There are several actions you can take in order to secure Firefox, how far you chose to go is of course up to you.
You can make some modifications in the Firefox preferences menu:
- "when Firefox starts"->"Show a blank page"
- "save files to:"Downloads"
- check:"Block pop-up windows"
- "Languages"->choose only:"en-us"
- "Applications"->choose:"Always ask" for every application
- check:"Warn me when sites try
to install add-ons"
- check:"Block reported attack sites"
- check:"Block reported web forgeries"
- "Passwords"->uncheck:"Remember passwords for sites"
- "Passwords"->uncheck:"Use a master password"
- "General"->"System Defaults"->uncheck:"Submit crash
- "General"->"System Defaults"->uncheck:"Submit
- "Update"->check:"Automatically install
- "Update"->check:"Warn me if this will disable
any of my add-ons"
- "Update"->check:"Automatically update
- "Encryption"->"Protocols"->check:"Use SSL
- "Encryption"->"Protocols"->check:"Use TLS 1.0"
- "Encryption"->"Certificates"->"When a server requests my
personal certificate"->check:"Ask me every time"
Empty Cache Button [optional]
Calomel SSL Validation [cool little addon which does exactly what its name says and also has some more tweaks in the settings]
Fanboy's Tracking List
Fanboy's Annoyance List
Cookie Monster [Allows you to Manage your Cookie-Policies. For less baggage use Firefox/Iceweasel "Preferences" -> "Privacy"]
HTTPS-Everywhere [Download via EFF.org] [settings: enable SSL-Observatory but don't allow to transmit ISP-data]
NoScript [go to "settings" and check "also apply on whitelisted sites"]
Perspectives [SSL-Cerfiticate-Control - go to settings: "notary servers" -> check "only contact when websites cause security error"]
RefControl [controls your HTTP-Referers - setting: "block" -> "3rd parties only"]
Request Policy [rejects cross-site requests]
WOT [Web of Trust - user based website ratings that show up in websearches. Caution: Not very accurate. Always double check when in doubt. This addon tends
to get abused by different groups of users who either give malicious sites good ratings - or flag perfectly good sites.]
PwdHash [Nice addon to help your password management. Use "F2" when entering a password into a password field when setting up a new account somewhere to create a MD5-hash using your password and the domain. (When logging in you have to select the password-field and press F2 again to run the hashing.) This way you can use the same password on different sites without having to worry about security implications - because every site gets its own password generated through the hash. The tool is provided by Standford University and can be trusted. No data is actually transmitted to their servers. The hash is generated using your local java-script. If you need to login from a machine that doesn't have pwdhash installed: go to https://www.pwdhash.com/ -> their SSL is very strong.]
FoxyProxy [a convenient Proxy Switcher]
Useragent Switcher [Does exactly that. But be careful: If you set your user-agent as shown below - using this addon it will overwrite these settings and will not automatically restore them if you turn off the switcher. So you would have to manually reconfigure about:config again. Which sucks. But you can get a whole load really cool user agents here. Simply download the .xml and import it to the Useragent Switcher. There are really neat current agents in there: e.g. all kinds of different web browser for all OSs and of course various bots. Google bot comes in handy when you need access to some forum... wink]
Web Developer [Has some cool features. If you like inspecting websites just check it out.]
Bloody Vikings [Creates disposable mail-addresses]
Note: You don't need Ghostery. The above mentioned Adblock lists do a much better job protecting you from web-tracking without using the additional resourced Ghostery uses.
Of course there are more addons you could use. But I don't really see the point of them. Most of them either are snake-oil or even dangerous.
To keep your ISP and possible MITM-attackers from reading what you do on the web always use SSL - as far as it is available. To help with this use:
The user "SSL Search Bar" has provided easily installable SSL-searchbar-plugins
You get SSL-plugins for all the alternative search-engines like ixquick, duckduckgo etc. there. Install those you happen to use.
Privatelee also looks promising. But I haven't tried it out extensively.
The next thing to do is to change macromedias flash-settings:
And fight yourself through their nasty settings-manager. Set everything to "0" or "never allow"/"never ask again" and
delete all stored website-content. Give special attention to the webcam and Mic settings
You might as well set the permissions of your .macromedia folder to read only - but that's kind of unnecessary because you want to make sure to edit the options mentioned above - to make sure that you don't allow websites to use your mic or webcam I actually take this one step further by disabling them in BIOS.
You can also go one step further and run Firefox in a sandbox such as Sandboxie.
Just a general idea of the things you can do that will help secure your browser.