{"id":7504,"date":"2024-06-03T08:08:32","date_gmt":"2024-06-03T15:08:32","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=7504"},"modified":"2024-06-05T07:18:12","modified_gmt":"2024-06-05T14:18:12","slug":"firefox-privacy-the-complete-how-to-guide-for-2024","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2024\/06\/03\/firefox-privacy-the-complete-how-to-guide-for-2024\/","title":{"rendered":"Firefox Privacy \u2013 The Complete How-To Guide for 2024"},"content":{"rendered":"\n<p>This is a good write up on how to improve Firefox privacy. Note that one of the settings, privacy.resistfingerprinting = true, will mess up websites picking up that you prefer dark webpages to match your OS theme. Consequently, I also use <a href=\"https:\/\/jasonsblog.ddns.net\/index.php\/2022\/03\/10\/ad-blocking-and-avoiding-web-tracking\/\" target=\"_blank\" rel=\"noreferrer noopener\">uMatrix<\/a> where I have control over the elements and servers that are loaded for a webpage, so I turned this off as I enjoy dark mode webpages and it was also forcing my browser window to load at a smaller size like the old Tor Browser. Also, function dom.event.clipboardevents.enabled = false also broke my web editor in WordPress, so I had to enable that one as well. So to go full privacy with these Firefox settings could impact your browsing experience and you&#8217;ll have decide if you can live with the results or figure out which ones need to be reversed or not implemented.<\/p>\n\n\n\n<p><a href=\"https:\/\/restoreprivacy.com\/firefox-privacy\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/restoreprivacy.com\/firefox-privacy\/<\/a><\/p>\n\n\n<div class=\"wp-block-ub-divider ub_divider ub-divider-orientation-horizontal\" id=\"ub_divider_b541063e-01e4-4f07-b8f5-50fe43716790\"><div class=\"ub_divider_wrapper\" style=\"position: relative; margin-bottom: 2px; width: 100%; height: 2px; \" data-divider-alignment=\"center\"><div class=\"ub_divider_line\" style=\"border-top: 2px solid #ccc; margin-top: 2px; \"><\/div><\/div><\/div>\n\n\n<p>By Alex Lekander<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2024\/01\/Firefox-Privacy-.png\" alt=\"Firefox Privacy\" class=\"wp-image-177353\"\/><\/figure>\n\n\n\n<p>Mozilla Firefox is one of the best browsers available that combines strong privacy protection features, good security, active development, and regular updates. The newest version of Firefox is fast, light-weight, and packed full of privacy and security features.<\/p>\n\n\n\n<p>It is for this reason that I consider Firefox to be the best all-around browser for privacy and security.&nbsp;It remains a solid alternative to some of the other options, such as Google Chrome, Microsoft Edge, and Safari.<\/p>\n\n\n\n<p>Another great aspect of Firefox is that it is <strong>highly customizable<\/strong>, which is the point of this guide. Below we will go over how you can customize Firefox to give you the security and privacy you desire, while still working well for day-to-day browsing.<\/p>\n\n\n\n<p>But before we jump in, let\u2019s cover some important details.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-important-considerations-before-starting\">Important considerations before starting<\/h2>\n\n\n\n<p>There are many factors to consider when configuring Firefox to meet your needs, including your threat model and browsing preferences. In other words, there is no \u201cone-size-fits-all\u201d configuration that will work for everyone. This guide is a basic overview covering some of the different configurations options.<\/p>\n\n\n\n<p>Before you start modifying Firefox and installing a bunch of add-ons, it\u2019s important to consider browser fingerprinting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-browser-fingerprinting\">Browser fingerprinting<\/h3>\n\n\n\n<p>The issue of <a href=\"https:\/\/restoreprivacy.com\/browser-fingerprinting\/\" target=\"_blank\" rel=\"noreferrer noopener\">browser fingerprinting<\/a>&nbsp;(or device fingerprinting) is a big topic that covers all the different ways you can be tracked and identified by your system and various settings. All of the different add-ons you install and preference modifications you make to Firefox are inputs that can potentially be used to identify and track you.<\/p>\n\n\n\n<p><strong>Herein lies the catch-22<\/strong>: the more browser add-ons you install and settings you modify, the more likely you will stand out from the crowd and be easier to track. There are solutions for this and the latest version of Firefox does offer <em>some<\/em> fingerprinting protection. I discuss this problem and also provide solutions in the <a href=\"https:\/\/restoreprivacy.com\/browser-fingerprinting\/\" target=\"_blank\" rel=\"noreferrer noopener\">browser fingerprinting<\/a> guide.