user.js

   1 /******************************************************************************
   2  * user.js                                                                    *
   3  * https://github.com/pyllyukko/user.js                                       *
   4  ******************************************************************************/
   5
   6 /******************************************************************************
   7  * SECTION: HTML5 / APIs / DOM                                                *
   8  ******************************************************************************/
   9
  10 // PREF: Disable Service Workers
  11 // https://developer.mozilla.org/en-US/docs/Web/API/Worker
  12 // https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker_API
  13 // https://wiki.mozilla.org/Firefox/Push_Notifications#Service_Workers
  14 // NOTICE: Disabling ServiceWorkers breaks functionality on some sites (Google Street View...)
  15 // Unknown security implications
  16 // CVE-2016-5259, CVE-2016-2812, CVE-2016-1949, CVE-2016-5287 (fixed)
  17 user_pref("dom.serviceWorkers.enabled",                         false);
  18
  19 // PREF: Disable Web Workers
  20 // https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Using_web_workers
  21 // https://www.w3schools.com/html/html5_webworkers.asp
  22 // NOTICE: Disabling Web Workers breaks "Download as ZIP" functionality on https://mega.nz/, WhatsApp Web and probably others
  23 user_pref("dom.workers.enabled",                                        false);
  24
  25 // PREF: Disable web notifications
  26 // https://support.mozilla.org/t5/Firefox/I-can-t-find-Firefox-menu-I-m-trying-to-opt-out-of-Web-Push-and/m-p/1317495#M1006501
  27 user_pref("dom.webnotifications.enabled",                       false);
  28
  29 // PREF: Disable DOM timing API
  30 // https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI
  31 // https://www.w3.org/TR/navigation-timing/#privacy
  32 user_pref("dom.enable_performance",                             false);
  33
  34 // PREF: Make sure the User Timing API does not provide a new high resolution timestamp
  35 // https://trac.torproject.org/projects/tor/ticket/16336
  36 // https://www.w3.org/TR/2013/REC-user-timing-20131212/#privacy-security
  37 user_pref("dom.enable_user_timing",                             false);
  38
  39 // PREF: Disable Web Audio API
  40 // https://bugzilla.mozilla.org/show_bug.cgi?id=1288359
  41 user_pref("dom.webaudio.enabled",                               false);
  42
  43 // PREF: Disable Location-Aware Browsing (geolocation)
  44 // https://www.mozilla.org/en-US/firefox/geolocation/
  45 user_pref("geo.enabled",                                        false);
  46
  47 // PREF: When geolocation is enabled, use Mozilla geolocation service instead of Google
  48 // https://bugzilla.mozilla.org/show_bug.cgi?id=689252
  49 user_pref("geo.wifi.uri", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");
  50
  51 // PREF: When geolocation is enabled, don't log geolocation requests to the console
  52 user_pref("geo.wifi.logging.enabled", false);
  53
  54 // PREF: Disable raw TCP socket support (mozTCPSocket)
  55 // https://trac.torproject.org/projects/tor/ticket/18863
  56 // https://www.mozilla.org/en-US/security/advisories/mfsa2015-97/
  57 // https://developer.mozilla.org/docs/Mozilla/B2G_OS/API/TCPSocket
  58 user_pref("dom.mozTCPSocket.enabled",                           false);
  59
  60 // PREF: Disable DOM storage (disabled)
  61 // http://kb.mozillazine.org/Dom.storage.enabled
  62 // https://html.spec.whatwg.org/multipage/webstorage.html
  63 // NOTICE-DISABLED: Disabling DOM storage is known to cause`TypeError: localStorage is null` errors
  64 //user_pref("dom.storage.enabled",              false);
  65
  66 // PREF: Disable leaking network/browser connection information via Javascript
  67 // Network Information API provides general information about the system's connection type (WiFi, cellular, etc.)
  68 // https://developer.mozilla.org/en-US/docs/Web/API/Network_Information_API
  69 // https://wicg.github.io/netinfo/#privacy-considerations
  70 // https://bugzilla.mozilla.org/show_bug.cgi?id=960426
  71 user_pref("dom.netinfo.enabled",                                false);
  72
  73 // PREF: Disable network API (Firefox < 32)
  74 // https://developer.mozilla.org/en-US/docs/Web/API/Connection/onchange
  75 // https://www.torproject.org/projects/torbrowser/design/#fingerprinting-defenses
  76 user_pref("dom.network.enabled",                                false);
  77
  78 // PREF: Disable WebRTC entirely to prevent leaking internal IP addresses (Firefox < 42)
  79 // NOTICE: Disabling WebRTC breaks peer-to-peer file sharing tools (reep.io ...)
  80 user_pref("media.peerconnection.enabled",                       false);
  81
  82 // PREF: Don't reveal your internal IP when WebRTC is enabled (Firefox >= 42)
  83 // https://wiki.mozilla.org/Media/WebRTC/Privacy
  84 // https://github.com/beefproject/beef/wiki/Module%3A-Get-Internal-IP-WebRTC
  85 user_pref("media.peerconnection.ice.default_address_only",      true); // Firefox 42-51
  86 user_pref("media.peerconnection.ice.no_host",                   true); // Firefox >= 52
  87
  88 // PREF: Disable WebRTC getUserMedia, screen sharing, audio capture, video capture
  89 // https://wiki.mozilla.org/Media/getUserMedia
  90 // https://blog.mozilla.org/futurereleases/2013/01/12/capture-local-camera-and-microphone-streams-with-getusermedia-now-enabled-in-firefox/
  91 // https://developer.mozilla.org/en-US/docs/Web/API/Navigator
  92 user_pref("media.navigator.enabled",                            false);
  93 user_pref("media.navigator.video.enabled",                      false);
  94 user_pref("media.getusermedia.screensharing.enabled",           false);
  95 user_pref("media.getusermedia.audiocapture.enabled",            false);
  96
  97 // PREF: Disable battery API (Firefox < 52)
  98 // https://developer.mozilla.org/en-US/docs/Web/API/BatteryManager
  99 // https://bugzilla.mozilla.org/show_bug.cgi?id=1313580
 100 user_pref("dom.battery.enabled",                                false);
 101
 102 // PREF: Disable telephony API
 103 // https://wiki.mozilla.org/WebAPI/Security/WebTelephony
 104 user_pref("dom.telephony.enabled",                              false);
 105
 106 // PREF: Disable "beacon" asynchronous HTTP transfers (used for analytics)
 107 // https://developer.mozilla.org/en-US/docs/Web/API/navigator.sendBeacon
 108 user_pref("beacon.enabled",                                     false);
 109
 110 // PREF: Disable clipboard event detection (onCut/onCopy/onPaste) via Javascript
 111 // NOTICE: Disabling clipboard events breaks Ctrl+C/X/V copy/cut/paste functionaility in JS-based web applications (Google Docs...)
