Customize Privacy Settings in Mozilla Firefox: Part 1 (about:config)

This post[1] marks the first in a series of posts covering the customization of privacy settings in Mozilla Firefox. In this post, we will look at some modifications using the “about:config” interface (those unfamiliar with about:config might want to check out the Knowledge Base article for more information).

To open about:config, type about:config in in the Location Bar (address bar) and press Enter to display the list of preferences, as shown in the picture below. If you see a page with the warning message, This might void your warranty!, click the button labeled I’ll be careful, I promise!, to continue (in fact, there is no warranty whatsoever, it is more a joke to ensure that users are aware of what they are about to do). Use the check box there to avoid the warning in the future.

List of preferences in the about:config interface of Mozilla Firefox
The about:config interface in Mozilla Firefox

The rest of this post alphabetically lists all the entries that—in our opinion—warrant a closer examination. Wherever possible we linked to official Mozilla sites that might help you to better understand what you are doing. We also tried to give a brief description of every entry and to justify our recommendation.

Before we get started please read and understand the following disclaimer: These changes are thought to maximize your browsing privacy and will not contribute to your user experience. On the contrary, some of these changes might break some–lazily designed—websites; therefore it is up to you to decide whether you want to compromise your privacy or your browsing experience. Alternatively, you could run two (or more) Firefoxes in parallel (we will cover that in a future post).

browser.privatebrowsing.autostart [boolean]

Description

Private Browsing allows you to browse the Internet without saving any information about which sites and pages you have visited. One caveat though: Private Browsing does not make you anonymous on the Internet. Your Internet service provider, employer, or the sites themselves can still track what pages you visit. Private Browsing also does not protect you from keyloggers or spyware that may be installed on your computer.

Recommendation

At WebDevelopmentAid we always use the Private Browsing mode, we therefore recommend to set browser.privatebrowsing.autostart to true.

browser.safebrowsing.enabled [boolean]

Description

Mozilla Firefox incorporates the Google Safe Browsing extension in its own Phishing Protection feature to detect and warn users of phishy web sites. This preference, along with browser.safebrowsing.remoteLookups, determines whether or not the Safe Browsing functionality is active.

Recommendation

As a privacy-minded individual you might have some problems that this feature compares visited URLs against a blacklist and submits URLs to Google to determine whether a site is legitimate. Moreover, with every update of your blacklist and with every encounter of a reported phishing site you will send your existing Google cookie. We at WebDevelopmentAid strongly recommend to set this entry to false.

browser.safebrowsing.malware.enabled [boolean]

Description

As part of its Safe Browsing feature, Mozilla Firefox keeps track of a list of malware to compare against data the user downloads. In the event the user downloads known malware, a warning can be displayed. This preference determines whether to enable these malware checks.

Recommendation

We have the same issues with this feature as with Mozilla’s Phishing Protection. In our view the slightly increased safety is not worth the compromise of privacy. We therefore suggest to set this entry to false so that Firefox does not download malware blacklists and does not check downloads.

browser.startup.page [integer]

Description

Each time the web browser starts, this preference is consulted to determine what to display.

Recommendation

By default this entry is set to 1, i.e. to start with the web page defined as the home page which by default is the Mozilla Firefox Start Page, a Google search box. As we have outlined in another post you should take care of  your digital footprint by searching where you want to find and by diversifying your search providers. Although it might seem convenient to start your browsing session with a Google search instead of typing the correct URL in the adress bar, from a privacy-oriented perspective you should avoid doing that. Therefore, we recommend to set the browser.startup.page entry to 0, i.e. to start with a blank page (about:blank).

datareporting.healthreport.uploadEnabled [boolean]

Description

The Firefox Health Report provides its users with information about their browser’s performance and stability over time. Mozilla uses this data to provide the users with meaningful comparisons and tips. Mozilla also uses the aggregated data to improve the development of future versions of Firefox.

Recommendation

Even if you choose not to share data with Mozilla, you will still be able to see information about your browser when you go to the Firefox Health Report page, and you can view the comparison data from other browsers that are sharing their data. The comparison data will not be based on the data from your browser since it was not shared with Mozilla.  We recommend to set this entry to false.

dom.event.clipboardevents.enabled [boolean]

Description

This entry lets websites get notifications if the user copies, pastes, or cuts something from a web page, and it lets them know which part of the page had been selected. The emitting of the oncopy, oncut and onpaste events are controlled by this preference.

Depending on how a website is configured, it may be able to read or modify clipboard events that happen on it. For example, a script could record what you are copying or modify the contents. A website could also use these events to block you from copying any contents, again by manipulating the event so that nothing is returned; finally these events can be used to prevent paste operations on the site, so that you cannot paste data into form fields but have to type it instead.

