Mozilla Firefox Spyware Mitigation Guide
-Note: This guide is deprecated. Sometime in the future it will be updated again.
-You may want to see this for more information.
-After configuring Mozilla Firefox with arkenfox's user.js, according to this guide it's rating changes like so:
+After configuring Mozilla Firefox with Narsil's user.js, according to this guide it's rating changes like so:
Spyware Rating: High → Not Spyware
-The arkenfox's user.js is a template which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible — while minimizing any loss of functionality and breakage (but it will happen).[2]
--
- Before beginning this guide it is important that you try and cross-reference it with other guides, - to see which prospective on this topic is the best way to do it for you. At the bottom of the page are links - to other guides and projects like this one. You should strongly consider this as - you may find other guides more useful than this one. -
-+
Narsil's user.js is a template which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible. It's a fork of arkenfox's user.js, which was used in previous versions of this guide. But Narsil's enhance it for maximum privacy and minimizing automatic connections.
For extra privacy & security, disconnect your computer from the internet while following this guide, so that Firefox is unable to phone home by accident.
-Mozilla Firefox has a huge amount of spyware features, but they can all be disabled by using predefined profile settings. To do this you need to create new Firefox profile: +
- Run
firefox -no-remote -ProfileManager - Create a new profile @@ -69,13 +59,13 @@
- firefox@getpocket.com.xpi — Pocket -
- followonsearch@mozilla.com.xpi — Follow On Search -
- activity-stream@mozilla.org.xpi — Activity Stream -
- screenshots@mozilla.org.xpi — Screenshots -
- onboarding@mozilla.org.xpi — Onboarding -
- formautofill@mozilla.org.xpi — Autofill -
- webcompat@mozilla.org.xpi — Web Compatibility Reporter -
- Privacy Related "about:config" Tweaks to Firefox [web.archive.org] [archive.is] +
- Privacy Related "about:config" Tweaks to Firefox [web.archive.org] [archive.is]
- Firefox Privacy – The Complete How-To Guide [web.archive.org] [archive.is] -
- Librewolf, Firefox with privacy enhancements +
- Librewolf, Firefox with privacy enhancements
- https://commons.wikimedia.org/wiki/File:Firefox_logo,_2019.svg (Firefox Logo) -
- arkenfox/user.js [web.archive.org] [archive.is] +
- Narsil's user.js README [web.archive.org] [archive.is] +
- arkenfox/user.js wiki [web.archive.org] [archive.is]
- https://github.com/arkenfox/user.jss/blob/master/README.md
- Ejecuta el comando
firefox -no-remote -ProfileManager
- - Crea un nuevo perfil -
- Sal del programa. -
- firefox@getpocket.com.xpi - Pocket -
- followonsearch@mozilla.com.xpi - Follow On Search -
- activity-stream@mozilla.org.xpi - Activity Stream -
- screenshots@mozilla.org.xpi - Screenshots -
- onboarding@mozilla.org.xpi - Onboarding -
- formautofill@mozilla.org.xpi - Autofill -
- webcompat@mozilla.org.xpi - Web Compatibility Reporter -
- Privacy Related "about:config" Tweaks to Firefox [web.archive.org] [archive.is] -
- Firefox Privacy – The Complete How-To Guide [web.archive.org] [archive.is] -
- Librewolf, Firefox con mejoras de privacidad -
- https://commons.wikimedia.org/wiki/File:Firefox_logo,_2019.svg (Logotipo de Firefox) -
- ghacksuserjs/ghacks-user.js [web.archive.org] [archive.is] -
- https://github.com/ghacksuserjs/ghacks-user.js/blob/master/README.md -
-
Delete everything from the new profile and get arkenfox's user.js:
-cd /path/to/your/profile && rm -r * && wget https://raw.githubusercontent.com/arkenfox/user.js/master/user.js
+ Delete everything from the new profile and get Narsil's user.js:
+cd /path/to/your/profile && rm -r * && wget https://codeberg.org/Narsil/user.js/raw/branch/main/desktop/user.js
You may want to edit the file to your needs, if so:
$EDITOR user.js
- If you want to disable OCSP as well, you should also add this to your user.js. These settings are separated - because while OCSP is a privacy breach, it is also a security feature. It works by contacting other servers to verify the authenticity of the address you are connecting to. + If you want to enable OCSP, you should also modify these options in the user.js. These settings are disabled in Narsil's user.js + because OCSP is a privacy breach, but it is also a security feature. It works by contacting other servers to verify the authenticity of the address you are connecting to.