 112 // https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/dom.event.clipboardevents.enabled
 113 user_pref("dom.event.clipboardevents.enabled",                  false);
 114
 115 // PREF: Disable "copy to clipboard" functionality via Javascript (Firefox >= 41)
 116 // NOTICE: Disabling clipboard operations will break legitimate JS-based "copy to clipboard" functionality
 117 // https://hg.mozilla.org/mozilla-central/rev/2f9f8ea4b9c3
 118 user_pref("dom.allow_cut_copy", false);
 119
 120 // PREF: Disable speech recognition
 121 // https://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html
 122 // https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition
 123 // https://wiki.mozilla.org/HTML5_Speech_API
 124 user_pref("media.webspeech.recognition.enable",                 false);
 125
 126 // PREF: Disable speech synthesis
 127 // https://developer.mozilla.org/en-US/docs/Web/API/SpeechSynthesis
 128 user_pref("media.webspeech.synth.enabled",                      false);
 129
 130 // PREF: Disable sensor API
 131 // https://wiki.mozilla.org/Sensor_API
 132 user_pref("device.sensors.enabled",                             false);
 133
 134 // PREF: Disable pinging URIs specified in HTML <a> ping= attributes
 135 // http://kb.mozillazine.org/Browser.send_pings
 136 user_pref("browser.send_pings",                                 false);
 137
 138 // PREF: When browser pings are enabled, only allow pinging the same host as the origin page
 139 // http://kb.mozillazine.org/Browser.send_pings.require_same_host
 140 user_pref("browser.send_pings.require_same_host",               true);
 141
 142 // PREF: Disable IndexedDB (disabled)
 143 // https://developer.mozilla.org/en-US/docs/IndexedDB
 144 // https://en.wikipedia.org/wiki/Indexed_Database_API
 145 // https://wiki.mozilla.org/Security/Reviews/Firefox4/IndexedDB_Security_Review
 146 // http://forums.mozillazine.org/viewtopic.php?p=13842047
 147 // https://github.com/pyllyukko/user.js/issues/8
 148 // NOTICE-DISABLED: IndexedDB could be used for tracking purposes, but is required for some add-ons to work (notably uBlock), so is left enabled
 149 //user_pref("dom.indexedDB.enabled",            false);
 150
 151 // TODO: "Access Your Location" "Maintain Offline Storage" "Show Notifications"
 152
 153 // PREF: Disable gamepad API to prevent USB device enumeration
 154 // https://www.w3.org/TR/gamepad/
 155 // https://trac.torproject.org/projects/tor/ticket/13023
 156 user_pref("dom.gamepad.enabled",                                false);
 157
 158 // PREF: Disable virtual reality devices APIs
 159 // https://developer.mozilla.org/en-US/Firefox/Releases/36#Interfaces.2FAPIs.2FDOM
 160 // https://developer.mozilla.org/en-US/docs/Web/API/WebVR_API
 161 user_pref("dom.vr.enabled",                                     false);
 162
 163 // PREF: Disable vibrator API
 164 user_pref("dom.vibrator.enabled",           false);
 165
 166 // PREF: Disable resource timing API
 167 // https://www.w3.org/TR/resource-timing/#privacy-security
 168 user_pref("dom.enable_resource_timing",                         false);
 169
 170 // PREF: Disable Archive API (Firefox < 54)
 171 // https://wiki.mozilla.org/WebAPI/ArchiveAPI
 172 // https://bugzilla.mozilla.org/show_bug.cgi?id=1342361
 173 user_pref("dom.archivereader.enabled",                          false);
 174
 175 // PREF: Disable webGL
 176 // https://en.wikipedia.org/wiki/WebGL
 177 // https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/
 178 user_pref("webgl.disabled",                                     true);
 179 // PREF: When webGL is enabled, use the minimum capability mode
 180 user_pref("webgl.min_capability_mode",                          true);
 181 // PREF: When webGL is enabled, disable webGL extensions
 182 // https://developer.mozilla.org/en-US/docs/Web/API/WebGL_API#WebGL_debugging_and_testing
 183 user_pref("webgl.disable-extensions",                           true);
 184 // PREF: When webGL is enabled, force enabling it even when layer acceleration is not supported
 185 // https://trac.torproject.org/projects/tor/ticket/18603
 186 user_pref("webgl.disable-fail-if-major-performance-caveat",     true);
 187 // PREF: When webGL is enabled, do not expose information about the graphics driver
 188 // https://bugzilla.mozilla.org/show_bug.cgi?id=1171228
 189 // https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug_renderer_info
 190 user_pref("webgl.enable-debug-renderer-info",                   false);
 191 // somewhat related...
 192 //user_pref("pdfjs.enableWebGL",                                        false);
 193
 194 // PREF: Spoof dual-core CPU
 195 // https://trac.torproject.org/projects/tor/ticket/21675
 196 // https://bugzilla.mozilla.org/show_bug.cgi?id=1360039
 197 user_pref("dom.maxHardwareConcurrency",                         2);
 198
 199 /******************************************************************************
 200  * SECTION: Misc                                                              *
 201  ******************************************************************************/
 202
 203 // PREF: Disable face detection
 204 user_pref("camera.control.face_detection.enabled",              false);
 205
 206 // PREF: Set the default search engine to DuckDuckGo (disabled)
 207 // https://support.mozilla.org/en-US/questions/948134
 208 //user_pref("browser.search.defaultenginename",         "DuckDuckGo");
 209 //user_pref("browser.search.order.1",                           "DuckDuckGo");
 210 //user_pref("keyword.URL",                                                      "https://duckduckgo.com/html/?q=!+");
 211
 212 // PREF: Disable GeoIP lookup on your address to set default search engine region
 213 // https://trac.torproject.org/projects/tor/ticket/16254
 214 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine
 215 user_pref("browser.search.countryCode",                         "US");
 216 user_pref("browser.search.region",                              "US");
 217 user_pref("browser.search.geoip.url",                           "");
 218
 219 // PREF: Set Accept-Language HTTP header to en-US regardless of Firefox localization
 220 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language
 221 user_pref("intl.accept_languages",                              "en-us, en");
 222
 223 // PREF: Don't use OS values to determine locale, force using Firefox locale setting
 224 // http://kb.mozillazine.org/Intl.locale.matchOS
 225 user_pref("intl.locale.matchOS",                                false);
 226
 227 // PREF: Don't use Mozilla-provided location-specific search engines
 228 user_pref("browser.search.geoSpecificDefaults",                 false);
 229
 230 // PREF: Do not automatically send selection to clipboard on some Linux platforms
 231 // http://kb.mozillazine.org/Clipboard.autocopy
 232 user_pref("clipboard.autocopy",                                 false);
 233
 234 // PREF: Prevent leaking application locale/date format using JavaScript
 235 // https://bugzilla.mozilla.org/show_bug.cgi?id=867501
 236 // https://hg.mozilla.org/mozilla-central/rev/52d635f2b33d
 237 user_pref("javascript.use_us_english_locale",                   true);
 238
 239 // PREF: Do not submit invalid URIs entered in the address bar to the default search engine
 240 // http://kb.mozillazine.org/Keyword.enabled
 241 user_pref("keyword.enabled",                                    false);
 242
 243 // PREF: Don't trim HTTP off of URLs in the address bar.
 244 // https://bugzilla.mozilla.org/show_bug.cgi?id=665580
 245 user_pref("browser.urlbar.trimURLs",                            false);
 246
 247 // PREF: Don't try to guess domain names when entering an invalid domain name in URL bar
 248 // http://www-archive.mozilla.org/docs/end-user/domain-guessing.html
 249 user_pref("browser.fixup.alternate.enabled",                    false);
 250
 251 // PREF: When browser.fixup.alternate.enabled is enabled, strip password from 'user:password@...' URLs
 252 // https://github.com/pyllyukko/user.js/issues/290#issuecomment-303560851
 253 user_pref("browser.fixup.hide_user_pass", true);
 254
 255 // PREF: Send DNS request through SOCKS when SOCKS proxying is in use
 256 // https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers
 257 user_pref("network.proxy.socks_remote_dns",                     true);
 258
 259 // PREF: Don't monitor OS online/offline connection state
 260 // https://trac.torproject.org/projects/tor/ticket/18945
 261 user_pref("network.manage-offline-status",                      false);
 262
 263 // PREF: Enforce Mixed Active Content Blocking
 264 // https://support.mozilla.org/t5/Protect-your-privacy/Mixed-content-blocking-in-Firefox/ta-p/10990
