{"uuid": "b2b6cd8f-55f3-49fb-9e34-b30915c34b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://gist.github.com/vseredi/153fca0b63bab02237be36c7c5e29109", "content": "//\n/******************************************************************************\n * user.js                                                                    *\n * https://github.com/pyllyukko/user.js                                       *\n ******************************************************************************/\n\n/******************************************************************************\n * SECTION: HTML5 / APIs / DOM                                                *\n ******************************************************************************/\n\n// PREF: Disable Service Workers\n// https://developer.mozilla.org/en-US/docs/Web/API/Worker\n// https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker_API\n// https://wiki.mozilla.org/Firefox/Push_Notifications#Service_Workers\n// NOTICE: Disabling ServiceWorkers breaks functionality on some sites (Google Street View...)\n// NOTICE: Disabling ServiceWorkers breaks Firefox Sync\n// Unknown security implications\n// CVE-2016-5259, CVE-2016-2812, CVE-2016-1949, CVE-2016-5287 (fixed)\nuser_pref(\"dom.serviceWorkers.enabled\",\t\t\t\ttrue);\n\n// PREF: Disable web notifications\n// https://support.mozilla.org/en-US/questions/1140439\nuser_pref(\"dom.webnotifications.enabled\",\t\t\tfalse);\n\n// PREF: Disable DOM timing API\n// https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI\n// https://www.w3.org/TR/navigation-timing/#privacy\n// NOTICE: Disabling DOM timing API breaks item pages in AliExpress (https://github.com/pyllyukko/user.js/issues/561)\nuser_pref(\"dom.enable_performance\",\t\t\t\ttrue);\n\n// PREF: Disable resource timing API\n// https://www.w3.org/TR/resource-timing/#privacy-security\n// NOTICE: Disabling resource timing API breaks some DDoS protection pages (Cloudflare)\nuser_pref(\"dom.enable_resource_timing\",\t\t\t\ttrue);\n\n// PREF: Make sure the User Timing API does not provide a new high resolution timestamp\n// https://trac.torproject.org/projects/tor/ticket/16336\n// https://www.w3.org/TR/2013/REC-user-timing-20131212/#privacy-security\nuser_pref(\"dom.enable_user_timing\",\t\t\t\tfalse);\n\n// PREF: Disable Web Audio API\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1288359\n// NOTICE: Web Audio API is required for Unity web player/games\nuser_pref(\"dom.webaudio.enabled\",\t\t\t\ttrue);\n\n// PREF: Disable Location-Aware Browsing (geolocation)\n// https://www.mozilla.org/en-US/firefox/geolocation/\nuser_pref(\"geo.enabled\",\t\t\t\t\tfalse);\n\n// PREF: When geolocation is enabled, use Mozilla geolocation service instead of Google\n// https://bugzilla.mozilla.org/show_bug.cgi?id=689252\nuser_pref(\"geo.wifi.uri\", \"https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%\");\n\n// PREF: When geolocation is enabled, don't log geolocation requests to the console\nuser_pref(\"geo.wifi.logging.enabled\", false);\n\n// PREF: Disable raw TCP socket support (mozTCPSocket)\n// https://trac.torproject.org/projects/tor/ticket/18863\n// https://www.mozilla.org/en-US/security/advisories/mfsa2015-97/\n// https://developer.mozilla.org/docs/Mozilla/B2G_OS/API/TCPSocket\nuser_pref(\"dom.mozTCPSocket.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable DOM storage (disabled)\n// http://kb.mozillazine.org/Dom.storage.enabled\n// https://html.spec.whatwg.org/multipage/webstorage.html\n// NOTICE-DISABLED: Disabling DOM storage is known to cause`TypeError: localStorage is null` errors\n//user_pref(\"dom.storage.enabled\",\t\tfalse);\n\n// PREF: Disable leaking network/browser connection information via Javascript\n// Network Information API provides general information about the system's connection type (WiFi, cellular, etc.)\n// https://developer.mozilla.org/en-US/docs/Web/API/Network_Information_API\n// https://wicg.github.io/netinfo/#privacy-considerations\n// https://bugzilla.mozilla.org/show_bug.cgi?id=960426\nuser_pref(\"dom.netinfo.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable network API (Firefox < 32)\n// https://developer.mozilla.org/en-US/docs/Web/API/Connection/onchange\n// https://www.torproject.org/projects/torbrowser/design/#fingerprinting-defenses\nuser_pref(\"dom.network.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable WebRTC entirely to prevent leaking internal IP addresses (Firefox < 42)\n// NOTICE: Disabling WebRTC breaks peer-to-peer file sharing tools (reep.io ...)