This checklist is a work in progress, would love to hear your feedback.

Good work. There are some hardening options that you may be able to glean from ArkenFox [1] and Betterfox [2]. Another addon to consider listing is CSS Exfil protection [3a] CSS Exfil Test Site [3b].

[1] - https://github.com/arkenfox/user.js

[2] - https://github.com/yokoffing/Betterfox

[3a] - https://addons.mozilla.org/en-US/firefox/addon/css-exfil-pro...

[3b] - https://www.mike-gualtieri.com/css-exfil-vulnerability-teste...

	▲	amarder 6 days ago \| parent [-]
		Awesome, will check these out, thank you!

▲

mmphosis 6 days ago | parent | prev | next [-]

https://librewolf.net/

https://codeberg.org/librewolf/settings/src/branch/master/li...

▲

backscratches 6 days ago | parent [-]

Librefox is the most robust/maintained fork I've come across.

▲

mmphosis 6 days ago | parent [-]

LibreFox? (2019)

https://github.com/intika/Librefox/issues/125

	▲	backscratches 6 days ago \| parent [-]
		Typo! sorry. Librewolf is what I meant.

▲

speckx 6 days ago | parent | prev | next [-]

Also have a look at https://ffprofile.com/

	▲	frm88 5 days ago \| parent \| next [-]
		Thank you, this helps a lot.
	▲	jvdvegt 5 days ago \| parent \| prev [-]
		Nice site, thanks!

▲

touristtam 6 days ago | parent | prev | next [-]

NoScript to automatically disable JS on first load, something to deal with Cookies (like cookie auto delete) and making use of MultiAccount containers. (defo privacy badger installed as well).

	▲	usr1106 5 days ago \| parent [-]
		I have used Cookie Auto delete for years. Last time I checked development seemed to have stalled.

▲

trod1234 6 days ago | parent | prev | next [-]

This is quite a rudimentary checklist, and it won't provide much in terms of privacy protections, but it will break a number of sites.

The current state of browser-fingerprinting is off-the-rails, where they deny service if they don't get those fingerprints, and the browser to a lesser degree has had its securities/privacy protections gradually degraded.

Stock Firefox will not be able to provide any sufficient guarantees. There are patches that need to be re-compiled in, because there have been about:config options removed.

I highly suggest you review Arkenfox's work, most of the hardening feature he recommends will provide a better defense than nothing. He regularly also contributes to the Mullvad browser which implements most of his hardening and then some but also has some differentiation from the Tor Browser, but many of the same protections.

The TL;DR of the problemscope is that there are artifacts that must be randomized within a certain range. There are also artifacts that must be non-distinct so as to not provide entropy for identification (system fonts and such that are shared among many people in a cohort).

JS, and several other components, if its active will negate a lot of the defenses that have been developed to-date.

Additionally, it seems that in some regional localities Eclipse attacks may be happening (multi-path transparent MITM), by terminating encryption early or through Raptor.

At a bare minimum, there seem to be some bad actors that have mixed themselves into the root pki pool. I've seen valid issued Google Trust certs floating around that were not authorized by the owner of the SAN being visited, and it was transparent and targeted to that blog, but its also happened with vendors (providing VOIP related telco services).

It seems Some ISPs may be doing this to collect sensitive data for surveillance capitalism or other unknown malign purposes. In either case TLS can't be trusted.

▲

ranger_danger 6 days ago | parent | next [-]

> JS, and several other components, if its active will negate a lot of the defenses that have been developed to-date.

I thought if you disabled JS, then that would greatly narrow down which user on the internet you are, since very few people (in comparison to everyone else in the world) actually do this.

> not authorized by the owner of the SAN being visited

Source?

> TLS can't be trusted

Do you have more info on this? Why are more people not worried about it?