 265 // https://developer.mozilla.org/en-US/docs/Site_Compatibility_for_Firefox_23#Non-SSL_contents_on_SSL_pages_are_blocked_by_default
 266 // https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/
 267 user_pref("security.mixed_content.block_active_content",        true);
 268
 269 // PREF: Enforce Mixed Passive Content blocking (a.k.a. Mixed Display Content)
 270 // NOTICE: Enabling Mixed Display Content blocking can prevent images/styles... from loading properly when connection to the website is only partially secured
 271 user_pref("security.mixed_content.block_display_content",       true);
 272
 273 // PREF: Disable JAR from opening Unsafe File Types
 274 // http://kb.mozillazine.org/Network.jar.open-unsafe-types
 275 // CIS Mozilla Firefox 24 ESR v1.0.0 - 3.7
 276 user_pref("network.jar.open-unsafe-types",                      false);
 277
 278 // CIS 2.7.4 Disable Scripting of Plugins by JavaScript
 279 // http://forums.mozillazine.org/viewtopic.php?f=7&t=153889
 280 user_pref("security.xpconnect.plugin.unrestricted",             false);
 281
 282 // PREF: Set File URI Origin Policy
 283 // http://kb.mozillazine.org/Security.fileuri.strict_origin_policy
 284 // CIS Mozilla Firefox 24 ESR v1.0.0 - 3.8
 285 user_pref("security.fileuri.strict_origin_policy",              true);
 286
 287 // PREF: Disable Displaying Javascript in History URLs
 288 // http://kb.mozillazine.org/Browser.urlbar.filter.javascript
 289 // CIS 2.3.6
 290 user_pref("browser.urlbar.filter.javascript",                   true);
 291
 292 // PREF: Disable asm.js
 293 // http://asmjs.org/
 294 // https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/
 295 // https://www.mozilla.org/en-US/security/advisories/mfsa2015-50/
 296 // https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2712
 297 user_pref("javascript.options.asmjs",                           false);
 298
 299 // PREF: Disable SVG in OpenType fonts
 300 // https://wiki.mozilla.org/SVGOpenTypeFonts
 301 // https://github.com/iSECPartners/publications/tree/master/reports/Tor%20Browser%20Bundle
 302 user_pref("gfx.font_rendering.opentype_svg.enabled",            false);
 303
 304 // PREF: Disable in-content SVG rendering (Firefox >= 53)
 305 // NOTICE: Disabling SVG support breaks many UI elements on many sites
 306 // https://bugzilla.mozilla.org/show_bug.cgi?id=1216893
 307 // https://github.com/iSECPartners/publications/raw/master/reports/Tor%20Browser%20Bundle/Tor%20Browser%20Bundle%20-%20iSEC%20Deliverable%201.3.pdf#16
 308 user_pref("svg.disabled", true);
 309
 310
 311 // PREF: Disable video stats to reduce fingerprinting threat
 312 // https://bugzilla.mozilla.org/show_bug.cgi?id=654550
 313 // https://github.com/pyllyukko/user.js/issues/9#issuecomment-100468785
 314 // https://github.com/pyllyukko/user.js/issues/9#issuecomment-148922065
 315 user_pref("media.video_stats.enabled",                          false);
 316
 317 // PREF: Don't reveal build ID
 318 // Value taken from Tor Browser
 319 // https://bugzilla.mozilla.org/show_bug.cgi?id=583181
 320 user_pref("general.buildID.override",                           "20100101");
 321 user_pref("browser.startup.homepage_override.buildID",          "20100101");
 322
 323 // PREF: Prevent font fingerprinting
 324 // https://browserleaks.com/fonts
 325 // https://github.com/pyllyukko/user.js/issues/120
 326 user_pref("browser.display.use_document_fonts",                 0);
 327
 328 // PREF: Enable only whitelisted URL protocol handlers
 329 // http://kb.mozillazine.org/Network.protocol-handler.external-default
 330 // http://kb.mozillazine.org/Network.protocol-handler.warn-external-default
 331 // http://kb.mozillazine.org/Network.protocol-handler.expose.%28protocol%29
 332 // https://news.ycombinator.com/item?id=13047883
 333 // https://bugzilla.mozilla.org/show_bug.cgi?id=167475
 334 // https://github.com/pyllyukko/user.js/pull/285#issuecomment-298124005
 335 // NOTICE: Disabling nonessential protocols breaks all interaction with custom protocols such as mailto:, irc:, magnet: ... and breaks opening third-party mail/messaging/torrent/... clients when clicking on links with these protocols
 336 // TODO: Add externally-handled protocols from Windows 8.1 and Windows 10 (currently contains protocols only from Linux and Windows 7) that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)
 337 // TODO: Add externally-handled protocols from Mac OS X that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)
 338 // If you want to enable a protocol, set network.protocol-handler.expose.(protocol) to true and network.protocol-handler.external.(protocol) to:
 339 //   * true, if the protocol should be handled by an external application
 340 //   * false, if the protocol should be handled internally by Firefox
 341 user_pref("network.protocol-handler.warn-external-default",     true);
 342 user_pref("network.protocol-handler.external.http",             false);
 343 user_pref("network.protocol-handler.external.https",            false);
 344 user_pref("network.protocol-handler.external.javascript",       false);
 345 user_pref("network.protocol-handler.external.moz-extension",    false);
 346 user_pref("network.protocol-handler.external.ftp",              false);
 347 user_pref("network.protocol-handler.external.file",             false);
 348 user_pref("network.protocol-handler.external.about",            false);
 349 user_pref("network.protocol-handler.external.chrome",           false);
 350 user_pref("network.protocol-handler.external.blob",             false);
 351 user_pref("network.protocol-handler.external.data",             false);
 352 user_pref("network.protocol-handler.expose-all",                false);
 353 user_pref("network.protocol-handler.expose.http",               true);
 354 user_pref("network.protocol-handler.expose.https",              true);
 355 user_pref("network.protocol-handler.expose.javascript",         true);
 356 user_pref("network.protocol-handler.expose.moz-extension",      true);
 357 user_pref("network.protocol-handler.expose.ftp",                true);
 358 user_pref("network.protocol-handler.expose.file",               true);
 359 user_pref("network.protocol-handler.expose.about",              true);
 360 user_pref("network.protocol-handler.expose.chrome",             true);
 361 user_pref("network.protocol-handler.expose.blob",               true);
 362 user_pref("network.protocol-handler.expose.data",               true);
 363
 364 /******************************************************************************
 365  * SECTION: Extensions / plugins                                                       *
 366  ******************************************************************************/
 367
 368 // PREF: Ensure you have a security delay when installing add-ons (milliseconds)
 369 // http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox
 370 // http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/
 371 user_pref("security.dialog_enable_delay",                       1000);
 372
 373 // PREF: Require signatures
 374 // https://wiki.mozilla.org/Addons/Extension_Signing
 375 //user_pref("xpinstall.signatures.required",            true);
 376
 377 // PREF: Opt-out of add-on metadata updates
 378 // https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/
 379 user_pref("extensions.getAddons.cache.enabled",                 false);
 380
 381 // PREF: Opt-out of themes (Persona) updates
 382 // https://support.mozilla.org/t5/Firefox/how-do-I-prevent-autoamtic-updates-in-a-50-user-environment/td-p/144287
 383 user_pref("lightweightThemes.update.enabled",                   false);
 384
 385 // PREF: Disable Flash Player NPAPI plugin
 386 // http://kb.mozillazine.org/Flash_plugin
 387 user_pref("plugin.state.flash",                                 0);
 388
 389 // PREF: Disable Java NPAPI plugin
 390 user_pref("plugin.state.java",                                  0);
 391
 392 // PREF: Disable sending Flash Player crash reports
 393 user_pref("dom.ipc.plugins.flash.subprocess.crashreporter.enabled",     false);
 394
 395 // PREF: When Flash crash reports are enabled, don't send the visited URL in the crash report
 396 user_pref("dom.ipc.plugins.reportCrashURL",                     false);
 397
 398 // PREF: When Flash is enabled, download and use Mozilla SWF URIs blocklist
 399 // https://bugzilla.mozilla.org/show_bug.cgi?id=1237198
 400 // https://github.com/mozilla-services/shavar-plugin-blocklist
 401 user_pref("browser.safebrowsing.blockedURIs.enabled", true);
 402
 403 // PREF: Disable Shumway (Mozilla Flash renderer)
 404 // https://developer.mozilla.org/en-US/docs/Mozilla/Projects/Shumway
