
 351 * Disable Mozilla VPN ads on the about:protections page [ [1](https://support.mozilla.org/en-US/kb/what-mozilla-vpn-and-how-does-it-work) [2](https://en.wikipedia.org/wiki/Mozilla_VPN) [3](https://blog.mozilla.org/security/2021/08/31/mozilla-vpn-security-audit/) [4](https://www.mozilla.org/en-US/security/advisories/mfsa2021-31/) ]
 352 * Enable Auto Notification of Outdated Plugins (Firefox < 50) [ [1](https://wiki.mozilla.org/Firefox3.6/Plugin_Update_Awareness_Security_Review) ]
 353 * Force Punycode for Internationalized Domain Names [ [1](http://kb.mozillazine.org/Network.IDN_show_punycode) [2](https://www.xudongz.com/blog/2017/idn-phishing/) [3](https://wiki.mozilla.org/IDN_Display_Algorithm) [4](https://en.wikipedia.org/wiki/IDN_homograph_attack) [5](https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/) ]
 354 * Disable inline autocomplete in URL bar [ [1](http://kb.mozillazine.org/Inline_autocomplete) ]
 355 * Disable CSS :visited selectors [ [1](https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/) [2](https://dbaron.org/mozilla/visited-privacy) ]
 356 * Disable URL bar autocomplete and history/bookmarks suggestions dropdown [ [1](http://kb.mozillazine.org/Disabling_autocomplete_-_Firefox#Firefox_3.5) ]
 357 * Do not check if Firefox is the default browser
 358 * When password manager is enabled, lock the password storage periodically
 359 * Lock the password storage every 1 minutes (default: 30)
 360 * Display a notification bar when websites offer data for offline use [ [1](http://kb.mozillazine.org/Browser.offline-apps.notify) ]
 361
 362 ### Cryptography
 363
 364 [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) protocol related settings
 365 * Enable HTTPS-Only Mode [ [1](https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/) [2](https://www.feistyduck.com/bulletproof-tls-newsletter/issue_71_firefox_introduces_https_only_mode) ]
 366 * Enable HSTS preload list (pre-set HSTS sites list provided by Mozilla) [ [1](https://blog.mozilla.org/security/2012/11/01/preloading-hsts/) [2](https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List) [3](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) ]
 367 * Enable Online Certificate Status Protocol [ [1](https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol) [2](https://www.imperialviolet.org/2014/04/19/revchecking.html) [3](https://www.maikel.pro/blog/current-state-certificate-revocation-crls-ocsp/) [4](https://wiki.mozilla.org/CA:RevocationPlan) [5](https://wiki.mozilla.org/CA:ImprovingRevocation) [6](https://wiki.mozilla.org/CA:OCSP-HardFail) [7](https://news.netcraft.com/archives/2014/04/24/certificate-revocation-why-browsers-remain-affected-by-heartbleed.html) [8](https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html) ]
 368 * Enable OCSP Stapling support [ [1](https://en.wikipedia.org/wiki/OCSP_stapling) [2](https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/) [3](https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx) ]
 369 * Enable OCSP Must-Staple support (Firefox >= 45) [ [1](https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/) [2](https://www.entrust.com/ocsp-must-staple/) [3](https://github.com/schomery/privacy-settings/issues/40) ]
 370 * Require a valid OCSP response for OCSP enabled certificates [ [1](https://groups.google.com/forum/#!topic/mozilla.dev.security/n1G-N2-HTVA) ]
 371 * Disable TLS Session Tickets [ [1](https://www.blackhat.com/us-13/briefings.html#NextGen) [2](https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-Slides.pdf) [3](https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-WP.pdf) [4](https://bugzilla.mozilla.org/show_bug.cgi?id=917049) [5](https://bugzilla.mozilla.org/show_bug.cgi?id=967977) ]
 372 * Only allow TLS 1.[2-3] [ [1](http://kb.mozillazine.org/Security.tls.version.*) ]
 373 * Disable insecure TLS version fallback [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1084025) [2](https://github.com/pyllyukko/user.js/pull/206#issuecomment-280229645) ]
 374 * Enforce Public Key Pinning [ [1](https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning) [2](https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning) ]
