diff --git a/.gitignore b/.gitignore index af1e890..19b6be6 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,5 @@ __pycache__ /wasi-sdk /scripts/env_local.sh .DS_Store +/patches/preferences/phoenix.js +/patches/preferences/phoenix-extended.js diff --git a/patches/preferences/phoenix-extended.js b/patches/preferences/phoenix-extended.js deleted file mode 100644 index 0a48b57..0000000 --- a/patches/preferences/phoenix-extended.js +++ /dev/null @@ -1,95 +0,0 @@ - -// - -// -// Copyright (C) 2024-2025 celenity -// -// This file is part of Phoenix. -// -// Phoenix is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. -// -// Phoenix is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along with Phoenix. If not, see https://www.gnu.org/licenses/. -// - -// This file contains preferences shared across Phoenix 'Extended' configs. - -/* INDEX - -001: FINGERPRINTING PROTECTION -002: WEBRTC -003: ATTACK SURFACE REDUCTION -004: MISC. PRIVACY + SECURITY (ANDROID ONLY) -005: MISC. PRIVACY - -*/ - -/* KEY - -Unspecified = This preference should be set EVERYWHERE - -[ANDROID-ONLY] = This preference should ONLY be set for Android - -[NO-LINUX] = This preference should be set everywhere, EXCEPT for GNU/Linux -[NO-MAIL] = This preference should be set everywhere, EXCEPT for Thunderbird (Used for ex. Dove) -[NO-OSX] = This preference should be set everywhere, EXCEPT for macOS -[NO-WINDOWS] = This preference should be set everywhere, EXCEPT for Windows - -*/ - - -/*** 001 FINGERPRINTING PROTECTION ***/ - - -/// Further harden FPP... -// As explained here: https://codeberg.org/celenity/Phoenix/wiki/Extended#fingerprinting -// Compared to standard, this just removes '-JSDateTimeUTC' - meaning timezone is spoofed to UTC-0 -pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-CanvasExtractionBeforeUserInputIsBlocked,-CSSPrefersColorScheme,-FrameRate,-CanvasImageExtractionPrompt"); // [ANDROID-ONLY] -pref("browser.phoenix.status.extended", "001"); - -/*** 002 WEBRTC ***/ -// This will likely break WebRTC... - -/// Always exclude local IP addresses, even in trusted scenarios -pref("media.peerconnection.ice.no_host", true); - -/// Force a single candidate for ICE generation -pref("media.peerconnection.ice.default_address_only", true); - -/// Only use TURN servers/relays -// No P2P -// https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/issues/40#note_2884663 -pref("media.peerconnection.ice.relay_only", true); - -pref("browser.phoenix.status.extended", "002"); - -/*** 003 ATTACK SURFACE REDUCTION ***/ - -/// Disable WebAssembly (WASM) -// https://spectrum.ieee.org/more-worries-over-the-security-of-web-assembly -pref("javascript.options.wasm", false); - -pref("browser.phoenix.status.extended", "003"); - -/*** 004 MISC. PRIVACY + SECURITY ***/ - -/// Disable WebGL [ANDROID-ONLY] -// PRIVACY: Fingerprinting concerns [ANDROID-ONLY] -// SECURITY: Attack Surface Reduction [ANDROID-ONLY] -// https://blog.browserscan.net/docs/webgl-fingerprinting [ANDROID-ONLY] -// https://security.stackexchange.com/questions/13799/is-webgl-a-security-concern [ANDROID-ONLY] -// On desktop we're no longer setting/recommending this in favor of the built-in `Block WebGL` filterlist in uBlock Origin, but on Android, we can't necessarily control uBlock Origin/set policies, so let's just make sure this is disabled. [ANDROID-ONLY] -pref("webgl.disabled", true); // [ANDROID-ONLY] - -pref("browser.phoenix.status.extended", "004"); - -/*** 005 MISC. PRIVACY ***/ - -/// Only send cross-origin referers if hosts match -// https://wiki.mozilla.org/Security/Referrer -pref("network.http.referer.XOriginPolicy", 2); - -pref("browser.phoenix.status.extended", "005"); - -pref("browser.phoenix.status.extended", "successfully applied :D", locked); diff --git a/patches/preferences/phoenix.js b/patches/preferences/phoenix.js deleted file mode 100644 index 19297a2..0000000 --- a/patches/preferences/phoenix.js +++ /dev/null @@ -1,2850 +0,0 @@ -// -// The Phoenix shall rise from the ashes of what fell before it. - -// -// Copyright (C) 2024-2025 celenity -// -// This file is part of Phoenix. -// -// Phoenix is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. -// -// Phoenix is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. -// -// You should have received a copy of the GNU General Public License along with Phoenix. If not, see https://www.gnu.org/licenses/. -// - -// Welcome to the heart of the Phoenix. -// This file contains preferences shared across all Phoenix configs, platforms (Desktop & Android), and Dove. - -pref("browser.phoenix.version", "2025.06.24.1", locked); - -/* INDEX - -000: ABOUT:CONFIG -001: DATA COLLECTION -002: MOZILLA CRAP™ -003: TRACKING PROTECTION -004: FINGERPRINTING PROTECTION -005: DISK AVOIDANCE -006: DOWNLOADS -007: HTTP(S) -008: IMPLICIT CONNECTIONS -009: SEARCH & URL BAR -010: DNS -011: PROXIES -012: WEBRTC -013: MEDIA -014: ATTACK SURFACE REDUCTION -015: PASSWORDS & AUTHENTICATION -016: EXTENSIONS -017: AI -018: GEOLOCATION -019: PDF.js -020: SAFE BROWSING -021: MISC. PRIVACY + SECURITY -022: MISC. PRIVACY -023: MISC. SECURITY -024: MISC. -025: DEBUGGING -026: PERFORMANCE -027: Personal Touch 💜 -028: UPDATES -029: FIREFOX HOME (DESKTOP ONLY) -030: FIREFOX SUGGEST (DESKTOP ONLY) -031: SYNC (DESKTOP ONLY) -032: LIBREWOLF (DESKTOP ONLY) -033: SPECIALIZED/CUSTOM CONFIGS (DESKTOP ONLY) - -*/ - -/* KEY - -Unspecified = This preference should be set EVERYWHERE - -[ANDROID-ONLY] = This preference should ONLY be set for Android - -[NO-LINUX] = This preference should be set everywhere, EXCEPT for GNU/Linux -[NO-MAIL] = This preference should be set everywhere, EXCEPT for Thunderbird (Useful for ex. Dove) -[NO-OSX] = This preference should be set everywhere, EXCEPT for macOS -[NO-WINDOWS] = This preference should be set everywhere, EXCEPT for Windows - -*/ - - -/*** 000 ABOUT:CONFIG ***/ - -/// Disable annoying warnings when attempting to access the `about:config` -pref("general.warnOnAboutConfig", false); - -/// Ensure that the `about:config` is always enabled -pref("general.aboutConfig.enable", true, locked); // [DEFAULT - non-Android] - -/// Ensure our policies aren't overriden... -// https://searchfox.org/mozilla-central/source/toolkit/components/enterprisepolicies/EnterprisePoliciesParent.sys.mjs -pref("toolkit.policies.perUserDir", false, locked); // [HIDDEN] [DEFAULT] - -pref("browser.phoenix.status", "000"); - -/*** 001 DATA COLLECTION ***/ - -// A lot of defense in depth... -// These also provide Attack Surface Reduction - -/// Block domains -// Any domains listed here are redirected to `127.0.0.1` -// We'll use this primarily for Mozilla ad/telemetry domains, but we'll also use it for ads & trackers that appear on Mozilla properties and services, as well as ad/tracking/telemetry domains that appear on other default connections/services -// Ex. We use DuckDuckGo as our default search engine, so we'll nclude their analytics domains -// On IronFox, we link to our GitLab releases via the `What's New` alert, so we'll also cover their analytics domains, etc... -// But generally we'll want to keep this limited in favor of ex. uBlock Origin & other mechanisms. -pref("network.dns.localDomains", "250analytics.com,a.omappapi.com,activity-stream-icons.services.mozilla.com,ads.allizom.org,ads.mozilla.org,ads.nonprod.webservices.mozgcp.net,ads.prod.webservices.mozgcp.net,ads-img.mozilla.org,analytics.getpocket.com,analytics.google.com,analytics.withgoogle.com,anf1.fuzzing.mozilla.org,anonymco.com,api.divviup.org,asan-nightly-frontend-elb-1348905149.us-east-2.elb.amazonaws.com,braze.com,contile.services.mozilla.com,contile-images.services.mozilla.com,classify-client.nonprod.webservices.mozgcp.net,classify-client.prod.webservices.mozgcp.net,classify-client.services.mozilla.com,crash-reports.allizom.org,crash-reports.mozilla.com,crash-reports-xpsp2.mozilla.com,crash-stacks.mozilla.com,crash-stats.allizom.org,crash-stats.mozilla.com,crash-stats.mozilla.org,dap.services.mozilla.com,dap.nonprod.webservices.mozgcp.net,dap.prod.webservices.mozgcp.net,dap-09-3.api.divviup.org,data.mozilla.com,data-ingestion.prod.dataops.mozgcp.net,dataops.mozgcp.net,dataservices.mozgcp.net,discovery.addons.allizom.org,discovery.addons.mozilla.org,discovery.addons-dev.allizom.org,divviup.org,download-stats.mozilla.org,download-stats.r53-2.services.mozilla.com,experimenter.services.mozilla.com,experimenter.nonprod.webservices.mozgcp.net,experimenter.prod.webservices.mozgcp.net,fhr.data.mozilla.com,fhr.r53-2.services.mozilla.com,firefox-android-home-recommendations.getpocket.com,firefox-dns-perf-test.net,fuzzing.mozilla.org,google-analytics.com,google-analytics-cn.com,googleanalytics.com,googlesyndication.com,googlesyndication-cn.com,googletagmanager.com,googletagmanager-cn.com,googletagservices.com,googletagservices-cn.com,improving.duckduckgo.com,incoming.telemetry.mozilla.org,incoming.thunderbird.net,incoming-telemetry.thunderbird.net,ingestion-edge.prod.dataops.mozgcp.net,location.services.mozilla.com,locprod1-elb-eu-west-1.prod.mozaws.net,locprod2-elb-us-west-2.prod.mozaws.net,metrics-content.duckduckgo.com,new-sentry.gitlab.net,nonprod.classify-client.nonprod.webservices.mozgcp.net,normandy.cdn.mozilla.net,normandy.nonprod.cloudops.mozgcp.net,normandy.prod.cloudops.mozgcp.net,normandy-cdn.services.mozilla.com,omappapi.com,pagead2.googlesyndication.com,pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com,prod.ads.prod.webservices.mozgcp.net,prod.classify-client.prod.webservices.mozgcp.net,prod.dap.prod.webservices.mozgcp.net,prod.data-ingestion.prod.dataops.mozgcp.net,prod.dataops.mozgcp.net,prod.experimenter.prod.webservices.mozgcp.net,prod.ingestion-edge.prod.dataops.mozgcp.net,prod.sentry.prod.cloudops.mozgcp.net,prod-classifyclient.normandy.prod.cloudops.mozgcp.net,sdk.iad-05.braze.com,search.r53-2.services.mozilla.com,search.services.mozilla.com,self-repair.mozilla.org,self-repair.r53-2.services.mozilla.com,sentry.gitlab.net,sentry.io,sentry.nonprod.cloudops.mozgcp.net,sentry.prod.cloudops.mozgcp.net,sentry.prod.mozaws.net,sitereview.zscaler.com,snippets.allizom.org,snippets.cdn.mozilla.net,snippets.mozilla.com,snippets-prod.frankfurt.moz.works,snippets-prod.moz.works,snippets-prod.oregon-b.moz.works,snippets-stage.moz.works,snippets-stage.oregon-b.moz.works,snowplow.trx.gitlab.net,snowplowalb-1011729428.us-east-1.elb.amazonaws.com,snowplowprd.trx.gitlab.net,snowplowprdnlb-1490493263.us-east-2.elb.amazonaws.com,socorro.nonprod.webservices.mozgcp.net,socorro.prod.webservices.mozgcp.net,socorro-collector.services.mozilla.com,socorro-webapp-allizom.stage.mozaws.net,socorro-webapp.services.mozilla.com,spocs.getpocket.com,spocs.getpocket.dev,spocs.mozilla.net,ssl.google-analytics.com,ssl-google-analytics.l.google.com,stage.sentry.nonprod.cloudops.mozgcp.net,start.fedoraproject.org,start.thunderbird.net,start.ubuntu.com,start-stage.thunderbird.net,survey.mozilla.com,tagmanager.google.com,talkback.mozilla.org,talkback-public.mozilla.org,talkback-reports.mozilla.org,telemetry-coverage.mozilla.org,telemetry-coverage.r53-2.services.mozilla.com,telemetry-experiment.cdn.mozilla.net,telemetry-incoming.r53-2.services.mozilla.com,telemetry-incoming-a.r53-2.services.mozilla.com,telemetry-incoming-b.r53-2.services.mozilla.com,telemetry-prod-1054754349.us-east-1.elb.amazonaws.com,tiles-cdn.prod.ads.prod.webservices.mozgcp.net,updates.thunderbird.net,updates-stage.thunderbird.net,use-application-dns.net,vf.startpage.com,widgets.getpocket.com,www.250analytics.com,www.anonymco.com,www.google-analytics.com,www.google-analytics-cn.com,www.googleanalytics.com,www.googlesyndication.com,www.googlesyndication-cn.com,www.googletagmanager.com,www.googletagmanager-cn.com,www.googletagservices.com,www.googletagservices-cn.com,www.sentry.io,www-google-analytics.l.google.com,www-googletagmanager.l.google.com"); - -/// Disable Browser Usage Telemetry metrics -// https://searchfox.org/mozilla-central/source/browser/docs/BrowserUsageTelemetry.rst -// https://searchfox.org/mozilla-central/source/browser/modules/BrowserUsageTelemetry.sys.mjs -// https://searchfox.org/mozilla-central/source/toolkit/content/widgets/tabbox.js -pref("browser.engagement.ctrlTab.has-used", true, locked); // [HIDDEN - Android/Thunderbird] - -/// Disable Coverage -// https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ -// https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/pings/CoveragePing.sys.mjs -// https://bugzilla.mozilla.org/show_bug.cgi?id=1487578 -pref("toolkit.coverage.enabled", false, locked); // [DEFAULT] [HIDDEN - Android/Thunderbird] -pref("toolkit.coverage.endpoint.base", "", locked); // [DEFAULT - Android/Thunderbird] [HIDDEN - Android/Thunderbird] -pref("toolkit.coverage.log-level", 70); // [HIDDEN] Limits logging to fatal only -pref("toolkit.coverage.opt-out", true, locked); // [HIDDEN] -pref("toolkit.telemetry.coverage.opt-out", true, locked); // [HIDDEN] - -/// Disable Crash Reporting -// https://github.com/mozilla-services/socorro -// https://wiki.mozilla.org/Socorro -// https://firefox-source-docs.mozilla.org/tools/sanitizer/asan_nightly.html -// https://github.com/choller/firefox-asan-reporter -// https://searchfox.org/mozilla-central/source/toolkit/modules/AsanReporter.sys.mjs -pref("asanreporter.apiurl", "", locked); // [HIDDEN - non-MOZ_ASAN_REPORTER builds] [DEFAULT - non-MOZ_ASAN_REPORTER builds] -pref("asanreporter.clientid", "unknown", locked); // [HIDDEN - non-MOZ_ASAN_REPORTER builds] [DEFAULT] -pref("asanreporter.loglevel", 70); // [HIDDEN] -pref("breakpad.reportURL", "", locked); -pref("browser.crashReports.crashPull", false, locked); // [DEFAULT] Do not request crash reports for background processes from users https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/crash-reports-ondemand/changeset?