?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
history | raw | HEAD
Update README.md
[user-js.git] / user.js
blobc4ff709593f9ac6dde3b017fee842c9ffe27b8c8
1 //
2 /******************************************************************************
3  * user.js                                                                    *
4  * https://github.com/pyllyukko/user.js                                       *
5  ******************************************************************************/
6
7 /******************************************************************************
8  * SECTION: HTML5 / APIs / DOM                                                *
9  ******************************************************************************/
10
11 // PREF: Disable Service Workers
12 // https://developer.mozilla.org/en-US/docs/Web/API/Worker
13 // https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker_API
14 // https://wiki.mozilla.org/Firefox/Push_Notifications#Service_Workers
15 // NOTICE: Disabling ServiceWorkers breaks functionality on some sites (Google Street View...)
16 // NOTICE: Disabling ServiceWorkers breaks Firefox Sync
17 // Unknown security implications
18 // CVE-2016-5259, CVE-2016-2812, CVE-2016-1949, CVE-2016-5287 (fixed)
19 user_pref("dom.serviceWorkers.enabled",                         false);
20
21 // PREF: Disable web notifications
22 // https://support.mozilla.org/en-US/questions/1140439
23 user_pref("dom.webnotifications.enabled",                       false);
24
25 // PREF: Disable DOM timing API
26 // https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI
27 // https://www.w3.org/TR/navigation-timing/#privacy
28 user_pref("dom.enable_performance",                             false);
29
30 // PREF: Disable resource timing API
31 // https://www.w3.org/TR/resource-timing/#privacy-security
32 // NOTICE: Disabling resource timing API breaks some DDoS protection pages (Cloudflare)
33 user_pref("dom.enable_resource_timing",                         false);
34
35 // PREF: Make sure the User Timing API does not provide a new high resolution timestamp
36 // https://trac.torproject.org/projects/tor/ticket/16336
37 // https://www.w3.org/TR/2013/REC-user-timing-20131212/#privacy-security
38 user_pref("dom.enable_user_timing",                             false);
39
40 // PREF: Disable Web Audio API
41 // https://bugzilla.mozilla.org/show_bug.cgi?id=1288359
42 // NOTICE: Web Audio API is required for Unity web player/games
43 user_pref("dom.webaudio.enabled",                               false);
44
45 // PREF: Disable Location-Aware Browsing (geolocation)
46 // https://www.mozilla.org/en-US/firefox/geolocation/
47 user_pref("geo.enabled",                                        false);
48
49 // PREF: When geolocation is enabled, use Mozilla geolocation service instead of Google
50 // https://bugzilla.mozilla.org/show_bug.cgi?id=689252
51 user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");
52
53 // PREF: When geolocation is enabled, don't log geolocation requests to the console
54 user_pref("geo.wifi.logging.enabled", false);
55
56 // PREF: Disable raw TCP socket support (mozTCPSocket)
57 // https://trac.torproject.org/projects/tor/ticket/18863
58 // https://www.mozilla.org/en-US/security/advisories/mfsa2015-97/
59 // https://developer.mozilla.org/docs/Mozilla/B2G_OS/API/TCPSocket
60 user_pref("dom.mozTCPSocket.enabled",                           false);
61
62 // PREF: Disable DOM storage (disabled)
63 // http://kb.mozillazine.org/Dom.storage.enabled
64 // https://html.spec.whatwg.org/multipage/webstorage.html
65 // NOTICE-DISABLED: Disabling DOM storage is known to cause`TypeError: localStorage is null` errors
66 //user_pref("dom.storage.enabled",              false);
67
68 // PREF: Disable leaking network/browser connection information via Javascript
69 // Network Information API provides general information about the system's connection type (WiFi, cellular, etc.)
70 // https://developer.mozilla.org/en-US/docs/Web/API/Network_Information_API
71 // https://wicg.github.io/netinfo/#privacy-considerations
72 // https://bugzilla.mozilla.org/show_bug.cgi?id=960426
73 user_pref("dom.netinfo.enabled",                                false);
74
75 // PREF: Disable network API (Firefox < 32)
76 // https://developer.mozilla.org/en-US/docs/Web/API/Connection/onchange
77 // https://www.torproject.org/projects/torbrowser/design/#fingerprinting-defenses
78 user_pref("dom.network.enabled",                                false);
79
80 // PREF: Disable WebRTC entirely to prevent leaking internal IP addresses (Firefox < 42)
81 // NOTICE: Disabling WebRTC breaks peer-to-peer file sharing tools (reep.io ...)
82 user_pref("media.peerconnection.enabled",                       false);
83
84 // PREF: Don't reveal your internal IP when WebRTC is enabled (Firefox >= 42)
85 // https://wiki.mozilla.org/Media/WebRTC/Privacy
86 // https://github.com/beefproject/beef/wiki/Module%3A-Get-Internal-IP-WebRTC
87 user_pref("media.peerconnection.ice.default_address_only",      true); // Firefox 42-51
88 user_pref("media.peerconnection.ice.no_host",                   true); // Firefox >= 52
89
90 // PREF: Disable WebRTC getUserMedia, screen sharing, audio capture, video capture
91 // https://wiki.mozilla.org/Media/getUserMedia
92 // https://blog.mozilla.org/futurereleases/2013/01/12/capture-local-camera-and-microphone-streams-with-getusermedia-now-enabled-in-firefox/
93 // https://developer.mozilla.org/en-US/docs/Web/API/Navigator
94 user_pref("media.navigator.enabled",                            false);
95 user_pref("media.navigator.video.enabled",                      false);
96 user_pref("media.getusermedia.screensharing.enabled",           false);
97 user_pref("media.getusermedia.audiocapture.enabled",            false);
98
99 // PREF: Disable battery API (Firefox < 52)
100 // https://developer.mozilla.org/en-US/docs/Web/API/BatteryManager
101 // https://bugzilla.mozilla.org/show_bug.cgi?id=1313580
102 user_pref("dom.battery.enabled",                                false);
103
104 // PREF: Disable telephony API
105 // https://wiki.mozilla.org/WebAPI/Security/WebTelephony
106 user_pref("dom.telephony.enabled",                              false);
107
108 // PREF: Disable "beacon" asynchronous HTTP transfers (used for analytics)
109 // https://developer.mozilla.org/en-US/docs/Web/API/navigator.sendBeacon
110 user_pref("beacon.enabled",                                     false);
111
112 // PREF: Disable clipboard event detection (onCut/onCopy/onPaste) via Javascript
113 // https://web.archive.org/web/20210416195937/https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/dom.event.clipboardevents.enabled
114 // https://github.com/pyllyukko/user.js/issues/287
115 // NOTICE: Disabling clipboard events breaks Ctrl+C/X/V copy/cut/paste functionaility in JS-based web applications (Google Docs...)
116 user_pref("dom.event.clipboardevents.enabled",                  false);
117
118 // PREF: Disable "copy to clipboard" functionality via Javascript (Firefox >= 41)
119 // https://hg.mozilla.org/mozilla-central/rev/2f9f8ea4b9c3
120 // https://github.com/pyllyukko/user.js/issues/287
121 // NOTICE: Disabling clipboard operations will break legitimate JS-based "copy to clipboard" functionality
122 user_pref("dom.allow_cut_copy", false);
123
124 // PREF: Disable speech recognition
125 // https://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html
126 // https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition
127 // https://wiki.mozilla.org/HTML5_Speech_API
128 user_pref("media.webspeech.recognition.enable",                 false);
129
130 // PREF: Disable speech synthesis
131 // https://developer.mozilla.org/en-US/docs/Web/API/SpeechSynthesis
132 user_pref("media.webspeech.synth.enabled",                      false);
133
134 // PREF: Disable sensor API
135 // https://wiki.mozilla.org/Sensor_API
136 user_pref("device.sensors.enabled",                             false);
137
138 // PREF: Disable pinging URIs specified in HTML <a> ping= attributes
139 // http://kb.mozillazine.org/Browser.send_pings
140 user_pref("browser.send_pings",                                 false);
141
142 // PREF: When browser pings are enabled, only allow pinging the same host as the origin page
143 // http://kb.mozillazine.org/Browser.send_pings.require_same_host
144 user_pref("browser.send_pings.require_same_host",               true);
145
146 // PREF: Disable IndexedDB (disabled)
147 // https://developer.mozilla.org/en-US/docs/IndexedDB
148 // https://en.wikipedia.org/wiki/Indexed_Database_API
149 // https://wiki.mozilla.org/Security/Reviews/Firefox4/IndexedDB_Security_Review
150 // http://forums.mozillazine.org/viewtopic.php?p=13842047
151 // https://github.com/pyllyukko/user.js/issues/8
152 // NOTICE-DISABLED: IndexedDB could be used for tracking purposes, but is required for some add-ons to work (notably uBlock), so is left enabled
153 //user_pref("dom.indexedDB.enabled",            false);
154
155 // TODO: "Access Your Location" "Maintain Offline Storage" "Show Notifications"
156
157 // PREF: Disable gamepad API to prevent USB device enumeration
158 // https://www.w3.org/TR/gamepad/
159 // https://trac.torproject.org/projects/tor/ticket/13023
160 user_pref("dom.gamepad.enabled",                                false);
161
162 // PREF: Disable virtual reality devices APIs
163 // https://developer.mozilla.org/en-US/Firefox/Releases/36#Interfaces.2FAPIs.2FDOM
164 // https://developer.mozilla.org/en-US/docs/Web/API/WebVR_API
165 user_pref("dom.vr.enabled",                                     false);
166
167 // PREF: Disable vibrator API
168 user_pref("dom.vibrator.enabled",           false);
169
170 // PREF: Disable Archive API (Firefox < 54)
171 // https://wiki.mozilla.org/WebAPI/ArchiveAPI
172 // https://bugzilla.mozilla.org/show_bug.cgi?id=1342361
173 user_pref("dom.archivereader.enabled",                          false);
174
175 // PREF: Disable webGL
176 // https://en.wikipedia.org/wiki/WebGL
177 // https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/
178 // NOTICE: Disabling WebGL breaks WebGL-based websites/applications (windy, meteoblue...)
