10

What would be a sensible approach to enhance the security and privacy of Firefox?

I did not find a question about this and I feel that some guidelines for casual web users would be handy.

Currently my browser is wearing:

The first two have been in use for a long time. The latter was installed today and I'm still assessing how it fares since I've heard it breaks some web sites.

Feel free to post an answer for the most paranoid of us using VM inception and the likes. As for the rest of the world, what else would you add to the list and why? Please keep usability in mind.

  • Four points: (1) Privacy and security are often interdependent, actions taken to improve one sometimes improves the other; (2) The browser is just one of many components that need attention for best security and privacy; (3) As you probably realize, usability can suffer with blocking add-ons - page elements may not function properly and whole pages may not function; (4) Be aware that many browser mods will actually increase your susceptibility to fingerprinting. See, for example: panopticlick.eff.org – pseudon Jan 27 '15 at 15:10
  • Especially because of #4 above, from a privacy perspective, a common browser UA in a VM set up as a common OS config, with aggressive cookie management and without loading Flash or Java, can be reasonably effective. Vary your IP addresss. Even better: use the Tor version of Firefox for as much anonymous browsing as possible. HTTPS and Tor are your best friends for security too. If you can articulate your security & privacy threat model, recommendations become easier to prioritize (e.g., are you more concerned about government, local ISP, café wi-fi, or commercial tracking across web sites?). – pseudon Jan 27 '15 at 15:11
  • To address fingerprinting, it's better to partition your web use across different personas for different purposes, and keep each persona in a different physical machine or VM (with differently-configured VM/browser combinations). But again, Tor browser bundle is a very easy way to achieve high levels of anonymity when used properly. – pseudon Jan 27 '15 at 15:11
  • I use flashblock, too, partially because of security. And instead of adblock plus I use adblock edge (it doesn't have an exception list). – peterh Jan 27 '15 at 22:06
  • 1
    It is nice to know there are people around collecting hardening guidelines: github.com/pyllyukko/user.js – Deer Hunter Apr 10 '15 at 13:24
6

There are several actions you can take in order to secure Firefox, how far you chose to go is of course up to you.

You can make some modifications in the Firefox preferences menu:

  • "General"
    • "when Firefox starts"->"Show a blank page"
    • "save files to:"Downloads"
  • "Content"
    • check:"Block pop-up windows"
    • uncheck:"Enable JavaScript"
    • "Languages"->choose only:"en-us"
  • "Applications"->choose:"Always ask" for every application
  • "Privacy"

    • "Tracking"->check:"Tell websites I do not want to be tracked"
    • "History"->"Firefox will:"Use custom settings for history"
    • "History"->uncheck:"Always use private browsing mode"
    • "History"->uncheck:"Remember my browsing and download history"
    • "History"->uncheck:"Remember search and form history"
    • "History"->uncheck:"Accept cookies from sites"
    • "History"->uncheck:"Accept third-party cookies"

    • "History"->check:"Clear history when Firefox/Nightly closes"

    • "History"->"settings":check all -> except:"Site Preferences"
    • "location bar"->"When using the location bar, suggest:"->choose:"Nothing"
  • "security"
    • check:"Warn me when sites try to install add-ons"
    • check:"Block reported attack sites"
    • check:"Block reported web forgeries"
    • "Passwords"->uncheck:"Remember passwords for sites"
    • "Passwords"->uncheck:"Use a master password"
  • "advanced"
    • "General"->"System Defaults"->uncheck:"Submit crash reports"
    • "General"->"System Defaults"->uncheck:"Submit performance data"
    • "Update"->check:"Automatically install updates"
    • "Update"->check:"Warn me if this will disable any of my add-ons"
    • "Update"->check:"Automatically update Search Engines"
    • "Encryption"->"Protocols"->check:"Use SSL 3.0"
    • "Encryption"->"Protocols"->check:"Use TLS 1.0"
    • "Encryption"->"Certificates"->"When a server requests my personal certificate"->check:"Ask me every time"

Addons

Empty Cache Button [optional]

Calomel SSL Validation [cool little addon which does exactly what its name says and also has some more tweaks in the settings]

Adblock Edge

Easylist

EasyPrivacy

fanboy-adblock

Fanboy's Tracking List

Fanboy's Annoyance List

BetterPrivacy [LSO/Flash-Cookie-Protection]

Cookie Monster [Allows you to Manage your Cookie-Policies. For less baggage use Firefox/Iceweasel "Preferences" -> "Privacy"]

HTTPS-Everywhere [Download via EFF.org] [settings: enable SSL-Observatory but don't allow to transmit ISP-data]

HTTPS Finder

NoScript [go to "settings" and check "also apply on whitelisted sites"]

Perspectives [SSL-Cerfiticate-Control - go to settings: "notary servers" -> check "only contact when websites cause security error"]

RefControl [controls your HTTP-Referers - setting: "block" -> "3rd parties only"]

Request Policy [rejects cross-site requests]

WOT [Web of Trust - user based website ratings that show up in websearches. Caution: Not very accurate. Always double check when in doubt. This addon tends to get abused by different groups of users who either give malicious sites good ratings - or flag perfectly good sites.]