 405 user_pref("shumway.disabled", true);
 406
 407 // PREF: Disable Gnome Shell Integration NPAPI plugin
 408 user_pref("plugin.state.libgnome-shell-browser-plugin",         0);
 409
 410 // PREF: Disable the bundled OpenH264 video codec (disabled)
 411 // http://forums.mozillazine.org/viewtopic.php?p=13845077&sid=28af2622e8bd8497b9113851676846b1#p13845077
 412 //user_pref("media.gmp-provider.enabled",               false);
 413
 414 // PREF: Enable plugins click-to-play
 415 // https://wiki.mozilla.org/Firefox/Click_To_Play
 416 // https://blog.mozilla.org/security/2012/10/11/click-to-play-plugins-blocklist-style/
 417 user_pref("plugins.click_to_play",                              true);
 418
 419 // PREF: Updates addons automatically
 420 // https://blog.mozilla.org/addons/how-to-turn-off-add-on-updates/
 421 user_pref("extensions.update.enabled",                          true);
 422
 423 // PREF: Enable add-on and certificate blocklists (OneCRL) from Mozilla
 424 // https://wiki.mozilla.org/Blocklisting
 425 // https://blocked.cdn.mozilla.net/
 426 // http://kb.mozillazine.org/Extensions.blocklist.enabled
 427 // http://kb.mozillazine.org/Extensions.blocklist.url
 428 // https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
 429 // Updated at interval defined in extensions.blocklist.interval (default: 86400)
 430 user_pref("extensions.blocklist.enabled",                       true);
 431 user_pref("services.blocklist.update_enabled",                  true);
 432
 433 // PREF: Decrease system information leakage to Mozilla blocklist update servers
 434 // https://trac.torproject.org/projects/tor/ticket/16931
 435 user_pref("extensions.blocklist.url",                           "https://blocklist.addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/");
 436
 437 /******************************************************************************
 438  * SECTION: Firefox (anti-)features / components                              *                            *
 439  ******************************************************************************/
 440
 441 // PREF: Disable WebIDE
 442 // https://trac.torproject.org/projects/tor/ticket/16222
 443 // https://developer.mozilla.org/docs/Tools/WebIDE
 444 user_pref("devtools.webide.enabled",                            false);
 445 user_pref("devtools.webide.autoinstallADBHelper",               false);
 446 user_pref("devtools.webide.autoinstallFxdtAdapters",            false);
 447
 448 // PREF: Disable remote debugging
 449 // https://developer.mozilla.org/en-US/docs/Tools/Remote_Debugging/Debugging_Firefox_Desktop
 450 // https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox#Advanced_settings
 451 user_pref("devtools.debugger.remote-enabled",                   false);
 452 user_pref("devtools.chrome.enabled",                            false);
 453 user_pref("devtools.debugger.force-local",                      true);
 454
 455 // PREF: Disable Mozilla telemetry/experiments
 456 // https://wiki.mozilla.org/Platform/Features/Telemetry
 457 // https://wiki.mozilla.org/Privacy/Reviews/Telemetry
 458 // https://wiki.mozilla.org/Telemetry
 459 // https://www.mozilla.org/en-US/legal/privacy/firefox.html#telemetry
 460 // https://support.mozilla.org/t5/Firefox-crashes/Mozilla-Crash-Reporter/ta-p/1715
 461 // https://wiki.mozilla.org/Security/Reviews/Firefox6/ReviewNotes/telemetry
 462 // https://gecko.readthedocs.io/en/latest/browser/experiments/experiments/manifest.html
 463 // https://wiki.mozilla.org/Telemetry/Experiments
 464 user_pref("toolkit.telemetry.enabled",                          false);
 465 user_pref("toolkit.telemetry.unified",                          false);
 466 user_pref("experiments.supported",                              false);
 467 user_pref("experiments.enabled",                                false);
 468 user_pref("experiments.manifest.uri",                           "");
 469
 470 // PREF: Disallow Necko to do A/B testing
 471 // https://trac.torproject.org/projects/tor/ticket/13170
 472 user_pref("network.allow-experiments",                          false);
 473
 474 // PREF: Disable sending Firefox crash reports to Mozilla servers
 475 // https://wiki.mozilla.org/Breakpad
 476 // http://kb.mozillazine.org/Breakpad
 477 // https://dxr.mozilla.org/mozilla-central/source/toolkit/crashreporter
 478 // https://bugzilla.mozilla.org/show_bug.cgi?id=411490
 479 // A list of submitted crash reports can be found at about:crashes
 480 user_pref("breakpad.reportURL",                                 "");
 481
 482 // PREF: Disable sending reports of tab crashes to Mozilla (about:tabcrashed), don't nag user about unsent crash reports
 483 // https://hg.mozilla.org/mozilla-central/file/tip/browser/app/profile/firefox.js
 484 user_pref("browser.tabs.crashReporting.sendReport",             false);
 485 user_pref("browser.crashReports.unsubmittedCheck.enabled",      false);
 486
 487 // PREF: Disable FlyWeb (discovery of LAN/proximity IoT devices that expose a Web interface)
 488 // https://wiki.mozilla.org/FlyWeb
 489 // https://wiki.mozilla.org/FlyWeb/Security_scenarios
 490 // https://docs.google.com/document/d/1eqLb6cGjDL9XooSYEEo7mE-zKQ-o-AuDTcEyNhfBMBM/edit
 491 // http://www.ghacks.net/2016/07/26/firefox-flyweb
 492 user_pref("dom.flyweb.enabled",                                 false);
 493
 494 // PREF: Disable the UITour backend
 495 // https://trac.torproject.org/projects/tor/ticket/19047#comment:3
 496 user_pref("browser.uitour.enabled",                             false);
 497
 498 // PREF: Enable Firefox Tracking Protection
 499 // https://wiki.mozilla.org/Security/Tracking_protection
 500 // https://support.mozilla.org/en-US/kb/tracking-protection-firefox
 501 // https://support.mozilla.org/en-US/kb/tracking-protection-pbm
 502 // https://kontaxis.github.io/trackingprotectionfirefox/
 503 // https://feeding.cloud.geek.nz/posts/how-tracking-protection-works-in-firefox/
 504 user_pref("privacy.trackingprotection.enabled",                 true);
 505 user_pref("privacy.trackingprotection.pbmode.enabled",          true);
 506
 507 // PREF: Enable contextual identity Containers feature (Firefox >= 52)
 508 // NOTICE: Containers are not available in Private Browsing mode
 509 // https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers
 510 user_pref("privacy.userContext.enabled",                        true);
 511
 512 // PREF: Enable hardening against various fingerprinting vectors (Tor Uplift project)
 513 // https://wiki.mozilla.org/Security/Tor_Uplift/Tracking
 514 // https://bugzilla.mozilla.org/show_bug.cgi?id=1333933
 515 user_pref("privacy.resistFingerprinting",                       true);
 516
 517 // PREF: Disable the built-in PDF viewer
 518 // https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2743
 519 // https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/
 520 // https://www.mozilla.org/en-US/security/advisories/mfsa2015-69/
 521 user_pref("pdfjs.disabled",                                     true);
 522
 523 // PREF: Disable collection/sending of the health report (healthreport.sqlite*)
 524 // https://support.mozilla.org/en-US/kb/firefox-health-report-understand-your-browser-perf
 525 // https://gecko.readthedocs.org/en/latest/toolkit/components/telemetry/telemetry/preferences.html
 526 user_pref("datareporting.healthreport.uploadEnabled",           false);
 527 user_pref("datareporting.healthreport.service.enabled",         false);
 528 user_pref("datareporting.policy.dataSubmissionEnabled",         false);
 529
 530 // PREF: Disable Heartbeat  (Mozilla user rating telemetry)
 531 // https://wiki.mozilla.org/Advocacy/heartbeat
 532 // https://trac.torproject.org/projects/tor/ticket/19047
 533 user_pref("browser.selfsupport.url",                            "");
 534
 535 // PREF: Disable Firefox Hello (disabled) (Firefox < 49)
 536 // https://wiki.mozilla.org/Loop
 537 // https://support.mozilla.org/t5/Chat-and-share/Support-for-Hello-discontinued-in-Firefox-49/ta-p/37946
 538 // NOTICE-DISABLED: Firefox Hello requires setting `media.peerconnection.enabled` and `media.getusermedia.screensharing.enabled` to true, `security.OCSP.require` to false to work.
 539 //user_pref("loop.enabled",             false);
 540
 541 // PREF: Disable Firefox Hello metrics collection
 542 // https://groups.google.com/d/topic/mozilla.dev.platform/nyVkCx-_sFw/discussion
 543 user_pref("loop.logDomains",                                    false);
 544
 545 // PREF: Enable Auto Update (disabled)
 546 // NOTICE: Fully automatic updates are disabled and left to package management systems on Linux. Windows users may want to change this setting.
