Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Profilemaker

ffprofile.com

Post reply on HN
Print view View original

61–70 of 89 posts

Re: Firefox Profilemaker

#61

Post by mrmr1993 »

xte wrote: post #54
mrmr1993 wrote: post #48

Earlier quoted context omitted.

This seems to be by design: when these things are available, spyware -- especially on Windows -- will be quick to make malicious changes in all these if they can. It's a pain, but I can see the compromise. If it makes the average Firefox user more vulnerable, there's definitely a case to protect them, even at the expense of its more capable users.

No software trick can fix OS unsafe design. Also "protecting users" limiting their power means jails them, not really protecting. End users are adult, not child, and developers are others adults with ZERO right on their software's user. If people want safer systems better learn to avoid commercial software, nothing else can help them.

I can agree in general, but, for now, disabling a firefox --install maliciousaddon.xpi and firefox --setconfig keyyoudontwant=valueyoudontlike is enough barrier to stop a majority of bad actors. None of us want users to click yes through install screens, having toolbars and spyware installed for the average user, but that has been the reality of those APIs thus far.

Perhaps a more fine-grained permission model is needed for cross-application changes, but I can't think of anybody actively working on it in an OS.

Re: Firefox Profilemaker

#62

Post by mrmr1993 »

rhizome wrote: post #52
mrmr1993 wrote: post #48

Earlier quoted context omitted.

This seems to be by design: when these things are available, spyware -- especially on Windows -- will be quick to make malicious changes in all these if they can. It's a pain, but I can see the compromise. If it makes the average Firefox user more vulnerable, there's definitely a case to protect them, even at the expense of its more capable users.

if spyware has permissions to change ".firefox-prefs" doesn't it have permission to change about:config items, too?

Yes, this leads Firefox to be fairly conservative with its permissions.

In general, blocking userspace from installing extensions and otherwise running malicious code stops FF from being exploited. Blocking all of these options blocks the OS from bad behaviour, especially where the user may expect a new computer/phone to have the default behaviour.

The vendors of phones and personal computers seem to have an interest in interfering with users' internet access; perhaps it is a good decision that Firefox does not let them.

Re: Firefox Profilemaker

#63

Post by albertgoeswoof »

huhtenberg wrote: post #45
0xffff2 wrote: post #21

Earlier quoted context omitted.

>(This is in fact sarcasm before you get too eager with that down arrow) I see this defense quite a lot on the internet, and I think it's misplaced. Even without your comment, I would have downvoted you, not because I though you were in earnest, but because your sarcastic comment doesn't add anything to the conversation.

Technically, your comment doesn't add much to the conversation either.

If you believe that your comment adds value, then so must the parent comment. If that’s true then your comment is false and adds no value.

Quite paradoxical.

Re: Firefox Profilemaker

#65

Post by forapurpose »

Spooky23 wrote: post #40
papayawhip wrote: post #6

I feel the strong need to point out some of these settings will break Firefox in subtle and hard to understand ways. There’s a reason you “void the warranty” when tweaking the about:config preferences. No rule against it, but just watch out. (Mozilla employee)

Does Mozilla have a sanctioned way to pre-configure a browser with standard configurations? This used to be impossible, and essentially made my employer banish Firefox in most cases.

Look up Mike Kaply's blog; he covers it extensively and, AFAIK, knows the topic as well as anyone.

Re: Firefox Profilemaker

#66

Post by dangom »

If I opt for multiple "hidden" settings that make my browser more private, am I not giving away my privacy? I mean, finger-printers will notice my unique fingerprint consisting of tailor made privacy choices.

Re: Firefox Profilemaker

#67

Post by jolmg »

xte wrote: post #41
papayawhip wrote: post #6

I feel the strong need to point out some of these settings will break Firefox in subtle and hard to understand ways. There’s a reason you “void the warranty” when tweaking the about:config preferences. No rule against it, but just watch out. (Mozilla employee)

As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any complex enough software offer config files/dir. normally human readable and manageable. I can easily install plugins in Emacs via a simple config edit, same for (n)vim, same for zsh or fish, I can change my OS (NixOS) with a simple human-readable config file. Same f…

> ... Mozilla seems to try avoiding supporting such a thing

Back when I was trying to manage the configuration of my machines by having a git repository in my home directory or using stow, I got a little upset when I found that firefox stored its configuration in a profile directory with a random prefix. Why would it make it random? It's got to be the only program to do such a thing. I cannot imagine it's for anything other than to annoy people trying to manage its configuration with tools different from their own.

I've since found a way to make the profile directory not have a random prefix, but it still requires doing the change through Firefox's GUI profile manager.

Re: Firefox Profilemaker

#68

Post by tinus_hn »

jolmg wrote: post #67
xte wrote: post #41

Earlier quoted context omitted.

As a FF user (and a browser's user in general) I found actual browsers absurd monsters that service like ffprofile only try to mitigate. Few example: any complex enough software offer config files/dir. normally human readable and manageable. I can easily install plugins in Emacs via a simple config edit, same for (n)vim, same for zsh or fish, I can change my OS (NixOS) with a simple human-readable config file. Same f…

> ... Mozilla seems to try avoiding supporting such a thing Back when I was trying to manage the configuration of my machines by having a git repository in my home directory or using stow, I got a little upset when I found that firefox stored its configuration in a profile directory with a random prefix. Why would it make it random? It's got to be the only program to do such a thing. I cannot imagine it's for anythin…

The name is random so pages on the web can’t reference files in it using the file:// urls.

Re: Firefox Profilemaker

#69

Post by moosingin3space »

garrettr_ wrote: post #44
currysausage wrote: post #33

Earlier quoted context omitted.

Ironically, checking for UTC+0 JavaScript time from an obviously-not-UTC+0 IP geolocation might give additional hints for fingerprinting, as does everything else that looks non-default, like odd language preferences or even a DNT header.

Good point. I'm pretty sure this component of resistFingerprinting is derived from Project Fusion, which uplifts privacy/anonymity-related changes from Tor Browser into Firefox. In the Tor Browser threat model, the idea is that you can't avoid looking like a Tor user, so the goal is to make all Tor users indistinguishable from each other. Flipping this pref as a regular Firefox user is incompatible with its primary i…

> should be designed and implemented holistically for best results

This is why I, a privacy-conscious individual, don't follow any of these guides in my Firefox. If you follow the discussion on Bugzilla, the weekly team meeting notes, and occasionally ask respectful questions on Mozilla IRC, you come to a similar conclusion to me in that the Firefox development community is doing the right thing in not enabling this by default.

Re: Firefox Profilemaker

#70

Post by jolmg »

tinus_hn wrote: post #68
jolmg wrote: post #67

Earlier quoted context omitted.

> ... Mozilla seems to try avoiding supporting such a thing Back when I was trying to manage the configuration of my machines by having a git repository in my home directory or using stow, I got a little upset when I found that firefox stored its configuration in a profile directory with a random prefix. Why would it make it random? It's got to be the only program to do such a thing. I cannot imagine it's for anythin…

The name is random so pages on the web can’t reference files in it using the file:// urls.

If that's dangerous in Firefox, isn't it just as dangerous, if not more, for them to reference other non-firefox files? I can't see this being a proper security measure for anything.
Post reply on HN