<\/p>\n\n\n\n<p>And that leads us to the next point that\u2026<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-more-is-not-always-better\">More is not always better<\/h3>\n\n\n\n<p>When it comes to browser add-ons and modifications, you don\u2019t want to be like that kid who puts every topping imaginable on his ice cream. Similarly, more is not always better with Firefox browser add-ons.<\/p>\n\n\n\n<p>Aside from the issue of browser fingerprinting, having too many add-ons may slow down performance and break things. Many of the popular Firefox add-ons also fulfill the same functions and are&nbsp;<strong>redundant<\/strong> when used together.<\/p>\n\n\n\n<p>Therefore it is best to strike a balanced approach. Install and modify <em>only<\/em> what you think will be useful and necessary for your specific situation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-proceed-with-caution\">Proceed with caution<\/h3>\n\n\n\n<p>Modifying some of these settings may interfere with your browsing experience and break some websites (they won\u2019t load properly). Therefore taking an <strong>incremental approach may be<\/strong> the <strong>best<\/strong> way to proceed. You can continue to install add-ons and adjust your settings as you see what works best for your needs.<\/p>\n\n\n\n<p>This allows you to modify the settings, create exceptions, or add sites to a whitelist.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-firefox-privacy-tweaks\">Firefox privacy tweaks<\/h2>\n\n\n\n<p>Before you get going with Firefox you may want to adjust the following settings for better privacy.<\/p>\n\n\n\n<p>Note: if you are a Mac OS user, you will see the word \u201cPreferences\u201d in your menu rather than \u201cOptions\u201d as it is listed below.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-disable-firefox-telemetry\">Disable Firefox telemetry<\/h3>\n\n\n\n<p>With the latest version of Firefox, it is configured to share \u201c<strong>technical and interaction data<\/strong>\u201d with Mozilla. This includes the ability to \u201c<strong>install and run studies<\/strong>\u201d on your computer. You can learn more about these <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/shield?as=u&amp;utm_source=inproduct\" target=\"_blank\" rel=\"noreferrer noopener\">studies<\/a> and <a href=\"https:\/\/www.mozilla.org\/en-US\/privacy\/firefox\/#health-report\" target=\"_blank\" rel=\"noreferrer noopener\">data collection<\/a> practices, but I\u2019d recommend disabling these settings.<\/p>\n\n\n\n<p>To disable go to <strong>Open Menu<\/strong> (three bars at the top right corner of the browser) &gt; <strong>Options<\/strong> &gt; <strong>Privacy &amp; Security<\/strong> &gt; <strong>Firefox Data Collection and Use<\/strong> and then uncheck the boxes as you see below:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2022\/01\/firefox-telemetry-security-.jpeg\" alt=\"firefox telemetry security\" class=\"wp-image-113236\"\/><figcaption class=\"wp-element-caption\">It is easy to disable telemetry in Firefox.<\/figcaption><\/figure>\n\n\n\n<p>You can also disable data sharing with Firefox for Android by going to <strong>Menu<\/strong> &gt; <strong>Options<\/strong> &gt; <strong>Privacy<\/strong> &gt; <strong>Data Choices<\/strong> and then uncheck all three categories for Telemetry, Crash Reporter, and Mozilla Location Service.<\/p>\n\n\n\n<p>Note: You can also disable this in the About:Config settings with <strong>toolkit.telemetry.enabled<\/strong> set to <strong>false<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-change-the-default-search-engine-in-firefox\">Change the default search engine in Firefox<\/h3>\n\n\n\n<p>Firefox now uses Google as the default search engine, but there are other <a href=\"https:\/\/restoreprivacy.com\/private-search-engine\/\" target=\"_blank\" rel=\"noreferrer noopener\">private search engines<\/a> you can use instead.<\/p>\n\n\n\n<p>To do this, go to <strong>Menu<\/strong> &gt; <strong>Options<\/strong>&nbsp;&gt; <strong>Search<\/strong> &gt; <strong>Default Search Engine<\/strong>. Firefox does not provide you with very many alternatives directly in the settings area. However, you can view more options by going down to <strong>One-Click Search Engines<\/strong> and then click <strong>Find more search engines<\/strong> to see the other alternatives.<\/p>\n\n\n\n<p>See our guide on <a href=\"https:\/\/restoreprivacy.com\/private-search-engine\/\" target=\"_blank\" rel=\"noreferrer noopener\">private search engines<\/a> to dive into this topic more.