The Web can be a hostile place, full of deceptive and malicious sites trying to install software on your computer or steal your personal information. However, you have a friend on your side: your user agent (also called your web browser). This talk will examine some of the hidden or advanced settings and extensions that Firefox offers to users who are concerned about their security and privacy. While we at Mozilla strive to bring these features to all of our users, the reality is that it's sometimes challenging to balance the need for maximum web compatibility and standards compliance with the desire to phase out harmful practices. With a little bit of context on the benefits and risks that some of these features provide, you should be able to make informed decisions and tweak your favorite user agent. https://osem.seagl.org/conference/seagl2016/program/proposal/188

1. Hardening Firefox
for Privacy & Security
François Marier <francois@mozilla.com>

5. enable
disable
restrict

6. enable
disable
restrict

8. eliminating all fingerprinting

9. eliminating all fingerprinting

10. eliminating all traffic to Mozilla

11. eliminating all traffic to Mozilla
support.mozilla.org/kb/how-stop-firefox-making-automatic-connections

12. eliminating all traffic to Mozilla
●
auto-updates

13. eliminating all traffic to Mozilla
●
auto-updates
●
add-on blocklist

14. eliminating all traffic to Mozilla
●
telemetry

15. eliminating all traffic to Mozilla
●
telemetry
wiki.mozilla.org/Firefox/Data_Collection

16. disabling features with big perf impact
●
prefetching
●
speculative connections

17. disabling useful features
●
WebGL
●
WebRTC
●
DOM Storage

18. disabling features that:
●
disabled by default
●
prompt you first

19. features to enable

21. privacy.trackingprotection.enabled

23. feeding.cloud.geek.nz/posts/how-tracking-protection-works-in-firefox

24. Do Not Track

25. privacy.donottrackheader.enabled

26. privacy.donottrackheader.enabled

27. features to disable

29. media.eme.enabled

34. device.sensors.enabled

36. BatteryManagery {
charging: false,
chargingTime: Infinity,
dischargingTime: 8940,
level: 0.59,
onchargingchange: null,
onchargingtimechange: null,
ondischargingtimechange: null,
onlevelchange: null
}

37. BatteryManagery {
charging: false,
chargingTime: Infinity,
dischargingTime: 8940,
level: 0.59,
onchargingchange: null,
onchargingtimechange: null,
ondischargingtimechange: null,
onlevelchange: null
}

38. BatteryManagery {
charging: false,
chargingTime: Infinity,
dischargingTime: 8940,
level: 0.59,
onchargingchange: null,
onchargingtimechange: null,
ondischargingtimechange: null,
onlevelchange: null
}

39. dom.battery.enabled

40. removed
in 52
dom.battery.enabled

41. www.fsf.org
www.eff.org

42. www.fsf.org
www.eff.org
www.netflix.com
store.steampowered.com

43. layout.css.visited_links_enabled

45. Simple Service
Discovery Protocol

46. browser.casting.enabled

48. pdfjs.disabled

49. network information

50. navigator.connection.type;

51. navigator.connection.type;
bluetooth, cellular, ethernet, none,
wifi, wimax, other, mixed, unknown

52. navigator.connection.type;
bluetooth, cellular, ethernet, none,
wifi, wimax, other, mixed, unknown
navigator.connection.downlinkMax;

53. dom.netinfo.enabled

54. media.video_stats.enabled

55. webgl.enable-debug-renderer-info

56. dom.enable_performance

57. features to restrict

59. network.cookie.cookieBehavior = 0
network.cookie.thirdparty.sessionOnly = true
privacy.clearOnShutdown.cookies = false
network.cookie.lifetimePolicy = 3
network.cookie.lifetime.days = 5
feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox

61. network.http.referer.XoriginPolicy = 1

62. network.http.referer.XoriginPolicy = 1
network.http.referer.XOriginTrimmingPolicy = 2
feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox
new
in 52

67. pre-downloaded lists
of URL hash prefixes

68. feeding.cloud.geek.nz/

69. 5b31c2702efc7c81e4d197cd80113396
54da10d3315636cccbb536e868ff82a6

70. 5b31c2702efc7c81e4d197cd80113396
54da10d3315636cccbb536e868ff82a6

71. 5b31c2702efc7c81e4d197cd80113396
54da10d3315636cccbb536e868ff82a6
feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox

73. .exe
.com
.bat
.apk
.dmg
.pl
.py
.sh
.deb
.rpm

74. .exe
.com
.bat
.apk
.dmg
.pl
.py
.sh
.deb
.rpm
toolkit/components/downloads/ApplicationReputation.cpp

75. filename and size
URLs
hash of contents
locale
toolkit/components/downloads/ApplicationReputation.cpp

77. browser.safebrowsing.downloads.remote.enabled
feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox

81. revealing non-VPN IP address
leaking internal IP address

82. revealing non-VPN IP address
leaking internal IP address
fixed
in 51

83. media.peerconnection.ice.default_address_only = true
50 or earlier:

84. media.peerconnection.ice.no_host = true
51 or later:
media.peerconnection.ice.default_address_only = true
50 or earlier:

85. other things to
keep in mind

86. p@ssW0rd5

96. user_pref("privacy.trackingprotection.enabled",true);
user_pref("privacy.donottrackheader.enabled", true);
user_pref("device.sensors.enabled", false);
user_pref("media.eme.enabled", false);
user_pref("pdfjs.disabled", true);
user_pref("browser.casting.enabled", false);
user_pref("layout.css.visited_links_enabled", false);
user_pref("dom.battery.enabled", false); // Fx < 52
user_pref("dom.netinfo.enabled", false);
user_pref("media.video_stats.enabled", false);
user_pref("dom.enable_performance", false);
user_pref("webgl.enable-debug-renderer-info", false);
user_pref("media.peerconnection.ice.default_address_only", true); // Fx < 51
user_pref("media.peerconnection.ice.no_host", true); // Fx >= 51
user_pref("security.pki.sha1_enforcement_level", 2); // Fx < 52
user_pref("network.http.referer.XOriginPolicy", 1);
user_pref("privacy.clearOnShutdown.cookies", false);
user_pref("network.cookie.cookieBehavior", 0);
user_pref("network.cookie.lifetimePolicy", 3);
user_pref("network.cookie.lifetime.days", 5);
user_pref("network.cookie.thirdparty.sessionOnly", true);
user_pref("browser.urlbar.trimURLs", false);
?
@fmarier

97. Photo Credits:
shooting star: https://www.flickr.com/photos/funcrush/9496927983/
yellow triangle: https://www.flickr.com/photos/tillwe/2974932670/
jail cell: https://www.flickr.com/photos/mikecogh/5997920696
speedbump: https://www.flickr.com/photos/jputnam/9078451876/
cookie: https://www.flickr.com/photos/amagill/34754258/
chromecast: https://www.flickr.com/photos/medithit/10165535814/