 547 // CIS 2.1.1
 548 //user_pref("app.update.auto",                                  true);
 549
 550 // PREF: Enforce checking for Firefox updates
 551 // http://kb.mozillazine.org/App.update.enabled
 552 // NOTICE: Update check page might incorrectly report Firefox ESR as out-of-date
 553 user_pref("app.update.enabled",                 true);
 554
 555 // PREF: Enable blocking reported web forgeries
 556 // https://wiki.mozilla.org/Security/Safe_Browsing
 557 // http://kb.mozillazine.org/Safe_browsing
 558 // https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work
 559 // http://forums.mozillazine.org/viewtopic.php?f=39&t=2711237&p=12896849#p12896849
 560 // CIS 2.3.4
 561 user_pref("browser.safebrowsing.enabled",                       true); // Firefox < 50
 562 user_pref("browser.safebrowsing.phishing.enabled",              true); // firefox >= 50
 563
 564 // PREF: Enable blocking reported attack sites
 565 // http://kb.mozillazine.org/Browser.safebrowsing.malware.enabled
 566 // CIS 2.3.5
 567 user_pref("browser.safebrowsing.malware.enabled",               true);
 568
 569 // PREF: Disable querying Google Application Reputation database for downloaded binary files
 570 // https://www.mozilla.org/en-US/firefox/39.0/releasenotes/
 571 // https://wiki.mozilla.org/Security/Application_Reputation
 572 user_pref("browser.safebrowsing.downloads.remote.enabled",      false);
 573
 574 // PREF: Disable Pocket
 575 // https://support.mozilla.org/en-US/kb/save-web-pages-later-pocket-firefox
 576 // https://github.com/pyllyukko/user.js/issues/143
 577 user_pref("browser.pocket.enabled",                             false);
 578 user_pref("extensions.pocket.enabled",                          false);
 579
 580 // PREF: Disable SHIELD
 581 // https://support.mozilla.org/en-US/kb/shield
 582 // https://bugzilla.mozilla.org/show_bug.cgi?id=1370801
 583 user_pref("extensions.shield-recipe-client.enabled",            false);
 584 user_pref("app.shield.optoutstudies.enabled",                   false);
 585
 586 // PREF: Disable "Recommended by Pocket" in Firefox Quantum
 587 user_pref("browser.newtabpage.activity-stream.feeds.section.topstories",        false);
 588
 589 /******************************************************************************
 590  * SECTION: Automatic connections                                             *
 591  ******************************************************************************/
 592
 593 // PREF: Disable prefetching of <link rel="next"> URLs
 594 // http://kb.mozillazine.org/Network.prefetch-next
 595 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#Is_there_a_preference_to_disable_link_prefetching.3F
 596 user_pref("network.prefetch-next",                              false);
 597
 598 // PREF: Disable DNS prefetching
 599 // http://kb.mozillazine.org/Network.dns.disablePrefetch
 600 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching
 601 user_pref("network.dns.disablePrefetch",                        true);
 602 user_pref("network.dns.disablePrefetchFromHTTPS",               true);
 603
 604 // PREF: Disable the predictive service (Necko)
 605 // https://wiki.mozilla.org/Privacy/Reviews/Necko
 606 user_pref("network.predictor.enabled",                          false);
 607
 608 // PREF: Reject .onion hostnames before passing the to DNS
 609 // https://bugzilla.mozilla.org/show_bug.cgi?id=1228457
 610 // RFC 7686
 611 user_pref("network.dns.blockDotOnion",                          true);
 612
 613 // PREF: Disable search suggestions in the search bar
 614 // http://kb.mozillazine.org/Browser.search.suggest.enabled
 615 user_pref("browser.search.suggest.enabled",                     false);
 616
 617 // PREF: Disable "Show search suggestions in location bar results"
 618 user_pref("browser.urlbar.suggest.searches",                    false);
 619 // PREF: When using the location bar, don't suggest URLs from browsing history
 620 user_pref("browser.urlbar.suggest.history",                     false);
 621
 622 // PREF: Disable SSDP
 623 // https://bugzilla.mozilla.org/show_bug.cgi?id=1111967
 624 user_pref("browser.casting.enabled",                            false);
 625
 626 // PREF: Disable automatic downloading of OpenH264 codec
 627 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_media-capabilities
 628 // https://andreasgal.com/2014/10/14/openh264-now-in-firefox/
 629 user_pref("media.gmp-gmpopenh264.enabled",                      false);
 630 user_pref("media.gmp-manager.url",                              "");
 631
 632 // PREF: Disable speculative pre-connections
 633 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_speculative-pre-connections
 634 // https://bugzilla.mozilla.org/show_bug.cgi?id=814169
 635 user_pref("network.http.speculative-parallel-limit",            0);
 636
 637 // PREF: Disable downloading homepage snippets/messages from Mozilla
 638 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_mozilla-content
 639 // https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service
 640 user_pref("browser.aboutHomeSnippets.updateUrl",                "");
 641
 642 // PREF: Never check updates for search engines
 643 // https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_auto-update-checking
 644 user_pref("browser.search.update",                              false);
 645
 646 // PREF: Disable automatic captive portal detection (Firefox >= 52.0)
 647 // https://support.mozilla.org/en-US/questions/1157121
 648 user_pref("network.captive-portal-service.enabled",             false);
 649
 650 /******************************************************************************
 651  * SECTION: HTTP                                                              *
 652  ******************************************************************************/
 653
 654 // PREF: Disallow NTLMv1
 655 // https://bugzilla.mozilla.org/show_bug.cgi?id=828183
 656 user_pref("network.negotiate-auth.allow-insecure-ntlm-v1",      false);
 657 // it is still allowed through HTTPS. uncomment the following to disable it completely.
 658 //user_pref("network.negotiate-auth.allow-insecure-ntlm-v1-https",              false);
 659
 660 // PREF: Enable CSP 1.1 script-nonce directive support
 661 // https://bugzilla.mozilla.org/show_bug.cgi?id=855326
 662 user_pref("security.csp.experimentalEnabled",                   true);
 663
 664 // PREF: Enable Content Security Policy (CSP)
 665 // https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy
 666 // https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
 667 user_pref("security.csp.enable",                                true);
 668
 669 // PREF: Enable Subresource Integrity
 670 // https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
 671 // https://wiki.mozilla.org/Security/Subresource_Integrity
 672 user_pref("security.sri.enable",                                true);
 673
 674 // PREF: DNT HTTP header (disabled)
 675 // https://www.mozilla.org/en-US/firefox/dnt/
 676 // https://en.wikipedia.org/wiki/Do_not_track_header
 677 // https://dnt-dashboard.mozilla.org
 678 // https://github.com/pyllyukko/user.js/issues/11
 679 // NOTICE: Do No Track must be enabled manually
 680 //user_pref("privacy.donottrackheader.enabled",         true);
 681
 682 // PREF: Send a referer header with the target URI as the source
 683 // https://bugzilla.mozilla.org/show_bug.cgi?id=822869
 684 // https://github.com/pyllyukko/user.js/issues/227
 685 // NOTICE: Spoofing referers breaks functionality on websites relying on authentic referer headers
 686 // NOTICE: Spoofing referers breaks visualisation of 3rd-party sites on the Lightbeam addon
 687 // NOTICE: Spoofing referers disables CSRF protection on some login pages not implementing origin-header/cookie+token based CSRF protection
 688 // TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs
 689 user_pref("network.http.referer.spoofSource",                   true);
 690
 691 // PREF: Don't send referer headers when following links across different domains (disabled)
 692 // https://github.com/pyllyukko/user.js/issues/227
 693 // user_pref("network.http.referer.XOriginPolicy",              2);
 694
 695 // PREF: Accept Only 1st Party Cookies
 696 // http://kb.mozillazine.org/Network.cookie.cookieBehavior#1
 697 // NOTICE: Blocking 3rd-party cookies breaks a number of payment gateways
 698 // CIS 2.5.1
 699 user_pref("network.cookie.cookieBehavior",                      1);
 700
 701 // PREF: Enable first-party isolation
 702 // https://bugzilla.mozilla.org/show_bug.cgi?id=1299996
 703 // https://bugzilla.mozilla.org/show_bug.cgi?id=1260931
 704 // https://wiki.mozilla.org/Security/FirstPartyIsolation
 705 // NOTICE: Breaks Firefox addon "Cookie AutoDelete" as of February 2018
 706 user_pref("privacy.firstparty.isolate",                         true);
 707
 708 // PREF: Make sure that third-party cookies (if enabled) never persist beyond the session.