<\/p>\n\n\n\n<p>Firefox also <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/add-or-remove-search-engine-firefox\" target=\"_blank\" rel=\"noreferrer noopener\">has a guide<\/a> on modifying your search engine preferences.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-firefox-content-blocking\">Firefox Content Blocking<\/h3>\n\n\n\n<p>Another great new feature with Firefox is Content Blocking. This <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/content-blocking\" target=\"_blank\" rel=\"noreferrer noopener\">customizable feature<\/a> will automatically block \u201ccontent that tracks the sites you visit and profiles you.\u201d You can choose between Standard, Strict, and Custom modes, which allow you to block:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cookies<\/li>\n\n\n\n<li>Tracking content<\/li>\n\n\n\n<li>Cyrptominers<\/li>\n\n\n\n<li>Fingerprinters<\/li>\n<\/ul>\n\n\n\n<p>To adjust the Firefox Content Blocking settings, go to <strong>Menu<\/strong> &gt; <strong>Options<\/strong> &gt; <strong>Privacy and Security<\/strong> &gt; <strong>Content Blocking<\/strong> and then select which mode you want to use.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2022\/01\/firefox-content-blocking-privacy.jpeg\" alt=\"firefox content blocking privacy\" class=\"wp-image-113239\"\/><\/figure>\n\n\n\n<p>The <strong>Standard<\/strong> setting may be the best balance for regular users. Firefox warns that&nbsp;<strong>Strict<\/strong> mode may \u201ccause some websites to break.\u201d However, you can still\u2026<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-disable-content-blocking-for-specific-sites\">Disable content blocking for specific sites<\/h4>\n\n\n\n<p>It\u2019s easy to disable content blocking for certain trusted sites. Simply enter the website URL, then click the \u201ci\u201d icon to the left of the address bar, then click the grey button to \u201c<strong>Turn off Blocking for This Site<\/strong>.\u201d<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2019\/10\/turn-off-content-blocking-firefox-.png\" alt=\"turn off content blocking firefox\" class=\"wp-image-55427\"\/><\/figure>\n\n\n\n<p>Another benefit of Firefox\u2019s Content Blocking feature is that it can save your data and improve page load speeds.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-the-do-not-track-request\">The \u201cDo Not Track\u201d request<\/h3>\n\n\n\n<p>Firefox also has an option to request that websites \u201cdo not track\u201d you online. This is simply an <a href=\"https:\/\/en.wikipedia.org\/wiki\/Do_Not_Track\" target=\"_blank\" rel=\"noreferrer noopener\">HTTP header field<\/a> that you can easily enable. However, the key word here is <strong>request<\/strong>, because this is not actually blocking anything. We have also learned that many websites simply <a href=\"https:\/\/marketingland.com\/hulu-joined-list-major-platforms-ignore-not-track-requests-185610\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>ignore these requests<\/strong><\/a>.<\/p>\n\n\n\n<p>In addition to being ignored by most sites, this is also a value that can be used for browser fingerprinting purposes, as explained <a href=\"https:\/\/www.intego.com\/mac-security-blog\/apple-to-remove-do-not-track-feature-from-safari\/\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>. Therefore I no longer recommend enabling or modifying the Do Not Track settings, which you\u2019ll find in the Content Blocking settings area.<\/p>\n\n\n\n<p>You can learn more about the Do Not Track feature <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/how-do-i-turn-do-not-track-feature\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-firefox-about-config-settings\">Firefox About:Config settings<\/h2>\n\n\n\n<p>Aside from the general Menu settings we used above, you can also make a number of different modifications using <strong>about:config<\/strong>.<\/p>\n\n\n\n<p>Note: If you made all of the changes above, you may notice that some of these settings are already updated in about:config. We will still cover the different about:config since some people prefer to modify settings in this area, rather than through the general Menu.<\/p>\n\n\n\n<p>To access these configuration settings, simply enter <strong>about:config<\/strong> into the URL bar and hit enter. You will then be prompted with a warning screen stating \u201cThis might void your warranty.\u201d Just click \u201c<strong>I accept the risk<\/strong>\u201d to continue.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2019\/10\/firefox-about.config-changes-.png\" alt=\"firefox about.config changes\" class=\"wp-image-55435\"\/><\/figure>\n\n\n\n<p>After proceeding, you will see a large list of preferences, which each include a status, type, and value.