Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Configuration Guide for Privacy Freaks and Performance Buffs

12bytes.org

Post reply on HN
Print view View original

111–120 of 125 posts

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#111

Post by mikedelfino »

tinus_hn wrote: post #109
hazeii wrote: post #67

Earlier quoted context omitted.

Indeed, that's the approach I use to run multiple copies of Thunderbird. Using a separate account does add protection against browser exploits though (if visiting an interesting-but-risky site, the 'guest' account approach prevents access to the main account - at least as long as a browser exploit doesn't then lead to a privilege escalation).

Although exploitation is more difficult, all programs that run in an X session have complete access to all the other programs in it, regardless of user ids or for that matter the host the program is running on.

You can use xauth to get an Xauthority cookie for untrusted clients, so they can't meddle with other X clients.

The biggest downside is that you lose access to the X clipboard - which is also good, so its data doesn't get compromised.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#112

Post by mikedelfino »

suprfnk wrote: post #32
ams6110 wrote: post #4

Earlier quoted context omitted.

Yeah I've tried some of these extremely hardened configurations but ultimately there's too much breakage. My config now is basically: - uBlock Origin in default configuration - No 3rd party cookies (breaks some things, but not too many) - Clear history and cookies on exit Combined with an /etc/hosts file, and rather frequent browser restarts (generally daily).

> Clear history [..] on exit Why the history? That's not readable by anyone except you, right? > Clear [..] cookies on exit So do you have to keep logging in to websites daily? Isn't that very annoying?

I'm someone who clear cookies on exit to the sole purpose of having to login again every time. And I don't even use a password manager.

It does get annoying because I have to type my credentials all the time, but it just takes a few seconds so it's not a big deal. I'm sure this is not preventing me from doing anything better with my time.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#113

Post by tinus_hn »

mikedelfino wrote: post #111
tinus_hn wrote: post #109

Earlier quoted context omitted.

Although exploitation is more difficult, all programs that run in an X session have complete access to all the other programs in it, regardless of user ids or for that matter the host the program is running on.

You can use xauth to get an Xauthority cookie for untrusted clients, so they can't meddle with other X clients. The biggest downside is that you lose access to the X clipboard - which is also good, so its data doesn't get compromised.

I did not know that. Turns out it’s a bit weak though, all untrusted clients have full access to all other untrusted clients. So you only have two levels. Still, better than nothing.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#114

Post by hazeii »

tinus_hn wrote: post #109
hazeii wrote: post #67

Earlier quoted context omitted.

Indeed, that's the approach I use to run multiple copies of Thunderbird. Using a separate account does add protection against browser exploits though (if visiting an interesting-but-risky site, the 'guest' account approach prevents access to the main account - at least as long as a browser exploit doesn't then lead to a privilege escalation).

Although exploitation is more difficult, all programs that run in an X session have complete access to all the other programs in it, regardless of user ids or for that matter the host the program is running on.

As a simple demo of this, running 'gimp' as a 'guest' user allows you to take screenshots of windows owned by the user who started the session. Thus, a compromised copy of firefox on the 'guest' account could, for example, easily capture the contents of any window on the system.

Still, the main reason I run the browser as a different user is to isolate it for privacy; there are some security benefits too, but I agree it's not something that would defeat a targetted attack.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#115

Post by rhn_mk1 »

gorhill wrote: post #107
rhn_mk1 wrote: post #24

> NoScript Security Suite: since uMatrix will be used to block scripts, this functionality is not required from NoScript This is a mistake. uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself. NoScript stops script execution completely. NoScript also activates ` ` tags which will allow content to render on Medium. And which break Twit…

> uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself You are mistaken. You could have taken a few seconds to try for yourself before making this erroneous claim. > NoScript also activates ` ` tags which will allow content to render on Medium. uMatrix can also "activate" the `noscript` tags, and this can be disabled/enabled on a per-s…

Can you explain how to enable/disable the noscript tags? I can only find a global "spoof noscript tags" option which does indeed seem to make tags work.

I did base my comment on an observations. I wouldn't be using NoScript myself if I wasn't fairly sure it's the only way.

Seems I was wrong indeed, because there are no scripts listed in the Debug tab of the Inspector if uMatrix blocks them.

