Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Configuration Guide for Privacy Freaks and Performance Buffs

12bytes.org

Post reply on HN
Print view View original

41–50 of 125 posts

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#41

Post by QasimK »

hazeii wrote: post #33

For privacy, on a linux box are there any downsides to simply creating one or more extra accounts, and running Firefox in them for privacy ('DISPLAY=:0 firefox')?. I use this approach to set up firefox as I like it on a spare account, then copy '.mozilla' to '.mozilla-base'. Then it's just a simple case of 'su -l guest' and (via a script) 'rm -fr ~/.mozilla; cp -a ~/.mozilla_base .mozilla; DISPLAY=:0 firefox; rm -fr…

Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#42

Post by regecks »

arthurfm wrote: post #21
sohkamyung wrote: post #6

One thing not mentioned in the list is Firefox Multi-Account Containers [1]. It helps by segregating your on-line information (cookies) into separate containers that you set up. It doesn't stop sites pulling all cookies, but it reduces the amount of information being sent: only the information in the same container is accessible. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Also worth mentioning is the Temporary Containers add-on [1] [2] which works in conjunction with Multi-Account Containers. If you browse the Internet in default Tabs or in a specific Container you still collect Cookies, Storage and Cache in one place — which is something advertisers and other data-collecting services really appreciate — it makes tracking you easy. Fortunately there’s an easy way to automatically crea…

Nice! This is exactly the feature I had been pining for, with Containers already being a core part of my browser experience. Works as advertised. Always pays to open the comments, thanks!

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#43

Post by chrisan »

ams6110 wrote: post #4
TD-Linux wrote: post #2

This isn't the most unreasonable list I've seen, but beware you will break many websites with this, so you need to be prepared to deal with the fallout. Notably, a lot of the breakage is hidden in user.js, including: * No WebGL or WebRTC * Aggressive TLS settings (will break many websites) * Mixed-content upgrading (Nightly ran an experiment on this recently and it also broke a lot of websites) * No history The text…

Yeah I've tried some of these extremely hardened configurations but ultimately there's too much breakage. My config now is basically: - uBlock Origin in default configuration - No 3rd party cookies (breaks some things, but not too many) - Clear history and cookies on exit Combined with an /etc/hosts file, and rather frequent browser restarts (generally daily).

> Combined with an /etc/hosts file

Check out pi-hole and manage that for your whole family

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#44

Post by hazeii »

QasimK wrote: post #41
hazeii wrote: post #33

For privacy, on a linux box are there any downsides to simply creating one or more extra accounts, and running Firefox in them for privacy ('DISPLAY=:0 firefox')?. I use this approach to set up firefox as I like it on a spare account, then copy '.mozilla' to '.mozilla-base'. Then it's just a simple case of 'su -l guest' and (via a script) 'rm -fr ~/.mozilla; cp -a ~/.mozilla_base .mozilla; DISPLAY=:0 firefox; rm -fr…

Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?

I'm not familiar with Firefox Multi-account containers; do they use separate Unix accounts? (since my approach means Firefox is running as a completely diffrent user, a simple firefox compromise or bug shouldn't be able to access anything sensitive on the main account - like SSH keys, say).

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#45

Post by regecks »

hazeii wrote: post #44
QasimK wrote: post #41

Earlier quoted context omitted.

Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?

I'm not familiar with Firefox Multi-account containers; do they use separate Unix accounts? (since my approach means Firefox is running as a completely diffrent user, a simple firefox compromise or bug shouldn't be able to access anything sensitive on the main account - like SSH keys, say).

They're not containers as in Linux containers, they're "contextual identities" within the same Firefox process, that isolate things like cookies. Much weaker isolation (technologically) than process/user privilege separation, but OTOH highly usable. (Well, there's the e10s process separation, but nothing anything extra for multi-account containers, as far as I understand).

What things it isolates are listed here: https://wiki.mozilla.org/Security/Contextual_Identity_Projec...