\nuser_pref(\"media.peerconnection.enabled\",\t\t\tfalse);\n\n// PREF: Don't reveal your internal IP when WebRTC is enabled (Firefox >= 42)\n// https://wiki.mozilla.org/Media/WebRTC/Privacy\n// https://github.com/beefproject/beef/wiki/Module%3A-Get-Internal-IP-WebRTC\nuser_pref(\"media.peerconnection.ice.default_address_only\",\ttrue); // Firefox 42-51\nuser_pref(\"media.peerconnection.ice.no_host\",\t\t\ttrue); // Firefox >= 52\n\n// PREF: Disable WebRTC getUserMedia, screen sharing, audio capture, video capture\n// https://wiki.mozilla.org/Media/getUserMedia\n// https://blog.mozilla.org/futurereleases/2013/01/12/capture-local-camera-and-microphone-streams-with-getusermedia-now-enabled-in-firefox/\n// https://developer.mozilla.org/en-US/docs/Web/API/Navigator\nuser_pref(\"media.navigator.enabled\",\t\t\t\ttrue);\nuser_pref(\"media.navigator.video.enabled\",\t\t\ttrue);\nuser_pref(\"media.getusermedia.screensharing.enabled\",\t\ttrue);\nuser_pref(\"media.getusermedia.audiocapture.enabled\",\t\ttrue);\n\n// PREF: Disable battery API (Firefox < 52)\n// https://developer.mozilla.org/en-US/docs/Web/API/BatteryManager\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1313580\nuser_pref(\"dom.battery.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable telephony API\n// https://wiki.mozilla.org/WebAPI/Security/WebTelephony\nuser_pref(\"dom.telephony.enabled\",\t\t\t\ttrue);\n\n// PREF: Disable \"beacon\" asynchronous HTTP transfers (used for analytics)\n// https://developer.mozilla.org/en-US/docs/Web/API/navigator.sendBeacon\nuser_pref(\"beacon.enabled\",\t\t\t\t\tfalse);\n\n// PREF: Disable clipboard event detection (onCut/onCopy/onPaste) via Javascript\n// https://web.archive.org/web/20210416195937/https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/dom.event.clipboardevents.enabled\n// https://github.com/pyllyukko/user.js/issues/287\n// NOTICE: Disabling clipboard events breaks Ctrl+C/X/V copy/cut/paste functionaility in JS-based web applications (Google Docs...)\nuser_pref(\"dom.event.clipboardevents.enabled\",\t\t\ttrue);\n\n// PREF: Disable \"copy to clipboard\" functionality via Javascript (Firefox >= 41)\n// https://hg.mozilla.org/mozilla-central/rev/2f9f8ea4b9c3\n// https://github.com/pyllyukko/user.js/issues/287\n// NOTICE: Disabling clipboard operations will break legitimate JS-based \"copy to clipboard\" functionality\nuser_pref(\"dom.allow_cut_copy\", true);\n\n// PREF: Disable speech recognition\n// https://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html\n// https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition\n// https://wiki.mozilla.org/HTML5_Speech_API\nuser_pref(\"media.webspeech.recognition.enable\",\t\t\tfalse);\n\n// PREF: Disable speech synthesis\n// https://developer.mozilla.org/en-US/docs/Web/API/SpeechSynthesis\nuser_pref(\"media.webspeech.synth.enabled\",\t\t\tfalse);\n\n// PREF: Disable sensor API\n// https://wiki.mozilla.org/Sensor_API\nuser_pref(\"device.sensors.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable pinging URIs specified in HTML  ping= attributes\n// http://kb.mozillazine.org/Browser.send_pings\nuser_pref(\"browser.send_pings\",\t\t\t\t\tfalse);\n\n// PREF: When browser pings are enabled, only allow pinging the same host as the origin page\n// http://kb.mozillazine.org/Browser.send_pings.require_same_host\nuser_pref(\"browser.send_pings.require_same_host\",\t\ttrue);\n\n// PREF: Disable IndexedDB (disabled)\n// https://developer.mozilla.org/en-US/docs/IndexedDB\n// https://en.wikipedia.org/wiki/Indexed_Database_API\n// https://wiki.mozilla.org/Security/Reviews/Firefox4/IndexedDB_Security_Review\n// http://forums.mozillazine.org/viewtopic.php?p=13842047\n// https://github.com/pyllyukko/user.js/issues/8\n// NOTICE-DISABLED: IndexedDB could be used for tracking purposes, but is required for some add-ons to work (notably uBlock), so is left enabled\n//user_pref(\"dom.indexedDB.enabled\",\t\tfalse);\n\n// TODO: \"Access Your Location\" \"Maintain Offline Storage\" \"Show Notifications\"\n\n// PREF: Disable gamepad API to prevent USB device enumeration\n// https://www.w3.org/TR/gamepad/\n// https://trac.torproject.org/projects/tor/ticket/13023\nuser_pref(\"dom.gamepad.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable virtual reality devices APIs\n// https://developer.mozilla.org/en-US/Firefox/Releases/36#Interfaces.2FAPIs.2FDOM\n// https://developer.mozilla.org/en-US/docs/Web/API/WebVR_API\nuser_pref(\"dom.vr.enabled\",\t\t\t\t\tfalse);\n\n// PREF: Disable vibrator API\nuser_pref(\"dom.vibrator.enabled\",           false);\n\n// PREF: Disable Archive API (Firefox < 54)\n// https://wiki.mozilla.org/WebAPI/ArchiveAPI\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1342361\nuser_pref(\"dom.archivereader.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable webGL\n// https://en.wikipedia.org/wiki/WebGL\n// https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/\n// NOTICE: Disabling WebGL breaks WebGL-based websites/applications (windy, meteoblue...)