 375 * Disallow SHA-1 [ [1](https://bugzilla.mozilla.org/show_bug.cgi?id=1302140) [2](https://shattered.io/) ]
 376 * Warn the user when server doesn't support RFC 5746 ("safe" renegotiation) [ [1](https://wiki.mozilla.org/Security:Renegotiation#security.ssl.treat_unsafe_negotiation_as_broken) [2](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555) ]
 377 * Disable automatic reporting of TLS connection errors [ [1](https://support.mozilla.org/en-US/kb/certificate-pinning-reports) ]
 378 * Pre-populate the current URL but do not pre-fetch the certificate in the "Add Security Exception" dialog [ [1](http://kb.mozillazine.org/Browser.ssl_override_behavior) [2](https://github.com/pyllyukko/user.js/issues/210) ]
 379 * Encrypted SNI (when TRR is enabled) [ [1](https://www.cloudflare.com/ssl/encrypted-sni/) [2](https://wiki.mozilla.org/Trusted_Recursive_Resolver#ESNI) [3](https://en.wikipedia.org/wiki/Server_Name_Indication#Security_implications_(ESNI)) ]
 380
 381 ### Cipher suites
 382
 383 This section tweaks the cipher suites used by Firefox. The idea is to support only the strongest ones with emphasis on [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), but without compromising compatibility with all those sites on the internet. As new crypto related flaws are discovered quite often, the cipher suites can be [tweaked to mitigate these newly discovered threats](https://github.com/pyllyukko/user.js/pull/18).
 384 * Disable null ciphers
 385 * Disable SEED cipher [ [1](https://en.wikipedia.org/wiki/SEED) ]
 386 * Disable 40/56/128-bit ciphers
 387 * Disable RC4 [ [1](https://developer.mozilla.org/en-US/Firefox/Releases/38#Security) [2](https://bugzilla.mozilla.org/show_bug.cgi?id=1138882) [3](https://rc4.io/) [4](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2566) ]
 388 * Disable 3DES (effective key size is < 128) [ [1](https://en.wikipedia.org/wiki/3des#Security) [2](http://en.citizendium.org/wiki/Meet-in-the-middle_attack) [3](http://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html) ]
 389 * Disable ciphers with ECDH (non-ephemeral)
 390 * Disable 256 bits ciphers without PFS
 391 * Enable GCM ciphers (TLSv1.2 only) [ [1](https://en.wikipedia.org/wiki/Galois/Counter_Mode) ]
 392 * Enable ChaCha20 and Poly1305 (Firefox >= 47) [ [1](https://www.mozilla.org/en-US/firefox/47.0/releasenotes/) [2](https://tools.ietf.org/html/rfc7905) [3](https://bugzilla.mozilla.org/show_bug.cgi?id=917571) [4](https://bugzilla.mozilla.org/show_bug.cgi?id=1247860) [5](https://cr.yp.to/chacha.html) ]
 393 * Disable ciphers susceptible to the logjam attack [ [1](https://weakdh.org/) ]
 394 * Disable ciphers with DSA (max 1024 bits)
 395 * Enable X25519Kyber768Draft00 (post-quantum key exchange) [FF Nightly 2024-01-18+] [ [1](https://datatracker.ietf.org/doc/draft-tls-westerbaan-xyber768d00/) [2](https://twitter.com/bwesterb/status/1748017372764475519) [3](https://pq.cloudflareresearch.com/) ]
 396 <!-- END SECTION -->
 397
 398 -------------------------------------------------------------------------
 399
 400 ## Further hardening
 401
 402 **This is not enough!** Here's some other tips how you can further harden Firefox:
 403
 404 * By default **your browser trusts 100's of [Certificate Authorities](https://en.wikipedia.org/wiki/Certificate_authority)** (CAs) from various organizations to guarantee privacy of your encrypted communications with websites. Some CAs have been known for misusing or deliberately abusing this power in the past, and **a single malicious CA can compromise all** your encrypted communications! To workaround this you may want to [inspect the list of trusted certificates](https://support.mozilla.org/en-US/kb/advanced-panel-settings-in-firefox?#w_certificates-tab). [[1](https://blog.torproject.org/blog/life-without-ca)]
 405 * Keep your browser updated! If you check [Firefox's security advisories](https://www.mozilla.org/security/known-vulnerabilities/firefox.html), you'll see that pretty much every new version of Firefox contains some security updates. If you don't keep your browser updated, you've already lost the game.