_expected=0 -pref("browser.crashReports.requestedNeverShowAgain", true, locked); // Do not request crash reports for background processes from users https://searchfox.org/mozilla-central/source/toolkit/components/crashes/RemoteSettingsCrashPull.sys.mjs -pref("toolkit.crashreporter.include_context_heap", false, locked); // [DEFAULT - non-Nightly] - -/// Disable Data Reporting & Telemetry -/// We also configure "DisableTelemetry" & "ImproveSuggest" in policies on Desktop -// https://mozilla.github.io/policy-templates/#disabletelemetry -// https://mozilla.github.io/policy-templates/#firefoxsuggest -// https://wiki.mozilla.org/QA/Telemetry -// https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/internals/preferences.html -// https://searchfox.org/mozilla-release/source/toolkit/components/glean/xpcom/FOG.cpp -// https://searchfox.org/mozilla-release/source/toolkit/components/telemetry/app/TelemetryUtils.sys.mjs -// https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml -pref("browser.safebrowsing.features.emailtracking.datacollection.update", false, locked); // [HIDDEN] https://searchfox.org/mozilla-central/source/toolkit/components/url-classifier/SafeBrowsing.sys.mjs -pref("captchadetection.actor.enabled", false, locked); // Disable CAPTCHA Detection Pings https://searchfox.org/mozilla-central/source/toolkit/components/captchadetection -pref("captchadetection.hasUnsubmittedData", false, locked); // [HIDDEN] Disable CAPTCHA Detection Pings https://searchfox.org/mozilla-central/source/toolkit/components/captchadetection/CaptchaDetectionPingUtils.sys.mjs -pref("captchadetection.loglevel", "Off"); -pref("datareporting.dau.cachedUsageProfileID", "beefbeef-beef-beef-beef-beeefbeefbee", locked); // [HIDDEN] https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/app/ClientID.sys.mjs#44 -pref("datareporting.dau.cachedUsageProfileGroupID", "b0bacafe-b0ba-cafe-b0ba-cafeb0bacafe", locked); // [HIDDEN] https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/app/ClientID.sys.mjs#44 -pref("datareporting.healthreport.uploadEnabled", false, locked); // [DEFAULT - Android] Required for Firefox Labs on Desktop -pref("datareporting.policy.dataSubmissionEnabled", false, locked); -pref("datareporting.policy.dataSubmissionPolicyBypassNotification", true, locked); // [DEFAULT - non-MOZILLA_OFFICIAL builds] -pref("datareporting.policy.firstRunURL", "", locked); -pref("datareporting.usage.uploadEnabled", false, locked); // [HIDDEN - ANDROID] [DEFAULT - Android] Disables "daily usage pings" https://support.mozilla.org/kb/usage-ping-settings -pref("dom.security.unexpected_system_load_telemetry_enabled", false, locked); // [DEFAULT - non-Nightly] -pref("extensions.dataCollectionPermissions.enabled", false, locked); // [NIGHTLY] [DEFAULT] https://searchfox.org/mozilla-central/source/toolkit/locales-preview/dataCollectionPermissions.ftl -pref("network.jar.record_failure_reason", false, locked); // [DEFAULT - non-Nightly] https://searchfox.org/mozilla-release/source/modules/libpref/init/StaticPrefList.yaml#14397 -pref("network.traffic_analyzer.enabled", false, locked); // https://searchfox.org/mozilla-release/source/modules/libpref/init/StaticPrefList.yaml#13191 -pref("network.trr.confirmation_telemetry_enabled", false, locked); -pref("nimbus.telemetry.targetingContextEnabled", false, locked); // [HIDDEN - ANDROID/THUNDERBIRD] [DEFAULT - Artifact builds] Targeting context telemetry - https://searchfox.org/mozilla-central/rev/f1e32fa7/browser/app/profile/firefox.js#2040 -pref("privacy.imageInputTelemetry.enableTestMode", false, locked); // [HIDDEN] "Event Telemetry" https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml#15549 -pref("privacy.trackingprotection.emailtracking.data_collection.enabled", false, locked); -pref("telemetry.fog.test.activity_limit", -1, locked); // Disable activity-based ping submission - ex. https://mozilla.github.io/glean/book/user/pings/baseline.html#scheduling -pref("telemetry.fog.test.inactivity_limit", -1, locked); // Disable inactivity-based ping submission - ex. https://mozilla.github.io/glean/book/user/pings/baseline.html#scheduling -pref("telemetry.fog.init_on_shutdown", false, locked); // Prevent Glean from initializing on shutdown https://searchfox.org/mozilla-central/source/toolkit/components/glean/docs/dev/preferences.md#49 -pref("telemetry.fog.test.localhost_port", 70000, locked); // Force telemetry pings to be sent to localhost instead of Mozilla's servers, if they're somehow enabled... (port just has to be higher than 0, I chose 70000 as its invalid) - https://searchfox.org/mozilla-central/source/toolkit/components/glean/docs/dev/preferences.md#15 -pref("telemetry.glean.internal.finalInactive", false, locked); // [HIDDEN] [DEFAULT] Disable early shutdown pings https://searchfox.org/mozilla-central/source/toolkit/components/glean/xpcom/FOG.cpp -pref("telemetry.glean.internal.maxPingsPerMinute", 0, locked); // [HIDDEN] Prevent Glean from sending pings https://searchfox.org/mozilla-central/source/toolkit/components/glean/xpcom/FOG.cpp -pref("telemetry.number_of_site_origin.min_interval", 999999999, locked); -pref("toolkit.content-background-hang-monitor.disabled", true, locked); // BHR https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml#16720 -pref("toolkit.telemetry.archive.enabled", false, locked); // [HIDDEN - Android] -pref("toolkit.telemetry.bhrPing.enabled", false, locked); // [HIDDEN - Android] -pref("toolkit.telemetry.cachedClientID", "c0ffeec0-ffee-c0ff-eec0-ffeec0ffeec0", locked); // [HIDDEN] -pref("toolkit.telemetry.cachedProfileGroupID", "decafdec-afde-cafd-ecaf-decafdecafde", locked); // [HIDDEN] -pref("toolkit.telemetry.collectInterval", 999999999, locked); // [HIDDEN] -pref("toolkit.telemetry.dap.helper.hpke", "", locked); -pref("toolkit.telemetry.dap.helper.url", "", locked); -pref("toolkit.telemetry.dap.leader.hpke", "", locked); -pref("toolkit.telemetry.dap.leader.url", "", locked); -pref("toolkit.telemetry.dap.logLevel", "Off"); -pref("toolkit.telemetry.dap_enabled", false, locked); // [DEFAULT] -pref("toolkit.telemetry.dap_task1_enabled", false, locked); // [DEFAULT] -pref("toolkit.telemetry.dap_task1_taskid", "", locked); // [DEFAULT] -pref("toolkit.telemetry.dap_visit_counting_enabled", false, locked); // [DEFAULT] -pref("toolkit.telemetry.dap_visit_counting_experiment_list", "[]", locked); // [DEFAULT] -pref("toolkit.telemetry.debugSlowSql", false); // [DEFAULT] -pref("toolkit.telemetry.enabled", false, locked); // [DEFAULT - non-Nightly] -pref("toolkit.telemetry.eventping.maximumFrequency", 999999999, locked); // [HIDDEN] Disable `event` pings -pref("toolkit.telemetry.eventping.minimumFrequency", 999999999, locked); // [HIDDEN] Disable `event` pings -pref("toolkit.telemetry.firstShutdownPing.enabled", false, locked); // [HIDDEN - Android] -pref("toolkit.telemetry.healthping.enabled", false, locked); // [HIDDEN] -pref("toolkit.telemetry.initDelay", 999999999, locked); // [HIDDEN] Prevent the Telemetry component from initializing -pref("toolkit.telemetry.log.dump", false); // [HIDDEN] [DEFAULT] - To expose via the `about:config` -pref("toolkit.telemetry.log.level", "Fatal"); // [HIDDEN] [Default: Warn] -pref("toolkit.telemetry.minSubsessionLength", 999999999, locked); // [HIDDEN] -pref("toolkit.telemetry.newProfilePing.delay", 999999999, locked); // [HIDDEN] -pref("toolkit.telemetry.newProfilePing.enabled", false, locked); // [HIDDEN - Android] -pref("toolkit.telemetry.overrideUpdateChannel", "release", locked); // [HIDDEN] [DEFENSE IN DEPTH] Always report channel as `release`, regardless of actual value https://docs.telemetry.mozilla.org/concepts/channels/channel_normalization -pref("toolkit.telemetry.previousBuildID", "", locked); // [HIDDEN] -pref("toolkit.telemetry.reportingpolicy.firstRun", false, locked); // [HIDDEN] -pref("toolkit.telemetry.scheduler.idleTickInterval", 999999999, locked); // [HIDDEN] -pref("toolkit.telemetry.scheduler.tickInterval", 999999999, locked); // [HIDDEN] -pref("toolkit.telemetry.send.overrideOfficialCheck", false, locked); // [HIDDEN] [DEFAULT] Never send pings on unofficial builds - https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/internals/preferences.html -pref("toolkit.telemetry.server", "data;", locked); -pref("toolkit.telemetry.server_owner", "", locked); -pref("toolkit.telemetry.shutdownPingSender.backgroundtask.enabled", false, locked); // [HIDDEN - Android/Thunderbird] [DEFAULT - desktop Firefox] -pref("toolkit.telemetry.shutdownPingSender.enabled", false, locked); // [HIDDEN - Android] -pref("toolkit.telemetry.shutdownPingSender.enabledFirstSession", false, locked); // [HIDDEN - Android] [DEFAULT] -pref("toolkit.telemetry.testing.disableFuzzingDelay", false, locked); // [HIDDEN] [DEFAULT] [DEFENSE IN DEPTH] Always delay sending pings between 0-1 AM -pref("toolkit.telemetry.testing.overridePreRelease", false, locked); // [HIDDEN] [DEFAULT] Never record extended/prelease data on release channels - https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/internals/preferences.html -pref("toolkit.telemetry.testing.overrideProductsCheck", false, locked); // [DEFAULT] Limit probes to only what is supported on the current product - https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/internals/preferences.html -pref("toolkit.telemetry.testing.suppressPingsender", true, locked); // [HIDDEN] -pref("toolkit.telemetry.translations.logLevel", "Off"); -pref("toolkit.telemetry.unified", false, locked); // [DEFAULT - Android] -pref("toolkit.telemetry.untrustedModulesPing.frequency", 999999999, locked); // [HIDDEN] -pref("toolkit.telemetry.updatePing.enabled", false, locked); // [HIDDEN - Android] -pref("toolkit.telemetry.user_characteristics_ping.current_version", 0, locked); // [DEFAULT] -pref("toolkit.telemetry.user_characteristics_ping.last_version_sent", 0, locked); // [DEFAULT] -pref("toolkit.telemetry.user_characteristics_ping.logLevel", "Off"); -pref("toolkit.telemetry.user_characteristics_ping.opt-out", true, locked); -pref("toolkit.telemetry.user_characteristics_ping.send-once", false, locked); // [DEFAULT] -pref("toolkit.telemetry.user_characteristics_ping.uuid", "", locked); // [DEFAULT] -pref("urlclassifier.features.emailtracking.datacollection.allowlistTables", "", locked); // https://searchfox.org/mozilla-central/source/toolkit/components/url-classifier/SafeBrowsing.sys.mjs -pref("urlclassifier.features.emailtracking.datacollection.blocklistTables", "", locked); // https://searchfox.org/mozilla-central/source/toolkit/components/url-classifier/SafeBrowsing.sys.mjs - - -/// Disable Experiments/Studies -// (Shield/Nimbus/Normandy) -// https://support.mozilla.org/kb/shield -// https://support.mozilla.org/kb/how-stop-firefox-making-automatic-connections#w_experiments-or-studies -// https://experimenter.info/ -// https://wiki.mozilla.org/Firefox/Shield/Shield_Studies -// https://mozilla.github.io/normandy/ -// https://wiki.mozilla.org/Advocacy/heartbeat -// resource://nimbus/ExperimentAPI.sys.mjs -// https://searchfox.org/mozilla-central/source/toolkit/components/backgroundtasks/defaults/backgroundtasks_browser.js -pref("app.normandy.run_interval_seconds", 0, locked); // [HIDDEN - Android/Thunderbird] Prevent fetching experiments - This pref is also used by Nimbus -pref("app.shield.optoutstudies.enabled", false, locked); // [HIDDEN - Android/Thunderbird] Required for Firefox Labs on Desktop -pref("messaging-system.rsexperimentloader.collection_id", ""); // [DEFAULT: `nimbus-desktop-experiments`] Required for Firefox Labs on Desktop -pref("nimbus.appId", ""); // [HIDDEN] [DEFAULT: `firefox-desktop`] Required for Firefox Labs on Desktop -pref("nimbus.profileId", "", sticky); // [HIDDEN] https://searchfox.org/mozilla-central/rev/16a9e4fb/toolkit/components/nimbus/ExperimentAPI.sys.mjs#79 -pref("nimbus.profilesdatastoreservice.enabled", false, locked); // [HIDDEN] Disable writing to the NimbusEnrollments table database https://searchfox.org/mozilla-central/rev/16a9e4fb/toolkit/components/nimbus/lib/Enrollments.sys.mjs#418 -pref("nimbus.profilesdatastoreservice.read.enabled", false, locked); // [HIDDEN] Disable reading from the NimbusEnrollments table database https://searchfox.org/mozilla-central/rev/16a9e4fb/toolkit/components/nimbus/lib/Enrollments.sys.mjs#429 - -/// Disable OHTTP Telemetry [ANDROID-ONLY] -// https://searchfox.org/mozilla-central/source/widget/android/OhttpHelper.cpp [ANDROID-ONLY] -pref("network.ohttp.configURL", "", locked); // [ANDROID-ONLY] [NIGHTLY] -pref("network.ohttp.relayURL", "", locked); // [ANDROID-ONLY] [NIGHTLY] - -/// Disable Origin Trials -// https://wiki.mozilla.org/Origin_Trials -pref("dom.origin-trials.enabled", false); - - -/// Prevent automatically uploading profiler data (from `about:logging`) to Mozilla -pref("toolkit.aboutLogging.uploadProfileToCloud", false); // [DEFAULT - non-Android] - -/// Remove partner attribution -// These are *only* used for telemetry, and could potentially be used for fingerprinting -pref("app.distributor", "", locked); // [HIDDEN] [DEFAULT] -pref("app.distributor.channel", "", locked); // [HIDDEN] [DEFAULT] -pref("mozilla.partner.id", "", locked); // [HIDDEN] [DEFAULT] - -pref("browser.phoenix.status", "001"); - -/*** 002 MOZILLA CRAP™ ***/ - -// Some of these also provide Attack Surface Reduction - -/// Clear unnecessary/undesired Mozilla URLs -pref("extensions.getAddons.langpacks.url", ""); // [ANDROID-ONLY] Functionality isn't supported on Android, so no need to connect there - ex. https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=android&type=language&appversion=138.0.1 -pref("extensions.recommendations.privacyPolicyUrl", ""); // [DEFAULT - Android] - - -/// Disable add-on/feature recommendations -// https://support.mozilla.org/kb/recommendations-firefox -// https://searchfox.org/mozilla-central/source/toolkit/mozapps/extensions/content/aboutaddons.js -// https://searchfox.org/mozilla-central/source/browser/components/enterprisepolicies/Policies.sys.mjs -pref("browser.discovery.enabled", false, locked); // [HIDDEN - Android/Thunderbird] [DEFAULT - Android/Thunderbird] -pref("browser.translations.panelShown", true, locked); // [HIDDEN] -pref("extensions.getAddons.browseAddons", ""); // [HIDDEN - non-Android] -pref("extensions.getAddons.discovery.api_url", "data;"); -pref("extensions.getAddons.showPane", false); // [HIDDEN] -pref("extensions.htmlaboutaddons.recommendations.enabled", false); -pref("extensions.recommendations.hideNotice", true, locked); // [HIDDEN] "Some of these recommendations are personalized..." banner -pref("extensions.recommendations.themeRecommendationUrl", ""); -pref("extensions.ui.lastCategory", "addons://list/extension"); // [HIDDEN] [DEFAULT = `addons://discover/`] Ensure default view of `about:addons` is always local/installed extensions -pref("extensions.webservice.discoverURL", ""); // [HIDDEN - non-Thunderbird] - -/// Disable DoH Rollout/heuristics/steering -// This helps ensure Firefox doesn't override our/the user's DoH settings... -// https://searchfox.org/mozilla-central/source/toolkit/components/doh/DoHConfig.sys.mjs -// https://searchfox.org/mozilla-central/source/toolkit/components/doh/DoHController.sys.mjs -// https://searchfox.org/mozilla-central/source/toolkit/components/doh/DoHHeuristics.sys.mjs -// https://searchfox.org/mozilla-central/source/netwerk/docs/dns/dns-over-https-trr.md -// https://searchfox.org/mozilla-central/rev/f1e32fa7/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/GeckoRuntimeSettings.java#1625 -pref("doh-rollout._testing", true, locked); // [HIDDEN] -pref("doh-rollout.disable-heuristics", true, locked); // [HIDDEN] -pref("doh-rollout.doneFirstRun", true, locked); // [HIDDEN] -pref("doh-rollout.doorhanger-decision", "UIDisabled", locked); // [HIDDEN] -pref("doh-rollout.enabled", false, locked); // [HIDDEN] -pref("doh-rollout.mode", 5, locked); // [HIDDEN] -pref("doh-rollout.provider-steering.enabled", false, locked); // [HIDDEN] -pref("doh-rollout.provider-steering.provider-list", "", locked); // [HIDDEN] -pref("doh-rollout.self-enabled", false, locked); // [HIDDEN] -pref("doh-rollout.skipHeuristicsCheck", true, locked); // [HIDDEN] -pref("doh-rollout.trr-selection.enabled", false, locked); // [HIDDEN] -pref("doh-rollout.trr-selection.provider-list", "", locked); // [HIDDEN] -pref("doh-rollout.uri", "", locked); // [HIDDEN] -pref("network.android_doh.autoselect_enabled", false, locked); // [DEFAULT] https://searchfox.org/mozilla-central/rev/f1e32fa7/modules/libpref/init/StaticPrefList.yaml#14585 - -/// Disable DoH performance measurements -// https://searchfox.org/mozilla-central/rev/3b58bde3/browser/components/BrowserGlue.sys.mjs#1196 -// https://searchfox.org/mozilla-central/source/toolkit/components/doh/TRRPerformance.sys.mjs -pref("doh-rollout.trrRace.canonicalDomain", ""); // [HIDDEN] [Default = firefox-dns-perf-test.net] -pref("doh-rollout.trrRace.complete", true); // [HIDDEN] -pref("doh-rollout.trrRace.enabled", false); // [HIDDEN] -pref("doh-rollout.trrRace.popularDomains", ""); // [HIDDEN] -pref("doh-rollout.trrRace.randomSubdomainCount", 0); // [HIDDEN] - -/// Disable 'Essential Domains Fallback' -// My concern here is the fact that this is fetched from Remote Settings - this could potentially be used to bypass our internal domain blocklist above + the firewall of users if they themselves choose to block specific domains for whatever reason -// I don't have a problem with this being a local dump though, as I can understand the usefulness of this (and being local would mitigate my concerns here) - but I'm not comfortable with the remote part -// This is currently unused anyways... -// https://searchfox.org/mozilla-central/source/netwerk/base/EssentialDomainsRemoteSettings.sys.mjs -// https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/moz-essential-domain-fallbacks/changeset?