Recommendation

Besides being annoying, as you may get a different result than expected, it does have privacy implications as well as sites can log what users paste—into text areas only we assume—as well. Knowing that this setting might potentially interfere with the functionality of some online editors we have set this entry to false (i.e. the oncopy, oncut and onpaste events are disabled for web content)—and we have yet to notice any functionality loss.

dom.storage.enabled [boolean]

Description

The Web Applications 1.0 specification defines a mechanism allowing web pages to store information with a web browser (similar to cookies) called “client-side session and persistent storage.”

Recommendation

DOM storage has become a much bigger threat to our privacy than the dreaded cookies were. Unfortunately this technology is certainly set to leave cookies in the dust. We strongly advise you to change the default value of this configuration to false, i.e. to disable client-side session and persistent storage for web pages entirely.

general.useragent.override [string]

Description

Whenever you visit a web page, your browser sends a “User Agent” header to the website saying precisely which operating system and web browser you are using which allows an automated recognition of user agents for the sake of tailoring responses to avoid particular user agent limitations.

The user agent contributes to the information that the client sends to the server and this information might be quite unique since the string can vary considerably from user to user. An experiment by the Electronic Frontier Foundation has shown that the browser User Agent string usually carries 5-15 bits of identifying information (about 10.5 bits on average). That means that on average, only one person in about 1,500 (210.5) will have the same User Agent as you. On its own, that is not enough to recreate cookies and track people perfectly, but in combination with another detail like geolocation to a particular ZIP code or having an uncommon browser plugin installed, the User Agent string becomes a real privacy problem.

Recommendation

We suggest a “privacy through obscurity”-approach and recommend that you spoof your User Agent to a more common one. We at WebDevelopmentAid use “Mozilla/5.0 (X11; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0“. This user agent informs the server that  we use the current Mozilla Firefox 26.0 browser [Mozilla/5.0 and Firefox/26.0] using a X Window System [X11], running on a Linux operating system [Linux] with 64-bit Intel CPU [x86-64], which has a Gecko engine inside [Gecko]. To test the uniqueness of various User Agent strings please use the EFF’s Panopticlick test.

To change your User Agent in the about:config settings you have to follow these steps:

  1. Type useragent into the filter box. We are looking for the general.useragent.override preference, but it probably will not exist on your system.Screenshot of about:config interface: Type useragent into the filter box
  2. To create the preference, right-click on the about:config page, point to New, and select String.Screenshot of about:config interface: right-click on the about:config page, point to New, and select String
  3. Name the preference general.useragent.overrideScreenshot of the about:config interface: Name the preference general.useragent.override
  4. Enter your desired user agent as the value of the preference. UserAgentString.com is a great reference page for valid User Agents. If you want to use our User Agent, copy/paste the string below and click OK.
    Mozilla/5.0 (X11; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
    Mozilla/5.0 (X11; Linux x86_64; rv:29.0) Gecko/20100101 Firefox/29.0
  5. Make sure that you keep the version number of your User Agent string up-to-date; otherwise your supposedly generic header becomes quite unique.

geo.enabled [boolean]

Description

When enabled this feature determines your location by sending your computer’s IP address, information about the nearby wireless access points, and a random client identifier, which is assigned by Google, that expires every 2 weeks; Google Location Services then returns your estimated geolocation (e.g. latitude and longitude) which Firefox will pass to the website that requested it.

Recommendation

Although geolocation APIs are only accessible to the application after you have explicitly allowed it, we set this entry to false just to make sure we not accidentally grant a site access to our data.

geo.wifi.uri [string]

Description

This entry controls which geolocation service provider to use. The default is set to https://www.google.com/loc/json (i.e. Google Location Services).

Recommendation

Setting the above-mentioned geo.enabled to false already completely disables the geolocation API. But if the link to Google makes you nervous, we recommend to change the string to “http://127.0.0.1“. So even if somehow the API is enabled  Firefox will not contact Google but will instead just loop back to itself.

network.dns.disablePrefetch [boolean]

Description

DNS prefetching was implemented to improve page load time. This feature allows Firefox to perform domain name resolution proactively and in parallel for hyperlinks, images, CSS, JavaScript, and other webpage content. Whenever Firefox encounters a web address, it needs to convert that text address into an IP number before it can use it. It does this by looking up the name and IP number through a DNS server. By using a small amount of bandwidth to resolve the IP addresses in advance, when a user eventually clicks on any one of them they will load up more quickly.

Recommendation

As recommended in a paper “DNS Prefetching and Its Privacy Implications” by Srinivas Krishnan and Fabian Monrose, presented at the LEET ’10 conference 2010, we have set this entry to true.

network.cookie.cookieBehavior [integer]

Description

This preference controls how the browser allows cookies.