<\/p>\n\n\n\n<p>These preferences will be listed in alphabetical order and are easily searchable from the search bar near the top.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2018\/04\/firefox-about-config-changes-.png\" alt=\"firefox about config changes\" class=\"wp-image-28487\"\/><\/figure>\n\n\n\n<p><strong>Modifying preferences<\/strong> \u2013 You can modify any of these Firefox preferences by simply <strong>double clicking <\/strong>the preference name. If the preference is a \u201cboolean\u201d type, then double clicking will change the value to true or false. If the preference is an \u201cinteger\u201d or \u201cstring\u201d type, double clicking will open a box to change the value.<\/p>\n\n\n\n<p>Here are my recommended changes:<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-disable-webrtc-media-peerconnection-enabled-nbsp-webrtc-false\">Disable WebRTC:<br><strong>media.peerconnection.enabled<\/strong>&nbsp;(WebRTC) = false<\/h4>\n\n\n\n<p>WebRTC stands for \u201cWeb Real-Time Communication\u201d and it allows for voice, video chat, and P2P sharing through your browser. Unfortunately, this capability can also <strong>expose your real IP address<\/strong> through browser STUN requests, even if you are using a good&nbsp;VPN service. (This is called a <a href=\"https:\/\/restoreprivacy.com\/webrtc-leaks\/\" target=\"_blank\" rel=\"noreferrer noopener\">WebRTC leak<\/a>.)<\/p>\n\n\n\n<p>To disable WebRTC in Firefox simply enter&nbsp;<strong>media.peerconnection.enabled<\/strong> into the search bar and then double click the value to change it to <strong>false<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2021\/12\/firefox-disable-webrtc.png\" alt=\"firefox disable webrtc\" class=\"wp-image-112267\"\/><\/figure>\n\n\n\n<p>Aside from Firefox, the WebRTC vulnerability also affects Chrome, Opera, Brave, and other Chromium-based browsers. Safari is also in the process of implementing WebRTC.<\/p>\n\n\n\n<p><strong>Note<\/strong>: If you disable WebRTC, services like Google Meet and Whereby may not work.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-resist-fingerprinting-privacy-resistfingerprinting-true\">Resist Fingerprinting:<br>privacy.resistFingerprinting = true<\/h4>\n\n\n\n<p>Changing this preference to <strong>true<\/strong> will help to make Firefox more resistant to browser fingerprinting.<\/p>\n\n\n\n<p>Note: There are many factors that go into browser fingerprinting and the ability of an adversary to identify you. See the <a href=\"https:\/\/restoreprivacy.com\/browser-fingerprinting\/\" target=\"_blank\" rel=\"noreferrer noopener\">browser fingerprinting<\/a> guide for additional details.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-privacy-trackingprotection-fingerprinting-enabled-true\">privacy.trackingprotection.fingerprinting.enabled = true<\/h4>\n\n\n\n<p>This is a new preference with Firefox 67+ to block fingerprinting.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-privacy-trackingprotection-cryptomining-enabled-true\">privacy.trackingprotection.cryptomining.enabled = true<\/h4>\n\n\n\n<p>Another new preference with Firefox 67+, this will block cryptominers.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-first-party-isolate-privacy-firstparty-isolate-true\">First party isolate<br>privacy.firstparty.isolate = true<\/h4>\n\n\n\n<p>Changing this to <strong>true<\/strong> will isolate cookies to the first party domain, which prevents tracking across multiple domains. First party isolation also does much more than isolating cookies, it affects:&nbsp;cookies, cache, HTTP Authentication, DOM Storage, Flash cookies, SSL and TLS session resumption, Shared Workers, blob URIs, SPDY and HTTP\/2, automated cross-origin redirects, window.name, auto-form fill, HSTS and HPKP supercookies, broadcast channels, OCSP, favicons, mediasource URIs and Mediastream, speculative and prefetched connections.<\/p>\n\n\n\n<p>This preference was added in late 2017 as part of the <a href=\"https:\/\/wiki.mozilla.org\/Security\/Tor_Uplift\" target=\"_blank\" rel=\"noreferrer noopener\">Tor Uplift Project<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-tracking-protection-privacy-trackingprotection-enabled-true\">Tracking protection<br>privacy.trackingprotection.enabled = true<\/h4>\n\n\n\n<p>Another new update, this is Mozilla\u2019s built-in tracking protection feature. This will use a Disconnect.me filter list, but may be redundant if you are using uBlock Origin 3rd party filters.