Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Configuration Guide for Privacy Freaks and Performance Buffs

12bytes.org

Post reply on HN
Print view View original

61–70 of 125 posts

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#61

Post by sleavey »

milofeynman wrote: post #12
sohkamyung wrote: post #6

One thing not mentioned in the list is Firefox Multi-Account Containers [1]. It helps by segregating your on-line information (cookies) into separate containers that you set up. It doesn't stop sites pulling all cookies, but it reduces the amount of information being sent: only the information in the same container is accessible. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account...

There is a new config in Firefox under privacy.firstpartyisolation that is similar. But I can't use it or the various referer about:configs with my work mac because they break JIRA. First party isolation was made for Tor and privacy and keeps all cookies in containers in some fashion.

It's a promising idea but has issues currently. In recent Nightly builds I found it completely broke websites that override control keys [1], which is loads (GitHub, Facebook, Google Docs, etc.). It'll be great when they iron out all the bugs, because this guards against all sorts of the more advanced, sinister ways of deanonymising people.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1433592

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#62

Post by patrickbolle »

alwillis wrote: post #34

Great article. However, the days when we could install some plugins and tweak a few settings to restore our privacy are, unfortunately, pretty much over. There’s only so much a plugin can do when it doesn’t have access to the core APIs of the rendering engine or the network stack. As long as Google and Firefox are incentivized to make money by ads, user tracking and all of the rest, they won’t stop. Long story short:…

This sounds 100% like an ad just FYI

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#63

Post by Santosh83 »

QasimK wrote: post #41
hazeii wrote: post #33

For privacy, on a linux box are there any downsides to simply creating one or more extra accounts, and running Firefox in them for privacy ('DISPLAY=:0 firefox')?. I use this approach to set up firefox as I like it on a spare account, then copy '.mozilla' to '.mozilla-base'. Then it's just a simple case of 'su -l guest' and (via a script) 'rm -fr ~/.mozilla; cp -a ~/.mozilla_base .mozilla; DISPLAY=:0 firefox; rm -fr…

Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?

AFAIK Firefox profiles should give you the same kind of privacy as running them under different user accounts.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#64

Post by lucideer »

severine wrote: post #52
lucideer wrote: post #11

Earlier quoted context omitted.

This is a great post, and is exactly the line I've been thinking along for a long time. I currently use uMatrix for this and it implements this almost perfectly. However, it's scope is too narrow: it only controls requests within the webpage, so doesn't have access to it many requests the browser will make outside of that scope. If you start by broadening the scope from webpage to browser, you eventually get to the o…

>it only controls requests within the webpage, so doesn't have access to it many requests the browser will make outside of that scope. You also have the "behind the scene" settings: https://github.com/gorhill/uBlock/wiki/Behind-the-scene-netw... That's for uBlock Origin but I seem to recall it works similarly in uMatrix (can't check now).

Wow. That's not a feature I was aware of at all.

My only concern here is: does the extensions API used by this feature definitely cover all requests made by the browser. e.g. I don't see requests to geolocation services from the Navigator.geolocation API, Google Safe Browsing or CT auditing included in the list of example request types there.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#65

Post by Santosh83 »

QasimK wrote: post #39
cpeterso wrote: post #29

Also check out Firefox's "privacy.resistFingerprinting" [1] and "privacy.firstparty.isolate" [2] prefs in about:config. These are Tor privacy features that Tor and Mozilla are merging into Firefox. resistFingerprinting reduces the uniqueness of various Firefox properties that are visible to JavaScript and web servers. First-party isolation will isolate third-party cookies by first-party domain. So Facebook Like butto…

Is there any reason not to just block third-party cookies ("Accept third-party cookies: Never" in settings) all-together? I've never encountered anything breaking as a result of doing this.

That's what I do too. Deny all third-party cookies, plus uBlock Origin with a sizable filter list and prefetching and link auditing blocked, video autoplay disabled gets me most of the security benefits with minimal setup and cognitive load. Privacy is not much better than running vanilla because although 3rd party cookies are blocked, most sites can still identify by device fingerprinting. That can only be blocked by not running Javascript, but that's personally too much of a hassle to handle and unbreak for practically every site out there.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#66

Post by 12bytes »

sohkamyung wrote: post #6

One thing not mentioned in the list is Firefox Multi-Account Containers [1]. It helps by segregating your on-line information (cookies) into separate containers that you set up. It doesn't stop sites pulling all cookies, but it reduces the amount of information being sent: only the information in the same container is accessible. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account...

thanks for that - i'll look into adding that information

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#67

Post by hazeii »

Santosh83 wrote: post #63
QasimK wrote: post #41

Earlier quoted context omitted.

Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?

AFAIK Firefox profiles should give you the same kind of privacy as running them under different user accounts.

Indeed, that's the approach I use to run multiple copies of Thunderbird. Using a separate account does add protection against browser exploits though (if visiting an interesting-but-risky site, the 'guest' account approach prevents access to the main account - at least as long as a browser exploit doesn't then lead to a privilege escalation).

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#68

Post by forgotmypw »

alwillis wrote: post #34

Great article. However, the days when we could install some plugins and tweak a few settings to restore our privacy are, unfortunately, pretty much over. There’s only so much a plugin can do when it doesn’t have access to the core APIs of the rendering engine or the network stack. As long as Google and Firefox are incentivized to make money by ads, user tracking and all of the rest, they won’t stop. Long story short:…

Are there any mods on this site? This is spam with referral links.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#69

Post by Vinnl »

rockdoe wrote: post #51

What I don't understand is why someone would go to the problems of essentially spending a lot of time breaking their Firefox installation instead of using Tor directly when they care about privacy. Most of the tweaks boil down to turning Firefox defaults into Tor defaults, but without the benefit of actual anonymity, unless you're going to go ahead and install and trust the VPN provider which you also need. The major…

Because if you don't use Tor browser correctly, you might actually be leaking some of your private data.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#70

Post by 12bytes »

rhn_mk1 wrote: post #24

> NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript This is a mistake. uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself. NoScript stops script execution completely. NoScript also activates ` ` tags which will allow content to render on Medium. And which break Twit…

> NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript

> This is a mistake.

thanks for bringing this up - i couldn't quickly find info regarding how uM handles inline scripts, but i see that uBO does have that specific option - this has caused me to look deeper into uBO and i'm now considering revising the guide and dumping uM completely since i personally don't require all the granularity of uM (i always allow images/css globally for example)

so although there may be some caveats with not using NS, it seems that uBO can basically eliminate the need for NS, at least for those of us that just want stuff to work for the most part

Post reply on HN