 406 * Disable/uninstall all unnecessary extensions and plugins!
 407 * Use long and **unique** passwords/passphrases for each website/service.
 408 * Prefer open-source, reviewed and audited software and operating systems whenever possible.
 409 * Do not transmit information meant to be private over unencrypted communication channels.
 410 * Use a search engine that doesn't track its users, and set it as default search engine.
 411 * If a plugin is absolutely required, [check for plugin updates](https://www.mozilla.org/en-US/plugincheck/)
 412 * Create different [profiles][15] for different purposes
 413 * Change the Firefox's built-in tracking protection to use the [strict list](https://support.mozilla.org/en-US/kb/tracking-protection-pbm?as=u#w_change-your-block-list)
 414 * Change the timezone for Firefox by using the `TZ` environment variable (see [here](https://wiki.archlinux.org/index.php/Firefox_privacy#Change_browser_time_zone)) to reduce it's value in browser fingerprinting
 415 * If you are concerned about more advanced threats, use specialized hardened operating systems and browsers such as [Tails](https://tails.boum.org/) or [Tor Brower Bundle](https://www.torproject.org/projects/torbrowser.html.en)
 416 * [Do Not Track (DNT)](https://en.wikipedia.org/wiki/Do_Not_Track) is not set in the `user.js` and is left for the user to decide (see [#11](https://github.com/pyllyukko/user.js/issues/11))
 417
 418 ### Add-ons
 419
 420 Here is a list of the most essential security and privacy enhancing add-ons that you should consider using:
 421
 422 * [uBlock Origin](https://addons.mozilla.org/firefox/addon/ublock-origin/)
 423   * For additional protection, enable more blocklists in the addon dashboard.
 424   * For additional protection, set it to [Hard mode](https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-mode) (experienced users) - the default is [Easy mode](https://github.com/gorhill/uBlock/wiki/Blocking-mode:-easy-mode)
 425 * [HTTPS Everywhere](https://www.eff.org/https-everywhere)
 426   * For additional protection, enable `Block all unencrypted requests` in the toolbar button menu. This will break websites where HTTPS is not available.
 427 * [Cookie AutoDelete](https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/) - when a tab closes, any cookies not being used are automatically deleted. Whitelist the ones you trust while deleting the rest.
 428 * [NoScript](https://noscript.net/)
 429 * [Decentraleyes](https://addons.mozilla.org/firefox/addon/decentraleyes/)
 430
 431 Additional add-ons that you might consider using or reading about:
 432
 433 * [uMatrix](https://addons.mozilla.org/en-US/firefox/addon/umatrix/) (experienced users)
 434 * [Privacy Badger](https://www.eff.org/privacybadger)
 435 * [Mozilla Lightbeam](https://www.mozilla.org/en-US/lightbeam/)
 436 * [PRISM Break Web Browser Addons section](https://prism-break.org/en/subcategories/gnu-linux-web-browser-addons/)
 437 * [Ghostery](https://www.ghostery.com/) (proprietary software, maintained by [an advertising company](https://en.wikipedia.org/wiki/Ghostery))
 438
 439 ## Known problems and limitations
 440
 441 Hardening your often implies a trade-off with ease-of-use and comes with reduced functionality. Here is a list of known problems/limitations:
 442
 443 <!-- BEGIN PROBLEMS-LIMITATIONS -->
 444 * Disabling ServiceWorkers breaks functionality on some sites (Google Street View...)
 445 * Disabling ServiceWorkers breaks Firefox Sync
 446 * Disabling resource timing API breaks some DDoS protection pages (Cloudflare)
 447 * Web Audio API is required for Unity web player/games
 448 * Disabling WebRTC breaks peer-to-peer file sharing tools (reep.io ...)
