Mozilla Firefox Privacy in About Config
If you’re interested in Mozilla Firefox Privacy settings, you might be wondering about how to tune About:Config for the most privacy forward settings.
To start, in the URL bar of your browser, enter about:config. Click the “I’ll be careful, I promise” button.
Archived image unavailable: Mozilla Firefox About:Config screenshot.
Warning, making any changes here can and likely will have an impact, and I take no responsibility for any issues that arise as a result. Proceed at your own risk.
browser.pocket.enabled and right click to Toggle, which will set it to false.
loop.enabled and right click to Toggle, which will set it to false.
Consider disabling browser.cache.
browser.cache will show dozens of config options. The positive of this option, is it will load pages faster when you return to them. The negative, is any websites you go to, Firefox will store a cache of these pages on your disk where someone else can read, analyze, or save these files.
browser.cache.disk.enable and and right click to Toggle, which will set it to false.
If you want to default to private browsing, you can enable this option. This means Firefox will not save information about any websites you visit. This does not make you anonymous on the internet, mean your employer, coffee shop, or ISP can’t log everything you do, or protect you from keystroke loggers, but it does mean your web surfing logs won’t be saved to your disk.
browser.privatebrowsing.autostart and and right click to Toggle, which will set it to true.
Google’s Safe Browsing for Firefox is enabled by default. This means that every URL you visit is being sent to Google, where they will evaluate if it is safe or not. Also, with every update of your blacklist and with every encounter of a reported phishing site you will send your existing Google cookie. You will no longer get a warning when visiting a site that Google does not consider safe if you disable this option.
browser.safebrowsing.enabled and and right click to Toggle, which will set it to false.
Similarly, Mozilla’s Safe Browsing feature maintains a list of known malware, to compare against every URL you visit. You will no longer get a warning when visiting a site with known malware if you disable this.
browser.safebrowsing.malware.enabled and and right click to Toggle, which will set it to false.
The Web Applications 1.0 specification defines a mechanism allowing web pages to store information with a web browser (similar to cookies) called “client-side session and persistent storage.” Although use of session storage is subject to a user’s cookie preferences, this preference allows it to be disabled entirely.
dom.storage.enabled and and right click to Toggle, which will set it to false.
You likely want to turn off webrtc right now, as it can do bad things like disclose your internal IP even if you’re using a VPN.
media.peerconnection.enabled and and right click to Toggle, which will set it to false.
If you know you don’t want to send websites your location:
geo.enabled and right click to Toggle, which will set it to false.
If you’re extra paranoid, and want to make sure even if something accidentally is trying to send your location, you can change the URL to something like your local machine by replacing:
geo.wifi.uri and right click to Modify, and set the URL to http://127.0.0.1
When you visit a website, your browser will send your User Agent information to the webserver, and it will be retained in the web server logs. One of the first things you want to do in regards to web browser privacy, to stand out as less unique on the web, is make sure you’re using a common User Agent. There is a User Agent Switcher plugin for Firefox, or a two step static config change:
general.useragent.compatMode.firefox and right click to select New -> String. In the textbox, enter the value general.useragent.override. Once you do this, you will be asked to provide a value for this new variable, enter something like
Mozilla/5.0 (X11; Linux x86_64; rv:39.0) Gecko/20100101 Firefox/39.0
noting that Firefox version 39 is the latest as of writing this. You will want to keep this updated to avoid the uniqueness of using an old browser.
You should decide how you want to handle browser cookies, there are 4 options. If you’re going to allow cookies, we recommend setting this to 1, which means only allow cookies that are coming from the originating server.
network.cookie.cookieBehavior and right click to Modify, and set the integer to 1.
Also, if you’re going to accept cookies, you should determine how long you want to keep them for. There are also 4 options. We recommend setting this to 2, which means the cookie expires at the end of the session (when the browser closes).
network.cookie.lifetimePolicy and right click to Modify, and set the integer to 2.
Need this translated for your organization? PrivaSecTech offers confidential briefings, policy reviews, workshops, and privacy/security advisory for teams that need to decide what to do next.