PwdHash [Nice addon to help your password management. Use "F2" when entering a password into a password field when setting up a new account somewhere to create a MD5-hash using your password and the domain. (When logging in you have to select the password-field and press F2 again to run the hashing.) This way you can use the same password on different sites without having to worry about security implications - because every site gets its own password generated through the hash. The tool is provided by Standford University and can be trusted. No data is actually transmitted to their servers. The hash is generated using your local java-script. If you need to login from a machine that doesn't have pwdhash installed: go to https://www.pwdhash.com/ -> their SSL is very strong.]

FoxyProxy [a convenient Proxy Switcher]

Useragent Switcher [Does exactly that. But be careful: If you set your user-agent as shown below - using this addon it will overwrite these settings and will not automatically restore them if you turn off the switcher. So you would have to manually reconfigure about:config again. Which sucks. But you can get a whole load really cool user agents here. Simply download the .xml and import it to the Useragent Switcher. There are really neat current agents in there: e.g. all kinds of different web browser for all OSs and of course various bots. Google bot comes in handy when you need access to some forum... wink]

Web Developer [Has some cool features. If you like inspecting websites just check it out.]

Bloody Vikings [Creates disposable mail-addresses]

Note: You don't need Ghostery. The above mentioned Adblock lists do a much better job protecting you from web-tracking without using the additional resourced Ghostery uses.

Of course there are more addons you could use. But I don't really see the point of them. Most of them either are snake-oil or even dangerous. To keep your ISP and possible MITM-attackers from reading what you do on the web always use SSL - as far as it is available. To help with this use:

SSL-Search Engines

The user "SSL Search Bar" has provided easily installable SSL-searchbar-plugins

You get SSL-plugins for all the alternative search-engines like ixquick, duckduckgo etc. there. Install those you happen to use.

Privatelee also looks promising. But I haven't tried it out extensively.

The next thing to do is to change macromedias flash-settings:

Flash-Settings

Go here.

And fight yourself through their nasty settings-manager. Set everything to "0" or "never allow"/"never ask again" and delete all stored website-content. Give special attention to the webcam and Mic settings

You might as well set the permissions of your .macromedia folder to read only - but that's kind of unnecessary because you want to make sure to edit the options mentioned above - to make sure that you don't allow websites to use your mic or webcam I actually take this one step further by disabling them in BIOS.

You can also go one step further and run Firefox in a sandbox such as Sandboxie.

Just a general idea of the things you can do that will help secure your browser.

  • Secret Agent from dephormation.org.uk/index.php?page=81 is another great add-on for randomizing your user agent – CPagan Jan 27 '15 at 2:10
  • 1
    Checking "block reported attack sites & web forgeries" queries Google to tell whether a domain is malicious or not; given that the author wants to hide from Google Analytics I think enabling that option is counter productive. – user42178 Jan 27 '15 at 13:10
  • Completely turning off JavaScript and cookies will severely degrade usability on many sites. Also, some of the preferences settings depend on how Firefox is used. For example, it's OK to accept 1st-party cookies if you set up Firefox to clear all state when quitting and quit often. – pseudon Jan 27 '15 at 13:34
  • 1
    Extensions may be able to access elements of your browsing traffic. I have a certain level of trust of Mozilla, but I don't necessarily have that same level of trust for arbitrary extension developers. Need to weigh risk for a given extension with the benefit it provides. – pseudon Jan 27 '15 at 19:20
  • 1
    Absolutely its important to vet any type of software before relying on it. – CPagan Jan 27 '15 at 20:15
2

I will focus my answer in not so basic actions you can do to improve your security, add-ons and basic configuration i assume most security awaraness people already know so.

Go to about:config then search for :

security.ssl.require_safe_negotiation Set to it to true

security.warn_viewing_mixed Set it to true

security.xpconnect.plugin.unrestricted Set it to false (that may break plugins i didn't test it with the add-ons mentioned above if anyone can test that would be very good since i can't at moment)

privacy.trackingprotection.enabled Set it to true

Also search for "rc4" (on the same config page!) disable all of then rc4 is insecure on that way you enforce stronger ciphers when establishing an SSL connection.

network.http.sendRefererHeader

0 – never send the referring URL.
1 – send only when links are clicked.
2 – send for links and images (default).

Recommended : 1

network.http.referer.XOriginPolicy

0 – always send referrer (default).
1 – only send if base domains match.
2 – only send if hosts match.

Recommended : 1

network.http.referer.spoofSource

false – send the referrer (default).
true – spoof the referrer and use the target URI instead.

Recommended : True

network.http.referer.trimmingPolicy

0 – send full URI (default).
1 – scheme, host, port and path.
2 – scheme, host and port.

Recommended : 2

Set network.proxy.socks_remote_dns (in about:config) to true to force Firefox to make DNS requests through the proxy. Otherwise you can leak DNS requests to your local provider.(thanks @pseudon)

Thats all i remember for now since i can't acess a desktop only firefox for android if anyone knows more to add to list feel free to edit/comment

  • If using SOCKS proxies (as you might with VMs), set network.proxy.socks_remote_dns (in about:config) to true to force Firefox to make DNS requests through the proxy. Otherwise you can leak DNS requests to your local provider. – pseudon Jan 27 '15 at 19:13
  • Tighten up the about:config setting for network.http.sendRefererHeader to your liking (set to "0", or at worst to "1") kb.mozillazine.org/Network.http.sendRefererHeader (or use a referer control add-on for more granularity). – pseudon Jan 27 '15 at 19:16
  • Thanks @pseudon i've added the list with even a few more tweaks i found – Freedo Jan 27 '15 at 23:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.