179 user_pref("webgl.disabled",                                     true);
180 // PREF: When webGL is enabled, use the minimum capability mode
181 user_pref("webgl.min_capability_mode",                          true);
182 // PREF: When webGL is enabled, disable webGL extensions
183 // https://developer.mozilla.org/en-US/docs/Web/API/WebGL_API#WebGL_debugging_and_testing
184 user_pref("webgl.disable-extensions",                           true);
185 // PREF: When webGL is enabled, force enabling it even when layer acceleration is not supported
186 // https://trac.torproject.org/projects/tor/ticket/18603
187 user_pref("webgl.disable-fail-if-major-performance-caveat",     true);
188 // PREF: When webGL is enabled, do not expose information about the graphics driver
189 // https://bugzilla.mozilla.org/show_bug.cgi?id=1171228
190 // https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug_renderer_info
191 user_pref("webgl.enable-debug-renderer-info",                   false);
192 // somewhat related...
193 //user_pref("pdfjs.enableWebGL",                                        false);
194
195 // PREF: Spoof dual-core CPU
196 // https://trac.torproject.org/projects/tor/ticket/21675
197 // https://bugzilla.mozilla.org/show_bug.cgi?id=1360039
198 user_pref("dom.maxHardwareConcurrency",                         2);
199
200 // PREF: Disable WebAssembly
201 // https://webassembly.org/
202 // https://en.wikipedia.org/wiki/WebAssembly
203 // https://trac.torproject.org/projects/tor/ticket/21549
204 // NOTICE: WebAssembly is required for Unity web player/games
205 user_pref("javascript.options.wasm",                            false);
206
207 /******************************************************************************
208  * SECTION: Misc                                                              *
209  ******************************************************************************/
210
211 // PREF: Disable face detection
212 user_pref("camera.control.face_detection.enabled",              false);
213
214 // PREF: Disable GeoIP lookup on your address to set default search engine region
215 // https://trac.torproject.org/projects/tor/ticket/16254
216 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine
217 user_pref("browser.search.countryCode",                         "US");
218 user_pref("browser.search.region",                              "US");
219 user_pref("browser.search.geoip.url",                           "");
220
221 // PREF: Set Accept-Language HTTP header to en-US regardless of Firefox localization
222 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language
223 user_pref("intl.accept_languages",                              "en-US, en");
224
225 // PREF: Don't use OS values to determine locale, force using Firefox locale setting
226 // http://kb.mozillazine.org/Intl.locale.matchOS
227 user_pref("intl.locale.matchOS",                                false);
228
229 // Use LANG environment variable to choose locale (disabled)
230 //pref("intl.locale.requested", "");
231
232 // PREF: Don't use Mozilla-provided location-specific search engines
233 user_pref("browser.search.geoSpecificDefaults",                 false);
234
235 // PREF: Do not automatically send selection to clipboard on some Linux platforms
236 // http://kb.mozillazine.org/Clipboard.autocopy
237 user_pref("clipboard.autocopy",                                 false);
238
239 // PREF: Prevent leaking application locale/date format using JavaScript
240 // https://bugzilla.mozilla.org/show_bug.cgi?id=867501
241 // https://hg.mozilla.org/mozilla-central/rev/52d635f2b33d
242 user_pref("javascript.use_us_english_locale",                   true);
243
244 // PREF: Do not submit invalid URIs entered in the address bar to the default search engine
245 // http://kb.mozillazine.org/Keyword.enabled
246 user_pref("keyword.enabled",                                    false);
247
248 // PREF: Don't trim HTTP off of URLs in the address bar.
249 // https://bugzilla.mozilla.org/show_bug.cgi?id=665580
250 user_pref("browser.urlbar.trimURLs",                            false);
251
252 // PREF: Disable preloading of autocomplete URLs.
253 // https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks
254 user_pref("browser.urlbar.speculativeConnect.enabled", false);
255
256 // PREF: Don't try to guess domain names when entering an invalid domain name in URL bar
257 // http://www-archive.mozilla.org/docs/end-user/domain-guessing.html
258 user_pref("browser.fixup.alternate.enabled",                    false);
259
260 // PREF: When browser.fixup.alternate.enabled is enabled, strip password from 'user:password@...' URLs
261 // https://github.com/pyllyukko/user.js/issues/290#issuecomment-303560851
262 user_pref("browser.fixup.hide_user_pass", true);
263
264 // PREF: Send DNS request through SOCKS when SOCKS proxying is in use
265 // https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers
266 user_pref("network.proxy.socks_remote_dns",                     true);
267
268 // PREF: Don't monitor OS online/offline connection state
269 // https://trac.torproject.org/projects/tor/ticket/18945
270 user_pref("network.manage-offline-status",                      false);
271
272 // PREF: Enforce Mixed Active Content Blocking
273 // https://support.mozilla.org/t5/Protect-your-privacy/Mixed-content-blocking-in-Firefox/ta-p/10990
274 // https://developer.mozilla.org/en-US/docs/Site_Compatibility_for_Firefox_23#Non-SSL_contents_on_SSL_pages_are_blocked_by_default
275 // https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/
276 user_pref("security.mixed_content.block_active_content",        true);
277
278 // PREF: Enforce Mixed Passive Content blocking (a.k.a. Mixed Display Content)
279 // NOTICE: Enabling Mixed Display Content blocking can prevent images/styles... from loading properly when connection to the website is only partially secured
280 user_pref("security.mixed_content.block_display_content",       true);
281
282 // PREF: Disable JAR from opening Unsafe File Types
283 // http://kb.mozillazine.org/Network.jar.open-unsafe-types
284 // CIS Mozilla Firefox 24 ESR v1.0.0 - 3.7 
285 user_pref("network.jar.open-unsafe-types",                      false);
286
287 // CIS 2.7.4 Disable Scripting of Plugins by JavaScript
288 // http://forums.mozillazine.org/viewtopic.php?f=7&t=153889
289 user_pref("security.xpconnect.plugin.unrestricted",             false);
290
291 // PREF: Set File URI Origin Policy
292 // http://kb.mozillazine.org/Security.fileuri.strict_origin_policy
293 // CIS Mozilla Firefox 24 ESR v1.0.0 - 3.8
294 user_pref("security.fileuri.strict_origin_policy",              true);
295
296 // PREF: Disable Displaying Javascript in History URLs
297 // http://kb.mozillazine.org/Browser.urlbar.filter.javascript
298 // CIS 2.3.6 
299 user_pref("browser.urlbar.filter.javascript",                   true);
300
301 // PREF: Disable asm.js
302 // http://asmjs.org/
303 // https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/
304 // https://www.mozilla.org/en-US/security/advisories/mfsa2015-50/
305 // https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2712
306 user_pref("javascript.options.asmjs",                           false);
307
308 // PREF: Disable SVG in OpenType fonts
309 // https://wiki.mozilla.org/SVGOpenTypeFonts
310 // https://github.com/iSECPartners/publications/tree/master/reports/Tor%20Browser%20Bundle
311 user_pref("gfx.font_rendering.opentype_svg.enabled",            false);
312
313 // PREF: Disable in-content SVG rendering (Firefox >= 53) (disabled)
314 // NOTICE-DISABLED: Disabling SVG support breaks many UI elements on many sites
315 // https://bugzilla.mozilla.org/show_bug.cgi?id=1216893
316 // https://github.com/iSECPartners/publications/raw/master/reports/Tor%20Browser%20Bundle/Tor%20Browser%20Bundle%20-%20iSEC%20Deliverable%201.3.pdf#16
317 //user_pref("svg.disabled", true);
318
319 // PREF: Disable video stats to reduce fingerprinting threat
320 // https://bugzilla.mozilla.org/show_bug.cgi?id=654550
321 // https://github.com/pyllyukko/user.js/issues/9#issuecomment-100468785
322 // https://github.com/pyllyukko/user.js/issues/9#issuecomment-148922065
323 user_pref("media.video_stats.enabled",                          false);
324
325 // PREF: Don't reveal build ID
326 // Value taken from Tor Browser
327 // https://bugzilla.mozilla.org/show_bug.cgi?id=583181
328 user_pref("general.buildID.override",                           "20100101");
329 user_pref("browser.startup.homepage_override.buildID",          "20100101");
