diff options
Diffstat (limited to 'guides/harden-firefox')
| -rw-r--r-- | guides/harden-firefox/index.html | 222 |
1 files changed, 222 insertions, 0 deletions
diff --git a/guides/harden-firefox/index.html b/guides/harden-firefox/index.html new file mode 100644 index 0000000..642e794 --- /dev/null +++ b/guides/harden-firefox/index.html @@ -0,0 +1,222 @@ +<!DOCTYPE html> +<html lang="en"> + + <head><title>Firefox – dd</title> + + +<meta name="viewport" content="width=device-width, initial-scale=1"> +<meta charset="UTF-8"> +<meta name="robots" content="index, follow"> +<meta name="description" content="Minimal and personal website about GNU/Linux guides and other stuff"> +<meta name="keywords" content="linux, hosting, guides, tech, blog, networking, memes"> +<meta name="author" content="mb"> + + +<link rel="shortcut icon" href="/images/favicon.ico"> + + +<link rel="stylesheet" href="https://drainerdomain.xyz/css/dark.css"> +</head> + <body> + <div class="page"> + <section> + <a class="home" href="/index.html">← Back to home</a> + <header class="content__header"> + <h1>>Firefox_</h1> + <hr> + </header> + <div class="content__body"> + <p>A guide and explanation for making Firefox more secure/private using <code>arkenfox user.js</code> and some essential addons. This is a compilation from +various sources that are linked at the bottom of this article, and from my useless and extensive attempt for having a useful yet ‘privacy-oriented’ +and ‘secure browser’, things that are mutually exclusive. Still, this guide will leave the user with a better than nothing tool to navigate the net.</p> +<h2 id="a-little-test-before">A little test before</h2> +<p>You should check your browser against fingerprinting just so you can compare after. For that use this website: <a href="https://deviceinfo.me">deviceinfo.me</a>. +This is all the data that first-party and third-party sites get from you, but we will minimize it. Keep in mind that some information won’t be concealed, +such as your IP or location. Please do the test again after you finish.</p> +<h2 id="arkenfox-userjs">arkenfox user.js</h2> +<ul> +<li><a href="https://github.com/arkenfox/user.js/">LINK</a></li> +</ul> +<p>This tool is just a user config template that interacts with the inner functions of Firefox. It is highly recommended that you read the <a href="https://github.com/arkenfox/user.js/wiki">wiki</a> +so you can customize it. Otherwise, with just downloading the file and making the browser use it would be more than enough in most cases. So for that:</p> +<pre tabindex="0"><code>firefox -no-remote -CreateProfile <userprofile> +</code></pre><p>That will create a user directory under <code>$HOME/.mozilla/firefox/</code> that contains the string <code><userprofile></code> at the end of it. +Now delete its content, download <code>arkenfox user.js</code> and activate the profile:</p> +<pre tabindex="0"><code>cd $HOME/.mozilla/firefox/<userprofile>/ && rm times.json +wget https://raw.githubusercontent.com/arkenfox/user.js/master/user.js +firefox -P <userprofile> +</code></pre><p>Note: <code>firefox -P <userprofile></code> where <code><userprofile></code> is just the string you used to create the profile (not the random numbers from the directory)</p> +<p>Check <code>/usr/lib/firefox/</code> for these plugins (some may not be included) and delete them:</p> +<ul> +<li>firefox@getpocket.com.xpi</li> +<li>followonsearch@mozilla.com.xpi</li> +<li>activity-stream@mozilla.org.xpi</li> +<li>screenshots@mozilla.org.xpi</li> +<li>onboarding@mozilla.org.xpi</li> +<li>formautofill@mozilla.org.xpi</li> +<li>webcompat@mozilla.org.xpi</li> +</ul> +<p>Those are the basics, as I said read the extense wiki for customizing the template.</p> +<p>Note: notice that the content of the explorer have borders. That is a letterboxing option that strengthens against fingerprinting. +If it bothers you, edit your <code>user.js</code> and search for <code>user_pref("privacy.resistFingerprinting.letterboxing", true);</code>. Then replace +<code>true</code> with <code>false</code>.</p> +<p>Now start firefox we are going to install some addons.</p> +<h2 id="umatrix">uMatrix</h2> +<ul> +<li><a href="https://addons.mozilla.org/en-US/firefox/addon/umatrix/">LINK</a></li> +</ul> +<p>The superior blocker. If configured properly, it will restrict any malicious site you may misstakenly enter to and block any pop up window or annoying ad, guaranteed. +Other extensions or even the built-in anti ad options of for example, Brave Browser, are useless and do not work properly.