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-disable-geolocation-tracking-geo-enabled-false\">Disable geolocation tracking<br>geo.enabled = false<\/h4>\n\n\n\n<p>Setting this to <strong>false<\/strong> will <strong>disable geolocation tracking<\/strong>, which may be requested by a site you are visiting. As <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/does-firefox-share-my-location-websites?redirectlocale=en-US&amp;redirectslug=does-firefox-share-my-location-web-sites\" target=\"_blank\" rel=\"noreferrer noopener\">explained by Mozilla<\/a>, this preference is enabled by default and utilizes <strong>Google Location Services<\/strong> to pinpoint your location. In order to do that, Firefox sends Google:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>your computer\u2019s IP address<\/li>\n\n\n\n<li>information about nearby wireless access points<\/li>\n\n\n\n<li>a random client identifier, which is assigned by Google (expires every two weeks)<\/li>\n<\/ol>\n\n\n\n<p>Before this data is sent to Google, you would first get a request by the site you are visiting. Therefore you do have control over this, even if geo remains enabled.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-media-navigator-enabled-false\">media.navigator.enabled = false<\/h4>\n\n\n\n<p>Setting this preference to <strong>false<\/strong> will block websites from being able to track the microphone and camera status of your device.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-network-cookie-cookiebehavior\">network.cookie.cookieBehavior<\/h4>\n\n\n\n<p>This is an integer type preference with different values. Here are the cookie preference options:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>0 = Accept all cookies by default<\/li>\n\n\n\n<li>1 = Only accept from the originating site (block third-party cookies)<\/li>\n\n\n\n<li>2 = Block all cookies by default<\/li>\n\n\n\n<li>3 = Block cookies from unvisited sites<\/li>\n\n\n\n<li>4 = New Cookie Jar policy (prevent storage access to trackers)<\/li>\n<\/ul>\n\n\n\n<p>Any selection between 1 and 4 would improve privacy. The New Cookie Jar policy (value 4) offers more protection, but it may also break the functionality of some websites. Ghacks has a discussion of the New Cookie Jar policy <a href=\"https:\/\/www.ghacks.net\/2018\/09\/23\/firefox-65-new-cookie-jar-policy-to-block-tracking\/\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-network-cookie-lifetimepolicy-2\">network.cookie.lifetimePolicy = 2<\/h4>\n\n\n\n<p>This is another integer type preference that you should set to a <strong>value of 2<\/strong>. This preference determines when cookies are deleted. Here are the different options:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>0 = Accept cookies normally<\/li>\n\n\n\n<li>1 = Prompt for each cookie<\/li>\n\n\n\n<li>2 = Accept for current session only<\/li>\n\n\n\n<li>3 = Accept for N days<\/li>\n<\/ul>\n\n\n\n<p>With a value of 2, websites you visit should work without any problems, and all cookies will be automatically deleted at the end of the session.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-network-dns-disableprefetch-true\">network.dns.disablePrefetch = true<\/h4>\n\n\n\n<p>Setting this preference to <strong>true<\/strong>&nbsp;will disable Firefox from \u201cprefetching\u201d DNS requests. While advanced domain name resolution may slightly improve page load speeds, this also comes with some risks, as described in <a href=\"https:\/\/www.usenix.org\/legacy\/events\/leet10\/tech\/full_papers\/Krishnan.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">this paper<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-network-prefetch-next-false\">network.prefetch-next = false<\/h4>\n\n\n\n<p>Similar to prefetching DNS requests above, setting this preference to <strong>false<\/strong> will prevent pages from being prefetched by Firefox. Mozilla has deployed this feature to speed up web pages that you might visit. However, it will use up resources and poses a risk to privacy. This is another example of performance at the price of privacy.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-disable-webgl-webgl-disabled-true\">Disable WebGL:<br>webgl.disabled = true<\/h4>\n\n\n\n<p>WebGL is a potential <a href=\"https:\/\/security.stackexchange.com\/questions\/13799\/is-webgl-a-security-concern\" target=\"_blank\" rel=\"noreferrer noopener\">security risk<\/a>, which is why it is best disabled by setting <strong>webgl.disabled<\/strong> to <strong>true<\/strong>. Another issue with WebGL is that it can be used to fingerprint your device.