 709 // https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/
 710 // http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly
 711 // https://developer.mozilla.org/en-US/docs/Cookies_Preferences_in_Mozilla#network.cookie.thirdparty.sessionOnly
 712 user_pref("network.cookie.thirdparty.sessionOnly",              true);
 713
 714 // PREF: Spoof User-agent (disabled)
 715 //user_pref("general.useragent.override",                               "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0");
 716 //user_pref("general.appname.override",                         "Netscape");
 717 //user_pref("general.appversion.override",                      "5.0 (Windows)");
 718 //user_pref("general.platform.override",                                "Win32");
 719 //user_pref("general.oscpu.override",                           "Windows NT 6.1");
 720
 721 /*******************************************************************************
 722  * SECTION: Caching                                                            *
 723  ******************************************************************************/
 724
 725 // PREF: Permanently enable private browsing mode
 726 // https://support.mozilla.org/en-US/kb/Private-Browsing
 727 // https://wiki.mozilla.org/PrivateBrowsing
 728 // NOTICE: You can not view or inspect cookies when in private browsing: https://bugzilla.mozilla.org/show_bug.cgi?id=823941
 729 // NOTICE: When Javascript is enabled, Websites can detect use of Private Browsing mode
 730 // NOTICE: Private browsing breaks Kerberos authentication
 731 // NOTICE: Disables "Containers" functionality (see below)
 732 // NOTICE: "Always use private browsing mode" (browser.privatebrowsing.autostart) disables the possibility to use password manager: https://support.mozilla.org/en-US/kb/usernames-and-passwords-are-not-saved#w_private-browsing
 733 user_pref("browser.privatebrowsing.autostart",                  true);
 734
 735 // PREF: Do not download URLs for the offline cache
 736 // http://kb.mozillazine.org/Browser.cache.offline.enable
 737 user_pref("browser.cache.offline.enable",                       false);
 738
 739 // PREF: Clear history when Firefox closes
 740 // https://support.mozilla.org/en-US/kb/Clear%20Recent%20History#w_how-do-i-make-firefox-clear-my-history-automatically
 741 // NOTICE: Installing user.js will remove your browsing history, caches and local storage.
 742 // NOTICE: Installing user.js **will remove your saved passwords** (https://github.com/pyllyukko/user.js/issues/27)
 743 // NOTICE: Clearing open windows on Firefox exit causes 2 windows to open when Firefox starts https://bugzilla.mozilla.org/show_bug.cgi?id=1334945
 744 user_pref("privacy.sanitize.sanitizeOnShutdown",                true);
 745 user_pref("privacy.clearOnShutdown.cache",                      true);
 746 user_pref("privacy.clearOnShutdown.cookies",                    true);
 747 user_pref("privacy.clearOnShutdown.downloads",                  true);
 748 user_pref("privacy.clearOnShutdown.formdata",                   true);
 749 user_pref("privacy.clearOnShutdown.history",                    true);
 750 user_pref("privacy.clearOnShutdown.offlineApps",                true);
 751 user_pref("privacy.clearOnShutdown.sessions",                   true);
 752 user_pref("privacy.clearOnShutdown.openWindows",                true);
 753
 754 // PREF: Set time range to "Everything" as default in "Clear Recent History"
 755 user_pref("privacy.sanitize.timeSpan",                          0);
 756
 757 // PREF: Clear everything but "Site Preferences" in "Clear Recent History"
 758 user_pref("privacy.cpd.offlineApps",                            true);
 759 user_pref("privacy.cpd.cache",                                  true);
 760 user_pref("privacy.cpd.cookies",                                true);
 761 user_pref("privacy.cpd.downloads",                              true);
 762 user_pref("privacy.cpd.formdata",                               true);
 763 user_pref("privacy.cpd.history",                                true);
 764 user_pref("privacy.cpd.sessions",                               true);
 765
 766 // PREF: Don't remember browsing history
 767 user_pref("places.history.enabled",                             false);
 768
 769 // PREF: Disable disk cache
 770 // http://kb.mozillazine.org/Browser.cache.disk.enable
 771 user_pref("browser.cache.disk.enable",                          false);
 772
 773 // PREF: Disable memory cache (disabled)
 774 // http://kb.mozillazine.org/Browser.cache.memory.enable
 775 //user_pref("browser.cache.memory.enable",              false);
 776
 777 // PREF: Disable Caching of SSL Pages
 778 // CIS Version 1.2.0 October 21st, 2011 2.5.8
 779 // http://kb.mozillazine.org/Browser.cache.disk_cache_ssl
 780 user_pref("browser.cache.disk_cache_ssl",                       false);
 781
 782 // PREF: Disable download history
 783 // CIS Version 1.2.0 October 21st, 2011 2.5.5
 784 user_pref("browser.download.manager.retention",                 0);
 785
 786 // PREF: Disable password manager
 787 // CIS Version 1.2.0 October 21st, 2011 2.5.2
 788 user_pref("signon.rememberSignons",                             false);
 789
 790 // PREF: Disable form autofill, don't save information entered in web page forms and the Search Bar
 791 user_pref("browser.formfill.enable",                            false);
 792
 793 // PREF: Cookies expires at the end of the session (when the browser closes)
 794 // http://kb.mozillazine.org/Network.cookie.lifetimePolicy#2
 795 user_pref("network.cookie.lifetimePolicy",                      2);
 796
 797 // PREF: Require manual intervention to autofill known username/passwords sign-in forms
 798 // http://kb.mozillazine.org/Signon.autofillForms
 799 // https://www.torproject.org/projects/torbrowser/design/#identifier-linkability
 800 user_pref("signon.autofillForms",                               false);
 801
 802 // PREF: Disable formless login capture
 803 // https://bugzilla.mozilla.org/show_bug.cgi?id=1166947
 804 user_pref("signon.formlessCapture.enabled",                     false);
 805
 806 // PREF: When username/password autofill is enabled, still disable it on non-HTTPS sites
 807 // https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317
 808 user_pref("signon.autofillForms.http",                          false);
 809
 810 // PREF: Show in-content login form warning UI for insecure login fields
 811 // https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317
 812 user_pref("security.insecure_field_warning.contextual.enabled", true);
 813
 814 // PREF: Disable the password manager for pages with autocomplete=off (disabled)
 815 // https://bugzilla.mozilla.org/show_bug.cgi?id=956906
 816 // OWASP ASVS V9.1
 817 // Does not prevent any kind of auto-completion (see browser.formfill.enable, signon.autofillForms)
 818 //user_pref("signon.storeWhenAutocompleteOff",                  false);
 819
 820 // PREF: Delete Search and Form History
 821 // CIS Version 1.2.0 October 21st, 2011 2.5.6
 822 user_pref("browser.formfill.expire_days",                       0);
 823
 824 // PREF: Clear SSL Form Session Data
 825 // http://kb.mozillazine.org/Browser.sessionstore.privacy_level#2
 826 // Store extra session data for unencrypted (non-HTTPS) sites only.
 827 // CIS Version 1.2.0 October 21st, 2011 2.5.7
 828 // NOTE: CIS says 1, we use 2
 829 user_pref("browser.sessionstore.privacy_level",                 2);
 830
 831 // PREF: Delete temporary files on exit
 832 // https://bugzilla.mozilla.org/show_bug.cgi?id=238789
 833 user_pref("browser.helperApps.deleteTempFileOnExit",            true);
 834
 835 // PREF: Do not create screenshots of visited pages (relates to the "new tab page" feature)
 836 // https://support.mozilla.org/en-US/questions/973320
 837 // https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/browser.pagethumbnails.capturing_disabled
 838 user_pref("browser.pagethumbnails.capturing_disabled",          true);
 839
 840 // PREF: Don't fetch and permanently store favicons for Windows .URL shortcuts created by drag and drop
 841 // NOTICE: .URL shortcut files will be created with a generic icon
 842 // Favicons are stored as .ico files in $profile_dir\shortcutCache
 843 user_pref("browser.shell.shortcutFavicons",                                     false);
 844
 845 // PREF: Disable bookmarks backups (default: 15)
 846 // http://kb.mozillazine.org/Browser.bookmarks.max_backups
 847 user_pref("browser.bookmarks.max_backups", 0);
 848
 849 /*******************************************************************************
 850  * SECTION: UI related                                                         *
 851  *******************************************************************************/
 852
 853 // PREF: Enable insecure password warnings (login forms in non-HTTPS pages)
 854 // https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-over-http-please/
 855 // https://bugzilla.mozilla.org/show_bug.cgi?id=1319119
 856 // https://bugzilla.mozilla.org/show_bug.cgi?id=1217156
 857 user_pref("security.insecure_password.ui.enabled",              true);
 858
 859 // PREF: Disable right-click menu manipulation via JavaScript (disabled)
 860 //user_pref("dom.event.contextmenu.enabled",            false);
 861
 862 // PREF: Disable "Are you sure you want to leave this page?" popups on page close
 863 // https://support.mozilla.org/en-US/questions/1043508
 864 // Does not prevent JS leaks of the page close event.