You should think about it before making a decision. You can read more about OCSP here:
@@ -90,22 +80,72 @@
With this installation method, if you change any of the settings in user.js through about:config or Firefox preferences dialogs,
they will be reset to the user.js defined values after you restart Firefox.
This makes sure they're always back to secure defaults when starting the browser.
- At the end you need to delete several default plugins in Firefox directory at /path/to/firefox/browser/features (ie /usr/lib/firefox/browser/features/) that can violate privacy:
-
-
-
- It is highly recommended to also check other user.js template settings from ongoing "arkenfox-user.js project"[1] for further hardening Firefox privacy, security and anti-fingerprinting.
-
Run firefox -no-remote -ProfileManager again and start the profile you created. Delete any others if needed. Check to make sure, after the first start, that another profile which does not use arkenfox was not created by Firefox.
Run firefox -no-remote -ProfileManager again and start the profile you created. Delete any others if needed. Check to make sure, after the first start, that another profile which does not use our user.js was not created by Firefox.
+
+ We recommend to also check other user.js settings from "arkenfox-user.js docs"[1] for better understanding + of what the user.js is doing. Note that Narsil's user.js is optimized for the maximum privacy and security, but feel free to adapt it to your needs. +
+ +Hosts file
++ Narsil's user.js mitigates most Firefox's privacy issues. But there are still two automatic connections that can't be disabled in the user.js settings. + There are two solutions for this (Read Narsil's user.js README) but we will take the easiest path, which makes use of the hosts file. Unlike the other solution, it isn't + overwritten with every Firefox update. +
++
+ We will be using Mr Rawes hosts which blocks every + connection that Firefox does. Using the user.js, there should be only two automatic connections left. Adding every connection to the hosts file, + even the ones that we've already disabled, does not have + any negative effect and it may help in case you launch Firefox with a profile not using the custom user.js. +
++
+ Download the hosts file and add them to your system. In unix-like OSs it's located at /etc/hosts.
+ Note that for updating addons you will need to remove addons.mozilla.org from the hosts file, go to about:addons
+ in your browser and in the options menu click on "Check for updates". This is necessary because the user.js disables
+ automatic updates. Firefox won't update itself either, make sure to keep it updated using your package manager.
+
Mozilla.cfg
+This is unnecessary if you used the user.js method, but it's interesting to have this other option. + Important settings are enforced/locked within mozilla.cfg, the major difference with the user.js is that those settings cannot be changed by addons/updates/Firefox or unwanted/accidental + manipulation. To change those settings you can edit the mozilla.cfg. +
+We will use a modified mozilla.cfg from Narsil which is configured with a strong focus on privacy and security. + Download it in a zip file from here and unzip it. + You need to copy the config folder to the firefox installation path. +
+ +| OS | +Path | +
|---|---|
| Windows | +C:\Program Files\Mozilla Firefox\ or C:\Program Files (x86)\Mozilla Firefox\ |
+
+
| Linux | +/usr/lib/firefox/ |
+
| OS X | +Applications/Firefox.app/Contents/Resources/ |
+
+ +
This method may be preferable because settings can not be overwritten by addons or normal users, only by users with root privileges. Make sure to read through the + mozilla.cfg to check if the settings suit your usecase, it's optimized for maximum privacy and security.
+Other Guides
@@ -115,18 +155,21 @@ finish setting Firefox up. Librewolf is less of a guide and more of a project and series of tools and settings you can download to help you make Firefox private.
+Note that these guides might not completely remove automatic connections. Consider using the hosts file.
-
-
Sources
This guide was updated on 08/22/2022
If you want to edit this article, or contribute your own article(s), visit us at the git repo on Codeberg. All contributions must be licensed under the CC0 license to be accepted. diff --git a/guides/firefox_es.html b/guides/firefox_es.html deleted file mode 100644 index 1541fc7..0000000 --- a/guides/firefox_es.html +++ /dev/null @@ -1,139 +0,0 @@ - - -
- -
- Guía de Mitigación de Spyware para Mozilla Firefox
-Esta guía fue elaborada utilizando la versión 74 de Firefox.