 449 * Disabling clipboard events breaks Ctrl+C/X/V copy/cut/paste functionaility in JS-based web applications (Google Docs...)
 450 * Disabling clipboard operations will break legitimate JS-based "copy to clipboard" functionality
 451 * Disabling WebGL breaks WebGL-based websites/applications (windy, meteoblue...)
 452 * WebAssembly is required for Unity web player/games
 453 * Enabling Mixed Display Content blocking can prevent images/styles... from loading properly when connection to the website is only partially secured
 454 * Disabling nonessential protocols breaks all interaction with custom protocols such as mailto:, irc:, magnet: ... and breaks opening third-party mail/messaging/torrent/... clients when clicking on links with these protocols
 455 * Disabling system add-on updates prevents Mozilla from "hotfixing" your browser to patch critical problems (one possible use case from the documentation)
 456 * Containers are not available in Private Browsing mode
 457 * RFP breaks some keyboard shortcuts used in certain websites (see #443)
 458 * RFP changes your time zone
 459 * RFP breaks some DDoS protection pages (Cloudflare)
 460 * Fully automatic updates are disabled and left to package management systems on Linux. Windows users may want to change this setting.
 461 * Update check page might incorrectly report Firefox ESR as out-of-date
 462 * Do No Track must be enabled manually
 463 * Blocking referers across same eTLD sites breaks some login flows relying on them, consider lowering this pref to 1
 464 * Blocking 3rd-party cookies breaks a number of payment gateways
 465 * First-party isolation breaks Microsoft Teams
 466 * First-party isolation causes HTTP basic auth to ask for credentials for every new tab (see #425)
 467 * You can not view or inspect cookies when in private browsing: https://bugzilla.mozilla.org/show_bug.cgi?id=823941
 468 * When Javascript is enabled, Websites can detect use of Private Browsing mode
 469 * Private browsing breaks Kerberos authentication
 470 * Disables "Containers" functionality (see below)
 471 * "Always use private browsing mode" (browser.privatebrowsing.autostart) disables the possibility to use password manager: https://support.mozilla.org/en-US/kb/usernames-and-passwords-are-not-saved#w_private-browsing
 472 * Installing user.js will remove your browsing history, caches and local storage.
 473 * Installing user.js **will remove your saved passwords** (https://github.com/pyllyukko/user.js/issues/27)
 474 * Clearing open windows on Firefox exit causes 2 windows to open when Firefox starts https://bugzilla.mozilla.org/show_bug.cgi?id=1334945
 475 * .URL shortcut files will be created with a generic icon
 476 * disabling "beforeunload" events may lead to losing data entered in web forms
 477 * OCSP leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host
 478 * OCSP is vulnerable to replay attacks when nonce is not configured on the OCSP responder
 479 * OCSP adds latency (performance)
 480 * Short-lived certificates are not checked for revocation (security.pki.cert_short_lifetime_in_days, default:10)
 481 * Firefox falls back on plain OCSP when must-staple is not configured on the host certificate
 482 * `security.OCSP.require` will make the connection fail when the OCSP responder is unavailable
 483 * `security.OCSP.require` is known to break browsing on some [captive portals](https://en.wikipedia.org/wiki/Captive_portal)
 484 <!-- END PROBLEMS-LIMITATIONS -->
 485
 486 In addition see the current [issues](https://github.com/pyllyukko/user.js/issues). You can use the [web console](https://developer.mozilla.org/en-US/docs/Tools/Web_Console) to investigate what causes websites to break.
 487
 488 -------------------------------------------------------------------------
 489
 490 ## FAQ
 491
 492 > Does this user.js file fix all security problems?
 493
 494 No. Please read [Known problems and limitations](#known-problems-and-limitations), the project's
 495 [issue](https://github.com/pyllyukko/user.js/issues) tracker, and report new issues there.
 496 Please open separate issues for each individual problem/question you may have.
 497
 498 > Why are obsolete/deprecated entries included in the user.js file?
 499
 500 This project is aimed at Firefox versions between the current [ESR](https://www.mozilla.org/en-US/firefox/organizations/)
 501 and the latest Firefox release. We will wait for widespread deployment of the current ESR
 502 (eg. adoption in major Linux distributions) before removing deprecated/obsolete preferences.