 865 // https://developer.mozilla.org/en-US/docs/Web/Events/beforeunload
 866 //user_pref("dom.disable_beforeunload",    true);
 867
 868 // PREF: Disable Downloading on Desktop
 869 // CIS 2.3.2
 870 user_pref("browser.download.folderList",                        2);
 871
 872 // PREF: Always ask the user where to download
 873 // https://developer.mozilla.org/en/Download_Manager_preferences (obsolete)
 874 user_pref("browser.download.useDownloadDir",                    false);
 875
 876 // PREF: Disable the "new tab page" feature and show a blank tab instead
 877 // https://wiki.mozilla.org/Privacy/Reviews/New_Tab
 878 // https://support.mozilla.org/en-US/kb/new-tab-page-show-hide-and-customize-top-sites#w_how-do-i-turn-the-new-tab-page-off
 879 user_pref("browser.newtabpage.enabled",                         false);
 880 user_pref("browser.newtab.url",                                 "about:blank");
 881
 882 // PREF: Disable Activity Stream
 883 // https://wiki.mozilla.org/Firefox/Activity_Stream
 884 user_pref("browser.newtabpage.activity-stream.enabled",         false);
 885
 886 // PREF: Disable new tab tile ads & preload
 887 // http://www.thewindowsclub.com/disable-remove-ad-tiles-from-firefox
 888 // http://forums.mozillazine.org/viewtopic.php?p=13876331#p13876331
 889 // https://wiki.mozilla.org/Tiles/Technical_Documentation#Ping
 890 // https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-source
 891 // https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-ping
 892 // TODO: deprecated? not in DXR, some dead links
 893 user_pref("browser.newtabpage.enhanced",                        false);
 894 user_pref("browser.newtab.preload",                             false);
 895 user_pref("browser.newtabpage.directory.ping",                  "");
 896 user_pref("browser.newtabpage.directory.source",                "data:text/plain,{}");
 897
 898 // PREF: Enable Auto Notification of Outdated Plugins (Firefox < 50)
 899 // https://wiki.mozilla.org/Firefox3.6/Plugin_Update_Awareness_Security_Review
 900 // CIS Version 1.2.0 October 21st, 2011 2.1.2
 901 // https://hg.mozilla.org/mozilla-central/rev/304560
 902 user_pref("plugins.update.notifyUser",                          true);
 903
 904
 905 // PREF: Force Punycode for Internationalized Domain Names
 906 // http://kb.mozillazine.org/Network.IDN_show_punycode
 907 // https://www.xudongz.com/blog/2017/idn-phishing/
 908 // https://wiki.mozilla.org/IDN_Display_Algorithm
 909 // https://en.wikipedia.org/wiki/IDN_homograph_attack
 910 // https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/
 911 // CIS Mozilla Firefox 24 ESR v1.0.0 - 3.6
 912 user_pref("network.IDN_show_punycode",                          true);
 913
 914 // PREF: Disable inline autocomplete in URL bar
 915 // http://kb.mozillazine.org/Inline_autocomplete
 916 user_pref("browser.urlbar.autoFill",                            false);
 917 user_pref("browser.urlbar.autoFill.typed",                      false);
 918
 919 // PREF: Disable CSS :visited selectors
 920 // https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/
 921 // https://dbaron.org/mozilla/visited-privacy
 922 user_pref("layout.css.visited_links_enabled",                   false);
 923
 924 // PREF: Disable URL bar autocomplete and history/bookmarks suggestions dropdown
 925 // http://kb.mozillazine.org/Disabling_autocomplete_-_Firefox#Firefox_3.5
 926 user_pref("browser.urlbar.autocomplete.enabled",                false);
 927
 928 // PREF: Do not check if Firefox is the default browser
 929 user_pref("browser.shell.checkDefaultBrowser",                  false);
 930
 931 // PREF: When password manager is enabled, lock the password storage periodically
 932 // CIS Version 1.2.0 October 21st, 2011 2.5.3 Disable Prompting for Credential Storage
 933 user_pref("security.ask_for_password",                          2);
 934
 935 // PREF: Lock the password storage every 1 minutes (default: 30)
 936 user_pref("security.password_lifetime",                         1);
 937
 938 // PREF: Display a notification bar when websites offer data for offline use
 939 // http://kb.mozillazine.org/Browser.offline-apps.notify
 940 user_pref("browser.offline-apps.notify",                        true);
 941
 942 /******************************************************************************
 943  * SECTION: Cryptography                                                      *
 944  ******************************************************************************/
 945
 946 // PREF: Enable HSTS preload list (pre-set HSTS sites list provided by Mozilla)
 947 // https://blog.mozilla.org/security/2012/11/01/preloading-hsts/
 948 // https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List
 949 // https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
 950 user_pref("network.stricttransportsecurity.preloadlist",        true);
 951
 952 // PREF: Enable Online Certificate Status Protocol
 953 // https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
 954 // https://www.imperialviolet.org/2014/04/19/revchecking.html
 955 // https://www.maikel.pro/blog/current-state-certificate-revocation-crls-ocsp/
 956 // https://wiki.mozilla.org/CA:RevocationPlan
 957 // https://wiki.mozilla.org/CA:ImprovingRevocation
 958 // https://wiki.mozilla.org/CA:OCSP-HardFail
 959 // https://news.netcraft.com/archives/2014/04/24/certificate-revocation-why-browsers-remain-affected-by-heartbleed.html
 960 // https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html
 961 // NOTICE: OCSP leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host
 962 // NOTICE: OCSP is vulnerable to replay attacks when nonce is not configured on the OCSP responder
 963 // NOTICE: OCSP adds latency (performance)
 964 // NOTICE: Short-lived certificates are not checked for revocation (security.pki.cert_short_lifetime_in_days, default:10)
 965 // CIS Version 1.2.0 October 21st, 2011 2.2.4
 966 user_pref("security.OCSP.enabled",                              1);
 967
 968 // PREF: Enable OCSP Stapling support
 969 // https://en.wikipedia.org/wiki/OCSP_stapling
 970 // https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
 971 // https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx
 972 user_pref("security.ssl.enable_ocsp_stapling",                  true);
 973
 974 // PREF: Enable OCSP Must-Staple support (Firefox >= 45)
 975 // https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/
 976 // https://www.entrust.com/ocsp-must-staple/
 977 // https://github.com/schomery/privacy-settings/issues/40
 978 // NOTICE: Firefox falls back on plain OCSP when must-staple is not configured on the host certificate
 979 user_pref("security.ssl.enable_ocsp_must_staple",               true);
 980
 981 // PREF: Require a valid OCSP response for OCSP enabled certificates
 982 // https://groups.google.com/forum/#!topic/mozilla.dev.security/n1G-N2-HTVA
 983 // Disabling this will make OCSP bypassable by MitM attacks suppressing OCSP responses
 984 // NOTICE: `security.OCSP.require` will make the connection fail when the OCSP responder is unavailable
 985 // NOTICE: `security.OCSP.require` is known to break browsing on some [captive portals](https://en.wikipedia.org/wiki/Captive_portal)
 986 user_pref("security.OCSP.require",                              true);
 987
 988 // PREF: Disable TLS Session Tickets
 989 // https://www.blackhat.com/us-13/briefings.html#NextGen
 990 // https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-Slides.pdf
 991 // https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-WP.pdf
 992 // https://bugzilla.mozilla.org/show_bug.cgi?id=917049
 993 // https://bugzilla.mozilla.org/show_bug.cgi?id=967977
 994 user_pref("security.ssl.disable_session_identifiers",           true);
 995
 996 // PREF: Only allow TLS 1.[0-3]
 997 // http://kb.mozillazine.org/Security.tls.version.*
 998 // 1 = TLS 1.0 is the minimum required / maximum supported encryption protocol. (This is the current default for the maximum supported version.)
 999 // 2 = TLS 1.1 is the minimum required / maximum supported encryption protocol.
1000 user_pref("security.tls.version.min",                           1);
1001 user_pref("security.tls.version.max",                           4);
1002
1003 // PREF: Disable insecure TLS version fallback
1004 // https://bugzilla.mozilla.org/show_bug.cgi?id=1084025
1005 // https://github.com/pyllyukko/user.js/pull/206#issuecomment-280229645
1006 user_pref("security.tls.version.fallback-limit",                3);
1007
1008 // PREF: Enfore Public Key Pinning
1009 // https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
1010 // https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning
1011 // "2. Strict. Pinning is always enforced."