330
331 // PREF: Don't use document specified fonts to prevent installed font enumeration (fingerprinting)
332 // https://github.com/pyllyukko/user.js/issues/395
333 // https://browserleaks.com/fonts
334 // https://github.com/pyllyukko/user.js/issues/120
335 user_pref("browser.display.use_document_fonts",                 0);
336
337 // PREF: Enable only whitelisted URL protocol handlers
338 // http://kb.mozillazine.org/Network.protocol-handler.external-default
339 // http://kb.mozillazine.org/Network.protocol-handler.warn-external-default
340 // http://kb.mozillazine.org/Network.protocol-handler.expose.%28protocol%29
341 // https://news.ycombinator.com/item?id=13047883
342 // https://bugzilla.mozilla.org/show_bug.cgi?id=167475
343 // https://github.com/pyllyukko/user.js/pull/285#issuecomment-298124005
344 // NOTICE: Disabling nonessential protocols breaks all interaction with custom protocols such as mailto:, irc:, magnet: ... and breaks opening third-party mail/messaging/torrent/... clients when clicking on links with these protocols
345 // TODO: Add externally-handled protocols from Windows 8.1 and Windows 10 (currently contains protocols only from Linux and Windows 7) that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)
346 // TODO: Add externally-handled protocols from Mac OS X that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)
347 // If you want to enable a protocol, set network.protocol-handler.expose.(protocol) to true and network.protocol-handler.external.(protocol) to:
348 //   * true, if the protocol should be handled by an external application
349 //   * false, if the protocol should be handled internally by Firefox
350 user_pref("network.protocol-handler.warn-external-default",     true);
351 user_pref("network.protocol-handler.external.http",             false);
352 user_pref("network.protocol-handler.external.https",            false);
353 user_pref("network.protocol-handler.external.javascript",       false);
354 user_pref("network.protocol-handler.external.moz-extension",    false);
355 user_pref("network.protocol-handler.external.ftp",              false);
356 user_pref("network.protocol-handler.external.file",             false);
357 user_pref("network.protocol-handler.external.about",            false);
358 user_pref("network.protocol-handler.external.chrome",           false);
359 user_pref("network.protocol-handler.external.blob",             false);
360 user_pref("network.protocol-handler.external.data",             false);
361 user_pref("network.protocol-handler.expose-all",                false);
362 user_pref("network.protocol-handler.expose.http",               true);
363 user_pref("network.protocol-handler.expose.https",              true);
364 user_pref("network.protocol-handler.expose.javascript",         true);
365 user_pref("network.protocol-handler.expose.moz-extension",      true);
366 user_pref("network.protocol-handler.expose.ftp",                true);
367 user_pref("network.protocol-handler.expose.file",               true);
368 user_pref("network.protocol-handler.expose.about",              true);
369 user_pref("network.protocol-handler.expose.chrome",             true);
370 user_pref("network.protocol-handler.expose.blob",               true);
371 user_pref("network.protocol-handler.expose.data",               true);
372
373 /******************************************************************************
374  * SECTION: Extensions / plugins                                                       *
375  ******************************************************************************/
376
377 // PREF: Ensure you have a security delay when installing add-ons (milliseconds)
378 // http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox
379 // http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/
380 user_pref("security.dialog_enable_delay",                       1000);
381
382 // PREF: Require signatures
383 // https://wiki.mozilla.org/Addons/Extension_Signing
384 //user_pref("xpinstall.signatures.required",            true);
385
386 // PREF: Opt-out of add-on metadata updates
387 // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/
388 user_pref("extensions.getAddons.cache.enabled",                 false);
389
390 // PREF: Opt-out of themes (Persona) updates
391 // https://support.mozilla.org/t5/Firefox/how-do-I-prevent-autoamtic-updates-in-a-50-user-environment/td-p/144287
392 user_pref("lightweightThemes.update.enabled",                   false);
393
394 // PREF: Disable Flash Player NPAPI plugin
395 // http://kb.mozillazine.org/Flash_plugin
396 user_pref("plugin.state.flash",                                 0);
397
398 // PREF: Disable Java NPAPI plugin
399 user_pref("plugin.state.java",                                  0);
400
401 // PREF: Disable sending Flash Player crash reports
402 user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled",     false);
403
404 // PREF: When Flash crash reports are enabled, don't send the visited URL in the crash report
405 user_pref("dom.ipc.plugins.reportCrashURL",                     false);
406
407 // PREF: When Flash is enabled, download and use Mozilla SWF URIs blocklist
408 // https://bugzilla.mozilla.org/show_bug.cgi?id=1237198
409 // https://github.com/mozilla-services/shavar-plugin-blocklist
410 user_pref("browser.safebrowsing.blockedURIs.enabled", true);
411
412 // PREF: Disable Gnome Shell Integration NPAPI plugin
413 user_pref("plugin.state.libgnome-shell-browser-plugin",         0);
414
415 // PREF: Disable the bundled OpenH264 video codec (disabled)
416 // http://forums.mozillazine.org/viewtopic.php?p=13845077&sid=28af2622e8bd8497b9113851676846b1#p13845077
417 //user_pref("media.gmp-provider.enabled",               false);
418
419 // PREF: Enable plugins click-to-play
420 // https://wiki.mozilla.org/Firefox/Click_To_Play
421 // https://blog.mozilla.org/security/2012/10/11/click-to-play-plugins-blocklist-style/
422 user_pref("plugins.click_to_play",                              true);
423
424 // PREF: Updates addons automatically
425 // https://blog.mozilla.org/addons/how-to-turn-off-add-on-updates/
426 user_pref("extensions.update.enabled",                          true);
427
428 // PREF: Enable add-on and certificate blocklists (OneCRL) from Mozilla
429 // https://wiki.mozilla.org/Blocklisting
430 // https://blocked.cdn.mozilla.net/
431 // http://kb.mozillazine.org/Extensions.blocklist.enabled
432 // http://kb.mozillazine.org/Extensions.blocklist.url
433 // https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
434 // Updated at interval defined in extensions.blocklist.interval (default: 86400)
435 user_pref("extensions.blocklist.enabled",                       true);
436 user_pref("services.blocklist.update_enabled",                  true);
437
438 // PREF: Decrease system information leakage to Mozilla blocklist update servers
439 // https://trac.torproject.org/projects/tor/ticket/16931
440 user_pref("extensions.blocklist.url",                           "https://blocklist.addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/");
441
442 // PREF: Disable system add-on updates (hidden & always-enabled add-ons from Mozilla)
443 // https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html
444 // https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/
445 // https://github.com/pyllyukko/user.js/issues/419
446 // https://dxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManager.jsm#1248-1257
447 // NOTICE: Disabling system add-on updates prevents Mozilla from "hotfixing" your browser to patch critical problems (one possible use case from the documentation)
448 user_pref("extensions.systemAddon.update.enabled",              false);
449
450 /******************************************************************************
451  * SECTION: Firefox (anti-)features / components                              *                            *
452  ******************************************************************************/
453
454 // PREF: Disable Extension recommendations (Firefox >= 65)
455 // https://support.mozilla.org/en-US/kb/extension-recommendations
456 user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr",  false);
457
458 // PREF: Trusted Recursive Resolver (DNS-over-HTTPS) (disabled)
459 // https://wiki.mozilla.org/Trusted_Recursive_Resolver
460 //user_pref("network.trr.mode",                                 0);
461
462 // PREF: Disable WebIDE
463 // https://trac.torproject.org/projects/tor/ticket/16222