 503 Presence of deprecated entries causes no known problems.
 504
 505 > Installing the user.js file breaks xyz plugin/addon/extension, how can I fix it?
 506
 507 See https://github.com/pyllyukko/user.js/issues/100
 508
 509 > Will there be an official addon/an android version/feature xyz?
 510
 511 Search the project [issues](https://github.com/pyllyukko/user.js/issues?q=is%3Aissue).
 512
 513 > How can I lock my preferences to prevent Firefox overwriting them?
 514
 515 See `lockPref` in [System-wide installation](#system-wide-installation).
 516
 517 ## Contributing
 518
 519 Yes please! All issues and pull requests are more than welcome. Please try
 520 to break down your pull requests or commits into small / manageable entities,
 521 so they are easier to process. All the settings in the `user.js` file
 522 should have some official references to them, so the effect of those settings
 523 can be easily verified from Mozilla's documentation.
 524
 525 Feel free to follow the latest commits [RSS feed](https://github.com/pyllyukko/user.js/commits/master.atom)
 526 and other interesting feeds from the [References](#references) section.
 527
 528 You may also reach other contributors through [IRC](http://webchat.freenode.net?channels=%23user.js) (`#user.js` on Freenode) or [Gitter](https://gitter.im/user-js/Lobby).
 529
 530 For more information, see [CONTRIBUTING](https://github.com/pyllyukko/user.js/blob/master/CONTRIBUTING.md)
 531
 532
 533 -------------------------------------------------------------------------
 534
 535 ## Online tests
 536
 537 #### Version checks
 538
 539 * **[Mozilla Plugin Check](https://www.mozilla.org/en-US/plugincheck/)**
 540 * [Adobe Flash Player Version Check](https://www.adobe.com/software/flash/about/)
 541 * [Java Version Check](https://www.java.com/en/download/installed.jsp)
 542
 543 #### Fingerprinting tests
 544
 545 * [BrowserSpy.dk](http://browserspy.dk/)
 546 * [BrowserLeaks.com](https://www.browserleaks.com/firefox)
 547 * [AmIUnique](https://amiunique.org/) [[1](https://github.com/DIVERSIFY-project/amiunique)]
 548 * [Panopticlick](https://panopticlick.eff.org/)
 549 * [Unique Machine](http://www.uniquemachine.org/)
 550 * [Firefox Addon Detector](https://thehackerblog.com/addon_scanner/) [[1](https://thehackerblog.com/dirty-browser-enumeration-tricks-using-chrome-and-about-to-detect-firefox-plugins/)]
 551 * [AudioContext Fingerprint Test Page](https://audiofingerprint.openwpm.com/)
 552 * [Evercookie](https://samy.pl/evercookie/)
 553 * [WebRTC Test Landing Page](https://mozilla.github.io/webrtc-landing/)
 554 * [getUserMedia Test Page](https://mozilla.github.io/webrtc-landing/gum_test.html)
 555 * [Onion test for CORS and WebSocket](https://cure53.de/leak/onion.php)
 556 * [Official WebGL check](https://get.webgl.org/)
 557 * [WebGL Report](http://webglreport.com/)
 558 * [Battery API](https://robnyman.github.io/battery/) [[1](https://pstadler.sh/battery.js/)]
 559 * [WebRTC LAN address leak test](http://net.ipcalf.com/)
 560 * [IP Check](http://ip-check.info/?lang=en)
 561 * [OONI Internet censorship tests](https://ooni.torproject.org/nettest/)
 562
 563 #### SSL tests
 564
 565 * [SSL Client Test](https://www.ssllabs.com/ssltest/viewMyClient.html)
 566 * [How's My SSL](https://www.howsmyssl.com/)
 567 * [Mixed content tests (Mozilla)](https://people.mozilla.org/~tvyas/mixedcontent.html)
 568 * [Mixed content tests (Microsoft)](https://ie.microsoft.com/testdrive/browser/mixedcontent/assets/woodgrove.htm)
 569 * [SSL Checker | Symantec CryptoReport](https://cryptoreport.websecurity.symantec.com/checker/views/sslCheck.jsp)
 570 * [Bad SSL](https://badssl.com/)
 571
 572 #### Other tests
 573
 574 * [Test page for Firefox's built-in Tracking Protection](https://itisatrap.org/firefox/its-a-tracker.html)