-Después de configurar Firefox con el script ghacks-user.js su clasificación de spyware cambia, por lo que pasa a ser:
-Nivel de Spyware: Alto → No Es Spyware
-El script ghacks-user.js es una plantilla que clama mejorar la privacidad y seguridad tanto como sea posible, así como reducir el rastreo y el fingerprinting - intentando minimizar cualquier pérdida de funcionalidad y errores (aunque si se provocarán algunos).[2]
--
- Antes de comenzar, es importante hacer mención de otras guías de mitigación, de esta forma - se pueden ver otras perspectivas acerca de este tema, y así podrás seleccionar cuál es la mejor para hacer esto. En el pie - de esta página hay enlaces a otras guías y proyectos como este. Deberías considerar esto, ya que puedes hallar guías de mitigación mejores que esta. -
--
Para mayor privacidad y seguridad, desconecta tu dispositivo de internet mientras sigues esta guía, de esta forma evitarás que Firefox sea capaz de espiarte por accidente.
--
- Mozilla Firefox tiene una vasta cantidad de características spyware, pero todas ellas pueden ser deshabilitadas usando ciertas opciones predefinidas para tu perfil. - Para hacer esto, debes crear un nuevo perfil de Firefox: -
-
-
Posteriormente, abre el directorio de perfiles de Firefox, el cual se encuentra en las siguientes rutas:
-| Sistema Operativo | -Ruta | -
|---|---|
| Windows 7 | -%APPDATA%\Mozilla\Firefox\Profiles\XXXXXXXX.your_profile_name |
-
| Linux | -~/.mozilla/firefox/XXXXXXXX.your_profile_name |
-
| OS X | -~/Library/Application Support/Firefox/Profiles/XXXXXXXX.your_profile_name |
-
| Android | -/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name |
-
| Sailfish OS + Alien Dalvik | -/opt/alien/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name |
-
| Windows (portable) | -[firefox directory]\Data\profile\ |
-
-
Elimina todo en el nuevo perfil y obtén ghacks-user.js:
-cd /path/to/your/profile && rm -r * && wget https://raw.githubusercontent.com/ghacksuserjs/ghacks-user.js/master/user.js
- Puede que quieras editar el archivo, para eso ejecuta:
-$EDITOR user.js
- - Si también deseas desactivar OCSP, deberás agregar lo siguiente al archivo user.js. Estas configuraciones son separadas - porque aunque OCSP sea una vulnerabilidad para la privacidad, también es una característica de seguridad. Funciona conectándose a servidores para verificar la autenticidad de la dirección a la que te estás conectando. -
-- Deberías pensártelo bien antes de tomar una decisión para OCSP. Puedes leer más sobre el tema aquí: - https://scotthelme.co.uk/revocation-is-broken/ - [web.archive.org].
-
- user_pref("security.ssl.enable_ocsp_stapling", false);
- user_pref("security.OCSP.enabled", 0);
- user_pref("security.OCSP.require", false);
-
-
- Con este método, si cambias cualquiera de las configuraciones en el archivo user.js a través de la pestaña about:config o las preferencias de Firefox, éstas serán reestablecidas usando el archivo user.js la siguiente ocasión que reinicies Firefox.
- Esto asegura que el navegador estará siempre protegido aunque sea reiniciado.
- Para finalizar necesitas eliminar varios plugins y addons anti-privacidad en Firefox, que se encuentran en el directorio /ruta/de/firefox/browser/features (por ejemplo: /usr/lib/firefox/browser/features/)
-
-
-
- También es altamente recomendado buscar templates de user.js, como el "ghacks-user.js project"[1] para aumentar la privacidad de Firefox, así como su seguridad y técnicas anti-fingerprinting (rastreo) -
--
Por último, ejecuta el comando firefox -no-remote -ProfileManager nuevamente y abre el perfil que creaste. Elimina los otros perfiles si es necesario. También, para mayor seguridad, verifica que después de inciar el navegador, Firefox no ha creado nuevos perfiles.
-
Otras guías
-- Estas son otras guías y proyectos que ayudan a proteger tu privacidad en Firefox. Es importante mirar otras - perspectivas en lugar de SÓLO leer esta guía. Así que deberías comparar todas las guías que puedas encontrar para - entender las ideas de todos sobre cómo debería ser acabo la mitigación, antes de que acabes de configurar Firefox. Librewolf - no es exactamente una guía, pero sí un proyecto y una serie de herramientas y configuraciones que puedes descargar para - hacer Firefox más privado. -
--
-
-
Referencias
--
-
-
- Este artículo es una traducción al español del artículo original en inglés. Puede quedar desactualizado en cualquier momento. -
--
- If you want to edit this article, or contribute your own article(s), visit us at the git repo on Codeberg. All contributions must be licensed under the CC0 license to be accepted. -
-
-