_expected=0 -pref("network.essential_domains_fallback", false); // [DEFAULT] - -/// Disable Fakespot -pref("toolkit.shopping.ohttpConfigURL", ""); -pref("toolkit.shopping.ohttpRelayURL", ""); - - -/// Disable fetching Firefox Relay's "allowlist" (list of sites known to support Relay) -// Should reduce network activity, and also allows users of Relay to use it anywhere if desired -// https://bugzilla.mozilla.org/show_bug.cgi?id=1926974 -// https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/fxrelay-allowlist/changeset?_expected=0 -// https://searchfox.org/mozilla-central/source/toolkit/components/satchel/integrations/FirefoxRelay.sys.mjs -pref("signon.firefoxRelay.allowListRemoteSettingsCollection", ""); // [HIDDEN] - -/// Disable fetching Password Manager rules remotely by default -// (Used for identifying password forms on websites) -// Last update was January 2023... also included locally as a dump anyways (resource://app/defaults/settings/main/password-recipes.json), so I don't see a reason to fetch these remotely -// https://bugzilla.mozilla.org/show_bug.cgi?id=1134852 -// https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/password-recipes/changeset?_expected=0 -pref("signon.recipes.remoteRecipes.enabled", false); - - - -/// Disable Firefox Relay by default -pref("signon.firefoxRelay.feature", "disabled"); // [HIDDEN - Thunderbird] - -/// Disable "Interest-based Content Relevance Ranking and Personalization" -// https://bugzilla.mozilla.org/show_bug.cgi?id=1886207 -pref("toolkit.contentRelevancy.enabled", false, locked); // [HIDDEN - Android/Thunderbird] [DEFAULT] -pref("toolkit.contentRelevancy.ingestEnabled", false, locked); // [HIDDEN - Android/Thunderbird] [DEFAULT] -pref("toolkit.contentRelevancy.log", false); // [HIDDEN - Android/Thunderbird] [DEFAULT] - - - - -/// Disable "Privacy-Preserving Attribution" -// https://support.mozilla.org/kb/privacy-preserving-attribution -pref("dom.origin-trials.private-attribution.state", 2, locked); // [DEFAULT] -pref("dom.private-attribution.submission.enabled", false, locked); // [DEFAULT] - -/// Disable Remote Permissions -// This currently only allows overriding behavior for HTTPS-First (and only makes an exception for a testing domain...) -// We enforce HTTPS-Only Mode anyways, so this isn't relevant to us - and regardless, I don't think there should be remote/default overrides for a feature like this (or permissions in general...), best left up to the user. -// https://searchfox.org/mozilla-central/source/extensions/permissions/docs/remote.rst -// https://searchfox.org/mozilla-central/source/extensions/permissions/RemotePermissionService.sys.mjs -// https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/remote-permissions/changeset?_expected=0 -// https://support.mozilla.org/kb/https-first -pref("permissions.manager.remote.enabled", false); - -/// Disable Remote Settings 'Preview' Buckets -// Nice to expose via about:config -pref("services.settings.preview_enabled", false); // [HIDDEN] [DEFAULT] - - -/// Disable the Web Compatibility Reporter -// Harmless - We just don't want to waste Mozilla's time due to our custom set-up... -// Also acts as a potential performance improvement -// https://searchfox.org/mozilla-central/source/toolkit/components/nimbus/FeatureManifest.yaml#3604 -pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT - non-Release/ESR] -pref("extensions.webcompat-reporter.newIssueEndpoint", "https://phoenix.celenity.dev/issues"); // Temporarily override to our URL instead of Mozilla's to work-around upstream bug - https://bugzilla.mozilla.org/show_bug.cgi?id=1963764 - - -/// Opt out of add-on metadata updates -// Note: This prevents themes from displaying previews in `about:addons` -// https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/ -pref("extensions.getAddons.cache.enabled", false); - - - - -/// Remove special privileges from Mozilla domains -// https://firefox-source-docs.mozilla.org/dom/ipc/process_model.html#privileged-mozilla-content -pref("browser.tabs.remote.separatePrivilegedMozillaWebContentProcess", false, locked); // [DEFAULT on Firefox Desktop] -pref("browser.tabs.remote.separatedMozillaDomains", "", locked); -pref("dom.ipc.processCount.privilegedmozilla", 0, locked); -pref("extensions.webextensions.restrictedDomains", ""); -pref("permissions.manager.defaultsUrl", "", locked); // [HIDDEN - Android] [DEFAULT - Android] -pref("svg.context-properties.content.allowed-domains", "", locked); // [DEFAULT - Android/Thunderbird] - -/// Remove tracking parameters from Mozilla URLs + prevent exposing locale & unnecessary information -// For info on the extension update (`extensions.update.`) URL parameters, see https://devdoc.net/web/developer.mozilla.org/en-US/docs/Install_Manifests.html & https://mozilla-balrog.readthedocs.io/en/latest/database.html -pref("browser.backup.template.fallback-download.aurora", "https://www.mozilla.org/firefox/channel/desktop/#developer"); -pref("browser.backup.template.fallback-download.beta", "https://www.mozilla.org/firefox/channel/desktop/#beta"); -pref("browser.backup.template.fallback-download.esr", "https://www.mozilla.org/firefox/enterprise/#download"); -pref("browser.backup.template.fallback-download.nightly", "https://www.mozilla.org/firefox/channel/desktop/#nightly"); -pref("browser.backup.template.fallback-download.release", "https://www.mozilla.org/firefox/download/thanks/?s=direct"); -pref("extensions.abuseReport.amoFormURL", "https://addons.mozilla.org/feedback/addon/%addonID%/"); -pref("extensions.blocklist.addonItemURL", "https://addons.mozilla.org/blocked-addon/%addonID%/%addonVersion%/"); -pref("extensions.getAddons.search.browseURL", "https://addons.mozilla.org/android/search?q=%TERMS%"); // [ANDROID-ONLY] -pref("extensions.update.background.url", "https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%¤tAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%"); // [NO-MAIL] Removes maximum app/browser version (maxAppVersion), operating system (appOS), ABI (appABI), locale (locale), and compatibility mode (compatMode) -pref("extensions.update.url", "https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID%&version=%ITEM_VERSION%&status=%ITEM_STATUS%&appID=%APP_ID%&appVersion=%APP_VERSION%¤tAppVersion=%CURRENT_APP_VERSION%&updateType=%UPDATE_TYPE%"); // [NO-MAIL] Removes maximum app/browser version (maxAppVersion), operating system (appOS), ABI (appABI), locale (locale), and compatibility mode (compatMode) -pref("pdfjs.altTextLearnMoreUrl", "https://support.mozilla.org/kb/pdf-alt-text"); // [NO-MAIL] -pref("signon.firefoxRelay.learn_more_url", "https://support.mozilla.org/kb/relay-integration#w_frequently-asked-questions"); -pref("signon.firefoxRelay.manage_url", "https://relay.firefox.com/accounts/profile/"); -pref("signon.firefoxRelay.privacy_policy_url", "https://www.mozilla.org/privacy/subscription-services/"); -pref("signon.firefoxRelay.terms_of_service_url", "https://www.mozilla.org/about/legal/terms/subscription-services/"); - -/// Skip Mozilla's `Privacy Notice` & `Terms of Use` -// https://github.com/mozilla/policy-templates/pull/1212 -// https://searchfox.org/mozilla-central/source/browser/components/enterprisepolicies/Policies.sys.mjs -pref("datareporting.policy.dataSubmissionPolicyAcceptedVersion", 999, locked); -pref("datareporting.policy.dataSubmissionPolicyNotifiedTime", "32503679999000", locked); - -pref("browser.phoenix.status", "002"); - -/*** 003 TRACKING PROTECTION ***/ - -/// Allow users to add URLs to ETP via the `about:config` -// Typically hidden, but can be useful useful, so we can expose this via the `about:config` to make it easier for users to find/add entries -// https://developer.mozilla.org/docs/Web/Privacy/Guides/Storage_Access_Policy#adding_custom_domains_to_the_tracking_protection_list -pref("urlclassifier.trackingAnnotationTable.testEntries", ""); // [HIDDEN] [DEFAULT] - -/// Allow users to exclude URLs from ETP via the `about:config` -// These are typically hidden, but very useful (especially for testing/working around breakage), so we can expose this via the `about:config` to make it easier for users to find/add exclusions -pref("privacy.rejectForeign.allowList", ""); // [DEFAULT] -pref("urlclassifier.features.consentmanager.annotate.skipURLs", ""); // [HIDDEN] [DEFAULT] -pref("urlclassifier.features.cryptomining.skipURLs", ""); // [HIDDEN] [DEFAULT] -pref("urlclassifier.features.emailtracking.skipURLs", ""); // [HIDDEN] [DEFAULT] -pref("urlclassifier.features.fingerprinting.skipURLs", ""); // [HIDDEN] [DEFAULT] -pref("urlclassifier.features.socialtracking.skipURLs", ""); // [HIDDEN] [DEFAULT] -pref("urlclassifier.trackingSkipURLs", ""); // [HIDDEN] [DEFAULT] - -/// Enable ETP Strict -// https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop?as=u#w_strict-enhanced-tracking-protection -pref("browser.contentblocking.category", "strict", locked); // [HIDDEN] - -/// Manually enable ETP/Strict protections... -// These are typically configured by ETP Strict - but unfortunately Firefox doesn't set ETP Strict on the browser's first run :/ -// So we need to also manually configure them. We still also use ETP Strict (not 'Custom') due to our enforcement of it, so we should be covered by Mozilla changes/updates for protections. -// Manually specifying these is also useful for cases like Android: where all protections aren't enabled with ETP Strict, and on Thunderbird: where ETP Strict doesn't exist at all... -// We're also configuring the 'CookieBehavior' & 'EnableTrackingProtection' policies on desktop. - -//// Block known consent managers (CMPs) -pref("privacy.trackingprotection.consentmanager.annotate_channels", true); // [DEFAULT] -pref("privacy.trackingprotection.consentmanager.skip.enabled", false); // [DEFAULT] -pref("privacy.trackingprotection.consentmanager.skip.pbmode.enabled", false); - -//// Block known cryptominers -pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT - non-Thunderbird] - -//// Block known email trackers -pref("privacy.trackingprotection.emailtracking.enabled", true); -pref("privacy.trackingprotection.emailtracking.pbmode.enabled", true); // [DEFAULT] - -//// Block known fingerprinters -// Including ones classified as "anti-fraud": https://bugzilla.mozilla.org/show_bug.cgi?id=1962092 -pref("privacy.trackingprotection.antifraud.annotate_channels", true); // [DEFAULT] [NIGHTLY] -pref("privacy.trackingprotection.antifraud.skip.enabled", false); // [DEFAULT] [NIGHTLY] -pref("privacy.trackingprotection.antifraud.skip.pbmode.enabled", false); // [NIGHTLY] -pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT - non-Thunderbird] - -//// Block known social trackers -pref("privacy.trackingprotection.socialtracking.enabled", true); - -//// Block known trackers -pref("privacy.trackingprotection.annotate_channels", true); // [DEFAULT] -pref("privacy.trackingprotection.enabled", true); -pref("privacy.trackingprotection.pbmode.enabled", true); // [DEFAULT - non-Android] - -//// Block known trackers using the `strict` (Level 2) list -/// https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml#15192 -/// https://searchfox.org/mozilla-central/source/toolkit/components/nimbus/FeatureManifest.yaml#2804 -pref("privacy.annotate_channels.strict_list.enabled", true); // [DEFAULT - Android] -pref("privacy.annotate_channels.strict_list.pbmode.enabled", true); // [DEFAULT] - -//// Block known tracking cookies -pref("network.cookie.cookieBehavior.trackerCookieBlocking", true); // [DEFAULT - Desktop] [HIDDEN - Android/Thunderbird] -pref("privacy.socialtracking.block_cookies.enabled", true); // [DEFAULT] - -//// Enable Bounce Tracking Protection -/// https://support.mozilla.org/kb/enhanced-tracking-protection-firefox-desktop#w_bounce-tracking-protection -/// https://searchfox.org/mozilla-central/source/toolkit/components/antitracking/bouncetrackingprotection/nsIBounceTrackingProtection.idl#11 -pref("privacy.bounceTrackingProtection.mode", 1); // [DEFAULT - Nightly] -pref("privacy.bounceTrackingProtection.requireStatefulBounces", false); // [DEFAULT - Nightly] Protect against all bounce trackers, instead of just those who access cookies/storage https://searchfox.org/mozilla-central/rev/16a9e4fb/toolkit/components/nimbus/FeatureManifest.yaml#4436 - -//// Enable Query Parameter Stripping -/// https://firefox-source-docs.mozilla.org/toolkit/components/antitracking/anti-tracking/query-stripping/index.html -pref("privacy.query_stripping.enabled", true); -pref("privacy.query_stripping.enabled.pbmode", true); -pref("privacy.query_stripping.redirect", true); // [DEFAULT] - -//// Enable SmartBlock & UA overrides/injections -pref("extensions.webcompat.enable_shims", true); // [HIDDEN] [DEFAULT - non-Thunderbird] -pref("extensions.webcompat.perform_injections", true); // [HIDDEN] [DEFAULT - non-Thunderbird] -pref("extensions.webcompat.perform_ua_overrides", true); // [HIDDEN] [DEFAULT - non-Thunderbird] -pref("extensions.webcompat.smartblockEmbeds.enabled", true); // [HIDDEN - Android/Thunderbird] [DEFAULT - Desktop] - Enables Embeds/Placeholders to make certain resources click to load - -//// Enable State Partitioning -pref("network.fetch.cache_partition_cross_origin", true); // [DEFAULT] Cross origin fetch/XHR requests -pref("privacy.partition.always_partition_third_party_non_cookie_storage", true); // [DEFAULT] -pref("privacy.partition.always_partition_third_party_non_cookie_storage.exempt_sessionstorage", false); // [DEFAULT] -pref("privacy.partition.bloburl_per_partition_key", true); // [DEFAULT] -pref("privacy.partition.network_state", true); // [DEFAULT] -pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT] -pref("privacy.partition.network_state.ocsp_cache.pbmode", true); // [DEFAULT] -pref("privacy.partition.serviceWorkers", true); // [DEFAULT] - -//// Enable Suspected Fingerprinters Protection (FPP) -/// https://support.mozilla.org/kb/firefox-protection-against-fingerprinting#w_suspected-fingerprinters -pref("privacy.fingerprintingProtection", true); -pref("privacy.fingerprintingProtection.pbmode", true); // [DEFAULT] -pref("privacy.reduceTimerPrecision", true); // [DEFAULT] - -//// Enable TCP/dFPI -/// https://support.mozilla.org/kb/introducing-total-cookie-protection-standard-mode -/// https://searchfox.org/mozilla-central/source/toolkit/components/nimbus/FeatureManifest.yaml#2828 -pref("network.cookie.cookieBehavior", 5); // [DEFAULT - non-Thunderbird] -pref("network.cookie.cookieBehavior.optInPartitioning", true); -pref("network.cookie.cookieBehavior.optInPartitioning.pbmode", true); -pref("network.cookie.cookieBehavior.pbmode", 5); // [DEFAULT - non-Thunderbird] - -//// Ignore less restricted referer policies (than the default) -/// https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml#12979 -pref("network.http.referer.disallowCrossSiteRelaxingDefault", true); // [DEFAULT] - for cross-site requests -pref("network.http.referer.disallowCrossSiteRelaxingDefault.pbmode", true); // [DEFAULT] - for cross-site requests in Private Browsing -pref("network.http.referer.disallowCrossSiteRelaxingDefault.pbmode.top_navigation", true); // [DEFAULT] - for top navigations in Private Browsing -pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // for top navigations - -/// Lower the network priority of known trackers (if not blocked for whatever reason...) -pref("privacy.trackingprotection.lower_network_priority", true); - -pref("browser.phoenix.status", "003"); - -/*** 004 FINGERPRINTING PROTECTION ***/ - -/// Add notes to help prevent users from making themselves unnecessarily fingerprintable -// We need to keep Android notes under ~50 characters to prevent them from being cut off/un-readable; isn't an issue on Desktop -pref("dom.webmidi.enabled.0.NOTE", "Changing this value is unnecessary..."); -pref("dom.webmidi.enabled.1.NOTE", "and WILL aid fingerprinting."); -pref("dom.webmidi.enabled.2.NOTE", "Set 'dom.sitepermsaddon-provider.enabled' to 'false'..."); -pref("dom.webmidi.enabled.3.NOTE", "and 'dom.webmidi.gated' to 'true' instead."); -pref("geo.enabled.0.NOTE", "Changing this value is unnecessary..."); -pref("geo.enabled.1.NOTE", "and WILL aid fingerprinting."); -pref("geo.enabled.2.NOTE", "Use the 'Location' site setting instead."); // [ANDROID-ONLY] - -/// Always load fonts bundled with Firefox -// The default is -1 - which loads bundled fonts, EXCEPT on "low-memory" devices -// Hence, this could add extra entropy/add an extra fingerprinting vector for users on "low-memory" devices -// In general, this will ensure all users have the same standard behavior here -// https://bugzilla.mozilla.org/show_bug.cgi?id=1686274 -// https://searchfox.org/mozilla-central/rev/20fc11f1/gfx/thebes/gfxFT2FontList.cpp#1615 -pref("gfx.bundled-fonts.activate", 1); - - -/// Disable failIfMajorPerformanceCaveat in WebGL contexts -// https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/18603 -pref("webgl.disable-fail-if-major-performance-caveat", true); // [DEFAULT] - -/// Disable VP9 Benchmark -// This means that VP9 will always be enabled regardless of performance benchmarks (unless on a plaform where this isn't supported) -// This likely also results in a performance improvement, so that's nice -// https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/22548 -pref("media.benchmark.vp9.threshold", 0); - -/// Do not use the theme's toolbar color scheme for in-content pages by default -// https://searchfox.org/mozilla-central/source/toolkit/modules/LightweightThemeConsumer.sys.mjs -pref("browser.theme.unified-color-scheme", false); // [HIDDEN - non-Thunderbird] [DEFAULT - non-Thunderbird] - -/// Enable canvas randomization for the browser chrome -pref("privacy.resistFingerprinting.randomization.canvas.disable_for_chrome", false); // [DEFAULT] - -/// Enable fdlibm for Math.sin, Math.cos, and Math.tan -// https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml#8720 -// https://groups.google.com/a/mozilla.org/g/dev-platform/c/0dxAO-JsoXI/m/eEhjM9VsAgAJ -pref("javascript.options.use_fdlibm_for_sin_cos_tan", true); // [DEFAULT - non-Windows] - -/// Enable light mode by default -// Matches with RFP & prevents exposing system theme -pref("layout.css.prefers-color-scheme.content-override", 1); - -/// Ensure we use the standard Noto Color Emoji font by default (instead of ex. Samsung's if available) [ANDROID-ONLY] -// https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43023 [ANDROID-ONLY] -pref("font.name-list.emoji", "Noto Color Emoji"); // [ANDROID-ONLY] - - -/// Harden FPP (which we enable at `003` in `Phoenix-Core`) to match RFP with a few exceptions... -// As explained here: https://codeberg.org/celenity/Phoenix/wiki/Android#fingerprinting [ANDROID-ONLY] -// This also improves security - Attack Surface Reduction, reduced timer precision -// List of targets: https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargets.inc -// Easily build your own (global) override list: https://raw.githack.com/rindeal/Firefox-FPP-Override-List-Editor/master/FirefoxFPPOverrideListEditor.html -pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt,-CSSPrefersColorScheme,-FrameRate,-JSDateTimeUTC"); // [ANDROID-ONLY] - -/// Prevent enumeration of media devices -// Exceptions can be set via the `media.devices.enumerate.legacy.allowlist` pref -// https://bugzilla.mozilla.org/show_bug.cgi?id=1528042 -pref("media.devices.enumerate.legacy.enabled", false); // [DEFAULT] - -/// Prevent exposing WebGL Renderer Info -// So this is typically covered by RFP/FPP's 'WebGLRenderInfo' target, but some websites (ex. moviezapiya.fun) break when that target is set, due to the target disabling the debug renderer info (while spoofing the renderer query info to "Mozilla" for the vendor and renderer) -// So for cases like that, when the `WebGLRenderInfo` target is disabled, this will ensure the real vendor/renderer info is still not exposed (RFP/FPP's target here should still take precedent) -// Looks like this is fixed for 140, so we won't need these for long... - https://bugzilla.mozilla.org/show_bug.cgi?id=1966860 -// https://searchfox.org/mozilla-central/source/dom/canvas/SanitizeRenderer.cpp -pref("webgl.enable-renderer-query", false); // Spoofs "Vendor" and "Renderer" to "Mozilla" (Like the `WebGLRenderInfo` target does) -pref("webgl.sanitize-unmasked-renderer", true); // [DEFAULT] [DEFENSE IN DEPTH] -pref("webgl.override-unmasked-renderer", "Mozilla"); // Attempts to spoof "Unmasked Renderer" Debug info to "Mozilla" (like FPP/RFP does for the WebGL renderer query), but Firefox seems to override to "Generic Renderer" anyways -pref("webgl.override-unmasked-vendor", "Mozilla"); // Spoofs "Unmasked Vendor" Debug info to "Mozilla" (like FPP/RFP does for the WebGL renderer query) - -/// Prevent pre-allocating content processes -// These can cause certain values/settings to persist, even after a user changes them - which could result in leakage/fingerprinting concerns -// https://firefox-source-docs.mozilla.org/dom/ipc/process_model.html#preallocated-content -pref("dom.ipc.processPrelaunch.enabled", false); // [DEFAULT - Android] -pref("dom.ipc.processPrelaunch.fission.number", 0); - -/// Prevent using system accent colors -pref("widget.non-native-theme.use-theme-accent", false); // [DEFAULT - non-Thunderbird Windows] - -/// Prevent using system colors -// The `ui.use_standins_for_native_colors` pref does the same thing as the 'UseStandinsForNativeColors' RFP/FPP target (so it shouldn't interfere with FPP/RFP) -// But I also want to set this here to ensure users are protected if they disable FPP for whatever reason, or if they disable ETP/Strict for a specific site/add an exception -// https://searchfox.org/mozilla-central/rev/a589ce1e/layout/style/PreferenceSheet.cpp#69 -pref("browser.display.use_system_colors", false); // [DEFAULT - non-Windows] -pref("ui.use_standins_for_native_colors", true); - -/// Prompt to spoof locale to en-US -pref("privacy.spoof_english", 0); // [DEFAULT] - -/// Provide example templates to make it easier for users to set custom FPP overrides if needed -pref("privacy.fingerprintingProtection.granularOverrides.0.example", '[{"firstPartyDomain":"example1.invalid","overrides":"+ProtectionIWantToEnableOnThisWebsite,-ProtectionIWantToDisableOnThisWebsite"},{"firstPartyDomain":"*","thirdPartyDomain":"example2.invalid","overrides":"+ThirdPartyDomainsAreSupportedToo"}]'); -pref("privacy.fingerprintingProtection.overrides.0.example", "+ProtectionIWantToEnableGlobally,-ProtectionIWantToDisableGlobally"); - -/// Reset the fingerprinting randomization key daily (in addition to per-session/when the browser restarts) -// https://bugzilla.mozilla.org/show_bug.cgi?id=1816064 -pref("privacy.resistFingerprinting.randomization.daily_reset.enabled", true); -pref("privacy.resistFingerprinting.randomization.daily_reset.private.enabled", true); - -/// Round window sizes -pref("privacy.window.maxInnerHeight", 900); // [DEFAULT - non-Android/Thunderbird] -pref("privacy.window.maxInnerWidth", 1600); - -/// Set a fixed temporary storage limit -// https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41065 -// https://bugzilla.mozilla.org/show_bug.cgi?id=1781277 -pref("dom.quotaManager.temporaryStorage.fixedLimit", 52428800); // Ex. matches what Tor Browser uses & what Firefox uses by default in most cases - -/// Set FPP granular overrides (if the related target is enabled...) -// See here for details: https://codeberg.org/celenity/Phoenix/wiki/FPP-Overrides -pref("privacy.fingerprintingProtection.granularOverrides", '[{"firstPartyDomain":"google.ad","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ae","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.al","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.am","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.as","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.at","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.az","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ba","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.be","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.bf","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.bg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.bi","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.bj","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.bs","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.bt","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.by","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ca","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cat","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cd","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cf","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ch","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ci","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cl","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cn","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.ao","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.bw","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.ck","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.cr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.id","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.il","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.in","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.jp","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.ke","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.kr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.ls","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.ma","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.mz","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.nz","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.th","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.tz","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.ug","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.uk","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.uz","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.ve","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.vi","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.za","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.zm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.co.zw","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.af","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.ag","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.ar","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.au","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.bd","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.bh","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.bn","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.bo","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.br","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.bz","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.co","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.cu","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.cy","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.do","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.ec","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.eg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.et","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.fj","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.gh","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.gi","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.gt","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.hk","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.jm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.kh","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.kw","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.lb","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.ly","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.mm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.mt","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.mx","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.my","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.na","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.