<\/p>\n\n\n\n<p>You can get more information on the WebGL issue <a href=\"https:\/\/www.contextis.com\/blog\/webgl-a-new-dimension-for-browser-exploitation\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a> and <a href=\"https:\/\/www.khronos.org\/webgl\/security\/\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-dom-event-clipboardevents-enabled-false\">dom.event.clipboardevents.enabled = false<\/h4>\n\n\n\n<p>This prevents websites from getting notifications if you copy, paste, or cut something from the page.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-media-eme-enabled-false\">media.eme.enabled = false<\/h4>\n\n\n\n<p>This disables the playback of DRM-controlled HTML5 content. See <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/enable-drm#w_opt-out-of-cdm-playback-uninstall-cdms-and-stop-all-cdm-downloads\" target=\"_blank\" rel=\"noreferrer noopener\">details here<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-firefox-safe-browsing-preferences\">Firefox \u201csafe browsing\u201d preferences<\/h2>\n\n\n\n<p>There are many recommendations to disable the Safe Browsing feature in Firefox due to privacy concerns and potential Google tracking. However, these concerns are based on an <strong>older version<\/strong> of the Safe Browsing feature, which would utilize \u201creal-time lookup\u201d of website URLs. This method has not been in use since 2011 \u2013 <a href=\"https:\/\/feeding.cloud.geek.nz\/posts\/how-safe-browsing-works-in-firefox\/\" target=\"_blank\" rel=\"noreferrer noopener\">explained further here<\/a>.<\/p>\n\n\n\n<p>If a URL is needed, Firefox takes the following precautions to protect user privacy, as <a href=\"https:\/\/feeding.cloud.geek.nz\/posts\/how-safe-browsing-works-in-firefox\/\" target=\"_blank\" rel=\"noreferrer noopener\">explained by&nbsp;Fran\u00e7ois Marier<\/a>, a security engineer for Mozilla:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Query string parameters are <a href=\"https:\/\/dxr.mozilla.org\/mozilla-central\/rev\/494289c72ba3997183e7b5beaca3e0447ecaf96d\/toolkit\/components\/downloads\/ApplicationReputation.cpp#684-710\">stripped<\/a> from URLs we check as part of the download protection feature.<\/li>\n\n\n\n<li>Cookies set by the Safe Browsing servers to protect the service from abuse are stored in a <a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=897516\">separate cookie jar<\/a> so that they are not mixed with regular browsing\/session cookies.<\/li>\n\n\n\n<li>When requesting complete hashes for a 32-bit prefix, Firefox throws in a number of extra <a href=\"https:\/\/dxr.mozilla.org\/mozilla-central\/rev\/494289c72ba3997183e7b5beaca3e0447ecaf96d\/toolkit\/components\/url-classifier\/nsUrlClassifierDBService.cpp#283-289\">\u201cnoise\u201d entries<\/a> to obfuscate the original URL further.<\/li>\n<\/ul>\n\n\n\n<p>Therefore I would conclude that disabling Safe Browsing would give you no tangible privacy benefits, while also being a security risk.&nbsp;That being said, if you still want to disable this feature, here\u2019s how in the about:config area:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>browser.safebrowsing.phishing.enabled = false<\/strong><\/li>\n\n\n\n<li><strong>browser.safebrowsing.malware.enabled = false<\/strong><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-firefox-privacy-and-security-add-ons\">Firefox privacy and security add-ons<\/h2>\n\n\n\n<p>There are some great Firefox browser add-ons that will give you more privacy and security. With that being said, many of the add-ons we previously recommended are <strong>no longer necessary thanks to Firefox\u2019s upgraded privacy and security settings<\/strong>.<\/p>\n\n\n\n<p>Note: When looking for Firefox add-ons, be sure to consider what you need in relation to the preferences you modified above. Some add-ons will be <strong>redundant<\/strong> and not necessary depending on your Firefox preferences and the other add-ons you are using.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-ublock-origin\">uBlock Origin<\/h3>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2021\/12\/ublock-origin-firefox.jpg\" alt=\"ublock origin firefox\" class=\"wp-image-112270\"\/><\/figure>\n\n\n\n<p><a href=\"https:\/\/addons.mozilla.org\/en-US\/firefox\/addon\/ublock-origin\/\" target=\"_blank\" rel=\"noreferrer noopener\">uBlock Origin<\/a> is an efficient, light-weight blocker that filters both ads and tracking. It has risen to popularity as a powerful alternative to Adblock Plus, which allows \u201cacceptable ads\u201d that many users disdain. One added benefit of uBlock Origin is that it can significantly improve performance and page load speed.