New Profile Settings for Mozilla

[g-monk]

I was wondering if the .js file had some of the defined settings on the privacytools.io website for WebRTC and suggested Privacy. I have not tried this profile yet, but I wanted to help enhance it the best way I could.

Here is the code below - I tried my best to convert it .js code, but I am just a beginner.

; Disable WebRTC
user_pref(media.peerconnection.turn.disable, true)
user_pref(media.peerconnection.use_document_iceservers, false)
user_pref(media.peerconnection.video.enabled, false)
user_pref(media.peerconnection.identity.timeout, 1)

; Privacy Enhancements
user_pref(privacy.trackingprotection.enabled, true)
user_pref(geo.enabled, false)
user_pref(browser.safebrowsing.enabled, false)
user_pref(browser.safebrowsing.malware.enabled, false)
user_pref(dom.event.clipboardevents.enabled, false)
user_pref(network.cookie.cookieBehavior, 1)
user_pref(network.cookie.lifetimePolicy, 2)
user_pref(browser.cache.offline.enable, false)
user_pref(browser.send_pings, false)
user_pref(webgl.disabled, true)
user_pref(dom.battery.enabled, false)
user_pref(browser.sessionstore.max_tabs_undo, 0)

[licaon-kter]

Did you look before? https://github.com/pyllyukko/user.js/blob/master/user.js

[Thorin-Oakenpants]

Already there:
(to save pyllyukko some time)

• geo.enabled
• webgl.disabled
• browser.send_pings
• dom.battery.enabled
• browser.cache.offline.enable
• dom.event.clipboardevents.enabled
• privacy.trackingprotection.enabled
• browser.safebrowsing.enabled
• browser.safebrowsing.malware.enabled
• network.cookie.cookieBehavior
• network.cookie.lifetimePolicy

As for browser.sessionstore.max_tabs_undo this is what I have
// 1007: disable the Session Restore service completely
// WARNING: This also disables the the "Recently Closed Tabs" feature
// It does not affect "Recently Closed Windows" or any history.
user_pref("browser.sessionstore.max_tabs_undo", 0);
user_pref("browser.sessionstore.max_windows_undo", 0);

As for WebRTC, I agree it should be expanded to include more entries
Note: currently (line41+) there are only two media.peerconnection . Excluding these two entries, we could add the following:
// 2001: disable WebRTC
// https://www.privacytools.io/#webrtc
user_pref("media.peerconnection.enabled", false); <- this is already in the user.js
user_pref("media.peerconnection.use_document_iceservers", false);
user_pref("media.peerconnection.video.enabled", false);
user_pref("media.peerconnection.identity.enabled", false);
user_pref("media.peerconnection.identity.timeout", 1);
user_pref("media.peerconnection.turn.disable", true);

[g-monk]

Alright, thanks for the clarification Roman-Nopantski. As far as the suggested modifications I agree with you. In regards to the link: https://www.privacytools.io/#webrtc, how about changing it to:

// Settings defined below are taken from https://www.privacytools.io/#webrtc

[pyllyukko]

As for WebRTC, I agree it should be expanded to include more entries
Note: currently (line41+) there are only two media.peerconnection . Excluding these two entries, we could add the following:
// 2001: disable WebRTC
// https://www.privacytools.io/#webrtc
user_pref("media.peerconnection.enabled", false); <- this is already in the user.js
user_pref("media.peerconnection.use_document_iceservers", false);
user_pref("media.peerconnection.video.enabled", false);
user_pref("media.peerconnection.identity.enabled", false);
user_pref("media.peerconnection.identity.timeout", 1);
user_pref("media.peerconnection.turn.disable", true);

Do we actually need these, as WebRTC is disabled altogether?

Relates to #86

[Thorin-Oakenpants]

You know me, I like to "future-proof" and close all holes. Up to you. :)

[fmarier]

If disabling WebRTC doesn't automatically disable all of these things, that's a bug in Firefox and it should be fixed upstream :)

[pyllyukko]

I think it's better to keep the amount of settings at minimum when we have these kind of "main switches" available. Keeping the user.js tidier.

[Gitoffthelawn]

@fmarier wrote:

If disabling WebRTC doesn't automatically disable all of these things, that's a bug in Firefox and it should be fixed upstream :)

Does anyone have reason to believe it does not disable all of these things?

(As an aside, sometime settings need to be temporarily added to user.js to workaround Mozilla issues... until they develop a fix.)

[Thorin-Oakenpants]

I'm with TBB on this one. If it's good enough for them, it's good enough for me. It wouldn't be the first time unintended consequences/bugs derail code (I remember something about beacons or something back in the day). In fact, even INTENDED consequences (changes to telemetry/health reporting spring to mind). I would rather be pro-active, than do nothing. "Future proofing". At the very least urls can be blanked, set to 127.0.0.1 or "data:text/plain,". I'm not suggesting that for this repository, it's just my thoughts. I'm also not criticizing Moziila. It's just a fact, and I think they do an excellent job.

I simply approach this the same way I approach security - it's a many layered thing. Can it get into my network, can it get past the OS, can it get past any system protections, can it bypass any application mechanisms. Same goes for my approach to FF. I hope that makes sense 🎱

[Thorin-Oakenpants]

Suggest we close this. Everything has been covered, except session data which could be a separate issue if anyone wants to bring it up - I consider it a forensics item, certainly not online security/privacy etc. As for WebRTC, the single pref is the master switch and fits this repository's modus operandi.

[pyllyukko]

Suggest we close this. Everything has been covered

Lets.