</p> +<p>This extension gives you a per site list that shows first and third party domains that you are establishing a connection to. If you click on the extension icon and look at the grid, +you will notice 8 elements. These are simply the reason why this addon is superior to others. It will block ANYTHING because it doesn’t block per domain. In other words and as an example, +if you deny <code>script</code>, it will block JavaScript in every site you visit. Inferior extensions have a gigantic database of domains to work with, so if a domain is missing it is impossible for +it to block its elements.</p> +<p>First, go to uMatrix’s configuration panel and open the <code>Settings</code> tab. Copy this:</p> +<img src="/images/umatrix-01.webp" width="100%" height="auto" alt="settings"> +<p>I recommend you use <code>Domain</code> as an option to <code>Default scope level</code> so you can create more flexible rules such as the one from the example that comes later in the guide. +Cookies are trapped locally by uMatrix. This allows you to inspect the contents of it and blocks the sender from getting it back. Turn on the option and set +a timer for deleting non-blocked cookies if you want.</p> +<p>Moving on, lets generate some rules. Go to uMatrix’s panel and then to <code>My Rules</code>. Observing, you can see two sections: left is for permanent rules and right is for temporary rules. For editing a rule in, +type in the right section, then save it and click commit. Rules consist of 4 parts (<code>*</code> is a wildcard, which means any):</p> +<pre tabindex="0"><code>* * * allow/deny +| | | +| | |______ Element +| |________ Domain +|__________ Scope +</code></pre><p>So for a start, consider adding these strong rules:</p> +<pre tabindex="0"><code>* * * block +* * css allow +* * image allow +</code></pre><p>The first line blocks ANYTHING on any scope and domain. Then the second and third overrides first and allows css and image on ANY scope and domain. Pretty easy. +This is a good start for then tweaking and adding more rules.</p> +<p>Say you want to log in to a site you frequent. This site will need cookies allowed, and maybe needs a script to run a captcha from a third-party domain like google. +Such rule would look like this:</p> +<pre tabindex="0"><code>* ineedcookies.com cookie allow +ineedcookies.com googlecaptcha.com script allow +</code></pre><p>This will allow the google’s domain only in the site requesting for a login, which is desirable. This is pretty much it, if you are not looking for a strong blocking ruleset, you can +use uBlock Origin which is from the same creator, or search the <a href="https://github.com/gorhill/uMatrix/wiki">wiki</a> for a more suitable example.</p> +<h2 id="decentraleyes">Decentraleyes</h2> +<ul> +<li><a href="https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/">LINK</a></li> +</ul> +<p>This one is a content blocker that will deny, in the majority of cases, third party domains from trying to deliver something you don’t need. You could say, ‘but isn’t that already done by +uMatrix?’, and you are honestly right. The thing is that uMatrix breaks everything it touches. While adding Decentraleyes on top of it, you could still mantain some aspects of the sites you are visiting. +Decentraleyes stores content locally so you can still make use of it without the sender getting a response. On the other hand, uMatrix will prevent Decentraleyes from doing so if it is hardblocking content. +To avoid that from happening, you need to create some extra rules in uMatrix that allow traffic to some convenient domains.</p> +<p>These are the rules:</p> +<pre tabindex="0"><code>* ajax.aspnetcdn.com * allow +* ajax.googleapis.com * allow +* ajax.microsoft.com * allow +* cdn.jsdelivr.net * allow +* cdnjs.cloudflare.com * allow +* code.jquery.com * allow +* lib.sinaapp.com * allow +* libs.baidu.com * allow +* upcdn.b0.upaiyun * allow +* yandex.st * allow +* yastatic.net * allow +</code></pre><p>More rules could and should be added as long as you keep using the extensions.