Betterfox: User.js to harden Firefox and optimize privacy, security, and speed

Re:Betterfox: User.js to harden Firefox and optimize privacy... by mattstir on Tuesday July 18, 2023 @09:05PM (#36781011)

> Most of the preferences in this will actually reduce the target-able attack surface

Can you point to anything specific that reduces the attack surface?

When looking at the "securefox" config, it does a bunch of strange things, like enabling embedded TikTok links (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) and disabling UITour (https://github.com/yokoffing/Betterfox/blob/443710b0738ebc8f...) which Firefox uses to highlight menus and is only accessible by approved Mozilla domains (https://searchfox.org/mozilla-central/source/browser/app/per...).

It's a very strange mix of configs.

[ Parent | on HN ]

Re:Betterfox: User.js to harden Firefox and optimize privacy... by autoexec on Tuesday July 18, 2023 @09:42PM (#36781215)

> Can you point to anything specific that reduces the attack surface?

I haven't had a chance to dig though those configs yet, but disabling things like service workers, webgl, normandy/experiments, pocket, and webrtc would be a good start at reducing attack surface

[ Parent | on HN ]

Re:Betterfox: User.js to harden Firefox and optimize privacy... by throwaway290 on Wednesday July 19, 2023 @02:02AM (#36782626)

All of that also makes you easier to fingerprint. How many people disable WebGL?

[ Parent | on HN ]

Re:Betterfox: User.js to harden Firefox and optimize privacy... by Beldin on Wednesday July 19, 2023 @03:16AM (#36783039)

Enabling WebGL makes you a lot more fingerprintable than having it disabled. See e.g. How gullible are web measurement tools? A case study analysing and strengthening OpenWPM’s reliability. B. Krumnow, H. Jonker and S. Karsch. In Proc. 18th International Conference on emerging Networking EXperiments and Technologies (CoNEXT’22). ACM, pp. 171–186, 2022. (Table 3).

[ Parent | on HN ]

Re:Betterfox: User.js to harden Firefox and optimize privacy... by yokoffing on Wednesday July 19, 2023 @10:04AM (#36786537)

The section "Securefox" should probably be renamed "Privatefox", but labels are misleading. It's best to read the project files to understand the balance taken with security, privacy, and functionality. Let's make it simple:

Want a mix of speed and privacy, while retaining functionality? Use Betterfox user.js.

Want more privacy and security at the expense of site functionality? Use Arkenfox user.js.

Want Tor prefs but without using its nodes/relays? Use Mullvad Browser.

Want anonymity? Use Tor Browser.

[ Parent | on HN ]