\nuser_pref(\"webgl.disabled\",\t\t\t\t\tfalse);\n// PREF: When webGL is enabled, use the minimum capability mode\nuser_pref(\"webgl.min_capability_mode\",\t\t\t\ttrue);\n// PREF: When webGL is enabled, disable webGL extensions\n// https://developer.mozilla.org/en-US/docs/Web/API/WebGL_API#WebGL_debugging_and_testing\nuser_pref(\"webgl.disable-extensions\",\t\t\t\ttrue);\n// PREF: When webGL is enabled, force enabling it even when layer acceleration is not supported\n// https://trac.torproject.org/projects/tor/ticket/18603\nuser_pref(\"webgl.disable-fail-if-major-performance-caveat\",\ttrue);\n// PREF: When webGL is enabled, do not expose information about the graphics driver\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1171228\n// https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug_renderer_info\nuser_pref(\"webgl.enable-debug-renderer-info\",\t\t\tfalse);\n// somewhat related...\n//user_pref(\"pdfjs.enableWebGL\",\t\t\t\t\tfalse);\n\n// PREF: Spoof dual-core CPU\n// https://trac.torproject.org/projects/tor/ticket/21675\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1360039\nuser_pref(\"dom.maxHardwareConcurrency\",\t\t\t\t4);\n\n// PREF: Disable WebAssembly\n// https://webassembly.org/\n// https://en.wikipedia.org/wiki/WebAssembly\n// https://trac.torproject.org/projects/tor/ticket/21549\n// NOTICE: WebAssembly is required for Unity web player/games\nuser_pref(\"javascript.options.wasm\",\t\t\t\ttrue);\n\n/******************************************************************************\n * SECTION: Misc                                                              *\n ******************************************************************************/\n\n// PREF: Disable face detection\nuser_pref(\"camera.control.face_detection.enabled\",\t\tfalse);\n\n// PREF: Disable GeoIP lookup on your address to set default search engine region\n// https://trac.torproject.org/projects/tor/ticket/16254\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine\nuser_pref(\"browser.search.countryCode\",\t\t\t\t\"US\");\nuser_pref(\"browser.search.region\",\t\t\t\t\"US\");\nuser_pref(\"browser.search.geoip.url\",\t\t\t\t\"\");\n\n// PREF: Set Accept-Language HTTP header to en-US regardless of Firefox localization\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language\nuser_pref(\"intl.accept_languages\",\t\t\t\t\"en-US, en\");\n\n// PREF: Don't use OS values to determine locale, force using Firefox locale setting\n// http://kb.mozillazine.org/Intl.locale.matchOS\nuser_pref(\"intl.locale.matchOS\",\t\t\t\tfalse);\n\n// Use LANG environment variable to choose locale (disabled)\n//pref(\"intl.locale.requested\", \"\");\n\n// PREF: Don't use Mozilla-provided location-specific search engines\nuser_pref(\"browser.search.geoSpecificDefaults\",\t\t\tfalse);\n\n// PREF: Do not automatically send selection to clipboard on some Linux platforms\n// http://kb.mozillazine.org/Clipboard.autocopy\nuser_pref(\"clipboard.autocopy\",\t\t\t\t\tfalse);\n\n// PREF: Prevent leaking application locale/date format using JavaScript\n// https://bugzilla.mozilla.org/show_bug.cgi?id=867501\n// https://hg.mozilla.org/mozilla-central/rev/52d635f2b33d\nuser_pref(\"javascript.use_us_english_locale\",\t\t\ttrue);\n\n// PREF: Do not submit invalid URIs entered in the address bar to the default search engine\n// http://kb.mozillazine.org/Keyword.enabled\nuser_pref(\"keyword.enabled\",\t\t\t\t\ttrue);\n\n// PREF: Don't trim HTTP off of URLs in the address bar.\n// https://bugzilla.mozilla.org/show_bug.cgi?id=665580\nuser_pref(\"browser.urlbar.trimURLs\",\t\t\t\tfalse);\n\n// PREF: Disable preloading of autocomplete URLs.\n// https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks\nuser_pref(\"browser.urlbar.speculativeConnect.enabled\", false);\n\n// PREF: Don't try to guess domain names when entering an invalid domain name in URL bar\n// http://www-archive.mozilla.org/docs/end-user/domain-guessing.html\nuser_pref(\"browser.fixup.alternate.enabled\",\t\t\tfalse);\n\n// PREF: When browser.fixup.alternate.enabled is enabled, strip password from 'user:password@...' URLs\n// https://github.com/pyllyukko/user.js/issues/290#issuecomment-303560851\nuser_pref(\"browser.fixup.hide_user_pass\", true);\n\n// PREF: Send DNS request through SOCKS when SOCKS proxying is in use\n// https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers\nuser_pref(\"network.proxy.socks_remote_dns\",\t\t\ttrue);\n\n// PREF: Don't monitor OS online/offline connection state\n// https://trac.torproject.org/projects/tor/ticket/18945\nuser_pref(\"network.manage-offline-status\",\t\t\tfalse);\n\n// PREF: Enforce Mixed Active Content Blocking\n// https://support.mozilla.org/t5/Protect-your-privacy/Mixed-content-blocking-in-Firefox/ta-p/10990\n// https://developer.mozilla.org/en-US/docs/Site_Compatibility_for_Firefox_23#Non-SSL_contents_on_SSL_pages_are_blocked_by_default\n// https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/\nuser_pref(\"security.mixed_content.block_active_content\",\ttrue);\n\n// PREF: Enforce Mixed Passive Content blocking (a.k.a. Mixed Display Content)\n// NOTICE: Enabling Mixed Display Content blocking can prevent images/styles... from loading properly when connection to the website is only partially secured\nuser_pref(\"security.mixed_content.block_display_content\",\ttrue);\n\n// PREF: Disable JAR from opening Unsafe File Types\n// http://kb.mozillazine.org/Network.jar.open-unsafe-types\n// CIS Mozilla Firefox 24 ESR v1.0.0 - 3.7 \nuser_pref(\"network.jar.open-unsafe-types\",\t\t\tfalse);\n\n// CIS 2.7.4 Disable Scripting of Plugins by JavaScript\n// http://forums.mozillazine.org/viewtopic.php?f=7&t=153889\nuser_pref(\"security.xpconnect.plugin.unrestricted\",\t\tfalse);\n\n// PREF: Set File URI Origin Policy\n// http://kb.mozillazine.org/Security.fileuri.strict_origin_policy\n// CIS Mozilla Firefox 24 ESR v1.0.0 - 3.8\nuser_pref(\"security.fileuri.strict_origin_policy\",\t\ttrue);\n\n// PREF: Disable Displaying Javascript in History URLs\n// http://kb.mozillazine.org/Browser.urlbar.filter.javascript\n// CIS 2.3.6 \nuser_pref(\"browser.urlbar.filter.javascript\",\t\t\ttrue);\n\n// PREF: Disable asm.js\n// http://asmjs.org/\n// https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/\n// https://www.mozilla.org/en-US/security/advisories/mfsa2015-50/\n// https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2712\nuser_pref(\"javascript.options.asmjs\",\t\t\t\ttrue);\n\n// PREF: Disable SVG in OpenType fonts\n// https://wiki.mozilla.org/SVGOpenTypeFonts\n// https://github.com/iSECPartners/publications/tree/master/reports/Tor%20Browser%20Bundle\nuser_pref(\"gfx.font_rendering.opentype_svg.enabled\",\t\ttrue);\n\n// PREF: Disable in-content SVG rendering (Firefox >= 53) (disabled)\n// NOTICE-DISABLED: Disabling SVG support breaks many UI elements on many sites\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1216893\n// https://github.com/iSECPartners/publications/raw/master/reports/Tor%20Browser%20Bundle/Tor%20Browser%20Bundle%20-%20iSEC%20Deliverable%201.3.pdf#16\n//user_pref(\"svg.disabled\", true);\n\n// PREF: Disable video stats to reduce fingerprinting threat\n// https://bugzilla.mozilla.org/show_bug.cgi?id=654550\n// https://github.com/pyllyukko/user.js/issues/9#issuecomment-100468785\n// https://github.com/pyllyukko/user.js/issues/9#issuecomment-148922065\nuser_pref(\"media.video_stats.enabled\",\t\t\t\tfalse);\n\n// PREF: Don't reveal build ID\n// Value taken from Tor Browser\n// https://bugzilla.mozilla.org/show_bug.cgi?id=583181\nuser_pref(\"general.buildID.override\",\t\t\t\t\"20100101\");\nuser_pref(\"browser.startup.homepage_override.buildID\",\t\t\"20100101\");\n\n// PREF: Don't use document specified fonts to prevent installed font enumeration (fingerprinting)\n// https://github.com/pyllyukko/user.js/issues/395\n// https://browserleaks.com/fonts\n// https://github.com/pyllyukko/user.js/issues/120\nuser_pref(\"browser.display.use_document_fonts\",\t\t\t1);\n\n// PREF: Enable only whitelisted URL protocol handlers\n// http://kb.mozillazine.org/Network.protocol-handler.external-default\n// http://kb.mozillazine.org/Network.protocol-handler.warn-external-default\n// http://kb.mozillazine.org/Network.protocol-handler.expose.%28protocol%29\n// https://news.ycombinator.com/item?id=13047883\n// https://bugzilla.mozilla.org/show_bug.cgi?id=167475\n// https://github.com/pyllyukko/user.js/pull/285#issuecomment-298124005\n// NOTICE: Disabling nonessential protocols breaks all interaction with custom protocols such as mailto:, irc:, magnet: ... and breaks opening third-party mail/messaging/torrent/... clients when clicking on links with these protocols\n// TODO: Add externally-handled protocols from Windows 8.1 and Windows 10 (currently contains protocols only from Linux and Windows 7) that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)\n// TODO: Add externally-handled protocols from Mac OS X that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)\n// If you want to enable a protocol, set network.protocol-handler.expose.(protocol) to true and network.protocol-handler.external.