</p> +<h2 id="privacy-redirect">Privacy Redirect</h2> +<ul> +<li><a href="https://addons.mozilla.org/en-US/firefox/addon/privacy-redirect/">LINK</a></li> +</ul> +<p>This one is a redirector for the most famous and used sites such as Twitter, Reddit or Youtube. Simply click on the icon and turn on/off which service you want to redirect to its respective frontend. +Frontends are very useful at times when you can’t view content that is age restricted or simply because you are not logged in, not to mention that you also skip the annoying pop up windows +from shitsites like Twitter. This shouldn’t be a problem since you are running uMatrix now, but it is good to know. Also, using a frontend like Invidious for Youtube, allows for navigation +with no ads, no tracking (doesn’t log your IP) and without JS enabled.</p> +<p>Here is a quote from Nitter’s about section (logic applies to the other frontends):</p> +<blockquote> +<p>It’s impossible to use Twitter without JavaScript enabled. For privacy-minded folks, preventing JavaScript analytics and IP-based tracking is important, but apart from using a VPN and uBlock/uMatrix, it’s impossible. Despite being behind a VPN and using heavy-duty adblockers, you can get accurately tracked with your browser’s fingerprint, no JavaScript required. This all became particularly important after Twitter removed the ability for users to control whether their data gets sent to advertisers. +Using an instance of Nitter (hosted on a VPS for example), you can browse Twitter without JavaScript while retaining your privacy. In addition to respecting your privacy, Nitter is on average around 15 times lighter than Twitter, and in most cases serves pages faster (eg. timelines load 2-4x faster). +In the future a simple account system will be added that lets you follow Twitter users, allowing you to have a clean chronological timeline without needing a Twitter account.</p> +</blockquote> +<p>This is the list of sites that the extension allows to redirect:</p> +<ul> +<li>Twitter → Nitter</li> +<li>Youtube → Invidious</li> +<li>Instagram → Bibliogram</li> +<li>Reddit → Libreddit or old version</li> +<li>Google Translate → Simply Translate</li> +<li>Wikipedia → Wikiless</li> +<li>Google Maps → OpenStreetMaps</li> +<li>Search Engine → custom</li> +</ul> +<p>I recommend you go to the general options, where you can set the instance of the frontend you want to use.</p> +<p>We are done. Remember to run the test again and compare to see the results.</p> +<h3 id="not-privacysecurity-related-addons">Not privacy/security related addons</h3> +<ul> +<li>Stylus: custom/community generated css with one click</li> +<li>ff2mpv: forward links to mpv (useful for when you break js/xhr/frame on sites that have videos)</li> +<li>Vimium-FF: vimlike bindings</li> +</ul> +<h3 id="links">Links</h3> +<ul> +<li><a href="https://digdeeper.neocities.org/">digdeeper</a></li> +<li><a href="https://spyware.neocities.org/">spyware watchdog</a></li> +<li><a href="https://github.com/arkenfox/user.js/wiki">arkenfox user.js wiki</a></li> +<li><a href="hhttps://github.com/gorhill/uMatrix/wiki">uMatrix wiki</a></li> +</ul> + + </div> + + </section> + </div> + <footer class="page__footer"><ul class="buttons"> + + <li> + <a href="https://drainerdomain.xyz"><img src="/buttons/drainerdomain2.gif" alt="drainerdomain"></a> + </li> + + <li> + <a href="https://landchad.net"><img src="/buttons/landchad.gif" alt="LandChud"></a> + </li> + + <li> + <a href="https://tomfasano.net"><img src="/buttons/tomfasano.gif" alt="Tom Fasano"></a> + </li> + + <li> + <a href="https://neovim.io"><img src="/buttons/neovim.gif" alt="neovim"></a> + </li> + + <li> + <a href="https://gohugo.io"><img src="/buttons/hugo.gif" alt="neovim"></a> + </li> + + <li> + <a href="https://wiby.org"><img src="/buttons/wiby.gif" alt="wiby"></a> + </li> + + <li> + <a href="https://gnu.org"><img src="/buttons/gnu-linux.png" alt="gnu"></a> + </li> + + <li> + <a href="https://stephenvk.xyz"><img src="/buttons/stephenvk.gif" alt="stephenvk"></a> + </li> + + <li> + <a href="https://canoemail.net"><img src="/buttons/canoemail.gif" alt="canoemail services"></a> + </li> + + <li> + <a href="https://heaventreey.xyz"><img src="/buttons/heaventree.gif" alt="heaventree webring"></a> + </li> + + <li> + <a href="https://spyware.neocities.org"><img src="/buttons/spywaredotneocities.png" alt="spywarewatchdog"></a> + </li> + + <li> + <a href="https://getmonero.org"><img src="/buttons/getmonero.gif" alt="Get Monero"></a> + </li> + + <li> + <a href="https://digdeeper.neocities.org"><img src="/buttons/digdeeper.png" alt="Digdeeper"></a> + </li> + +</ul> +</footer> + </body> + +</html> |