 575 * [Test page for Firefox's built-in Phishing Protection](https://itisatrap.org/firefox/its-a-trap.html) ("Web forgeries")
 576 * [Test page for Firefox's built-in Malware Protection](https://itisatrap.org/firefox/its-an-attack.html) (attack page)
 577 * [Test page for Firefox's built-in Malware Protection](https://itisatrap.org/firefox/unwanted.html) (unwanted software)
 578 * [HTML5test](https://html5test.com/) - Comparison of supported HTML5 features in various browsers/versions
 579 * [Filldisk](http://www.filldisk.com/)
 580 * [BrowserAudit](https://browseraudit.com/)
 581
 582
 583 ---------------------------------------------------------------------------
 584
 585 ## References
 586
 587 #### Mozilla documentation
 588
 589 * **[Security Advisories for Firefox](https://www.mozilla.org/security/known-vulnerabilities/firefox.html)**
 590 * **[Known Vulnerabilities for Firefox](https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/)**
 591 * **[DXR - Firefox General preferences](https://dxr.mozilla.org/mozilla-central/source/modules/libpref/init/all.js) ([RSS](https://hg.mozilla.org/mozilla-central/atom-log/tip/modules/libpref/init/all.js))**
 592 * [DXR - Firefox Security preferences](https://dxr.mozilla.org/mozilla-central/source/security/manager/ssl/security-prefs.js) ([RSS](https://hg.mozilla.org/mozilla-central/atom-log/tip/security/manager/ssl/security-prefs.js))
 593 * [DXR - Firefox Datareporting preferences](https://dxr.mozilla.org/mozilla-central/source/toolkit/components/telemetry/datareporting-prefs.js) ([RSS](https://hg.mozilla.org/mozilla-central/atom-log/tip/toolkit/components/telemetry/datareporting-prefs.js))
 594 * [DXR - Firefox Healthreport preferences](https://dxr.mozilla.org/mozilla-central/source/toolkit/components/telemetry/healthreport-prefs.js) ([RSS](https://hg.mozilla.org/mozilla-central/atom-log/tip/toolkit/components/telemetry/healthreport-prefs.js))
 595 * **[Mozilla Security Blog](https://blog.mozilla.org/security/category/security/) ([RSS](https://blog.mozilla.org/security/feed/))**
 596 * [Mozilla Firefox Release Plan](https://wiki.mozilla.org/RapidRelease/Calendar)
 597 * [Mozilla Firefox developer release notes](https://developer.mozilla.org/en-US/Firefox/Releases)
 598 * [Advices from Mozilla Firefox on privacy and government surveillance](https://www.mozilla.org/en-US/teach/smarton/surveillance/)
 599 * [Polaris - advance privacy technology for the web](https://wiki.mozilla.org/Polaris)
 600 * [Mozilla Privacy Principles](https://wiki.mozilla.org/Privacy/Principles)
 601 * [List of Firefox "about:" URLs](https://developer.mozilla.org/en-US/Firefox/The_about_protocol)
 602 * [A brief guide to Mozilla preferences](https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/A_brief_guide_to_Mozilla_preferences)
 603 * [Mozilla preferences for uber-geeks](https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Mozilla_preferences_for_uber-geeks)
 604 * [Privacy & Security related add-ons](https://addons.mozilla.org/firefox/extensions/privacy-security/) ([RSS](https://addons.mozilla.org/en-US/firefox/extensions/privacy-security/format:rss?sort=featured))
 605 * [libpref — Firefox Source Docs documentation](https://firefox-source-docs.mozilla.org/modules/libpref/index.html)
 606 * [Firefox Source Tree documentation](https://firefox-source-docs.mozilla.org/index.html)
 607
 608 #### Other documentation
 609
 610 * **[User.js comparator](https://jm42.github.io/compare-user.js/)**
 611 * **[CVEs for Firefox - mitre.org](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox)**
 612 * [CVEs for Firefox - cvedetails.com](https://www.cvedetails.com/vulnerability-list/vendor_id-452/product_id-3264/Mozilla-Firefox.html)
 613 * [About:config entries - MozillaZine](http://kb.mozillazine.org/About:config_entries)