464 // https://developer.mozilla.org/docs/Tools/WebIDE
465 user_pref("devtools.webide.enabled",                            false);
466 user_pref("devtools.webide.autoinstallADBHelper",               false);
467 user_pref("devtools.webide.autoinstallFxdtAdapters",            false);
468
469 // PREF: Disable remote debugging
470 // https://developer.mozilla.org/en-US/docs/Tools/Remote_Debugging/Debugging_Firefox_Desktop
471 // https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox#Advanced_settings
472 user_pref("devtools.debugger.remote-enabled",                   false);
473 user_pref("devtools.chrome.enabled",                            false);
474 user_pref("devtools.debugger.force-local",                      true);
475
476 // PREF: Disable Mozilla telemetry/experiments
477 // https://wiki.mozilla.org/Platform/Features/Telemetry
478 // https://wiki.mozilla.org/Privacy/Reviews/Telemetry
479 // https://wiki.mozilla.org/Telemetry
480 // https://www.mozilla.org/en-US/legal/privacy/firefox.html#telemetry
481 // https://support.mozilla.org/t5/Firefox-crashes/Mozilla-Crash-Reporter/ta-p/1715
482 // https://wiki.mozilla.org/Security/Reviews/Firefox6/ReviewNotes/telemetry
483 // https://gecko.readthedocs.io/en/latest/browser/experiments/experiments/manifest.html
484 // https://wiki.mozilla.org/Telemetry/Experiments
485 // https://support.mozilla.org/en-US/questions/1197144
486 // https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html#id1
487 user_pref("toolkit.telemetry.enabled",                          false);
488 user_pref("toolkit.telemetry.unified",                          false);
489 user_pref("toolkit.telemetry.archive.enabled",                  false);
490 user_pref("experiments.supported",                              false);
491 user_pref("experiments.enabled",                                false);
492 user_pref("experiments.manifest.uri",                           "");
493
494 // PREF: Disallow Necko to do A/B testing
495 // https://trac.torproject.org/projects/tor/ticket/13170
496 user_pref("network.allow-experiments",                          false);
497
498 // PREF: Disable sending Firefox crash reports to Mozilla servers
499 // https://wiki.mozilla.org/Breakpad
500 // http://kb.mozillazine.org/Breakpad
501 // https://dxr.mozilla.org/mozilla-central/source/toolkit/crashreporter
502 // https://bugzilla.mozilla.org/show_bug.cgi?id=411490
503 // A list of submitted crash reports can be found at about:crashes
504 user_pref("breakpad.reportURL",                                 "");
505
506 // PREF: Disable sending reports of tab crashes to Mozilla (about:tabcrashed), don't nag user about unsent crash reports
507 // https://hg.mozilla.org/mozilla-central/file/tip/browser/app/profile/firefox.js
508 user_pref("browser.tabs.crashReporting.sendReport",             false);
509 user_pref("browser.crashReports.unsubmittedCheck.enabled",      false);
510
511 // PREF: Disable FlyWeb (discovery of LAN/proximity IoT devices that expose a Web interface)
512 // https://wiki.mozilla.org/FlyWeb
513 // https://wiki.mozilla.org/FlyWeb/Security_scenarios
514 // https://docs.google.com/document/d/1eqLb6cGjDL9XooSYEEo7mE-zKQ-o-AuDTcEyNhfBMBM/edit
515 // http://www.ghacks.net/2016/07/26/firefox-flyweb
516 user_pref("dom.flyweb.enabled",                                 false);
517
518 // PREF: Disable the UITour backend
519 // https://trac.torproject.org/projects/tor/ticket/19047#comment:3
520 user_pref("browser.uitour.enabled",                             false);
521
522 // PREF: Enable Firefox Tracking Protection
523 // https://wiki.mozilla.org/Security/Tracking_protection
524 // https://support.mozilla.org/en-US/kb/tracking-protection-firefox
525 // https://support.mozilla.org/en-US/kb/tracking-protection-pbm
526 // https://kontaxis.github.io/trackingprotectionfirefox/
527 // https://feeding.cloud.geek.nz/posts/how-tracking-protection-works-in-firefox/
528 user_pref("privacy.trackingprotection.enabled",                 true);
529 user_pref("privacy.trackingprotection.pbmode.enabled",          true);
530
531 // PREF: Enable contextual identity Containers feature (Firefox >= 52)
532 // NOTICE: Containers are not available in Private Browsing mode
533 // https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers
534 user_pref("privacy.userContext.enabled",                        true);
535
536 // PREF: Enable Firefox's anti-fingerprinting mode ("resist fingerprinting" or RFP) (Tor Uplift project)
537 // https://wiki.mozilla.org/Security/Tor_Uplift/Tracking
538 // https://bugzilla.mozilla.org/show_bug.cgi?id=1333933
539 // https://wiki.mozilla.org/Security/Fingerprinting
540 // NOTICE: RFP breaks some keyboard shortcuts used in certain websites (see #443)
541 // NOTICE: RFP changes your time zone
542 // NOTICE: RFP breaks some DDoS protection pages (Cloudflare)
543 user_pref("privacy.resistFingerprinting",                       true);
544
545 // PREF: disable mozAddonManager Web API [FF57+]
546 // https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330
547 // https://bugzilla.mozilla.org/buglist.cgi?bug_id=1406795
548 // https://bugzilla.mozilla.org/buglist.cgi?bug_id=1415644
549 // https://bugzilla.mozilla.org/buglist.cgi?bug_id=1453988
550 // https://trac.torproject.org/projects/tor/ticket/26114
551 user_pref("privacy.resistFingerprinting.block_mozAddonManager", true);
552 user_pref("extensions.webextensions.restrictedDomains", "");
553
554 // PREF: enable RFP letterboxing / resizing of inner window [FF67+] (disabled)
555 // https://bugzilla.mozilla.org/1407366
556 //user_pref("privacy.resistFingerprinting.letterboxing", true);
557 //user_pref("privacy.resistFingerprinting.letterboxing.dimensions", "800x600, 1000x1000, 1600x900");
558
559 // PREF: disable showing about:blank/maximized window as soon as possible during startup [FF60+]
560 // https://bugzilla.mozilla.org/1448423
561 user_pref("browser.startup.blankWindow", false);
562
563 // PREF: Disable the built-in PDF viewer
564 // https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2743
565 // https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
566 // https://www.mozilla.org/en-US/security/advisories/mfsa2015-69/
567 user_pref("pdfjs.disabled",                                     true);
568
569 // PREF: Disable collection/sending of the health report (healthreport.sqlite*)
570 // https://support.mozilla.org/en-US/kb/firefox-health-report-understand-your-browser-perf
571 // https://gecko.readthedocs.org/en/latest/toolkit/components/telemetry/telemetry/preferences.html
572 user_pref("datareporting.healthreport.uploadEnabled",           false);
573 user_pref("datareporting.healthreport.service.enabled",         false);
574 user_pref("datareporting.policy.dataSubmissionEnabled",         false);
575 // "Allow Firefox to make personalized extension recommendations"
576 user_pref("browser.discovery.enabled",                          false);
577
578 // PREF: Disable Shield/Heartbeat/Normandy (Mozilla user rating telemetry)
579 // https://wiki.mozilla.org/Advocacy/heartbeat
580 // https://trac.torproject.org/projects/tor/ticket/19047
581 // https://trac.torproject.org/projects/tor/ticket/18738
582 // https://wiki.mozilla.org/Firefox/Shield
583 // https://github.com/mozilla/normandy
584 // https://support.mozilla.org/en-US/kb/shield
585 // https://bugzilla.mozilla.org/show_bug.cgi?id=1370801
586 // https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout
587 user_pref("app.normandy.enabled", false);
588 user_pref("app.normandy.api_url", "");
589 user_pref("extensions.shield-recipe-client.enabled",            false);
590 user_pref("app.shield.optoutstudies.enabled",                   false);
591
592
593 // PREF: Disable Firefox Hello (disabled) (Firefox < 49)
594 // https://wiki.mozilla.org/Loop
595 // https://support.mozilla.org/t5/Chat-and-share/Support-for-Hello-discontinued-in-Firefox-49/ta-p/37946
596 // NOTICE-DISABLED: Firefox Hello requires setting `media.peerconnection.enabled` and `media.getusermedia.screensharing.enabled` to true, `security.OCSP.require` to false to work.
597 //user_pref("loop.enabled",             false);
598
599 // PREF: Disable Firefox Hello metrics collection
600 // https://groups.google.com/d/topic/mozilla.dev.platform/nyVkCx-_sFw/discussion
601 user_pref("loop.logDomains",                                    false);
602
603 // PREF: Enable Auto Update (disabled)
604 // NOTICE: Fully automatic updates are disabled and left to package management systems on Linux. Windows users may want to change this setting.