1012 user_pref("security.cert_pinning.enforcement_level",            2);
1013
1014 // PREF: Disallow SHA-1
1015 // https://bugzilla.mozilla.org/show_bug.cgi?id=1302140
1016 // https://shattered.io/
1017 user_pref("security.pki.sha1_enforcement_level",                1);
1018
1019 // PREF: Warn the user when server doesn't support RFC 5746 ("safe" renegotiation)
1020 // https://wiki.mozilla.org/Security:Renegotiation#security.ssl.treat_unsafe_negotiation_as_broken
1021 // https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555
1022 user_pref("security.ssl.treat_unsafe_negotiation_as_broken",    true);
1023
1024 // PREF: Disallow connection to servers not supporting safe renegotiation (disabled)
1025 // https://wiki.mozilla.org/Security:Renegotiation#security.ssl.require_safe_negotiation
1026 // https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555
1027 // TODO: `security.ssl.require_safe_negotiation` is more secure but makes browsing next to impossible (2012-2014-... - `ssl_error_unsafe_negotiation` errors), so is left disabled
1028 //user_pref("security.ssl.require_safe_negotiation",            true);
1029
1030 // PREF: Disable automatic reporting of TLS connection errors
1031 // https://support.mozilla.org/en-US/kb/certificate-pinning-reports
1032 // we could also disable security.ssl.errorReporting.enabled, but I think it's
1033 // good to leave the option to report potentially malicious sites if the user
1034 // chooses to do so.
1035 // you can test this at https://pinningtest.appspot.com/
1036 user_pref("security.ssl.errorReporting.automatic",              false);
1037
1038 // PREF: Pre-populate the current URL but do not pre-fetch the certificate in the "Add Security Exception" dialog
1039 // http://kb.mozillazine.org/Browser.ssl_override_behavior
1040 // https://github.com/pyllyukko/user.js/issues/210
1041 user_pref("browser.ssl_override_behavior",                      1);
1042
1043 /******************************************************************************
1044  * SECTION: Cipher suites                                                     *
1045  ******************************************************************************/
1046
1047 // PREF: Disable null ciphers
1048 user_pref("security.ssl3.rsa_null_sha",                         false);
1049 user_pref("security.ssl3.rsa_null_md5",                         false);
1050 user_pref("security.ssl3.ecdhe_rsa_null_sha",                   false);
1051 user_pref("security.ssl3.ecdhe_ecdsa_null_sha",                 false);
1052 user_pref("security.ssl3.ecdh_rsa_null_sha",                    false);
1053 user_pref("security.ssl3.ecdh_ecdsa_null_sha",                  false);
1054
1055 // PREF: Disable SEED cipher
1056 // https://en.wikipedia.org/wiki/SEED
1057 user_pref("security.ssl3.rsa_seed_sha",                         false);
1058
1059 // PREF: Disable 40/56/128-bit ciphers
1060 // 40-bit ciphers
1061 user_pref("security.ssl3.rsa_rc4_40_md5",                       false);
1062 user_pref("security.ssl3.rsa_rc2_40_md5",                       false);
1063 // 56-bit ciphers
1064 user_pref("security.ssl3.rsa_1024_rc4_56_sha",                  false);
1065 // 128-bit ciphers
1066 user_pref("security.ssl3.rsa_camellia_128_sha",                 false);
1067 user_pref("security.ssl3.ecdhe_rsa_aes_128_sha",                false);
1068 user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha",              false);
1069 user_pref("security.ssl3.ecdh_rsa_aes_128_sha",                 false);
1070 user_pref("security.ssl3.ecdh_ecdsa_aes_128_sha",               false);
1071 user_pref("security.ssl3.dhe_rsa_camellia_128_sha",             false);
1072 user_pref("security.ssl3.dhe_rsa_aes_128_sha",                  false);
1073
1074 // PREF: Disable RC4
1075 // https://developer.mozilla.org/en-US/Firefox/Releases/38#Security
1076 // https://bugzilla.mozilla.org/show_bug.cgi?id=1138882
1077 // https://rc4.io/
1078 // https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2566
1079 user_pref("security.ssl3.ecdh_ecdsa_rc4_128_sha",               false);
1080 user_pref("security.ssl3.ecdh_rsa_rc4_128_sha",                 false);
1081 user_pref("security.ssl3.ecdhe_ecdsa_rc4_128_sha",              false);
1082 user_pref("security.ssl3.ecdhe_rsa_rc4_128_sha",                false);
1083 user_pref("security.ssl3.rsa_rc4_128_md5",                      false);
1084 user_pref("security.ssl3.rsa_rc4_128_sha",                      false);
1085 user_pref("security.tls.unrestricted_rc4_fallback",             false);
1086
1087 // PREF: Disable 3DES (effective key size is < 128)
1088 // https://en.wikipedia.org/wiki/3des#Security
1089 // http://en.citizendium.org/wiki/Meet-in-the-middle_attack
1090 // http://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html
1091 user_pref("security.ssl3.dhe_dss_des_ede3_sha",                 false);
1092 user_pref("security.ssl3.dhe_rsa_des_ede3_sha",                 false);
1093 user_pref("security.ssl3.ecdh_ecdsa_des_ede3_sha",              false);
1094 user_pref("security.ssl3.ecdh_rsa_des_ede3_sha",                false);
1095 user_pref("security.ssl3.ecdhe_ecdsa_des_ede3_sha",             false);
1096 user_pref("security.ssl3.ecdhe_rsa_des_ede3_sha",               false);
1097 user_pref("security.ssl3.rsa_des_ede3_sha",                     false);
1098 user_pref("security.ssl3.rsa_fips_des_ede3_sha",                false);
1099
1100 // PREF: Disable ciphers with ECDH (non-ephemeral)
1101 user_pref("security.ssl3.ecdh_rsa_aes_256_sha",                 false);
1102 user_pref("security.ssl3.ecdh_ecdsa_aes_256_sha",               false);
1103
1104 // PREF: Disable 256 bits ciphers without PFS
1105 user_pref("security.ssl3.rsa_camellia_256_sha",                 false);
1106
1107 // PREF: Enable ciphers with ECDHE and key size > 128bits
1108 user_pref("security.ssl3.ecdhe_rsa_aes_256_sha",                true); // 0xc014
1109 user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha",              true); // 0xc00a
1110
1111 // PREF: Enable GCM ciphers (TLSv1.2 only)
1112 // https://en.wikipedia.org/wiki/Galois/Counter_Mode
1113 user_pref("security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256",       true); // 0xc02b
1114 user_pref("security.ssl3.ecdhe_rsa_aes_128_gcm_sha256",         true); // 0xc02f
1115
1116 // PREF: Enable ChaCha20 and Poly1305 (Firefox >= 47)
1117 // https://www.mozilla.org/en-US/firefox/47.0/releasenotes/
1118 // https://tools.ietf.org/html/rfc7905
1119 // https://bugzilla.mozilla.org/show_bug.cgi?id=917571
1120 // https://bugzilla.mozilla.org/show_bug.cgi?id=1247860
1121 // https://cr.yp.to/chacha.html
1122 user_pref("security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256", true);
1123 user_pref("security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256",   true);
1124
1125 // PREF: Disable ciphers susceptible to the logjam attack
1126 // https://weakdh.org/
1127 user_pref("security.ssl3.dhe_rsa_camellia_256_sha",             false);
1128 user_pref("security.ssl3.dhe_rsa_aes_256_sha",                  false);
1129
1130 // PREF: Disable ciphers with DSA (max 1024 bits)
1131 user_pref("security.ssl3.dhe_dss_aes_128_sha",                  false);
1132 user_pref("security.ssl3.dhe_dss_aes_256_sha",                  false);
1133 user_pref("security.ssl3.dhe_dss_camellia_128_sha",             false);
1134 user_pref("security.ssl3.dhe_dss_camellia_256_sha",             false);
1135
1136 // PREF: Fallbacks due compatibility reasons
1137 user_pref("security.ssl3.rsa_aes_256_sha",                      true); // 0x35
1138 user_pref("security.ssl3.rsa_aes_128_sha",                      true); // 0x2f