(protocol) to:\n//   * true, if the protocol should be handled by an external application\n//   * false, if the protocol should be handled internally by Firefox\nuser_pref(\"network.protocol-handler.warn-external-default\",\ttrue);\nuser_pref(\"network.protocol-handler.external.http\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.https\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.javascript\",\tfalse);\nuser_pref(\"network.protocol-handler.external.moz-extension\",\tfalse);\nuser_pref(\"network.protocol-handler.external.ftp\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.file\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.about\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.chrome\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.blob\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.data\",\t\tfalse);\nuser_pref(\"network.protocol-handler.expose-all\",\t\tfalse);\nuser_pref(\"network.protocol-handler.expose.http\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.https\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.javascript\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.moz-extension\",\ttrue);\nuser_pref(\"network.protocol-handler.expose.ftp\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.file\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.about\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.chrome\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.blob\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.data\",\t\ttrue);\n\n// PREF: Always block media autoplay\n// https://support.mozilla.org/en-US/kb/block-autoplay\nuser_pref(\"media.autoplay.default\",\t\t\t\t5);\n\n/******************************************************************************\n * SECTION: Extensions / plugins                                                       *\n ******************************************************************************/\n\n// PREF: Ensure you have a security delay when installing add-ons (milliseconds)\n// http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox\n// http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/\nuser_pref(\"security.dialog_enable_delay\",\t\t\t1000);\n\n// PREF: Require signatures\n// https://wiki.mozilla.org/Addons/Extension_Signing\n//user_pref(\"xpinstall.signatures.required\",\t\ttrue);\n\n// PREF: Opt-out of add-on metadata updates\n// https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/\nuser_pref(\"extensions.getAddons.cache.enabled\",\t\t\tfalse);\n\n// PREF: Opt-out of themes (Persona) updates\n// https://support.mozilla.org/t5/Firefox/how-do-I-prevent-autoamtic-updates-in-a-50-user-environment/td-p/144287\nuser_pref(\"lightweightThemes.update.enabled\",\t\t\tfalse);\n\n// PREF: Disable Flash Player NPAPI plugin\n// http://kb.mozillazine.org/Flash_plugin\nuser_pref(\"plugin.state.flash\",\t\t\t\t\t0);\n\n// PREF: Disable Java NPAPI plugin\nuser_pref(\"plugin.state.java\",\t\t\t\t\t0);\n\n// PREF: Disable sending Flash Player crash reports\nuser_pref(\"dom.ipc.plugins.flash.subprocess.crashreporter.enabled\",\tfalse);\n\n// PREF: When Flash crash reports are enabled, don't send the visited URL in the crash report\nuser_pref(\"dom.ipc.plugins.reportCrashURL\",\t\t\tfalse);\n\n// PREF: When Flash is enabled, download and use Mozilla SWF URIs blocklist\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1237198\n// https://github.com/mozilla-services/shavar-plugin-blocklist\nuser_pref(\"browser.safebrowsing.blockedURIs.enabled\", true);\n\n// PREF: Disable Gnome Shell Integration NPAPI plugin\nuser_pref(\"plugin.state.libgnome-shell-browser-plugin\",\t\t0);\n\n// PREF: Disable the bundled OpenH264 video codec (disabled)\n// http://forums.mozillazine.org/viewtopic.php?p=13845077&sid=28af2622e8bd8497b9113851676846b1#p13845077\n//user_pref(\"media.gmp-provider.enabled\",\t\tfalse);\n\n// PREF: Enable plugins click-to-play\n// https://wiki.mozilla.org/Firefox/Click_To_Play\n// https://blog.mozilla.org/security/2012/10/11/click-to-play-plugins-blocklist-style/\nuser_pref(\"plugins.click_to_play\",\t\t\t\ttrue);\n\n// PREF: Updates addons automatically\n// https://blog.mozilla.org/addons/how-to-turn-off-add-on-updates/\nuser_pref(\"extensions.update.enabled\",\t\t\t\ttrue);\n\n// PREF: Enable add-on and certificate blocklists (OneCRL) from Mozilla\n// https://wiki.mozilla.org/Blocklisting\n// https://blocked.cdn.mozilla.net/\n// http://kb.mozillazine.org/Extensions.blocklist.enabled\n// http://kb.mozillazine.org/Extensions.blocklist.url\n// https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/\n// Updated at interval defined in extensions.blocklist.interval (default: 86400)\nuser_pref(\"extensions.blocklist.enabled\",\t\t\ttrue);\nuser_pref(\"services.blocklist.update_enabled\",\t\t\ttrue);\n\n// PREF: Decrease system information leakage to Mozilla blocklist update servers\n// https://trac.torproject.org/projects/tor/ticket/16931\nuser_pref(\"extensions.blocklist.url\",\t\t\t\t\"https://blocklist.addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/\");\n\n// PREF: Disable system add-on updates (hidden & always-enabled add-ons from Mozilla)\n// https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html\n// https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/\n// https://github.com/pyllyukko/user.js/issues/419\n// https://dxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManager.jsm#1248-1257\n// NOTICE: Disabling system add-on updates prevents Mozilla from \"hotfixing\" your browser to patch critical problems (one possible use case from the documentation)\nuser_pref(\"extensions.systemAddon.update.enabled\",\t\tfalse);\n\n/******************************************************************************\n * SECTION: Firefox (anti-)features / components                              *                            *\n ******************************************************************************/\n\n// PREF: Disable Extension recommendations (Firefox >= 65)\n// https://support.mozilla.org/en-US/kb/extension-recommendations\n// https://brokkr.net/2025/08/10/firefox-aboutconfig-tricks-3-dont-recommend-extensions/\nuser_pref(\"browser.newtabpage.activity-stream.asrouter.userprefs.cfr\",\tfalse);\nuser_pref(\"extensions.htmlaboutaddons.recommendations.enabled\",\t\tfalse);\n\n// PREF: Trusted Recursive Resolver (DNS-over-HTTPS) (disabled)\n// https://wiki.mozilla.org/Trusted_Recursive_Resolver\n//user_pref(\"network.trr.mode\",\t\t\t\t\t0);\n\n// PREF: Disable WebIDE\n// https://trac.torproject.org/projects/tor/ticket/16222\n// https://developer.mozilla.org/docs/Tools/WebIDE\nuser_pref(\"devtools.webide.enabled\",\t\t\t\tfalse);\nuser_pref(\"devtools.webide.autoinstallADBHelper\",\t\tfalse);\nuser_pref(\"devtools.webide.autoinstallFxdtAdapters\",\t\tfalse);\n\n// PREF: Disable remote debugging\n// https://developer.mozilla.org/en-US/docs/Tools/Remote_Debugging/Debugging_Firefox_Desktop\n// https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox#Advanced_settings\nuser_pref(\"devtools.debugger.remote-enabled\",\t\t\tfalse);\nuser_pref(\"devtools.chrome.enabled\",\t\t\t\tfalse);\nuser_pref(\"devtools.debugger.force-local\",\t\t\ttrue);\n\n// PREF: Disable Mozilla telemetry/experiments\n// https://wiki.mozilla.org/Platform/Features/Telemetry\n// https://wiki.mozilla.org/Privacy/Reviews/Telemetry\n// https://wiki.mozilla.org/Telemetry\n// https://www.mozilla.org/en-US/legal/privacy/firefox.html#telemetry\n// https://support.mozilla.org/t5/Firefox-crashes/Mozilla-Crash-Reporter/ta-p/1715\n// https://wiki.mozilla.org/Security/Reviews/Firefox6/ReviewNotes/telemetry\n// https://gecko.readthedocs.io/en/latest/browser/experiments/experiments/manifest.html\n// https://wiki.mozilla.org/Telemetry/Experiments\n// https://support.mozilla.org/en-US/questions/1197144\n// https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html#id1\nuser_pref(\"toolkit.telemetry.enabled\",\t\t\t\tfalse);\nuser_pref(\"toolkit.telemetry.unified\",\t\t\t\tfalse);\nuser_pref(\"toolkit.telemetry.archive.enabled\",\t\t\tfalse);\nuser_pref(\"experiments.supported\",\t\t\t\tfalse);\nuser_pref(\"experiments.enabled\",\t\t\t\tfalse);\nuser_pref(\"experiments.manifest.uri\",\t\t\t\t\"\");\n\n// PREF: Disable daily usage ping\n// https://support.mozilla.org/1/firefox/140.2.0/Linux/en-US/usage-ping-settings\nuser_pref(\"datareporting.usage.uploadEnabled\",\t\t\tfalse);\n\n// PREF: Disallow Necko to do A/B testing\n// https://trac.torproject.org/projects/tor/ticket/13170\nuser_pref(\"network.allow-experiments\",\t\t\t\tfalse);\n\n// PREF: Disable sending Firefox crash reports to Mozilla servers\n// https://wiki.mozilla.org/Breakpad\n// http://kb.mozillazine.org/Breakpad\n// https://dxr.mozilla.org/mozilla-central/source/toolkit/crashreporter\n// https://bugzilla.mozilla.org/show_bug.cgi?id=411490\n// A list of submitted crash reports can be found at about:crashes\nuser_pref(\"breakpad.reportURL\",\t\t\t\t\t\"\");\n\n// PREF: Disable sending reports of tab crashes to Mozilla (about:tabcrashed), don't nag user about unsent crash reports\n// https://hg.mozilla.org/mozilla-central/file/tip/browser/app/profile/firefox.js\nuser_pref(\"browser.tabs.crashReporting.sendReport\",\t\tfalse);\nuser_pref(\"browser.crashReports.unsubmittedCheck.enabled\",\tfalse);\n\n// PREF: Disable FlyWeb (discovery of LAN/proximity IoT devices that expose a Web interface)\n// https://wiki.mozilla.org/FlyWeb\n// https://wiki.mozilla.org/FlyWeb/Security_scenarios\n// https://docs.google.com/document/d/1eqLb6cGjDL9XooSYEEo7mE-zKQ-o-AuDTcEyNhfBMBM/edit\n// http://www.ghacks.net/2016/07/26/firefox-flyweb\nuser_pref(\"dom.flyweb.enabled\",\t\t\t\t\tfalse);\n\n// PREF: Disable the UITour backend\n// https://trac.torproject.org/projects/tor/ticket/19047#comment:3\nuser_pref(\"browser.uitour.enabled\",\t\t\t\tfalse);\n\n// PREF: Enable Firefox Tracking Protection\n// https://wiki.mozilla.org/Security/Tracking_protection\n// https://support.mozilla.org/en-US/kb/tracking-protection-firefox\n// https://support.mozilla.org/en-US/kb/tracking-protection-pbm\n// https://kontaxis.github.io/trackingprotectionfirefox/\n// https://feeding.cloud.geek.nz/posts/how-tracking-protection-works-in-firefox/\nuser_pref(\"privacy.trackingprotection.enabled\",\t\t\ttrue);\nuser_pref(\"privacy.trackingprotection.pbmode.enabled\",\t\ttrue);\n\n// PREF: Enable contextual identity Containers feature (Firefox >= 52)\n// NOTICE: Containers are not available in Private Browsing mode\n// https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers\nuser_pref(\"privacy.userContext.enabled\",\t\t\ttrue);\n\n// PREF: Enable Firefox's anti-fingerprinting mode (\"resist fingerprinting\" or RFP) (Tor Uplift project)\n// https://wiki.mozilla.org/Security/Tor_Uplift/Tracking\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1333933\n// https://wiki.mozilla.org/Security/Fingerprinting\n// NOTICE: RFP breaks some keyboard shortcuts used in certain websites (see #443)\n// NOTICE: RFP changes your time zone\n// NOTICE: RFP breaks some DDoS protection pages (Cloudflare)\nuser_pref(\"privacy.resistFingerprinting\",\t\t\ttrue);\n\n// PREF: disable mozAddonManager Web API [FF57+]\n// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330\n// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1406795\n// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1415644\n// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1453988\n// https://trac.torproject.org/projects/tor/ticket/26114\nuser_pref(\"privacy.resistFingerprinting.block_mozAddonManager\", true);\nuser_pref(\"extensions.webextensions.restrictedDomains\", \"\");\n\n// PREF: enable RFP letterboxing / resizing of inner window [FF67+] (disabled)\n// https://bugzilla.mozilla.org/1407366\n//user_pref(\"privacy.resistFingerprinting.letterboxing\", true);\n//user_pref(\"privacy.resistFingerprinting.letterboxing.dimensions\", \"800x600, 1000x1000, 1600x900\");\n\n// PREF: disable showing about:blank/maximized window as soon as possible during startup [FF60+]\n// https://bugzilla.mozilla.org/1448423\nuser_pref(\"browser.startup.blankWindow\", false);\n\n// PREF: Disable the built-in PDF viewer\n// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2743\n// https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/\n// https://www.mozilla.org/en-US/security/advisories/mfsa2015-69/\nuser_pref(\"pdfjs.disabled\",\t\t\t\t\ttrue);\n\n// PREF: Disable collection/sending of the health report (healthreport.sqlite*)\n// https://support.mozilla.org/en-US/kb/firefox-health-report-understand-your-browser-perf\n// https://gecko.readthedocs.org/en/latest/toolkit/components/telemetry/telemetry/preferences.html\nuser_pref(\"datareporting.healthreport.uploadEnabled\",\t\tfalse);\nuser_pref(\"datareporting.healthreport.service.enabled\",\t\tfalse);\nuser_pref(\"datareporting.policy.dataSubmissionEnabled\",\t\tfalse);\n// \"Allow Firefox to make personalized extension recommendations\"\nuser_pref(\"browser.discovery.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable Shield/Heartbeat/Normandy (Mozilla user rating telemetry)\n// https://wiki.mozilla.org/Advocacy/heartbeat\n// https://trac.torproject.org/projects/tor/ticket/19047\n// https://trac.torproject.org/projects/tor/ticket/18738\n// https://wiki.mozilla.org/Firefox/Shield\n// https://github.com/mozilla/normandy\n// https://support.mozilla.org/en-US/kb/shield\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1370801\n// https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout\nuser_pref(\"app.normandy.enabled\", false);\nuser_pref(\"app.normandy.api_url\", \"\");\nuser_pref(\"extensions.shield-recipe-client.enabled\",\t\tfalse);\nuser_pref(\"app.shield.optoutstudies.enabled\",\t\t\tfalse);\n\n\n// PREF: Disable Firefox Hello (disabled) (Firefox < 49)\n// https://wiki.mozilla.org/Loop\n// https://support.mozilla.org/t5/Chat-and-share/Support-for-Hello-discontinued-in-Firefox-49/ta-p/37946\n// NOTICE-DISABLED: Firefox Hello requires setting `media.peerconnection.enabled` and `media.getusermedia.screensharing.enabled` to true, `security.OCSP.require` to false to work.\n//user_pref(\"loop.enabled\",\t\tfalse);\n\n// PREF: Disable Firefox Hello metrics collection\n// https://groups.google.com/d/topic/mozilla.dev.platform/nyVkCx-_sFw/discussion\nuser_pref(\"loop.logDomains\",\t\t\t\t\tfalse);\n\n// PREF: Enable Auto Update (disabled)\n// NOTICE: Fully automatic updates are disabled and left to package management systems on Linux. Windows users may want to change this setting.