605 // CIS 2.1.1
606 //user_pref("app.update.auto",                                  true);
607
608 // PREF: Enforce checking for Firefox updates
609 // http://kb.mozillazine.org/App.update.enabled
610 // NOTICE: Update check page might incorrectly report Firefox ESR as out-of-date
611 user_pref("app.update.enabled",                 true);
612
613 // PREF: Enable blocking reported web forgeries
614 // https://wiki.mozilla.org/Security/Safe_Browsing
615 // http://kb.mozillazine.org/Safe_browsing
616 // https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work
617 // http://forums.mozillazine.org/viewtopic.php?f=39&t=2711237&p=12896849#p12896849
618 // CIS 2.3.4
619 user_pref("browser.safebrowsing.enabled",                       true); // Firefox < 50
620 user_pref("browser.safebrowsing.phishing.enabled",              true); // firefox >= 50
621
622 // PREF: Enable blocking reported attack sites
623 // http://kb.mozillazine.org/Browser.safebrowsing.malware.enabled
624 // CIS 2.3.5
625 user_pref("browser.safebrowsing.malware.enabled",               true);
626
627 // PREF: Disable querying Google Application Reputation database for downloaded binary files
628 // https://www.mozilla.org/en-US/firefox/39.0/releasenotes/
629 // https://wiki.mozilla.org/Security/Application_Reputation
630 user_pref("browser.safebrowsing.downloads.remote.enabled",      false);
631
632 // PREF: Disable Pocket
633 // https://support.mozilla.org/en-US/kb/save-web-pages-later-pocket-firefox
634 // https://github.com/pyllyukko/user.js/issues/143
635 user_pref("browser.pocket.enabled",                             false);
636 user_pref("extensions.pocket.enabled",                          false);
637
638 // PREF: Disable "Recommended by Pocket" in Firefox Quantum
639 user_pref("browser.newtabpage.activity-stream.feeds.section.topstories",        false);
640
641 // PREF: Enable Global Privacy Control (GPC) (Firefox >= 120)
642 // https://support.mozilla.org/1/firefox/126.0/Linux/en-US/global-privacy-control
643 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-GPC
644 // https://globalprivacycontrol.org/
645 user_pref("privacy.globalprivacycontrol.enabled",               true);
646
647 /******************************************************************************
648  * SECTION: Automatic connections                                             *
649  ******************************************************************************/
650
651 // PREF: Limit the connection keep-alive timeout to 15 seconds (disabled)
652 // https://github.com/pyllyukko/user.js/issues/387
653 // http://kb.mozillazine.org/Network.http.keep-alive.timeout
654 // https://httpd.apache.org/docs/current/mod/core.html#keepalivetimeout
655 //user_pref("network.http.keep-alive.timeout",                  15);
656
657 // PREF: Disable prefetching of <link rel="next"> URLs
658 // http://kb.mozillazine.org/Network.prefetch-next
659 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#Is_there_a_preference_to_disable_link_prefetching.3F
660 user_pref("network.prefetch-next",                              false);
661
662 // PREF: Disable DNS prefetching
663 // http://kb.mozillazine.org/Network.dns.disablePrefetch
664 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching
665 user_pref("network.dns.disablePrefetch",                        true);
666 user_pref("network.dns.disablePrefetchFromHTTPS",               true);
667
668 // PREF: Disable the predictive service (Necko)
669 // https://wiki.mozilla.org/Privacy/Reviews/Necko
670 user_pref("network.predictor.enabled",                          false);
671
672 // PREF: Reject .onion hostnames before passing the to DNS
673 // https://bugzilla.mozilla.org/show_bug.cgi?id=1228457
674 // RFC 7686
675 user_pref("network.dns.blockDotOnion",                          true);
676
677 // PREF: Disable search suggestions in the search bar
678 // http://kb.mozillazine.org/Browser.search.suggest.enabled
679 user_pref("browser.search.suggest.enabled",                     false);
680
681 // PREF: Disable "Show search suggestions in location bar results"
682 user_pref("browser.urlbar.suggest.searches",                    false);
683 // PREF: When using the location bar, don't suggest URLs from browsing history
684 user_pref("browser.urlbar.suggest.history",                     false);
685 // PREF: Disable Firefox Suggest
686 // https://www.ghacks.net/2021/09/09/how-to-disable-firefox-suggest/
687 // https://support.mozilla.org/en-US/kb/navigate-web-faster-firefox-suggest
688 user_pref("browser.urlbar.groupLabels.enabled", false); // Firefox >= 93
689
690 // PREF: Disable SSDP
691 // https://bugzilla.mozilla.org/show_bug.cgi?id=1111967
692 user_pref("browser.casting.enabled",                            false);
693
694 // PREF: Disable automatic downloading of OpenH264 codec
695 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_media-capabilities
696 // https://andreasgal.com/2014/10/14/openh264-now-in-firefox/
697 user_pref("media.gmp-gmpopenh264.enabled",                      false);
698 user_pref("media.gmp-manager.url",                              "");
699
700 // PREF: Disable speculative pre-connections
701 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_speculative-pre-connections
702 // https://bugzilla.mozilla.org/show_bug.cgi?id=814169
703 user_pref("network.http.speculative-parallel-limit",            0);
704
705 // PREF: Disable downloading homepage snippets/messages from Mozilla
706 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_mozilla-content
707 // https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service
708 user_pref("browser.aboutHomeSnippets.updateUrl",                "");
709
710 // PREF: Never check updates for search engines
711 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_auto-update-checking
712 user_pref("browser.search.update",                              false);
713
714 // PREF: Disable automatic captive portal detection (Firefox >= 52.0)
715 // https://support.mozilla.org/en-US/questions/1157121
716 user_pref("network.captive-portal-service.enabled",             false);
717
718 // PREF: Disable (parts of?) "TopSites"
719 user_pref("browser.topsites.contile.enabled",                           false);
720 user_pref("browser.newtabpage.activity-stream.feeds.topsites",          false);
721 user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites",   false);
722
723 /******************************************************************************
724  * SECTION: HTTP                                                              *
725  ******************************************************************************/
726
727 // PREF: Disallow NTLMv1
728 // https://bugzilla.mozilla.org/show_bug.cgi?id=828183
729 user_pref("network.negotiate-auth.allow-insecure-ntlm-v1",      false);
730 // it is still allowed through HTTPS. uncomment the following to disable it completely.
731 //user_pref("network.negotiate-auth.allow-insecure-ntlm-v1-https",              false);
732
733 // PREF: Enable CSP 1.1 script-nonce directive support
734 // https://bugzilla.mozilla.org/show_bug.cgi?id=855326
735 user_pref("security.csp.experimentalEnabled",                   true);
736
737 // PREF: Enable Content Security Policy (CSP)
738 // https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy
739 // https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
740 user_pref("security.csp.enable",                                true);
741
742 // PREF: Enable Subresource Integrity
743 // https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
744 // https://wiki.mozilla.org/Security/Subresource_Integrity
745 user_pref("security.sri.enable",                                true);
746
747 // PREF: DNT HTTP header (disabled)
748 // https://www.mozilla.org/en-US/firefox/dnt/
749 // https://en.wikipedia.org/wiki/Do_not_track_header
750 // https://dnt-dashboard.mozilla.org
751 // https://github.com/pyllyukko/user.js/issues/11
752 // NOTICE: Do No Track must be enabled manually
753 //user_pref("privacy.donottrackheader.enabled",         true);
754
755 // PREF: Send a referer header with the target URI as the source (disabled)
756 // https://bugzilla.mozilla.org/show_bug.cgi?id=822869
757 // https://github.com/pyllyukko/user.js/issues/227
758 // NOTICE-DISABLED: Spoofing referers breaks functionality on websites relying on authentic referer headers
759 // NOTICE-DISABLED: Spoofing referers breaks visualisation of 3rd-party sites on the Lightbeam addon
760 // NOTICE-DISABLED: Spoofing referers disables CSRF protection on some login pages not implementing origin-header/cookie+token based CSRF protection
761 // TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs
762 //user_pref("network.http.referer.spoofSource",                 true);
763
764 // PREF: Don't send referer headers when following links across different domains
765 // https://github.com/pyllyukko/user.js/issues/227
766 // https://github.com/pyllyukko/user.js/issues/328
767 // https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/
768 // https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks
769 // NOTICE: Blocking referers across same eTLD sites breaks some login flows relying on them, consider lowering this pref to 1
770 user_pref("network.http.referer.XOriginPolicy",         2);
771
772 // PREF: Trim HTTP referer headers to only send the scheme, host, and port
773 // https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks
774 user_pref("network.http.referer.trimmingPolicy",        2);
775
776 // PREF: When sending Referer across domains, only send scheme, host, and port in the Referer header
777 // https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks
778 user_pref("network.http.referer.XOriginTrimmingPolicy", 2);
779
780 // PREF: Accept Only 1st Party Cookies
781 // http://kb.mozillazine.org/Network.cookie.cookieBehavior#1
782 // NOTICE: Blocking 3rd-party cookies breaks a number of payment gateways
783 // CIS 2.5.1
784 user_pref("network.cookie.cookieBehavior",                      1);
785
786 // PREF: Enable first-party isolation
787 // https://bugzilla.mozilla.org/show_bug.cgi?id=1299996
788 // https://bugzilla.mozilla.org/show_bug.cgi?id=1260931
789 // https://wiki.mozilla.org/Security/FirstPartyIsolation
790 // NOTICE: First-party isolation breaks Microsoft Teams
791 // NOTICE: First-party isolation causes HTTP basic auth to ask for credentials for every new tab (see #425)
792 user_pref("privacy.firstparty.isolate",                         true);
793
794 // PREF: Make sure that third-party cookies (if enabled) never persist beyond the session.