	▲	trod1234 6 days ago \| parent [-]
		> I thought if you disabled JS, then that would greatly narrow down which user on the internet you are... It is a fundamentally cursed problem that has a lot of nuance. You have buckets of people, and the entropy or difference between your collected artifacts and others must be sufficient to uniquely identify a single person, that is the point of fingerprinting. Your natural defense is in not sticking out of that group/crowd uniquely so others in the group may carry the same range of fingerprints. At the same time, if you homogenize the artifacts to limit it down to a single fingerprint the sites will simply deny access. Disabling JS altogether doesn't identify you aside from the fact that you are part of the overall group that has it disabled, the trade-off is that all the entropy JS would normally collect cannot be collected. So while they cannot identify you uniquely they can identify the group by denying that group, and that is the fundamental weakness of binary switches. Its a constant cat and mouse. > not authorized by the owner of the SAN being visited. > Source? Firsthand experience with a large VOIP provider where communications would fail intermittently but in targeted ways that avoid common test failures. Call tests would intermittently but routinely fail in the silent-fail domain of interrupt driven calling (where you wouldn't know a call was inbound), and the failures would occur only in that domain. The issues were narrowed down to a mismatch in certificates through a lengthy support correspondence where the hosted certificate vs what was being provided at the edge were different. The artifacts were compared manually through correspondence. The certificate revocation was revoked within 48h once the vendor reached out to Google, but we've seen it happen twice now. The standards in general use don't have a means aside from revocation to handle bad-acting at the root-PKI level. Chain of trust issues like this have been known about for over 2 decades in the respective fields. > Do you have any more info on this? Why are more people not worried about it? On the specifics? The Princeton Raptor attack paper (2015) covers the details. Early termination of encryption, and traffic analysis are pretty bad. Why more people aren't worried? I suppose its because most of the security industry (not all) has accepted the fact that device security is porous, and there isn't really much you can do to hold the manufacturer responsible or to make changes. Surveillance capitalism is also incentivized through profit motive to impose a state of complete and total dependency/compromise. The state of security today, with your almost routine data breaches every quarter, is a direct consequence from lack of liability, accountability, and regulation, and honestly people in the overall media have stopped listening to many of the experts. They don't want to know how bad, bad is. The breadth and depth of scale is enough to drive one a bit crazy when looking at the unvarnished reality, its such a complete departure from what is told that it becomes disbelief. The people are largely powerless to mitigate the issues as most of the market is silently nationalized in one form or another. Its no longer about the features people need, but about coercing the market where the only choice is what gets shoveled. Do you suppose the average middle class worker has the headspace to worry about their county tracking their minute movements through suites of radio sensors (TPMS/OBD-2), or someone hacking into their car through the telematics unit while their driving and disabling the braking, or inducing race conditions related to safety-critical systems. While we may not care domestically about many of these things when we are told, given our stance on free-speech, if your a critic of China; they might care, and no ones stopping them because the security deficits are almost equally imposed through inaction as they are through action. Many of these uses are also no commonly disclosed; and manipulated rhetoric is jamming communication channels. Cable modem security for instance requires a mandated backward compatibility to a 48bit RSA key (Cyphercon Talk), and while there are elevated security modes it boots in that mode, and pulls the config down remotely making it vulnerable to Eclipse. Money-printing is largely what drives these incentives towards a dysfunctional market. https://cyphercon.com/portfolio/exposing-the-threat-uncoveri... https://www.youtube.com/watch?v=_hk2DsCWGXs

▲

michaelt 6 days ago | parent | prev [-]

> I've seen valid issued Google Trust certs floating around that were not authorized by the owner of the SAN being visited

Did you confirm with the owner that they were unauthorized?

And can you point to the certificates in the Certificate Transparency logs?

▲

trod1234 5 days ago | parent [-]

> Did you confirm with the owner that they were unauthorized.

I confirmed with their support. I provided the certificate chain and sha-256 fingerprint being served, and they said it didn't match, and that they use a different provider for their certificates; which I suppose is Godaddy, at least that's what shows up on the crt.sh logs.

I don't run nor have access to a CT log for auditing. I was told it was revoked though. If you want to look into it you can; I'm including the CRT chain below.

There have been a number of issues uncovered while investigating the silent failing calls. Ranging from silent fail denial of service, unauthorized password changes after-the-fact, and with login credentials it seems some form of MITM translation, and these are consistent across many devices when accessing the site, or services.

The issues seem to clear up every month or so for about 1-2 weeks starting on the 4th, a new set of certs shows up every couple months.

The translation thing is that voip.ms doesn't allow @ symbols in passwords. About 2-4 hours after a lost password recovery the password that is set stops working with no change logged server-side. Replacing the token I used instead of @ with @, logs in without error from the edge successfully after that period occurs, despite their password policy/validator silent failing, and being against the use of that token which they have confirmed is still in effect. Craziness.

I can only conclude that this is some form MITM. I've seen similar issues across other vendors as well, but they haven't noticed failures yet, or have been completely non-responsive (with no phone contact), so they haven't been looking into it too hard, if at all.

www.voip.ms

SHA-256 Fingerprint:

FB:4E:10:D3:58:0A:01:1A:9E:82:92:5B:33:AE:1C:E3:6D:5C:B3:97:53:73:B4:1C:4A:7E:30:8B:49:44:BA:24

Support staff said they were investigating the issue, but its been almost 90 days now without next-steps, explanation, or anything actionable. I've been getting stonewalled for quite awhile now.

