Search the Community

Hello everybody! I was looking arround in this forum and saw a lot of questions about Firefox-leaks, -tracking and -hardening. I just took some time to share my knowledge about this topic with you and hope it might help some people. I think sharing is caring and whenever I found useful tipps on the Internet, I was very thankful for the the people who took their time to help others and wrote it down. The following are settings I find myself doing over and over again after new Friefox-Installation. So here is my part for helping this community to grow their knowledge: (All settings can be changed, by typing "about:config" into the URL-bar of Firefox and press enter; then search for the following entries) 1. "network.http.send.RefererHeader" - sends the next website that you visit information from which site you come (e.g. by clicking on a link) standard-value is "2" which means it does send these informations. setting the value to "1" is the same, only if you click on images, the RefererHeader won't be send anymore. setting the value to "0" disables the RefererHeaders completely. 2. "network.http.sendSecureSiteReferer" - same just for https-websites standard-value is "true" setting value to "false" (by double-clicking) disables this for https-webistes as well. 3. "privacy.trackingprotection.enabled" - the "new" tracking-protection from Firefox standard-value should be on an up-to-date Firefox already on "true" which enables this feature. setting the value to "false" disables it. 4. "geo.enabled" - Geo-tracking standard-value is "true" setting value to "false" disables geo-tracking. 5. "browser.safebrowsing.enabled" - here the Firefox checks if a website is secure by comparing it with Google's database. standard-value is "true" which means that everytime you call a website, the Firefox will send information about URL's to Google to compare if it's safe. setting the value to "false" disables this. (Please note that this setting doesn't make your Firefox more secure, but you can disable sending all the URL's to Google) 6. "browser.safebrowsing.malware.enabled" - does the same as above with your downloads. standard value is "true" setting the value to "false" will disable sending all you download-information to Google. (I've seen a lot of things that Google marks as unsecure although the datas were secure) 7. "dom.event.clipboardevents.enabled" - If you copy a text or picture from a webpage, Firefox will tell it the webpage and the webpage could eventually prevent you from copying these things. standard-value is "true" setting the value to "false" won't tell the website anymore, so it can't prevent you from copying things. 8. "dom.event.contextmenu.enabled" - shows a website that you call it's information via contextmenu (e.g. the source-code of the website). Also here the website then could prevent you from doing this. standard-value is "true" setting the value to "false" will allow you to do what you want to do again. 9. "network.cookie.cookieBehavior" - Cookie behavior in your Firefox. standard-value is "0" which means tha ALL cookies are allowed. setting the value to "1" will only allow cookies from the current website on which you are on. setting the value to "2" will disable all cookies. (Note that for some website you will need cookies, otherwise they won't work anymore). 10. "network.cookie.lifetimePolicy" - setting for how long a Cookie is saved in the Firefox standard-value is "0" which means cookies can stay forever, or in other words: The webiste decides how long they stay, which is mostly forever. setting the value to "1" means that Firefox will ask you how long a cookie may survive. setting the value to "2" means that cookies only live until you close the Firefox. setting the value to "3" means that cookies will survive as long as you specified in "network.cookie.lifetime.days" 11. "network.dnsCacheEntries" - setting for how many entries of websites that you visited will Firefox remember. standard-value is "400" you can set a value of whatever you think you'll need. 12. "network.dnsCacheExpiration" - in seconds, how long does Firefox remember dns-queries. *Please Note if you take this down to a small value, it will cause more traffic, because then Firefox has to ask more times for dns depending on the value set. 13. "places.history.enabled" - the classic Firefox-history of which websites you called. 14. "browser.formfill.enabled" - Firefox remembers which entries were made into formular-fields. standard-value is "true" setting the value to "false" will disable the memory of these information at all. 15. "browser.cache.disk.enable" - visited websites will be saved in the cache 16. "browser.cache.memory.enable" - same as above, just for your (RAM) memory. 17. "browser.cache.offline.enable" - same as above for your offline-cache. 18. "browser.send_pings" - websites can track you by sending pings to your Firefox. should be set "false" to disable this. 19. "network.dns.disableIPv6" - as long as you don't use IPv6 you can disable this setting, it's also the standard value in a new Firefox. If your ISP upgrades to IPv6 don't forget to enable this again. 20. "network.prefetch.next" - If you are on a website, your Firefoy will already load the next website which you can surf to from the current website as a background-job. This is for loading these websites faster if you click on them. standard-value is "true" setting the value to "false" will disable this feature. 21. "webgl.disabled" - this setting is for the creation of the so called "canvas-datas" which can be used to easily track a user. 22. "media.peerconnection.enabled" - this is for WebRTC-requests of websites. Even when using a VPN and this setting is enabled, you can be tracked and your real IP will leak. setting the value to "false" will disable those requests. I would appreciate if you use this thread to post your settings, if I forgot something important, or if some settings will change in the future. I hope you enjoy P.S. Here you got some websites to test if your browser leaks: 1. https://ipleak.net/ 2. https://diafygi.github.io/webrtc-ips/ 3. http://ipv6leak.com/ regards, me