<\/p>\n\n\n\n<p>Another great feature with uBlock Origin is the ability to whitelist certain websites. Given that many sites will block access if they detect an ad-blocker, the ability to whitelist will come in handy. uBlock Origin is free and entirely <a href=\"https:\/\/github.com\/gorhill\/uBlock\/\" target=\"_blank\" rel=\"noreferrer noopener\">open source<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-noscript\">NoScript<\/h3>\n\n\n\n<p><a href=\"https:\/\/noscript.net\" target=\"_blank\" rel=\"noreferrer noopener\">NoScript<\/a> is a script-blocker that allows you to identify\/block scripts running on websites. While it does give you control, NoScript can be a pain to get configured properly. It breaks many websites, which requires you to tweak and configure the options. If you are already using uBlock Origin, then you probably don\u2019t need to be using NoScript.<\/p>\n\n\n\n<p>This is definitely not an add-on for the casual user or those who don\u2019t have the patience to devote some time into configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-using-a-vpn-with-firefox\">Using a VPN with Firefox<\/h3>\n\n\n\n<p>Firefox currently offers a <a href=\"https:\/\/restoreprivacy.com\/vpn\/\" target=\"_blank\" rel=\"noreferrer noopener\">VPN<\/a> (virtual private network) called <strong>Mozilla VPN<\/strong>. However, this is just a rebranded version of Mullvad and I have seen many users complaining on various forums about the lack of support when things go wrong.<\/p>\n\n\n\n<p>Note that while some VPNs offer browser extensions for Firefox, these are fundamentally different from a full VPN. A VPN will run on your operating system (not just your browser) and encrypt all internet traffic on your operating system. This is different from a browser extension that only wraps your browsing traffic inside an additional layer of encryption.<\/p>\n\n\n\n<p>Additionally, some Firefox VPN extensions are actually just an extension of the desktop VPN application. These \u201cextensions\u201d literally just extend control of the VPN to a convenient browser interface. We discuss this and more in our guide on the <a href=\"https:\/\/restoreprivacy.com\/vpn\/best\/vpn-for-firefox\/\" target=\"_blank\" rel=\"noreferrer noopener\">best VPNs for Firefox<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-firefox-dns-over-https-doh-is-not-a-great-idea\">Firefox DNS over HTTPS (DoH) is not a great idea<\/h3>\n\n\n\n<p>Just like with Firefox Private Network, the implementation of DNS over HTTPS also relies on Cloudflare infrastructure. In fact, it makes <strong>Cloudflare the central processing point for all DNS requests<\/strong> in the Firefox browser <strong>by default<\/strong>.<\/p>\n\n\n\n<p>While DNS over HTTPS may sound advantageous in some respects, there are also potential concerns. Rather than going over why, you can read the article, <a href=\"https:\/\/blog.powerdns.com\/2019\/09\/25\/centralised-doh-is-bad-for-privacy-in-2019-and-beyond\/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong><em>Centralised DoH is bad for privacy, in 2019 and beyond<\/em><\/strong><\/a>, which concludes:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>Centralised DoH is currently a privacy net negative since anyone that could see your metadata can still see your metadata when DNS is moved to a third party. Additionally, that third party then gets a complete log per device of all DNS queries, in a way that can even be tracked across IP addresses.<\/p>\n\n\n\n<p>Even if further privacy leaks are plugged, DoH to a third party remains at best a partial solution, one that should not be relied upon as a serious security layer, since it will be hard to plug everything, especially if non-CDN content providers survive.<\/p>\n\n\n\n<p>Encrypting DNS is good, but if this could be done without involving additional parties, that would be better.<\/p>\n\n\n\n<p>And for actual privacy on untrusted networks, <strong>nothing beats a VPN<\/strong>, except possibly not using hostile networks.<\/p>\n<\/blockquote>\n\n\n\n<p>Many people also assume that encrypted third-party DNS will somehow offer privacy and anonymity. This is a false assumption. Your IP address and location remains exposed with everything you do online, while your ISP will still be able to see the websites you visit (IP addresses) even if it\u2019s no longer handling DNS requests. In conclusion, a good VPN will offer much more protection than DoH through Cloudflare.