I've seen this enough times now recently that TLS doesn't seem trustworthy anymore. Its quite maddening too where at a fairly fundamental level in troubleshooting; what you see on one end isn't what is actually being hosted on the other.

▲

SahAssar 5 days ago | parent [-]

The cert you mention is this one, right? https://crt.sh/?id=18844641499

Seems like they use cloudflare as their DNS provider, which uses Google as their cert provider and this has happened before with them. See for example https://news.ycombinator.com/item?id=40452307 where I got into the same discussion but where it was due to porkbun using cloudflare as their DNS backend.

I would not treat this as TLS being untrustworthy, I would treat it as cloudflare issuing certs for you even if you just want to use their DNS (and not their WAF or other products).

▲

trod1234 5 days ago | parent [-]

If that is the one that matches what was posted then yes. A cursory glance, those fingerprints match so I'd say yes that is one of the certificates with which we've narrowed issues down to.

I would think that a large company like voip, would have their certificate provider documented, and available to check when there is a significant issue, so when their customers report a problem and they say it isn't a match that's exactly what they mean.

Also, the only indicator of any of these issues which prompted all this, with any real explanation, is with the cert and by extension the secure tunnel which cannot be trusted. The issues extend to not just this one vendor, but several others as well across multiple devices and network connections. The translation issue appears only visible with this provider though due I suspect to their non-standard password policy, which appears contradictory at the edge in function.

Saying TLS is trustworthy, where things that shouldn't ever happen under TLS guarantees are happening, with no viable alternative explanation for the issues, where they have been troubleshooted over months at both ends, including all the way down to the raw physical level of the OSI level for traffic (at least at the edge)... that doesn't leave anyone with anywhere to go.

Still Trust TLS? If there were a reasonable alternative explanation that ties in and touches on all the issues both mentioned and unmentioned, I'd be the first to consider it.

Clearly there are objective issues where service cannot be relied upon for a business, let alone for anything less demanding. The issues are also not vendor specific and seem to be coupled loosely to geographical region. The only commonality are these Google Trust certificates.

Communications services fail silently across multiple providers, contact forms either fail to submit with weird HTTP error codes for large providers or submit with success only to have non-response with no verifiable record of submission after-the-fact, support chat's fail to load or load with a chatbot pretending to be a human with no record after-the-fact, emails disappear, and many other things that effectively rely upon only one thing in common when taken in aggregate.

When its one thing that happens in isolation at a single vendor sure I'd be more receptive to it being something else on the vendor side, but when every single path fails regularly in the same chaotic way in narrow time horizons, there's a significant issue, and one must question not only the guarantees, but the only common links.

Three or more path failures related to communication, within a short time horizon, all leading back to TLS guarantees, is beyond an astronomical bayes probability that something there is silently happening over those links that shouldn't be happening.

	▲	SahAssar 5 days ago \| parent [-]
		The TLS guarantees are to the edge of the infra of the vendor. If that vendor has decided to use infra providers that issue certs for them without their knowledge and they have not implemented CAA then the blame is not on TLS, it is on the vendor. A lot of what you mention can be explained by cloudflare issuing certs for customers without them knowing when using their DNS, an agressive WAF or other much more plausible things.

▲

arcfour 6 days ago | parent | prev | next [-]

Personally I leave the anonymous daily usage ping enabled in the (perhaps naive) hope that my use of Firefox being counted might help keep it afloat/popular. I guess that's not really in the spirit of a privacy-focused hardening guide but it is something that some may wish to consider.

Some may argue that the data that is included is a bit much for a "daily usage ping," an assertion that I won't dispute—but I will say that I appreciate the fact that Firefox even provides this level of transparency in the first place:

https://dictionary.telemetry.mozilla.org/apps/firefox_deskto...

▲

david_draco 5 days ago | parent | prev | next [-]

I'm surprised Firefox Multi-Account Containers isn't mentioned. Seems ideal to me to keep Web Universes separate.

▲

ris 5 days ago | parent | prev [-]

Disable WebGL. Not in a funny javascripty extension, in about:config.

	▲	tremon 5 days ago \| parent [-]
		Do you have an authoritative link for how to do so? The wisdom of the web seems to alternatively refer to webgl.disabled, webgl.disable-wgl or webgl.enable-webgl2 . I know I can simply disable them all, but I still like to know why there's three toggles and what each one covers.