Thanks for pointing it out! removes NoScript

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#116

Post by gorhill »

rhn_mk1 wrote: post #115
gorhill wrote: post #107

Earlier quoted context omitted.

> uMatrix will block requests which would pull source code, but it does not stop script execution, i.e. those embedded in the page itself You are mistaken. You could have taken a few seconds to try for yourself before making this erroneous claim. > NoScript also activates ` ` tags which will allow content to render on Medium. uMatrix can also "activate" the `noscript` tags, and this can be disabled/enabled on a per-s…

Can you explain how to enable/disable the noscript tags? I can only find a global "spoof noscript tags" option which does indeed seem to make tags work. I did base my comment on an observations. I wouldn't be using NoScript myself if I wasn't fairly sure it's the only way. Seems I was wrong indeed, because there are no scripts listed in the Debug tab of the Inspector if uMatrix blocks them. Thanks for pointing it out…

> Can you explain how to enable/disable the noscript tags?

It's one of the per-scope switches, see: https://github.com/gorhill/uMatrix/wiki/Per-scope-switches

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#117

Post by AlecSchueler »

kaskavalci wrote: post #106
robinhood wrote: post #86

Earlier quoted context omitted.

Also, block all tracking servers at the hosts level by adding rules in your /etc/hosts. I've been using https://github.com/StevenBlack/hosts for a few years now and it's incredibly useful.

How do you automate its updates?

Cron and git would be my idea.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#118

Post by rhn_mk1 »

gorhill wrote: post #116
rhn_mk1 wrote: post #115

Earlier quoted context omitted.

Can you explain how to enable/disable the noscript tags? I can only find a global "spoof noscript tags" option which does indeed seem to make tags work. I did base my comment on an observations. I wouldn't be using NoScript myself if I wasn't fairly sure it's the only way. Seems I was wrong indeed, because there are no scripts listed in the Debug tab of the Inspector if uMatrix blocks them. Thanks for pointing it out…

> Can you explain how to enable/disable the noscript tags? It's one of the per-scope switches, see: https://github.com/gorhill/uMatrix/wiki/Per-scope-switches

Thanks!

Unfortunately, Twitter's forced redirect still takes place even after it's off :(

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#119

Post by stoically »

Tomte wrote: post #36
sohkamyung wrote: post #6

One thing not mentioned in the list is Firefox Multi-Account Containers [1]. It helps by segregating your on-line information (cookies) into separate containers that you set up. It doesn't stop sites pulling all cookies, but it reduces the amount of information being sent: only the information in the same container is accessible. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account...

I abandoned that. Mukti containers have lots and lots of usability issues. I had some tabs (mostly YouTube) opened thrice when clicking on a YT link. They don't automatically switch back to the default container. That's a big problem. You open your FB container (and Firefox can do this automatically when entering a FB URL or following a link there), you follow a link elsewhere or enter another URL, and you keep inadv…

> I had some tabs (mostly YouTube) opened thrice when clicking on a YT link.

Some of the multiple tabs issues have been fixed in version 6.0.0. And the upcoming version will fix them completely.

> They don't automatically switch back to the default container. That's a big problem

I've added an "Isolation" feature to the just published version 0.67 of the Temporary Containers Add-on that gives you several ways to avoid accidentally staying in the same container - including an option to only allow "Always open in" assigned domains to load in their container.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#120

Post by stoically »

acqq wrote: post #93
r3bl wrote: post #30

Earlier quoted context omitted.

I just checked all the links in the repo of the add-on, and only links to Mozilla's domains are links to the MPL license.

I’ve had it installed before and received the prompt “to install the update of this extension please accept the new telemetry conditions.” I don’t claim every user sees it (maybe I’m a/b tested?). I’ve rejected it, and checking the repo wouldn’t help for that. The new requested permission, different from the ones previously accepted by me is, if I remember: " Monitor extension usage and manage themes" What's that if…

> How about not being required? Older versions really didn't require.

Unfortunately there's no other way for us to check whether an Add-on that tries to access the "API" has the needed "contextualIdentities" permission. I can assure you that it's in no way about telemetry and never will be. If the Multi-Account Features would be a Firefox platform feature then such an API would have the same requirements.

Post reply on HN