ng","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.ni","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.np","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.om","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.pa","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.pe","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.pg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.ph","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.pk","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.pr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.py","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.qa","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.sa","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.sb","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.sg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.sl","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.sv","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.tj","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.tr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.tw","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.ua","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.uy","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.vc","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.com.vn","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cv","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.cz","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.de","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.dj","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.dk","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.dm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.dz","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ee","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.es","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.fi","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.fm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.fr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ga","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ge","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.gg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.gl","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.gm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.gr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.gy","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.hn","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.hr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ht","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.hu","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ie","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.im","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.iq","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.is","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.it","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.je","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.jo","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.kg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ki","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.kz","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.la","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.li","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.lk","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.lt","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.lu","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.lv","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.md","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.me","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.mg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.mk","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ml","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.mn","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.mu","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.mv","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.mw","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ne","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.nl","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.no","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.nr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.nu","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.pl","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.pn","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ps","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.pt","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ro","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.rs","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ru","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.rw","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.sc","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.se","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.sh","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.si","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.sk","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.sn","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.so","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.sm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.sr","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.st","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.td","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.tg","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.tl","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.tm","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.tn","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.to","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.tt","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.vu","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"google.ws","overrides":"+CanvasRandomization,-JSDateTimeUTC"},{"firstPartyDomain":"aa.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.ae","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.ca","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.cn","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.co.jp","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.co.uk","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.co.za","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.com.au","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.com.be","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.com.br","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.com.mx","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.com.tr","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.de","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.eg","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.es","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.fr","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.ie","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.in","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.it","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.nl","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.pl","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.sa","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.se","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"amazon.sg","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"animepahe.ru","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"apple.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"apple.com.cn","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"apple.news","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt,+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"arcticfoxes.net","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"aria.im","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"bitcoinist.org","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"brave.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"bsky.app","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"cakepay.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt,-WebGLRenderInfo"},{"firstPartyDomain":"chatwave.org","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"chipotle.com","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"cinny.in","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"citybbq.com","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"cloudflare.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt,+JSDateTimeUTC"},{"firstPartyDomain":"cvs.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"discord.com","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"discord.gg","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt,+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"doordash.com","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"duesen.chat","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"element.io","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"epicgames.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"favicon.io","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt,+JSDateTimeUTC"},{"firstPartyDomain":"flieger.chat","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"g24.at","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"gemeinsam.jetzt","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"gitlab.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"gnulinux.club","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"goo.gl","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt,+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"gsi.go.jp","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"harkins.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"hot-chilli.im","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"icloud.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"icloud.com.cn","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"jerseymikes.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"kosmikdog.eu","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"kroger.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"letterboxd.com","overrides":"-ScreenRect"},{"firstPartyDomain":"medium.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"megacloud.blog","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"megacloud.store","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"moviezapiya.fun","overrides":"-WebGLRenderInfo,+JSDateTimeUTC"},{"firstPartyDomain":"mtrx.nz","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"neat.chat","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"nitro.chat","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"nope.chat","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"nperf.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"oblak.be","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"pcriot.org","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"pendora.io","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"pogo.com","thirdPartyDomain":"pogospike.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasExtractionFromThirdPartiesIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"photopea.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"pogospike.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"pornhub.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"proton.me","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"reddit.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"redditmedia.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"rezka-ua.in","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"riverside.fm","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"rollenspiel.chat","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"salespanel.io","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"socialnetwork24.com","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"southwest.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"stacksocial.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"studichat.de","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"synod.im","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"t.co","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt,+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"the-apothecary.club","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"tiktok.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"tileman.io","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt,+JSDateTimeUTC"},{"firstPartyDomain":"transfem.dev","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"unredacted.org","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"usps.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"utwente.io","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"viliusle.github.io","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"watchduty.org","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"we2.ee","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"x.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"yahoo.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"yatrix.org","overrides":"-JSDateTimeUTC"},{"firstPartyDomain":"youtu.be","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt,+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"youtube-nocookie.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"zoho.com","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"zoho.com.au","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"zoho.eu","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"zoho.in","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"zoho.jp","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"zoho.sa","overrides":"+CanvasExtractionBeforeUserInputIsBlocked,+CanvasImageExtractionPrompt"},{"firstPartyDomain":"*","thirdPartyDomain":"apple.com","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"apple.news","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"bsky.app","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"cdn-apple.com","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"cdninstagram.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"cloudflare.com","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"discord.gg","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"*","thirdPartyDomain":"favicon.io","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"goo.gl","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"*","thirdPartyDomain":"googlevideo.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"*","thirdPartyDomain":"gravatar.com","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"*","thirdPartyDomain":"instagram.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"licdn.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"linkedin.