Recommendation

Unless you use a cookie-management add-on—like Cookie Monster for example—that provides additional options and controls setting as well, we recommend to set this entry to 1, i.e. to “Only cookies from the originating server are allowed”.

network.cookie.lifetimePolicy [integer]

Description

This preference controls when cookies expire.

Recommendation

Unless you use a cookie-managment add-on—like Cookie Monster for example—that provides additional options and controls setting as well, we recommend to set this entry to 2, i.e. to “The cookie expires at the end of the session (when the browser closes)”.

network.http.sendRefererHeader [integer]

Description

HTTP is the application-layer protocol with which most web pages are transferred. As part of HTTP, requests can include a “Referer” (sic) header that tells the server which page the user was on that initiated the request. Servers use this information to track users’ paths through the site and possibly provide additional features.

Additionally, in JavaScript, the current page’s referrer is exposed in the DOM through document.referrer. Scripts running on the page can consult this property to see the same information that was sent in the Referer header.

This preference controls when to send the Referer header and set document.referrer.

Recommendation

Although Mozilla cautions that disabling referrer headers may cause some functionality on some sites to no longer work, from a privacy-focused perspective we recommend to change the setting to 0, i.e. to never send the Referer HTTP header—we at WebDevelopmentAid have not experienced any inconveniences.

Instead of setting your header sending globally by changing the about:config entry, you could use the RefControl which will set your header sending on a site-by-site basis.

network.http.sendSecureXSiteReferrer [boolean]

Description

Similarly to the network.http.sendRefererHeader-setting, this setting controls whether a Referer should be sent between two secure sites.

Recommendation

As for the network.http.sendRefererHeader, disabling the sending of referrers between secure sites might adversely affect some sites. Nonetheless, we recommend that those concerned with privacy should set this entry to false.

Instead of setting your header sending globally by changing the about:config entry, you could use the RefControl which will set your header sending on a site-by-site basis.

network.prefetch-next [boolean]

Description

Link prefetching is a browser mechanism, which utilizes browser idle time to download or prefetch documents that the user might visit in the near future. A web page provides a set of prefetching hints to the browser, and after the browser is finished loading the page, it begins silently prefetching specified documents and stores them in its cache. When the user visits one of the prefetched documents, it can be served up quickly out of the browser’s cache.

Recommendation

For sites that use prefetching, disabling this preference will decrease the amount of bandwidth used, but increase the time required to navigate sites. We stronlgy recommend to set this entry to false.

privacy.donottrackheader.enabled [boolean]

Description

The “Do Not Track” feature is a mechanism that allows to communicate a user’s tracking preferences to websites. User tracking is performed by websites, including advertisers and analytics services as well as social sites, to gather information about the user’s web browsing pattern. This includes the history of sites visited along with preferences stated and purchases made. Such sites often use this information to show advertisements for products or services specifically targeted based on the user’s profile.

Recommendation

Many privacy advocates complain that the “Do Not Track” header does not work since most tracking companies do not recongnize this standard and they suggest not to send this header as it tends to increase browser uniqueness. We would argue, however, that the “Do Not Track” header is a—albeit weak—statement of discontent with the current state of advertising on the web. Therefore, we recommend that you enable this feature by setting it to true. Since the content of the header sent depends on the value of the privacy.donottrackheader.value-entry make sure to set this entry accordingly.

privacy.donottrackheader.value [integer]

Description

This setting controls the content of the header sent when privacy.donottrackheader.enabled is set to true.

Recommendation

In order to send a header stating the request not to be tracked, make sure this entry is set to 1.

toolkit.telemetry.enabled [boolean]

Description

Firefox includes a statistics functionality called “telemetry” that sends Mozilla usage, performance, and responsiveness statistics about user interface features, memory, hardware configuration along with IP address.

This feature is turned off by default in general release versions of Firefox and Firefox Beta. In order to enable Aurora and Nightly testers to provide more efficient feedback, Usage Statistics are enabled by default on Aurora and Nightly.

Recommendation

We know how important it is for the developers to get feedback about their products and we like the developers of Mozilla Firefox a lot—but for the sake of our privacy we recommend to set this entry to false.

Final remarks

Make no mistake, these changes will not grant you anonymity while on the internet—far from it. Rather these changes help to decrease your digital footprint and help to evade the prying eyes of some tracking companies.

Moreover, if you feel not comfortable using the about:config settings, you can access most settings with the preference manager in Firefox.

If you have any questions or remarks about any of these settings or suggestions for other changes, please leave a comment or contact us via e-mail.


[1] This post was updated on January 11, 2014, to include dom.event.clipboardevents.enabled. On May 9, 2014 this post was updated to include an updated version of the user agent string.

About these ads

3 thoughts on “Customize Privacy Settings in Mozilla Firefox: Part 1 (about:config)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s