<\/p>\n\n\n\n<p>To disable DNS over HTTPS (DoH) in Firefox go&nbsp;to <strong>Menu<\/strong> &gt; <strong>Options<\/strong> &gt; <strong>General<\/strong> and then scroll down to <strong>Network Settings<\/strong> and click the <strong>Settings<\/strong> button. In the box that opens, scroll down to <strong>Enable DNS over HTTPS<\/strong>, where it can be enabled or <strong>disabled<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/cdn-resprivacy.pressidium.com\/wp-content\/uploads\/2022\/01\/firefox-dns-over-https-doh-1024x310.png\" alt=\"firefox dns over https doh\" class=\"wp-image-113245\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-user-js-firefox-hardening\">user.js Firefox hardening<\/h2>\n\n\n\n<p>For more information and resources on Firefox hardening, see here: <a href=\"https:\/\/github.com\/ghacksuserjs\/ghacks-user.js\" target=\"_blank\" rel=\"noreferrer noopener\">user.js Firefox hardening<\/a>.<\/p>\n\n\n\n<p>As explained on their <a href=\"https:\/\/github.com\/ghacksuserjs\/ghacks-user.js\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub page<\/a>, this is a \u201c<em>configuration file that can control hundreds of Firefox settings. For a more technical breakdown and explanation, you can read more on the <a href=\"https:\/\/github.com\/ghacksuserjs\/ghacks-user.js\/wiki\/1.1-Overview\">overview<\/a> wiki page.<\/em>\u201d<\/p>\n\n\n\n<p>Their <a href=\"https:\/\/github.com\/ghacksuserjs\/ghacks-user.js\/wiki\" target=\"_blank\" rel=\"noreferrer noopener\">Wiki page<\/a> is also full of great information.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-firefox-privacy-conclusion\">Firefox privacy conclusion<\/h2>\n\n\n\n<p>In my opinion, Firefox remains the best all-around, mainstream browser on the market for privacy when it is modified as recommended above.<\/p>\n\n\n\n<p>While many of the configurations and add-ons discussed in this guide will go a long way to giving you more privacy, there is one issue that remains: concealing your IP address and location. To do this, a <a href=\"https:\/\/restoreprivacy.com\/vpn\/best\/\" target=\"_blank\" rel=\"noreferrer noopener\">good VPN service<\/a> is necessary. The <a href=\"https:\/\/restoreprivacy.com\/tor\/\" target=\"_blank\" rel=\"noreferrer noopener\">Tor network<\/a> also achieves this end, but it comes with the drawbacks of slow speeds, risks, and limitations (only works in a browser).<\/p>\n\n\n\n<p>For more options in addition to Firefox, see the <a href=\"https:\/\/restoreprivacy.com\/browser\/secure\/\" target=\"_blank\" rel=\"noreferrer noopener\">secure browser<\/a> guide.<\/p>\n\n\n\n<p>Want to continue on the journey of restoring your online privacy? Check out these guides:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/restoreprivacy.com\/email\/secure\/\" target=\"_blank\" rel=\"noreferrer noopener\">Private and Secure Email Services<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/restoreprivacy.com\/browser\/secure\/\" target=\"_blank\" rel=\"noreferrer noopener\">Secure Browsers That Respect Your Privacy<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/restoreprivacy.com\/private-search-engine\/\" target=\"_blank\" rel=\"noreferrer noopener\">Private Search Engines<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/restoreprivacy.com\/password-manager\/best-password-manager\/\" target=\"_blank\" rel=\"noreferrer noopener\">Best Password Managers<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/restoreprivacy.com\/data-removal\/best-data-removal-services\/\" target=\"_blank\" rel=\"noreferrer noopener\">Online Data Removal Services<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/restoreprivacy.com\/vpn\/best\/\" target=\"_blank\" rel=\"noreferrer noopener\">Best VPN Services<\/a><\/li>\n<\/ul>\n\n\n\n<p><em>This Firefox Privacy article was last updated on January 19, 2024.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is a good write up on how to improve Firefox privacy. Note that one of the settings, privacy.resistfingerprinting = true, will mess up websites picking up that you prefer dark webpages to match your OS theme. Consequently, I also use uMatrix where I have control over the elements and servers that are loaded for [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-7504","post","type-post","status-publish","format-standard","hentry","category-tech"],"blocksy_meta":[],"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/7504","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=7504"}],"version-history":[{"count":5,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/7504\/revisions"}],"predecessor-version":[{"id":7523,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/7504\/revisions\/7523"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=7504"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=7504"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=7504"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}