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"loginwithamazon.com","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"megacloud.blog","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasExtractionFromThirdPartiesIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"*","thirdPartyDomain":"megacloud.store","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasExtractionFromThirdPartiesIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"*","thirdPartyDomain":"moviezapiya.fun","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"pinimg.com","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"pinterest.com","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"pornhub.com","overrides":"-CanvasExtractionBeforeUserInputIsBlocked,-CanvasExtractionFromThirdPartiesIsBlocked,-CanvasImageExtractionPrompt"},{"firstPartyDomain":"*","thirdPartyDomain":"recaptcha.net","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"recaptcha.net.cn","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"recaptcha-cn.net","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"redd.it","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"reddit.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"redditmedia.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"redditstatic.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"t.co","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"*","thirdPartyDomain":"tileman.io","overrides":"+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"tiktok.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"twitter.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"twimg.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"*","thirdPartyDomain":"vimeo.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"vimeocdn.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"x.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"youtu.be","overrides":"+CSSPrefersColorScheme,+FrameRate,+JSDateTimeUTC,+JSLocale"},{"firstPartyDomain":"*","thirdPartyDomain":"youtube.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"},{"firstPartyDomain":"*","thirdPartyDomain":"youtube-nocookie.com","overrides":"+CSSPrefersColorScheme,+JSDateTimeUTC"}]'); // [ANDROID-ONLY] - -/// Set target video resolution to 1080p -// Default on ESR is still 480p... -pref("privacy.resistFingerprinting.target_video_res", 1080); // [DEFAULT - non-ESR] - -/// Set zoom levels on a per-site basis -// Changing the zoom level globally can be fingerprintable -// Note: We also set the "SiteSpecificZoom" FPP/RFP target -pref("browser.zoom.siteSpecific", true); // [DEFAULT - non-Android] - -/// So people don't freak out when they see RFP isn't enabled... -// We need to keep Android notes under ~50 characters to prevent them from being cut off/un-readable; isn't an issue on Desktop -pref("privacy.resistFingerprinting.0.NOTE", "RFP is disabled on purpose."); -pref("privacy.resistFingerprinting.1.NOTE", "We use a hardened configuration of FPP instead."); -pref("privacy.resistFingerprinting.2.NOTE", "Using RFP is not recommended or supported."); - -pref("browser.phoenix.status", "004"); - -/*** 005 DISK AVOIDANCE ***/ - -/// Allow permission manager to write to disk -// This is already Firefox's default - but it's hidden, so this exposes it via the `about:config` -// https://searchfox.org/mozilla-central/source/extensions/permissions/PermissionManager.cpp#758 -pref("permissions.memory_only", false); // [HIDDEN] [DEFAULT] - - - - - -/// Clear cache on exit by default -// We also disable disk cache entirely below... -pref("privacy.clearOnShutdown.cache", true); -pref("privacy.clearOnShutdown_v2.cache", true); // [DEFAULT - Desktop Firefox] -pref("privacy.sanitize.sanitizeOnShutdown", true); - -/// Decrease the number of tabs saved in Session Store [NO-MAIL] -// Also improves performance [NO-MAIL] -// (Default = 10 for Android, 25 elsewhere) [NO-MAIL] -pref("browser.sessionstore.max_tabs_undo", 7); // [NO-MAIL] - -/// Disable back/forward cache (bfcache) -// This helps ensure that sensitive data/user state is discarded as soon as possible -// https://web.dev/articles/bfcache -// https://github.com/uazo/cromite/blob/master/docs/FEATURES.md -// https://github.com/uazo/cromite/issues/1649 -// https://kb.mozillazine.org/Browser.sessionhistory.max_total_viewers#Possible_values_and_their_effects -pref("browser.sessionhistory.max_total_viewers", 0); // (Default = -1 (Automatic) - which is 8 unless you're using a device with under 1GB of RAM) -pref("fission.bfcacheInParent", false); - -/// Disable collection/generation of background thumbnails -// https://searchfox.org/mozilla-central/source/toolkit/components/thumbnails/PageThumbs.sys.mjs#629 -pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN] - -/// Disable collection/generation of wireframes -// https://searchfox.org/mozilla-central/source/browser/components/sessionstore/PageWireframes.sys.mjs -pref("browser.history.collectWireframes", false); // [DEFAULT] - -/// Disable coloring visited links -pref("layout.css.visited_links_enabled", false); - -/// Disable disk cache -pref("browser.cache.disk.enable", false); -pref("browser.cache.disk_cache_ssl", false); - - - -pref("browser.contentblocking.database.enabled", false); // [DEFAULT - Android/Thunderbird] - -/// Disable Search & Form History -// Can be leaked to sites... -// https://blog.mindedsecurity.com/2011/10/autocompleteagain.html -pref("browser.formfill.enable", false); - -/// Disable WebRTC history -// History will still gather when `about:webrtc` is open -// Also likely improves performance... -pref("media.aboutwebrtc.hist.enabled", false); // [DEFAULT - non-Nightly] - - -/// Increase the interval between between Session Store save operations -// Also improves performance -// (Default = 10000 (10 secs) for Android, 15000 (15 secs) elsewhere) -// https://searchfox.org/mozilla-central/source/toolkit/components/sessionstore/docs/utils.rst -pref("browser.sessionstore.interval", 60000); // 1 minute - - -/// Prevent clearing cookies by default - -/// Prevent clearing passwords & site settings by default -pref("privacy.clearOnShutdown.siteSettings", false); // [HIDDEN - Android/Thunderbird] [DEFAULT] -pref("privacy.clearOnShutdown_v2.siteSettings", false); // [HIDDEN - Android/Thunderbird] [DEFAULT] - - - -/// Prevent storing unnecessary extra session data -pref("browser.sessionstore.privacy_level", 2); // [HIDDEN - Thunderbird] - -/// Prevent writing media cache (ex. for video streaming) to disk in private windows -pref("browser.privatebrowsing.forceMediaMemoryCache", true); - -/// Remove cached files from browser windows opened with external applications -// https://bugzilla.mozilla.org/buglist.cgi?bug_id=302433,1738574 -pref("browser.download.start_downloads_in_tmp_dir", true); -pref("browser.helperApps.deleteTempFileOnExit", true); // [DEFAULT - Thunderbird] - - - - -pref("browser.phoenix.status", "005"); - -/*** 006 DOWNLOADS ***/ - -/// Block insecure downloads -pref("dom.block_download_insecure", true); // [DEFAULT] - -/// Disable extra download logging by default -// This lets us expose it in the about:config for Android/Thunderbird -pref("browser.download.loglevel", "Error"); // [DEFAULT, HIDDEN - Android/Thunderbird] - -/// Notify when downloading files -pref("browser.download.alwaysOpenPanel", true); // [DEFAULT - Desktop] [HIDDEN - Android/Thunderbird] - -/// Prevent adding downloads to "recent documents"... -pref("browser.download.manager.addToRecentDocs", false); - -/// Prompt before downloading files -pref("browser.download.always_ask_before_handling_new_types", true); -pref("browser.download.useDownloadDir", false); // [DEFAULT - Thunderbird] - -pref("browser.phoenix.status", "006"); - -/*** 007 HTTP(S) ***/ - -/// Allow users to bypass invalid certificate errors by default -// (To expose the preference via the `about:config`) -pref("security.certerror.hideAddException", false); // [HIDDEN] [DEFAULT] - -/// Always preload intermediates -// https://wiki.mozilla.org/Security/CryptoEngineering/Intermediate_Preloading -pref("security.remote_settings.intermediates.enabled", true); // [DEFAULT] - -/// Always warn on insecure webpages -pref("security.insecure_connection_text.enabled", true); -pref("security.insecure_connection_text.pbmode.enabled", true); -pref("security.ssl.treat_unsafe_negotiation_as_broken", true); - -/// Always warn when submitting a form from HTTP to HTTPS, even on local IP addresses -pref("security.insecure_field_warning.ignore_local_ip_address", false); -pref("security.warn_submit_secure_to_insecure", true); // [DEFAULT] - -/// Disable the automatic import of OS client authentication certificates -// (Ex. smart cards) -// This prevents loading Mozilla's PKCS#11 module (which then loads these certificates from the OS store). -// AFAICT this functionality is quite obscure, use is seemingly nonexistent outside of very specific environments (ex. enterprise/government). -// Those who do actually use this functionality may also not want the browser to automatically import/expose these certificates, as they have many other uses. -// These certificates can also still be imported in browser settings anyways, so those who do need to use this functionality still can that way. -// So I no reason to leave this enabled by default - disabling it reduces attack surface and gives more control to users. -// (For reference, Tor Browser also disables this) -// https://blog.mozilla.org/security/2020/04/14/expanding-client-certificates-in-firefox-75/ -// https://bugzilla.mozilla.org/show_bug.cgi?id=1637807 -pref("security.osclientcerts.autoload", false); // [DEFAULT - Thunderbird] - -/// Disable downgrades to insecure TLS 1.0/1.1 -pref("security.tls.insecure_fallback_hosts", ""); // [DEFAULT] -pref("security.tls.version.enable-deprecated", false, locked); // [DEFAULT] - -/// Disable insecure ciphers (Like Chromium & Tor Browser) -// https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/issues/361#note_3089049 -// https://bugzilla.mozilla.org/show_bug.cgi?id=1600437 -// https://bugzilla.mozilla.org/show_bug.cgi?id=1036765 -pref("security.ssl3.dhe_rsa_aes_128_sha", false); // [DEFAULT] -pref("security.ssl3.dhe_rsa_aes_256_sha", false); // [DEFAULT] -pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false); // [DEFAULT - Nightly] TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA -pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false); // [DEFAULT - Nightly] TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - -/// Disable Parental Controls -// https://searchfox.org/mozilla-central/source/toolkit/components/parentalcontrols/nsIParentalControlsService.idl -// https://searchfox.org/mozilla-central/source/netwerk/protocol/http/nsHttpHandler.cpp#547 -pref("network.parental_controls_cached_state", false, locked); // [DEFAULT] - -/// Disable sending background HTTP requests to websites that do not respond quickly to check if they support HTTPS -pref("dom.security.https_only_mode_send_http_background_request", false); - -/// Disable third-party/OS-level root certificates -// I've been torn on how to handle this, but IMO the safest way forward is disabling this functionality in Firefox. -// This is commonly abused by malware/etc. and it's even overriden by certain software/garbage AV's... -// Ex. https://support.kaspersky.com/common/compatibility/14620#block3 -// Since this is something programs actively try to override, I don't see a safe way to support this, so we'll lock it. -// We still allow users to manually import certificates into Firefox... -// So we can ensure users are aware of certificates they add and are making this decision consciously. -pref("security.certerrors.mitm.auto_enable_enterprise_roots", false); // [ANDROID-ONLY] [DEFAULT] -pref("security.enterprise_roots.enabled", false); // [ANDROID-ONLY] [DEFAULT] - -//// Ensure HTTP/3 isn't disabled when/if third-party/OS-level root certificates are found -pref("network.http.http3.disable_when_third_party_roots_found", false); - -/// Disable TLS 1.3 0-RTT -// Not forward secret -// https://github.com/tlswg/tls13-spec/issues/1001 -pref("network.http.http3.enable_0rtt", false); // For HTTP3 https://bugzilla.mozilla.org/show_bug.cgi?id=1689550 -pref("security.tls.enable_0rtt_data", false); - -/// Enable (+ enforce) Certificate Transparency -// https://wiki.mozilla.org/SecurityEngineering/Certificate_Transparency -pref("security.pki.certificate_transparency.mode", 2); // [DEFAULT - Nightly Desktop] -pref("security.pki.certificate_transparency.disable_for_hosts", ""); // [DEFAULT] -pref("security.pki.certificate_transparency.disable_for_spki_hashes", ""); // [DEFAULT] - -/// Enable CRLite revocation checks & prioritize over OCSP -// https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/ -pref("security.pki.crlite_mode", 2); // [DEFAULT - Nightly] -pref("security.remote_settings.crlite_filters.enabled", true); // [DEFAULT - non-Android] - -/// Enable Delegated Credentials -// https://wikipedia.org/wiki/Delegated_credential -pref("security.tls.enable_delegated_credentials", true); // [DEFAULT] - -/// Enable MITM Detection -// https://github.com/arkenfox/user.js/issues/740 -// https://bugzilla.mozilla.org/show_bug.cgi?id=1529643 -pref("security.certerrors.mitm.priming.enabled", true); //[HIDDEN - Android/Thunderbird] [DEFAULT - non-Android/Thunderbird] -pref("security.certerrors.mitm.priming.endpoint", "https://mitmdetection.services.mozilla.com/"); //[HIDDEN - Android/Thunderbird] [DEFAULT - non-Android/Thunderbird] - -/// Enable OCSP revocation checks + stapling -// (https://wikipedia.org/wiki/Online_Certificate_Status_Protocol -// https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/ -// https://blog.cloudflare.com/high-reliability-ocsp-stapling/#ocsp-must-staple -pref("security.OCSP.enabled", 1); // [DEFAULT - non-Android] -pref("security.ssl.enable_ocsp_must_staple", true); // [DEFAULT] -pref("security.ssl.enable_ocsp_stapling", true); // [DEFAULT] - -/// Enable Post Quantum Key Agreement (Kyber) -pref("media.webrtc.enable_pq_dtls", true); // [DEFAULT] -pref("network.http.http3.enable_kyber", true); // [DEFAULT - non-Android] -pref("security.tls.client_hello.send_p256_keyshare", true); // [DEFAULT] -pref("security.tls.enable_kyber", true); // [DEFAULT - non-Android] - -/// Enforce Strict Certificate Pinning -// https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning#How_to_use_pinning -pref("security.cert_pinning.enforcement_level", 2); - -/// Enforce TLS 1.3 downgrade protection -// https://bugzilla.mozilla.org/show_bug.cgi?id=1576790 -pref("security.tls.hello_downgrade_check", true); // [DEFAULT] - -/// Enforce using HTTPS as much as possible -pref("dom.securecontext.allowlist", ""); // [HIDDEN] [DEFAULT] https://searchfox.org/mozilla-central/rev/a589ce1e/dom/security/nsMixedContentBlocker.cpp#270 -pref("dom.security.https_first", true); -pref("dom.security.https_first_for_custom_ports", true); // [DEFAULT] DEFENSE IN DEPTH -pref("dom.security.https_first_for_local_addresses", true); -pref("dom.security.https_first_for_unknown_suffixes", true); -pref("dom.security.https_first_pbm", true); // [DEFAULT] -pref("dom.security.https_first_schemeless", true); -pref("dom.security.https_only_mode", true); -pref("dom.security.https_only_mode.upgrade_local", true); -pref("dom.security.https_only_mode_pbm", true); -pref("security.mixed_content.block_active_content", true); -pref("security.mixed_content.block_display_content", false); // [DEFAULT] Unnecessary with the "security.mixed_content.upgrade_display_content" pref - "security.mixed_content.upgrade_display_content" tries to upgrade mixed content by default and still blocks it if fails, this pref ("security.mixed_content.block_display_content") just blocks all mixed content entirely, causing unnecessary breakage for users. https://github.com/mozilla/policy-templates/issues/1141 -pref("security.mixed_content.block_object_subrequest", true); -pref("security.mixed_content.upgrade_display_content", true); -pref("security.mixed_content.upgrade_display_content.audio", true); // [DEFAULT] -pref("security.mixed_content.upgrade_display_content.image", true); // [DEFAULT] -pref("security.mixed_content.upgrade_display_content.video", true); // [DEFAULT] - -/// Ensure we use the HSTS preload list -// https://searchfox.org/mozilla-central/source/remote/cdp/domains/parent/Security.sys.mjs -pref("network.stricttransportsecurity.preloadlist", true); // [DEFAULT] - -/// Hard-fail OCSP revocation checks by default -// Significant security improvement -// https://github.com/arkenfox/user.js/issues/1576 -pref("security.OCSP.require", true); - -/// If HTTPS-Only Mode is disabled in favor of HTTPS-First, prevent automatically exempting domains (to ensure we always try HTTPS first...) -pref("dom.security.https_first_add_exception_on_failure", false); - -/// Only allow certificate error exceptions per-session -pref("security.certerrors.permanentOverride", false); // [HIDDEN - Android/Thunderbird] - -/// Only load secure websockets from HTTPS pages -pref("network.websocket.allowInsecureFromHTTPS", false); // [DEFAULT] - -/// Require safe renegotiations -// Disables connections to servers without RFC 5746 -// https://wiki.mozilla.org/Security:Renegotiation -pref("security.ssl.require_safe_negotiation", true); - -/// Show detailed information on insecure warning pages -pref("browser.xul.error_pages.expert_bad_cert", true); - -/// Show suggestions when an HTTPS page can not be found -// Ex. If 'example.com' isn't secure, it may suggest 'www.example.com' -pref("dom.security.https_only_mode_error_page_user_suggestions", true); - -pref("browser.phoenix.status", "007"); - -/*** 008 IMPLICIT CONNECTIONS ***/ - -/// Disable Early Hints (Like Cromite) -// https://github.com/uazo/cromite/blob/master/build/patches/Client-hints-overrides.patch -// https://developer.mozilla.org/docs/Web/HTTP/Status/103 -// https://github.com/bashi/early-hints-explainer/blob/main/explainer.md -pref("network.early-hints.enabled", false); -pref("network.early-hints.over-http-v1-1.enabled", false); -pref("network.early-hints.preconnect.enabled", false); -pref("network.early-hints.preconnect.max_connections", 0); - -/// Disable Network Prefetching -// https://developer.mozilla.org/docs/Glossary/Prefetch -pref("dom.prefetch_dns_for_anchor_http_document", false); // https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42684 -pref("dom.prefetch_dns_for_anchor_https_document", false); // [DEFAULT] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42684 -pref("network.dns.disablePrefetch", true); -pref("network.dns.disablePrefetchFromHTTPS", true); -pref("network.dns.prefetch_via_proxy", false); // [DEFAULT] -pref("network.http.speculative-parallel-limit", 0); // [DEFAULT - Thunderbird] -pref("network.predictor.enable-hover-on-ssl", false); // [DEFAULT] -pref("network.predictor.enable-prefetch", false); // [DEFAULT] -pref("network.predictor.enabled", false); -pref("network.prefetch-next", false); - -/// Disable Preconnect -// https://github.com/uBlockOrigin/uBlock-issues/issues/2913 -// https://developer.mozilla.org/docs/Web/HTML/Attributes/rel/preconnect -pref("network.preconnect", false); - - - -/// Prevent middle mouse clicks from pasting clipboard contents by default -// Way too easy to accidentally press... -pref("middlemouse.paste", false); - -/// Prevent middle mouse clicks on new tab button opening URLs or searches from clipboard -pref("browser.tabs.searchclipboardfor.middleclick", false); -pref("middlemouse.contentLoadURL", false); // [DEFAULT] - -pref("browser.phoenix.status", "008"); - -/*** 009 SEARCH & URL BAR ***/ - -/// Allow using a different search engine in normal vs. private Windows -pref("browser.search.separatePrivateDefault.ui.enabled", true); - -/// Always show Punycode -// Protects against phishing & IDN Homograph Attacks -// https://wikipedia.org/wiki/IDN_homograph_attack -pref("network.IDN_show_punycode", true); - - - - - - - - - - -/// Disable search suggestions by default -// https://searchfox.org/mozilla-central/source/browser/components/urlbar/UrlbarProviderSearchSuggestions.sys.mjs -// `browser.search.suggest.enabled` and `browser.search.suggest.enabled.private` appear to have no impact on Android & Thunderbird, but they're still defined there by default.. so we can set them anyways -pref("browser.search.suggest.enabled", false); // [DEFAULT - Android] -pref("browser.search.suggest.enabled.private", false); // [DEFAULT] - - - - - - - -// Adds Unified Search button to easily switch search engines in URL Bar, among other tweaks - - - - -/// Enable the Rust-based Search Engine Selector -// https://bugzilla.mozilla.org/show_bug.cgi?id=1914143 -pref("browser.search.rustSelector.featureGate", true); // [DEFAULT] - - - - - - - - - - - - -/// Notify users if their default search engine has been removed -// https://searchfox.org/mozilla-central/rev/cc4985b7/toolkit/components/search/SearchService.sys.mjs#1806 -pref("browser.search.removeEngineInfobar.enabled", true); // [DEFAULT] - - -/// Use the same search engine in normal and private browsing windows by default -// (DuckDuckGo for us) -pref("browser.search.separatePrivateDefault", false); - -pref("browser.phoenix.status", "009"); - -/*** 010 DNS ***/ - - - -/// Disable DoH Connectivity Checks -pref("network.connectivity-service.DNS_HTTPS.domain", ""); -pref("network.trr.confirmationNS", "skip"); -pref("network.trr.skip-check-for-blocked-host", true); // https://searchfox.org/mozilla-central/rev/16a9e4fb/modules/libpref/init/StaticPrefList.yaml#14535 - -/// Disable EDNS Client Subnet (ECS) to prevent leaking general location data to authoritative DNS servers... -// https://wikipedia.org/wiki/EDNS_Client_Subnet -pref("network.trr.disable-ECS", true); // [DEFAULT] - -/// Disable falling back to system DNS by default -// https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml#13855 -pref("network.trr.retry_on_recoverable_errors", true); // [DEFAULT] -pref("network.trr.strict_native_fallback", true); // https://searchfox.org/mozilla-central/source/toolkit/components/telemetry/docs/data/environment.rst#438 - -/// Disable nsNotifyAddrListener -// (Ex. used for disabling DoH if certain conditions are met) -// https://searchfox.org/mozilla-central/source/netwerk/system/win32/nsNotifyAddrListener.cpp -pref("network.notify.changed", false); -pref("network.notify.checkForNRPT", false); -pref("network.notify.checkForProxies", false); -pref("network.notify.dnsSuffixList", false); -pref("network.notify.initial_call", false); -pref("network.notify.IPv6", false); // [DEFAULT - Windows] -pref("network.notify.resolvers", false); - -/// Enable DNS Rebinding Protection -// (Some like ex. LibreWolf set this to `true`...) -// https://bugzilla.mozilla.org/show_bug.cgi?id=1672528 -pref("network.trr.allow-rfc1918", false); // [DEFAULT] - -/// Enable DoH without fallback & Set to Quad9 by default -pref("network.trr.default_provider_uri", "https://dns.quad9.net/dns-query"); -pref("network.trr.mode", 3); - -/// Enable EncryptedClientHello -// https://blog.cloudflare.com/announcing-encrypted-client-hello -pref("network.dns.echconfig.enabled", true); // [DEFAULT] -pref("network.dns.http3_echconfig.enabled", true); // [DEFAULT] - -/// Enable native DNS HTTPS Lookups -pref("network.dns.native_https_query", true); // [DEFAULT - non-macOS] - -/// Ensure we clear cache upon changing DoH prefs -// https://searchfox.org/mozilla-central/rev/16a9e4fb/modules/libpref/init/StaticPrefList.yaml#14481 -pref("network.trr.clear-cache-on-pref-change", true); // [DEFAULT] - -/// Expose the DoH bootstrap pref, but don't configure by default -// This is the DNS server Firefox uses to resolve the address of your DoH server -// By default, Firefox just uses the system DNS -// This value MUST match the address of the DoH server you're using -// Ex. you could set this to "9.9.9.9" for Quad9 -// We won't configure this by default to prevent unexpected breakage for users when switching DNS providers, but it's hidden - so we can at least expose it in the about:config -pref("network.trr.bootstrapAddr", ""); // [HIDDEN] [DEFAULT] - -/// Fix IPv6 connectivity when DoH is enabled -// https://codeberg.org/divested/brace/pulls/5 -pref("network.dns.preferIPv6", true); - -/// Prevent bypassing DoH for /etc/HOSTS entries by default -// Protects against HOSTS file hijacking -// https://www.malwarebytes.com/blog/news/2016/09/hosts-file-hijacks -// https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=SettingsModifier:Win32/HostsFileHijack -// https://www.microcenter.com/tech_center/article/6472/how-to-clean-the-windows-hosts-file-if-malware-has-tampered-with-it -pref("network.trr.exclude-etc-hosts", false); - -/// Prevent sending headers for DoH requests -pref("network.trr.send_accept-language_headers", false); // [DEFAULT] -pref("network.trr.send_empty_accept-encoding_headers", true); // [DEFAULT] -pref("network.trr.send_user-agent_headers", false); // [DEFAULT] - -/// Temporarily exclude certain captive portal domains from DNS over HTTPS by default [ANDROID-ONLY] -// Android unfortunately doesn't currently prompt users to fallback from DNS over HTTPS when a site can't be found (like desktop does), which causes unexpected breakage for users, as it leaves them without a clear explanation of the issue and a way to add the exceptions [ANDROID-ONLY] -// I don't love the idea of doing this... so again, to clarify: these are temporary will be removed once Firefox adds the fallback UI [ANDROID-ONLY] -// Domains taken from: https://badblock.celenity.dev/#captive-whitelist [ANDROID-ONLY] -pref("network.trr.builtin-excluded-domains", "localhost,local,aainflight.com,acwifi.com,aircanadawifi.com,airtime.geemedia.com,alaskawifi.com,amtrakconnect.com,amtrakwifi.com,ana-inflight-wifi.com,app-yoda.arubathena.com,aruba.odyssys.net,arubanetworks.com,arubanetworks.com.cn,asset-acms.anuvu.cloud,auth.hpe.com,bap.aws.opennetworkexchange.net,btwifi.com,captive.o2wifi.co.uk,captive-2020.aio.cloudauth.net,captive-2022.aio.cloudauth.net,captivemgr.o2wifi.net.uk,captiveportal-login.belex.com,carnivalwifi.com,cbp-guest.cbp.dhs.gov,cdnhotspot.afd.azureedge.net,cdnhotspot.azureedge.net,central.access.network,cfr-mprtuam-01.cops.us1.pr.anuvu.cloud,checkout.aa.com,cloud.imedia.ie,connect.edge.ihg.com,connect-edge.ihg.com,connected.xfinity.com,controller.access.network,cust.blueprintrf.com,deltawifi.com,device-yoda2.arubadev.cloud.hpe.com,dlrguest-captive.disney.com,ee-wifi.ee.co.uk,etihadwi-fly.com,fedsso.yum.com,flyfi.com,freewlan.sbb.ch,gogoinair.com,gogoinflight.com,gp1.wendys.com,guestinternet.com,guestinternet.com.s3-website-us-east-1.amazonaws.com,hiltonwifi.com,hotspotportals.com,hs.imedia.ie,httpforever.com,iceportal.de,inflight.pacwisp.net,inflight-wifi.com,inflightinternet.com,internal2-public-device-nc-nlb-b71ba3c951b09682.elb.us-west-2.amazonaws.com,internal2-public-device-nlb-2e2273d4267c0682.elb.us-west-2.amazonaws.com,internetupgrade.marriott.com,kong-gtw-portal-apse2prod5-lb-1386339370.ap-southeast-2.elb.amazonaws.com,kong-gtw-portal-eu-lb-1104785228.eu-central-1.elb.amazonaws.com,kong-gtw-portal-mec1prod6-lb-2104849938.me-central-1.elb.amazonaws.com,kong-gtw-portal-production-lb-686216184.us-west-1.elb.amazonaws.com,kong-gtw-portal-use1prod2-lb-291057632.us-east-1.elb.amazonaws.com,krisworld.singaporeair.com,kw.sq.com,landing.sbb.ch,loggedin.wifigem.it,login.attwifi.com,login.cloud5.com,login.cloudi-fi.net,login.innflux.com,login.wifigem.com,login.windstream.com,login-awe-cluster.attwifi.com,login-federated.windstream.com,lounge.aa.com,lpv.attwifi.com,lufthansa-flynet.com,managedwifi.xfinity.com,massportwifi.com,marriottwifi.com,medallionclass.com,mscwifi.com,msftguest-virtual.partners.extranet.microsoft.com,mt1.datavalet.io,network-auth.com,neverssl.com,nossl.com,ofc-yoda2.arubadev.cloud.hpe.com,onboard.eurostar.com,onboard.sbb.ch,onboardicafe.com,portal.ac2.mist.com,portal.ac5.mist.com,portal.ac6.mist.com,portal.eu.mist.com,portal.gc1.mist.com,portal.gc2.mist.com,portal.gc3.mist.com,portal.mist.com,portal.moovmanage.com,qa-connect-edge.ihg.com,rcs.arubathena.com,rcs-m.arubathena.com,rcs-ng-yoda2.arubadev.cloud.hpe.com,regio-guide.de,rsc.att.com,rsc.wayport.net,rougewifi.com,sbux-j3.datavalet.io,sbux-portal.globalreachtech.com,sbux-portal.odyssys.net,secure.11os.com,secure.datavalet.io,secure.wayport.net,secure-login.attwifi.com,service.thecloud.net,shop.ba.com,singaporeair-krisworld.com,sso.wendys.com,stage.connect.edge.ihg.com,starbucks-east.datavalet.io,stay.marriottbonvoy.com,southwestwifi.com,thalysnet.com,thd.cloudauth.net,timhortonswifi.com,tvgreyhound.com,unitedprivatescreening.com,unitedwifi.com,universal-orlando.ampthink.com,viasat.com,virginwifi.com,wanderingwifi.com,we.windstream.com,weconnect.wendys.com,wifi.airasia.com,wifi.bahn.de,wifi.cathaypacific.com,wifi.delta.com,wifi.esa.com,wifi.kfc.com,wifi1.kfc.com,wifi2.kfc.com,wifi.panerabread.com,wifi.singaporeair.com,wifi.sncf,wifi.starbucks.com,wifi.tgv-lyria.com,wifi.tgvlyria.com,wifi.united.com,wifi.united.com.edgekey.net,wifi.we.co,wifi.xfinity.com,wifi-viarail.ca,wifi-xdb.boingohotspot.net,wifihotspot.io,wifilauncher.com,wifilauncher.com.s3-website.us-east-1.amazonaws.com,wifilrn-ch2-1p.xfinity.com,wifionboard.com,wirelessportal.americanexpress.com,wirelessportal.americanexpress.com.akadns.net,wirelessportal2.americanexpress.com.akadns.net,wlb1-1579773356.us-east-1.elb.amazonaws.com,yoda-cgqa.arubathena.com,yoda-cgqa-elb.arubathena.com,yoda2-ofc-nlb-f4f923213a2189c7.elb.us-west-2.amazonaws.com,yoda2-public-device-nlb-8343995ce4714f6f.elb.us-west-2.amazonaws.com,yoda2-rcs-nlb-0c9df3882f3f7416.elb.us-west-2.amazonaws.com,zugportal.de"); // [ANDROID-ONLY] - -pref("browser.phoenix.status", "010"); - -/*** 011 PROXIES ***/ - -/// Prevent Firefox from automatically using the system's proxy configuration by default -// This is commonly abused by content filtering/monitoring/MITM