795 // https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/
796 // http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly
797 // https://developer.mozilla.org/en-US/docs/Cookies_Preferences_in_Mozilla#network.cookie.thirdparty.sessionOnly
798 user_pref("network.cookie.thirdparty.sessionOnly",              true);
799
800 // PREF: Spoof User-agent (disabled)
801 //user_pref("general.useragent.override",                               "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0");
802 //user_pref("general.appname.override",                         "Netscape");
803 //user_pref("general.appversion.override",                      "5.0 (Windows)");
804 //user_pref("general.platform.override",                                "Win32");
805 //user_pref("general.oscpu.override",                           "Windows NT 6.1");
806
807 /*******************************************************************************
808  * SECTION: Caching                                                            *
809  ******************************************************************************/
810
811 // PREF: Permanently enable private browsing mode
812 // https://support.mozilla.org/en-US/kb/Private-Browsing
813 // https://wiki.mozilla.org/PrivateBrowsing
814 // NOTICE: You can not view or inspect cookies when in private browsing: https://bugzilla.mozilla.org/show_bug.cgi?id=823941
815 // NOTICE: When Javascript is enabled, Websites can detect use of Private Browsing mode
816 // NOTICE: Private browsing breaks Kerberos authentication
817 // NOTICE: Disables "Containers" functionality (see below)
818 // NOTICE: "Always use private browsing mode" (browser.privatebrowsing.autostart) disables the possibility to use password manager: https://support.mozilla.org/en-US/kb/usernames-and-passwords-are-not-saved#w_private-browsing
819 user_pref("browser.privatebrowsing.autostart",                  true);
820
821 // PREF: Do not download URLs for the offline cache
822 // http://kb.mozillazine.org/Browser.cache.offline.enable
823 user_pref("browser.cache.offline.enable",                       false);
824
825 // PREF: Clear history when Firefox closes
826 // https://support.mozilla.org/en-US/kb/Clear%20Recent%20History#w_how-do-i-make-firefox-clear-my-history-automatically
827 // NOTICE: Installing user.js will remove your browsing history, caches and local storage.
828 // NOTICE: Installing user.js **will remove your saved passwords** (https://github.com/pyllyukko/user.js/issues/27)
829 // NOTICE: Clearing open windows on Firefox exit causes 2 windows to open when Firefox starts https://bugzilla.mozilla.org/show_bug.cgi?id=1334945
830 user_pref("privacy.sanitize.sanitizeOnShutdown",                true);
831 user_pref("privacy.clearOnShutdown.cache",                      true);
832 user_pref("privacy.clearOnShutdown.cookies",                    true);
833 user_pref("privacy.clearOnShutdown.downloads",                  true);
834 user_pref("privacy.clearOnShutdown.formdata",                   true);
835 user_pref("privacy.clearOnShutdown.history",                    true);
836 user_pref("privacy.clearOnShutdown.offlineApps",                true);
837 user_pref("privacy.clearOnShutdown.sessions",                   true);
838 user_pref("privacy.clearOnShutdown.openWindows",                true);
839
840 // PREF: Set time range to "Everything" as default in "Clear Recent History"
841 user_pref("privacy.sanitize.timeSpan",                          0);
842
843 // PREF: Clear everything but "Site Preferences" in "Clear Recent History"
844 user_pref("privacy.cpd.offlineApps",                            true);
845 user_pref("privacy.cpd.cache",                                  true);
846 user_pref("privacy.cpd.cookies",                                true);
847 user_pref("privacy.cpd.downloads",                              true);
848 user_pref("privacy.cpd.formdata",                               true);
849 user_pref("privacy.cpd.history",                                true);
850 user_pref("privacy.cpd.sessions",                               true);
851
852 // PREF: Don't remember browsing history
853 user_pref("places.history.enabled",                             false);
854
855 // PREF: Don't remember recently closed tabs
856 user_pref("browser.sessionstore.max_tabs_undo",         0);
857
858 // PREF: Disable disk cache
859 // http://kb.mozillazine.org/Browser.cache.disk.enable
860 user_pref("browser.cache.disk.enable",                          false);
861
862 // PREF: Disable memory cache (disabled)
863 // http://kb.mozillazine.org/Browser.cache.memory.enable
864 //user_pref("browser.cache.memory.enable",              false);
865
866 // PREF: Disable Caching of SSL Pages
867 // CIS Version 1.2.0 October 21st, 2011 2.5.8
868 // http://kb.mozillazine.org/Browser.cache.disk_cache_ssl
869 user_pref("browser.cache.disk_cache_ssl",                       false);
870
871 // PREF: Disable download history
872 // CIS Version 1.2.0 October 21st, 2011 2.5.5
873 user_pref("browser.download.manager.retention",                 0);
874
875 // PREF: Disable password manager (use an external password manager!)
876 // CIS Version 1.2.0 October 21st, 2011 2.5.2
877 user_pref("signon.rememberSignons",                             false);
878
879 // PREF: Disable form autofill, don't save information entered in web page forms and the Search Bar
880 user_pref("browser.formfill.enable",                            false);
881
882 // PREF: Cookies expires at the end of the session (when the browser closes)
883 // http://kb.mozillazine.org/Network.cookie.lifetimePolicy#2
884 user_pref("network.cookie.lifetimePolicy",                      2);
885
886 // PREF: Require manual intervention to autofill known username/passwords sign-in forms
887 // http://kb.mozillazine.org/Signon.autofillForms
888 // https://www.torproject.org/projects/torbrowser/design/#identifier-linkability
889 user_pref("signon.autofillForms",                               false);
890
891 // PREF: Disable formless login capture
892 // https://bugzilla.mozilla.org/show_bug.cgi?id=1166947
893 user_pref("signon.formlessCapture.enabled",                     false);
894
895 // PREF: When username/password autofill is enabled, still disable it on non-HTTPS sites
896 // https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317
897 user_pref("signon.autofillForms.http",                          false);
898
899 // PREF: Show in-content login form warning UI for insecure login fields
900 // https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317
901 user_pref("security.insecure_field_warning.contextual.enabled", true);
902
903 // PREF: Disable the password manager for pages with autocomplete=off (disabled)
904 // https://bugzilla.mozilla.org/show_bug.cgi?id=956906
905 // OWASP ASVS V9.1
906 // Does not prevent any kind of auto-completion (see browser.formfill.enable, signon.autofillForms)
907 //user_pref("signon.storeWhenAutocompleteOff",                  false);
908
909 // PREF: Delete Search and Form History
910 // CIS Version 1.2.0 October 21st, 2011 2.5.6
911 user_pref("browser.formfill.expire_days",                       0);
912
913 // PREF: Clear SSL Form Session Data
914 // http://kb.mozillazine.org/Browser.sessionstore.privacy_level#2
915 // Store extra session data for unencrypted (non-HTTPS) sites only.
916 // CIS Version 1.2.0 October 21st, 2011 2.5.7
917 // NOTE: CIS says 1, we use 2
918 user_pref("browser.sessionstore.privacy_level",                 2);
919
920 // PREF: Delete temporary files on exit
921 // https://bugzilla.mozilla.org/show_bug.cgi?id=238789
922 user_pref("browser.helperApps.deleteTempFileOnExit",            true);
923
924 // PREF: Do not create screenshots of visited pages (relates to the "new tab page" feature)
925 // https://support.mozilla.org/en-US/questions/973320
926 // https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/browser.pagethumbnails.capturing_disabled
927 user_pref("browser.pagethumbnails.capturing_disabled",          true);
928
929 // PREF: Don't fetch and permanently store favicons for Windows .URL shortcuts created by drag and drop
930 // NOTICE: .URL shortcut files will be created with a generic icon
931 // Favicons are stored as .ico files in $profile_dir\shortcutCache
932 user_pref("browser.shell.shortcutFavicons",                                     false);
933
934 // PREF: Disable bookmarks backups (default: 15)
935 // http://kb.mozillazine.org/Browser.bookmarks.max_backups
936 user_pref("browser.bookmarks.max_backups", 0);
937
938 // PREF: Export bookmarks to HTML automatically when closing Firefox (disabled)
939 // https://support.mozilla.org/en-US/questions/1176242
940 //user_pref("browser.bookmarks.autoExportHTML",                                 true);
941 //user_pref("browser.bookmarks.file",   '/path/to/bookmarks-export.html');
942
943 // PREF: Disable downloading of favicons in response to favicon fingerprinting techniques
944 // https://github.com/jonasstrehle/supercookie
945 // http://kb.mozillazine.org/Browser.chrome.site_icons
946 // https://blog.mozilla.org/security/2021/01/26/supercookie-protections/
947 user_pref("browser.chrome.site_icons",                          false);
948
949 /*******************************************************************************
950  * SECTION: UI related                                                         *
951  *******************************************************************************/
952
953 // PREF: Enable insecure password warnings (login forms in non-HTTPS pages)
954 // https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-over-http-please/
955 // https://bugzilla.mozilla.org/show_bug.cgi?id=1319119
956 // https://bugzilla.mozilla.org/show_bug.cgi?id=1217156
957 user_pref("security.insecure_password.ui.enabled",              true);
958
959 // PREF: Disable right-click menu manipulation via JavaScript (disabled)
960 //user_pref("dom.event.contextmenu.enabled",            false);
961
962 // PREF: Disable "Are you sure you want to leave this page?" popups on page close
963 // https://support.mozilla.org/en-US/questions/1043508
964 // NOTICE: disabling "beforeunload" events may lead to losing data entered in web forms
965 // Does not prevent JS leaks of the page close event.