 614 * [Security and privacy-related preferences - MozillaZine](http://kb.mozillazine.org/Category:Security_and_privacy-related_preferences)
 615 * [Diff between various Firefox .js configurations in upcoming releases](https://cat-in-136.github.io/) **([RSS](https://cat-in-136.github.io/feed.xml))**
 616 * [Center for Internet Security - Mozilla Firefox benchmarks](https://benchmarks.cisecurity.org/downloads/browse/index.cfm?category=benchmarks.desktop.browsers.firefox) ([RSS](https://benchmarks.cisecurity.org/downloads/rss/))
 617 * [iSEC Tor Browser evaluation](https://github.com/iSECPartners/publications/tree/master/reports/Tor%20Browser%20Bundle)
 618 * [The Design and Implementation of the Tor Browser](https://www.torproject.org/projects/torbrowser/design/)
 619 * [Browser Exploitation Framework](https://beefproject.com/) [[1](http://blog.beefproject.com/) [2](https://github.com/beefproject/beef/wiki) [3](https://github.com/beefproject/beef)]
 620 * [shadow - Firefox jemalloc heap exploitation framework](https://github.com/CENSUS/shadow)
 621
 622 #### TLS/SSL documentation
 623
 624 * [Mozilla Included CA Certificate List](https://wiki.mozilla.org/CA:IncludedCAs)
 625 * [Potentially problematic CA practices](https://wiki.mozilla.org/CA:Problematic_Practices)
 626 * [Bulletproof SSL and TLS](https://www.feistyduck.com/books/bulletproof-ssl-and-tls/)
 627 * [TLS Cipher Suite Discovery](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/TLS_Cipher_Suite_Discovery)
 628 * [Server-side TLS configuration](https://wiki.mozilla.org/Security/Server_Side_TLS)
 629
 630 --------------------------------------------------------------------------
 631
 632 ## Maintenance
 633
 634 Run `make help` to get a list of makefile targets used for frequent maintenance operations.
 635
 636 ```
 637 $ make help
 638 locked_user.js      generate a locked configuration file
 639 systemwide_user.js  generate a system-wide configuration file
 640 debian_locked.js    generate a locked, system-wide configuration file
 641 policies.json       generate policy file (https://github.com/mozilla/policy-templates/blob/master/README.md)
 642 tests               run all tests
 643 test-acorn          validate user.js syntax
 644 test-shellcheck     check/lint shell scripts
 645 000-tor-browser.js  download Tor Browser custom configuration reference
 646 diff-tbb            differences between values from this user.js and tor browser's values
 647 diff-tbb-2          differences between values from this user.js and tor browser's values (alternate method)
 648 diff-tbb-missing-from-user.js           preferences that are present in tor browser's defaults, but not in this user.js
 649 diff-sourceprefs.js download and sort all known preferences files from Firefox (mozilla-central) source
 650 diff-upstream-duplicates                preferences with common values with default Firefox configuration
 651 diff-upstream-missing-from-user.js      preferences present in firefox source but not covered by user.js
 652 diff-upstream-deprecated                preferences in hardened user.js that are no longer present in firefox source
 653 diff-stats          count preferences number, various stats
 654 clean               clean automatically generated files/build/test artifacts
 655 doc-whatdoesitdo    generate the README "What does it do?" section
 656 doc-toc             generate the README table of contents
 657 help                generate list of targets with descriptions
 658
 659 ```
 660
 661 -----------------------------
 662
 663 [2]: https://wiki.mozilla.org/Security:Renegotiation#security.ssl.require_safe_negotiation
 664 [8]: https://support.mozilla.org/en-US/kb/Private%20Browsing
 665 [9]: https://bugzilla.mozilla.org/show_bug.cgi?id=822869
 666 [12]: https://support.mozilla.org/en-US/kb/tracking-protection-firefox
 667 [15]: https://mzl.la/NYhKHH