software & malware (just like third-party/OS-level root certificates...) -// There are of course legitimate use cases for proxies, but those require manual set-up anyways... let's ensure the user is always in control and making the conscious decision to use a proxy (if at all) -// Also helps with performance as a bonus -// https://bugzilla.mozilla.org/show_bug.cgi?id=500983 -// https://bugzilla.mozilla.org/show_bug.cgi?id=500983#c7 -// https://superuser.com/questions/169303/why-are-my-browsers-suddenly-configured-to-use-a-proxy -pref("network.proxy.type", 0); - -// Prevent bypasses/leakage - -/// Always start proxy extensions (if installed) as soon as possible, instead of waiting for the first browser window to open -pref("extensions.webextensions.early_background_wakeup_on_request", true); // [HIDDEN - non-Android] [DEFAULT - Android] - -/// Disable automatic failover from the proxy (if configured) to direct connections when certain system requests fail -// https://bugzilla.mozilla.org/show_bug.cgi?id=1720221 -pref("network.proxy.failover_direct", false); - -/// Disable file:///net -// https://bugzilla.mozilla.org/show_bug.cgi?id=1412081 -pref("network.file.path_blacklist", ""); // [ANDROID-ONLY] [HIDDEN] [DEFAULT] - -/// Disable GIO -// https://bugzilla.mozilla.org/1433507 -pref("network.gio.supported-protocols", ""); // [HIDDEN] - -/// Disable Uniform Naming Convention (UNC) file paths -// https://bugzilla.mozilla.org/1413868 -pref("network.file.disable_unc_paths", true); // [HIDDEN] - -/// Disable Wi-Fi Tickler -// Ex. disabled by the Proxy Bypass Protection build argument -// https://searchfox.org/mozilla-central/source/netwerk/base/Tickler.h -// https://searchfox.org/mozilla-central/source/netwerk/base/Tickler.cpp -pref("network.tickle-wifi.enabled", false); // [DEFAULT - non-Android] - -/// Prevent bypassing the proxy (if configured) for system connections that include the `bypassProxy` flag -// https://bugzilla.mozilla.org/show_bug.cgi?id=1732792 -pref("network.proxy.allow_bypass", false); - -/// Use the proxy (if configured) for remote DNS lookups -pref("network.proxy.socks_remote_dns", true); -pref("network.proxy.socks5_remote_dns", true); // [DEFAULT] - -pref("browser.phoenix.status", "011"); - -/*** 012 WEBRTC ***/ - -/// Allow user to silence notifications when screen sharing -// https://searchfox.org/mozilla-central/source/browser/app/profile/firefox.js#2452 -pref("privacy.webrtc.allowSilencingNotifications", true); // [HIDDEN - Android/Thunderbird] [DEFAULT] -pref("privacy.webrtc.hideGlobalIndicator", false); // [HIDDEN - Android/Thunderbird] [DEFAULT] - -/// Always sandbox Media Transport -// https://searchfox.org/mozilla-central/source/security/sandbox/common/SandboxSettings.cpp -pref("media.peerconnection.mtransport_process", true); // [HIDDEN - Android/Thunderbird] [DEFAULT] - -/// Enable global toggles for muting the camera/microphone -// https://searchfox.org/mozilla-central/source/browser/app/profile/firefox.js#2452 -pref("privacy.webrtc.globalMuteToggles", true); // [HIDDEN - Android] - -/// Enable mDNS Host Obfuscation to prevent leaking local IP addresses -// https://bugzilla.mozilla.org/show_bug.cgi?id=1588817 -pref("media.peerconnection.ice.obfuscate_host_addresses", true); // [DEFAULT - non-Android] - -/// Prevent WebRTC from bypassing the proxy (if configured) -// https://bugzilla.mozilla.org/show_bug.cgi?id=1790270 -pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); - -/// Warn users when attempting to switch tabs in a window being shared over WebRTC -// https://searchfox.org/mozilla-central/source/browser/app/profile/firefox.js#2459 -pref("privacy.webrtc.sharedTabWarning", true); // [HIDDEN - Android/Thunderbird] - -pref("browser.phoenix.status", "012"); - -/*** 013 MEDIA ***/ - -/// Add DRM notes -pref("media.eme.enabled.0.NOTE", "DRM/EME is NOT supported or recommended."); -pref("media.eme.enabled.1.NOTE", "Enabling it WILL compromise your privacy/security."); -pref("media.eme.enabled.2.NOTE", "Proceed at your own caution."); -pref("media.eme.enabled.3.NOTE", "You will also need to enable a CDM."); // [ANDROID-ONLY] -pref("media.eme.enabled.4.NOTE", "See media.mediadrm-widevinecdm.visible"); // [ANDROID-ONLY] - -/// Block media autoplay by default -// https://support.mozilla.org/kb/block-autoplay -pref("media.autoplay.default", 5); - -/// Disable Encrypted Media Extensions (EME) (DRM) -// Garbage technology with privacy, security, and freedom concerns -// https://www.w3.org/TR/encrypted-media/ -// https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next -// https://celenity.dev/posts/thoughts/drm/ -// (For testing: https://bitmovin.com/demos/drm) -// NOTE: EME also requires Content Decryption Modules (CDMs) to function -// By default, when EME is enabled, Firefox automatically enables/installs Google Widevine on all platforms, in addition to Microsoft PlayReady on Windows -// Unlike Firefox, when EME is enabled, we don't automatically enable any CDMs (see prefs below) - instead, we allow the user to decide which CDM they prefer to use with EME, instead of making that choice for them - allowing the user to remain in control -// NOTE: The standard "media.eme.enabled" pref only disables PROPRIETARY CDMs - Firefox on Desktop also enables an additional CDM (Clear Key: https://www.w3.org/TR/encrypted-media-2/#clear-key), which is ALWAYS active, even when the EME pref is disabled... (For reference, Clear Key has previously had security vulnerabilities: https://www.mozilla.org/security/advisories/mfsa2016-77/ (Tor Browser disables Clear Key FWIW) - and while Clear Key is open source, it still implements basic content protection (such as preventing users from downloading videos... https://bugzilla.mozilla.org/show_bug.cgi?id=1136707#c18)) -// BUT: To work around this, we leverage the `media.eme.require-app-approval` pref. This pref was originally intended for Android to block EME unless the user grants permission. However, when this pref is set on Desktop, since there's no way for users to grant permission to use EME like on Android, it ends up blocking EME entirely - INCLUDING Clear Key -// (For testing Clear Key: https://cpearce.github.io/mse-eme/ + https://reference.dashif.org/dash.js/latest/samples/drm/clearkey.html) -// So essentially: -// On Desktop: want to use EME, but ONLY with an open source CDM (Clear Key)? Set `media.eme.require-app-approval` to `false` and don't touch anything else. Otherwise, set `media.eme.enabled` to `true` AND `media.eme.require-app-approval` to `false`, and enable your preferred CDM(s) below -// On Android: want to use EME at all? Set `media.eme.enabled` to `true` (Do NOT touch `media.eme.require-app-approval`), and enable your preferred CDM below (Currently Android only supports Widevine) -pref("media.eme.enabled", false); -pref("media.eme.require-app-approval", true); // [DEFAULT - Android] https://bugzilla.mozilla.org/show_bug.cgi?id=1620102 https://searchfox.org/mozilla-central/source/dom/media/eme/MediaKeySystemAccessPermissionRequest.h - -//// Disable the Google Widevine CDM by default (if EME is enabled) -/// https://developers.google.com/widevine/drm/overview -/// NOTE: Widevine on Desktop requires Gecko Media Plugins (GMP) - which we also disable by default, see below -pref("media.mediadrm-widevinecdm.visible", false); // [ANDROID-ONLY] Android's MediaDrm API - https://developer.android.com/reference/android/media/MediaDrm https://bugzilla.mozilla.org/show_bug.cgi?id=1306219 - - -/// Disable Gecko Media Plugins (GMP) -// This is currently only used for DRM and OpenH264 (both of which we disable) -// So this helps reduce attack surface (and unwanted network activity...) -// https://wiki.mozilla.org/GeckoMediaPlugins -// https://blog.pearce.org.nz/2019/06/firefoxs-gecko-media-plugin-eme.html -// NOTE: We previously set `media.gmp-provider.enabled` to `false`, but it turns out that pref is essentially useless... all it does is hide installed plug-ins from `about:addons` (and prevents manually triggered add-on updates from checking for GMP updates); it doesn't actually disable GMP or plug-ins installed by it, it doesn't prevent the installation or update of GMP plug-ins, etc... -// The `media.gmp-manager.updateEnabled` pref is a better fit, as it (combined with the `media.gmp-manager.allowLocalSources` pref) effectively block all GMP downloads/updates -// https://github.com/arkenfox/user.js/issues/709 -pref("media.gmp-manager.updateEnabled", false); // [HIDDEN] - -/// Disable GMP local sources -// When combined with `media.gmp-manager.updateEnabled`, this blocks all GMP downloads/updates -// When GMP is enabled (`media.gmp-manager.updateEnabled` set to `true`), this is still useful - as it ensures the GMP plug-ins that Firefox installs are always the latest versions available (instead of being outdated/potentially vulnerable), directly from Mozilla -// https://searchfox.org/mozilla-central/source/toolkit/modules/GMPUtils.sys.mjs -pref("media.gmp-manager.allowLocalSources", false); - -/// Disable GMP logging by default (to expose via the `about:config`) -pref("media.gmp.log.dump", false); // [HIDDEN] [DEFAULT] -pref("media.gmp.log.level", 70); // [HIDDEN] Limits logging to fatal only - -/// Disable HLS [ANDROID-ONLY] -// This uses an additional external library (ExoPlayer), and poses privacy & security concerns [ANDROID-ONLY] -// This is already the default for all platforms except Android [ANDROID-ONLY] -// https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/29859 [ANDROID-ONLY] -pref("media.hls.enabled", false); // [ANDROID-ONLY] - -/// Disable OpenH264 (in favor of hardware decoding) -// Mozilla is currently shipping OpenH264 2.3.2, which is around ~2 years out of date... https://github.com/cisco/openh264/releases/tag/v2.3.1 -// Currently susceptible to a high severity CVE: https://www.cve.org/CVERecord?id=CVE-2025-27091 -// https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2025-27091 -// Downloads are also still distributed over standard, unencrypted HTTP... -// https://searchfox.org/mozilla-central/source/toolkit/content/gmp-sources/openh264.json -pref("media.ffmpeg.allow-openh264", false); // [DEFAULT - Nightly] -pref("media.gmp-gmpopenh264.enabled", false); -pref("media.gmp-gmpopenh264.visible", false); // Don't display in UI/`about:addons` -pref("media.webrtc.hw.h264.enabled", true); // [DEFAULT - Android] Enables H264 hardware decoding https://bugzilla.mozilla.org/show_bug.cgi?id=1717679 - - -/// If GMP is enabled (via `media.gmp-manager.updateEnabled`), ensure that installed plug-ins are visible/exposed in `about:addons` -pref("media.gmp-provider.enabled", true); // [DEFAULT - non-Thunderbird] - - -/// Validate signature when updating GMP (if enabled) -pref("media.gmp-manager.cert.checkAttributes", true); // [DEFAULT] -pref("media.gmp-manager.cert.requireBuiltIn", true); // [DEFAULT] -pref("media.gmp-manager.checkContentSignature", true); // [DEFAULT] - -pref("browser.phoenix.status", "013"); - -/*** 014 ATTACK SURFACE REDUCTION ***/ - -/// Disable ASM.JS -// https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ -pref("javascript.options.asmjs", false); - -/// Disable Graphite & SVG OpenType fonts -// https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+graphite -// https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+svg -pref("gfx.font_rendering.graphite.enabled", false); -pref("gfx.font_rendering.opentype_svg.enabled", false); - -/// Disable JavaScript Just-in-time Compilation (JIT) -// https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ -// https://firefox-source-docs.mozilla.org/js/index.html#javascript-jits -// https://codeberg.org/rusty-snake/firefox-config/src/branch/main/assets/user-overrides.js#L60 -// https://codeberg.org/celenity/Phoenix/issues/93 -pref("javascript.options.baselinejit", false); // Baseline Compiler -pref("javascript.options.ion", false); // WarpMonkey -pref("javascript.options.jithints", false); // Eager baseline hints https://bugzilla.mozilla.org/show_bug.cgi?id=1831572 -pref("javascript.options.main_process_disable_jit", true); // [DEFAULT - iOS?] The JIT backend https://searchfox.org/mozilla-central/source/js/src/jit/JitOptions.cpp -pref("javascript.options.native_regexp", false); // irregexp https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21865 -pref("javascript.options.wasm_baselinejit", false); // WASM Baseline Compiler - -/// Disable JPEG-XL -// https://github.com/mozilla/standards-positions/pull/1064 -pref("image.jxl.enabled", false); // [DEFAULT] - -/// Disable MathML -// https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mathml -pref("mathml.disabled", true); - -/// Disable SharedArrayBuffer using window.postMessage -// https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer -// https://developer.mozilla.org/docs/Web/API/Window/postMessage -// https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ -// https://github.com/tc39/ecma262/issues/1435 -// By default, Firefox restricts the use of SharedArrayBuffer - this fully disables it. -pref("dom.postMessage.sharedArrayBuffer.bypassCOOP_COEP.insecure.enabled", false); // [DEFAULT] -pref("dom.postMessage.sharedArrayBuffer.withCOOP_COEP", false); // [NO-MAIL] - -/// Disable WebVR/WebXR -// https://developer.mozilla.org/docs/Web/API/WebXR_Device_API -pref("permissions.default.xr", 2); // [HIDDEN - Android/Thunderbird] - -/// If JIT (Ion/WarpMonkey) is disabled, also disable it for extensions -// This is the default, but it's hidden - so setting it here lets us expose it... -// https://bugzilla.mozilla.org/show_bug.cgi?id=1599226 -pref("javascript.options.jit_trustedprincipals", false); - -pref("browser.phoenix.status", "014"); - -/*** 015 PASSWORDS & AUTHENTICATION ***/ - -/// Allow filling passwords on all websites, even if they try to block it... -// https://bugzilla.mozilla.org/show_bug.cgi?id=956906 -// https://blog.0xbadc0de.be/archives/124 -pref("signon.storeWhenAutocompleteOff", true); // [DEFAULT] - -/// Always display a `reveal password` button in `password` `` types -// https://developer.mozilla.org/docs/Web/HTML/Element/input/password -pref("layout.forms.reveal-password-button.enabled", true); - -/// Crash on insecure password input -pref("intl.allow-insecure-text-input", false); // [DEFAULT, HIDDEN - non-Nightly] - -/// Disable Autofill -pref("signon.autofillForms", false); -pref("signon.autofillForms.http", false); // [DEFAULT] - -/// Disable Basic authentication over HTTP -// This makes it require secure HTTPS -// https://chromeenterprise.google/policies/#BasicAuthOverHttpEnabled -// https://bugzilla.mozilla.org/show_bug.cgi?id=1763671 -pref("network.http.basic_http_auth.enabled", false); - -/// Disable formless capture of log-in credentials -// This gets very complicated very fast, and there's very little documentation on this - but TL;DR: -// Firefox's built-in password manager has historically prompted users to save passwords by detecting standard