966 // https://developer.mozilla.org/en-US/docs/Web/Events/beforeunload
967 //user_pref("dom.disable_beforeunload",    true);
968
969 // PREF: Disable Downloading on Desktop
970 // CIS 2.3.2
971 user_pref("browser.download.folderList",                        2);
972
973 // PREF: Always ask the user where to download
974 // https://developer.mozilla.org/en/Download_Manager_preferences (obsolete)
975 user_pref("browser.download.useDownloadDir",                    false);
976
977 // PREF: Disable the "new tab page" feature and show a blank tab instead
978 // https://wiki.mozilla.org/Privacy/Reviews/New_Tab
979 // https://support.mozilla.org/en-US/kb/new-tab-page-show-hide-and-customize-top-sites#w_how-do-i-turn-the-new-tab-page-off
980 user_pref("browser.newtabpage.enabled",                         false);
981 user_pref("browser.newtab.url",                                 "about:blank");
982
983 // PREF: Disable Snippets
984 // https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service
985 // https://support.mozilla.org/en-US/kb/snippets-firefox-faq
986 user_pref("browser.newtabpage.activity-stream.feeds.snippets",  false);
987
988 // PREF: Disable Activity Stream
989 // https://wiki.mozilla.org/Firefox/Activity_Stream
990 user_pref("browser.newtabpage.activity-stream.enabled",         false);
991
992 // PREF: Disable new tab tile ads & preload
993 // http://www.thewindowsclub.com/disable-remove-ad-tiles-from-firefox
994 // http://forums.mozillazine.org/viewtopic.php?p=13876331#p13876331
995 // https://wiki.mozilla.org/Tiles/Technical_Documentation#Ping
996 // https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-source
997 // https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-ping
998 // TODO: deprecated? not in DXR, some dead links
999 user_pref("browser.newtabpage.enhanced",                        false);
1000 user_pref("browser.newtab.preload",                             false);
1001 user_pref("browser.newtabpage.directory.ping",                  "");
1002 user_pref("browser.newtabpage.directory.source",                "data:text/plain,{}");
1003
1004 // PREF: Disable Mozilla VPN ads on the about:protections page
1005 // https://support.mozilla.org/en-US/kb/what-mozilla-vpn-and-how-does-it-work
1006 // https://en.wikipedia.org/wiki/Mozilla_VPN
1007 // https://blog.mozilla.org/security/2021/08/31/mozilla-vpn-security-audit/
1008 // https://www.mozilla.org/en-US/security/advisories/mfsa2021-31/
1009 user_pref("browser.vpn_promo.enabled",                  false);
1010
1011 // PREF: Enable Auto Notification of Outdated Plugins (Firefox < 50)
1012 // https://wiki.mozilla.org/Firefox3.6/Plugin_Update_Awareness_Security_Review
1013 // CIS Version 1.2.0 October 21st, 2011 2.1.2
1014 // https://hg.mozilla.org/mozilla-central/rev/304560
1015 user_pref("plugins.update.notifyUser",                          true);
1016
1017 // PREF: Force Punycode for Internationalized Domain Names
1018 // http://kb.mozillazine.org/Network.IDN_show_punycode
1019 // https://www.xudongz.com/blog/2017/idn-phishing/
1020 // https://wiki.mozilla.org/IDN_Display_Algorithm
1021 // https://en.wikipedia.org/wiki/IDN_homograph_attack
1022 // https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/
1023 // CIS Mozilla Firefox 24 ESR v1.0.0 - 3.6
1024 user_pref("network.IDN_show_punycode",                          true);
1025
1026 // PREF: Disable inline autocomplete in URL bar
1027 // http://kb.mozillazine.org/Inline_autocomplete
1028 user_pref("browser.urlbar.autoFill",                            false);
1029 user_pref("browser.urlbar.autoFill.typed",                      false);
1030
1031 // PREF: Disable CSS :visited selectors
1032 // https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/
1033 // https://dbaron.org/mozilla/visited-privacy
1034 user_pref("layout.css.visited_links_enabled",                   false);
1035
1036 // PREF: Disable URL bar autocomplete and history/bookmarks suggestions dropdown
1037 // http://kb.mozillazine.org/Disabling_autocomplete_-_Firefox#Firefox_3.5
1038 user_pref("browser.urlbar.autocomplete.enabled",                false);
1039
1040 // PREF: Do not check if Firefox is the default browser
1041 user_pref("browser.shell.checkDefaultBrowser",                  false);
1042
1043 // PREF: When password manager is enabled, lock the password storage periodically
1044 // CIS Version 1.2.0 October 21st, 2011 2.5.3 Disable Prompting for Credential Storage
1045 user_pref("security.ask_for_password",                          2);
1046
1047 // PREF: Lock the password storage every 1 minutes (default: 30)
1048 user_pref("security.password_lifetime",                         1);
1049
1050 // PREF: Display a notification bar when websites offer data for offline use
1051 // http://kb.mozillazine.org/Browser.offline-apps.notify
1052 user_pref("browser.offline-apps.notify",                        true);
1053
1054 /******************************************************************************
1055  * SECTION: Cryptography                                                      *
1056  ******************************************************************************/
1057
1058 // PREF: Enable HTTPS-Only Mode
1059 // https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/
1060 // https://www.feistyduck.com/bulletproof-tls-newsletter/issue_71_firefox_introduces_https_only_mode
1061 user_pref("dom.security.https_only_mode",                       true);
1062
1063 // PREF: Enable HSTS preload list (pre-set HSTS sites list provided by Mozilla)
1064 // https://blog.mozilla.org/security/2012/11/01/preloading-hsts/
1065 // https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List
1066 // https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
1067 user_pref("network.stricttransportsecurity.preloadlist",        true);
1068
1069 // PREF: Enable Online Certificate Status Protocol
1070 // https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
1071 // https://www.imperialviolet.org/2014/04/19/revchecking.html
1072 // https://www.maikel.pro/blog/current-state-certificate-revocation-crls-ocsp/
1073 // https://wiki.mozilla.org/CA:RevocationPlan
1074 // https://wiki.mozilla.org/CA:ImprovingRevocation
1075 // https://wiki.mozilla.org/CA:OCSP-HardFail
1076 // https://news.netcraft.com/archives/2014/04/24/certificate-revocation-why-browsers-remain-affected-by-heartbleed.html
1077 // https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html
1078 // NOTICE: OCSP leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host
1079 // NOTICE: OCSP is vulnerable to replay attacks when nonce is not configured on the OCSP responder
1080 // NOTICE: OCSP adds latency (performance)
1081 // NOTICE: Short-lived certificates are not checked for revocation (security.pki.cert_short_lifetime_in_days, default:10)
1082 // CIS Version 1.2.0 October 21st, 2011 2.2.4
1083 user_pref("security.OCSP.enabled",                              1);
1084
1085 // PREF: Enable OCSP Stapling support
1086 // https://en.wikipedia.org/wiki/OCSP_stapling
1087 // https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
1088 // https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx
1089 user_pref("security.ssl.enable_ocsp_stapling",                  true);
1090
1091 // PREF: Enable OCSP Must-Staple support (Firefox >= 45)
1092 // https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/
1093 // https://www.entrust.com/ocsp-must-staple/
1094 // https://github.com/schomery/privacy-settings/issues/40
1095 // NOTICE: Firefox falls back on plain OCSP when must-staple is not configured on the host certificate
1096 user_pref("security.ssl.enable_ocsp_must_staple",               true);
1097
1098 // PREF: Require a valid OCSP response for OCSP enabled certificates
1099 // https://groups.google.com/forum/#!topic/mozilla.dev.security/n1G-N2-HTVA
1100 // Disabling this will make OCSP bypassable by MitM attacks suppressing OCSP responses
1101 // NOTICE: `security.OCSP.require` will make the connection fail when the OCSP responder is unavailable
1102 // NOTICE: `security.OCSP.require` is known to break browsing on some [captive portals](https://en.wikipedia.org/wiki/Captive_portal)
1103 user_pref("security.OCSP.require",                              true);
1104
1105 // PREF: Disable TLS Session Tickets
1106 // https://www.blackhat.com/us-13/briefings.html#NextGen
1107 // https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-Slides.pdf
1108 // https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-WP.pdf
1109 // https://bugzilla.mozilla.org/show_bug.cgi?id=917049
1110 // https://bugzilla.mozilla.org/show_bug.cgi?id=967977
1111 user_pref("security.ssl.disable_session_identifiers",           true);
1112
1113 // PREF: Only allow TLS 1.[2-3]
1114 // http://kb.mozillazine.org/Security.tls.version.*
1115 // 1 = TLS 1.0 is the minimum required / maximum supported encryption protocol. (This is the current default for the maximum supported version.)
1116 // 2 = TLS 1.1 is the minimum required / maximum supported encryption protocol.
1117 // 3 = TLS 1.2 is the minimum required / maximum supported encryption protocol.
1118 // 4 = TLS 1.3 is the minimum required / maximum supported encryption protocol.