FWIW they work great.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#46

Post by eps »

CJefferson wrote: post #35
huhtenberg wrote: post #26

> C:\Program Files\Mozilla Firefox\browser\features\ WOAH. That's some genuinely nasty stuff that no one would normally want on their machines AND visible only from an obscure about:support page AND with no clear way of disabling it, save for deleting .xpi files: followonsearch@mozilla.com.xpi [1] shield-recipe-client@mozilla.org.xpi [2] There are also these two that explicitly disrespect and ignore one's updating pr…

While I understand you not wanting Mozilla to be able to push urgent patches, this is (in my) opinion necessary in sufficently serious cases. Imagine a remote code execution hole in Firefox, being actively attacked through ad networks. In that situation, every minute counts, and an attack could perform serious damage.

"The road to hell is paved with good intentions."

It's not about denying Mozilla an option of pushing zero-day patches. It's about the fact that it's a built-in always-on _concealed_ feature.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#47

Post by QasimK »

hazeii wrote: post #44
QasimK wrote: post #41

Earlier quoted context omitted.

Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?

I'm not familiar with Firefox Multi-account containers; do they use separate Unix accounts? (since my approach means Firefox is running as a completely diffrent user, a simple firefox compromise or bug shouldn't be able to access anything sensitive on the main account - like SSH keys, say).

I don't think they offer much in the way of security, but they do let you isolate the websites you choose from each other. I wrote a very small blog post about them: http://iamqasimk.com/2017/11/21/firefox-containers/

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#48

Post by rockdoe »

huhtenberg wrote: post #26

> C:\Program Files\Mozilla Firefox\browser\features\ WOAH. That's some genuinely nasty stuff that no one would normally want on their machines AND visible only from an obscure about:support page AND with no clear way of disabling it, save for deleting .xpi files: followonsearch@mozilla.com.xpi [1] shield-recipe-client@mozilla.org.xpi [2] There are also these two that explicitly disrespect and ignore one's updating pr…

Shield Studies are in the "Privacy & Security" settings: "Allow Firefox to install and run studies"

"Follow On Search" is AFAIK controlled by the Telemetry settings in the same dialog in "Privacy & Security".

ignore one's updating preferences

Are you sure? They're add-ons, so they should follow the add-on update preferences. Given that aushelper apparently does nothing aside from modify the update URL to include info whether the system is affected by some bug, it's hard to see how it wouldn't respect the settings.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#49

Post by rockdoe »

QasimK wrote: post #39
cpeterso wrote: post #29

Also check out Firefox's "privacy.resistFingerprinting" [1] and "privacy.firstparty.isolate" [2] prefs in about:config. These are Tor privacy features that Tor and Mozilla are merging into Firefox. resistFingerprinting reduces the uniqueness of various Firefox properties that are visible to JavaScript and web servers. First-party isolation will isolate third-party cookies by first-party domain. So Facebook Like butto…

Is there any reason not to just block third-party cookies ("Accept third-party cookies: Never" in settings) all-together? I've never encountered anything breaking as a result of doing this.

Some sites do break. The problem is that by the time you run into one you'll have forgotten you changed this setting.

Re: Firefox Configuration Guide for Privacy Freaks and Performance Buffs

#50

Post by severine »

QasimK wrote: post #38
sohkamyung wrote: post #6

One thing not mentioned in the list is Firefox Multi-Account Containers [1]. It helps by segregating your on-line information (cookies) into separate containers that you set up. It doesn't stop sites pulling all cookies, but it reduces the amount of information being sent: only the information in the same container is accessible. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account...

This is great and fairly simple to use. I personally use it to separate out Google into its own container, but it is also more practically useful to allow you to login to the same site with different accounts. It just works! But, the one problem that I've encountered is clicking links in gmail cause them to be opened within the Google container.

Right click > Open link in new container tab > No container
Post reply on HN