1119 user_pref("security.tls.version.min",                           3);
1120 user_pref("security.tls.version.max",                           4);
1121
1122 // PREF: Disable insecure TLS version fallback
1123 // https://bugzilla.mozilla.org/show_bug.cgi?id=1084025
1124 // https://github.com/pyllyukko/user.js/pull/206#issuecomment-280229645
1125 user_pref("security.tls.version.fallback-limit",                4);
1126
1127 // PREF: Enforce Public Key Pinning
1128 // https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
1129 // https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning
1130 // "2. Strict. Pinning is always enforced."
1131 user_pref("security.cert_pinning.enforcement_level",            2);
1132
1133 // PREF: Disallow SHA-1
1134 // https://bugzilla.mozilla.org/show_bug.cgi?id=1302140
1135 // https://shattered.io/
1136 user_pref("security.pki.sha1_enforcement_level",                1);
1137
1138 // PREF: Warn the user when server doesn't support RFC 5746 ("safe" renegotiation)
1139 // https://wiki.mozilla.org/Security:Renegotiation#security.ssl.treat_unsafe_negotiation_as_broken
1140 // https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555
1141 user_pref("security.ssl.treat_unsafe_negotiation_as_broken",    true);
1142
1143 // PREF: Disallow connection to servers not supporting safe renegotiation (disabled)
1144 // https://wiki.mozilla.org/Security:Renegotiation#security.ssl.require_safe_negotiation
1145 // https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555
1146 // TODO: `security.ssl.require_safe_negotiation` is more secure but makes browsing next to impossible (2012-2014-... - `ssl_error_unsafe_negotiation` errors), so is left disabled
1147 //user_pref("security.ssl.require_safe_negotiation",            true);
1148
1149 // PREF: Disable automatic reporting of TLS connection errors
1150 // https://support.mozilla.org/en-US/kb/certificate-pinning-reports
1151 // we could also disable security.ssl.errorReporting.enabled, but I think it's
1152 // good to leave the option to report potentially malicious sites if the user
1153 // chooses to do so.
1154 // you can test this at https://pinningtest.appspot.com/
1155 user_pref("security.ssl.errorReporting.automatic",              false);
1156
1157 // PREF: Pre-populate the current URL but do not pre-fetch the certificate in the "Add Security Exception" dialog
1158 // http://kb.mozillazine.org/Browser.ssl_override_behavior
1159 // https://github.com/pyllyukko/user.js/issues/210
1160 user_pref("browser.ssl_override_behavior",                      1);
1161
1162 // PREF: Encrypted SNI (when TRR is enabled)
1163 // https://www.cloudflare.com/ssl/encrypted-sni/
1164 // https://wiki.mozilla.org/Trusted_Recursive_Resolver#ESNI
1165 // https://en.wikipedia.org/wiki/Server_Name_Indication#Security_implications_(ESNI)
1166 user_pref("network.security.esni.enabled",                      true);
1167
1168 /******************************************************************************
1169  * SECTION: Cipher suites                                                     *
1170  ******************************************************************************/
1171
1172 // PREF: Disable null ciphers
1173 user_pref("security.ssl3.rsa_null_sha",                         false);
1174 user_pref("security.ssl3.rsa_null_md5",                         false);
1175 user_pref("security.ssl3.ecdhe_rsa_null_sha",                   false);
1176 user_pref("security.ssl3.ecdhe_ecdsa_null_sha",                 false);
1177 user_pref("security.ssl3.ecdh_rsa_null_sha",                    false);
1178 user_pref("security.ssl3.ecdh_ecdsa_null_sha",                  false);
1179
1180 // PREF: Disable SEED cipher
1181 // https://en.wikipedia.org/wiki/SEED
1182 user_pref("security.ssl3.rsa_seed_sha",                         false);
1183
1184 // PREF: Disable 40/56/128-bit ciphers
1185 // 40-bit ciphers
1186 user_pref("security.ssl3.rsa_rc4_40_md5",                       false);
1187 user_pref("security.ssl3.rsa_rc2_40_md5",                       false);
1188 // 56-bit ciphers
1189 user_pref("security.ssl3.rsa_1024_rc4_56_sha",                  false);
1190 // 128-bit ciphers
1191 user_pref("security.ssl3.rsa_camellia_128_sha",                 false);
1192 user_pref("security.ssl3.ecdhe_rsa_aes_128_sha",                false);
1193 user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha",              false);
1194 user_pref("security.ssl3.ecdh_rsa_aes_128_sha",                 false);
1195 user_pref("security.ssl3.ecdh_ecdsa_aes_128_sha",               false);
1196 user_pref("security.ssl3.dhe_rsa_camellia_128_sha",             false);
1197 user_pref("security.ssl3.dhe_rsa_aes_128_sha",                  false);
1198
1199 // PREF: Disable RC4
1200 // https://developer.mozilla.org/en-US/Firefox/Releases/38#Security
1201 // https://bugzilla.mozilla.org/show_bug.cgi?id=1138882
1202 // https://rc4.io/
1203 // https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2566
1204 user_pref("security.ssl3.ecdh_ecdsa_rc4_128_sha",               false);
1205 user_pref("security.ssl3.ecdh_rsa_rc4_128_sha",                 false);
1206 user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha",              false);
1207 user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha",                false);
1208 user_pref("security.ssl3.rsa_rc4_128_md5",                      false);
1209 user_pref("security.ssl3.rsa_rc4_128_sha",                      false);
1210 user_pref("security.tls.unrestricted_rc4_fallback",             false);
1211
1212 // PREF: Disable 3DES (effective key size is < 128)
1213 // https://en.wikipedia.org/wiki/3des#Security
1214 // http://en.citizendium.org/wiki/Meet-in-the-middle_attack
1215 // http://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html
1216 user_pref("security.ssl3.dhe_dss_des_ede3_sha",                 false);
1217 user_pref("security.ssl3.dhe_rsa_des_ede3_sha",                 false);
1218 user_pref("security.ssl3.ecdh_ecdsa_des_ede3_sha",              false);
1219 user_pref("security.ssl3.ecdh_rsa_des_ede3_sha",                false);
1220 user_pref("security.ssl3.ecdhe_ecdsa_des_ede3_sha",             false);
1221 user_pref("security.ssl3.ecdhe_rsa_des_ede3_sha",               false);
1222 user_pref("security.ssl3.rsa_des_ede3_sha",                     false);
1223 user_pref("security.ssl3.rsa_fips_des_ede3_sha",                false);
1224
1225 // PREF: Disable ciphers with ECDH (non-ephemeral)
1226 user_pref("security.ssl3.ecdh_rsa_aes_256_sha",                 false);
1227 user_pref("security.ssl3.ecdh_ecdsa_aes_256_sha",               false);
1228
1229 // PREF: Disable 256 bits ciphers without PFS
1230 user_pref("security.ssl3.rsa_camellia_256_sha",                 false);
1231
1232 // PREF: Enable GCM ciphers (TLSv1.2 only)
1233 // https://en.wikipedia.org/wiki/Galois/Counter_Mode
1234 user_pref("security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256",       true); // 0xc02b
1235 user_pref("security.ssl3.ecdhe_rsa_aes_128_gcm_sha256",         true); // 0xc02f
1236
1237 // PREF: Enable ChaCha20 and Poly1305 (Firefox >= 47)
1238 // https://www.mozilla.org/en-US/firefox/47.0/releasenotes/
1239 // https://tools.ietf.org/html/rfc7905
1240 // https://bugzilla.mozilla.org/show_bug.cgi?id=917571
1241 // https://bugzilla.mozilla.org/show_bug.cgi?id=1247860
1242 // https://cr.yp.to/chacha.html
1243 user_pref("security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256", true);
1244 user_pref("security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256",   true);
1245
1246 // PREF: Disable ciphers susceptible to the logjam attack
1247 // https://weakdh.org/
1248 user_pref("security.ssl3.dhe_rsa_camellia_256_sha",             false);
1249 user_pref("security.ssl3.dhe_rsa_aes_256_sha",                  false);
1250
1251 // PREF: Disable ciphers with DSA (max 1024 bits)
1252 user_pref("security.ssl3.dhe_dss_aes_128_sha",                  false);
1253 user_pref("security.ssl3.dhe_dss_aes_256_sha",                  false);
1254 user_pref("security.ssl3.dhe_dss_camellia_128_sha",             false);
1255 user_pref("security.ssl3.dhe_dss_camellia_256_sha",             false);
1256
1257 // PREF: Ciphers with CBC & SHA-1 (disabled)
1258 //user_pref("security.ssl3.rsa_aes_256_sha",                    false); // 0x35
1259 //user_pref("security.ssl3.rsa_aes_128_sha",                    false); // 0x2f
1260 //user_pref("security.ssl3.ecdhe_rsa_aes_256_sha",              false); // 0xc014
1261 //user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha",            false); // 0xc00a
1262
1263 // PREF: Enable X25519Kyber768Draft00 (post-quantum key exchange) [FF Nightly 2024-01-18+]
1264 // https://datatracker.ietf.org/doc/draft-tls-westerbaan-xyber768d00/
1265 // https://twitter.com/bwesterb/status/1748017372764475519
1266 // https://pq.cloudflareresearch.com/
1267 user_pref("security.tls.enable_kyber",                          true);