\n// CIS 2.1.1\n//user_pref(\"app.update.auto\",\t\t\t\t\ttrue);\n\n// PREF: Enforce checking for Firefox updates\n// http://kb.mozillazine.org/App.update.enabled\n// NOTICE: Update check page might incorrectly report Firefox ESR as out-of-date\nuser_pref(\"app.update.enabled\",                 true);\n\n// PREF: Enable blocking reported web forgeries\n// https://wiki.mozilla.org/Security/Safe_Browsing\n// http://kb.mozillazine.org/Safe_browsing\n// https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work\n// http://forums.mozillazine.org/viewtopic.php?f=39&t=2711237&p=12896849#p12896849\n// CIS 2.3.4\nuser_pref(\"browser.safebrowsing.enabled\",\t\t\ttrue); // Firefox < 50\nuser_pref(\"browser.safebrowsing.phishing.enabled\",\t\ttrue); // firefox >= 50\n\n// PREF: Enable blocking reported attack sites\n// http://kb.mozillazine.org/Browser.safebrowsing.malware.enabled\n// CIS 2.3.5\nuser_pref(\"browser.safebrowsing.malware.enabled\",\t\ttrue);\n\n// PREF: Disable querying Google Application Reputation database for downloaded binary files\n// https://www.mozilla.org/en-US/firefox/39.0/releasenotes/\n// https://wiki.mozilla.org/Security/Application_Reputation\nuser_pref(\"browser.safebrowsing.downloads.remote.enabled\",\tfalse);\n\n// PREF: Disable Pocket\n// https://support.mozilla.org/en-US/kb/save-web-pages-later-pocket-firefox\n// https://github.com/pyllyukko/user.js/issues/143\nuser_pref(\"browser.pocket.enabled\",\t\t\t\tfalse);\nuser_pref(\"extensions.pocket.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable \"Recommended by Pocket\" in Firefox Quantum\nuser_pref(\"browser.newtabpage.activity-stream.feeds.section.topstories\",\tfalse);\n\n// PREF: Enable Global Privacy Control (GPC) (Firefox >= 120)\n// https://support.mozilla.org/1/firefox/126.0/Linux/en-US/global-privacy-control\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-GPC\n// https://globalprivacycontrol.org/\nuser_pref(\"privacy.globalprivacycontrol.enabled\",\t\ttrue);\n\n// PREF: Hide weather on New Tab\nuser_pref(\"browser.newtabpage.activity-stream.showWeather\",\tfalse);\n\n/******************************************************************************\n * SECTION: Automatic connections                                             *\n ******************************************************************************/\n\n// PREF: Limit the connection keep-alive timeout to 15 seconds (disabled)\n// https://github.com/pyllyukko/user.js/issues/387\n// http://kb.mozillazine.org/Network.http.keep-alive.timeout\n// https://httpd.apache.org/docs/current/mod/core.html#keepalivetimeout\n//user_pref(\"network.http.keep-alive.timeout\",\t\t\t15);\n\n// PREF: Disable prefetching of  URLs\n// http://kb.mozillazine.org/Network.prefetch-next\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#Is_there_a_preference_to_disable_link_prefetching.3F\nuser_pref(\"network.prefetch-next\",\t\t\t\tfalse);\n\n// PREF: Disable DNS prefetching\n// http://kb.mozillazine.org/Network.dns.disablePrefetch\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching\nuser_pref(\"network.dns.disablePrefetch\",\t\t\ttrue);\nuser_pref(\"network.dns.disablePrefetchFromHTTPS\",\t\ttrue);\n\n// PREF: Disable the predictive service (Necko)\n// https://wiki.mozilla.org/Privacy/Reviews/Necko\nuser_pref(\"network.predictor.enabled\",\t\t\t\tfalse);\n\n// PREF: Reject .onion hostnames before passing the to DNS\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1228457\n// RFC 7686\nuser_pref(\"network.dns.blockDotOnion\",\t\t\t\ttrue);\n\n// PREF: Disable search suggestions in the search bar\n// http://kb.mozillazine.org/Browser.search.suggest.enabled\nuser_pref(\"browser.search.suggest.enabled\",\t\t\tfalse);\n\n// PREF: Disable \"Show search suggestions in location bar results\"\nuser_pref(\"browser.urlbar.suggest.searches\",\t\t\tfalse);\n// PREF: When using the location bar, don't suggest URLs from browsing history\nuser_pref(\"browser.urlbar.suggest.history\",\t\t\tfalse);\n// PREF: Disable Firefox Suggest\n// https://www.ghacks.net/2021/09/09/how-to-disable-firefox-suggest/\n// https://support.mozilla.org/en-US/kb/navigate-web-faster-firefox-suggest\nuser_pref(\"browser.urlbar.groupLabels.enabled\", false); // Firefox >= 93\n\n// PREF: Disable SSDP\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1111967\nuser_pref(\"browser.casting.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable automatic downloading of OpenH264 codec\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_media-capabilities\n// https://andreasgal.com/2014/10/14/openh264-now-in-firefox/\nuser_pref(\"media.gmp-gmpopenh264.enabled\",\t\t\tfalse);\nuser_pref(\"media.gmp-manager.url\",\t\t\t\t\"\");\n\n// PREF: Disable speculative pre-connections\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_speculative-pre-connections\n// https://bugzilla.mozilla.org/show_bug.cgi?id=814169\nuser_pref(\"network.http.speculative-parallel-limit\",\t\t0);\n\n// PREF: Disable downloading homepage snippets/messages from Mozilla\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_mozilla-content\n// https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service\nuser_pref(\"browser.aboutHomeSnippets.updateUrl\",\t\t\"\");\n\n// PREF: Never check updates for search engines\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_auto-update-checking\nuser_pref(\"browser.search.update\",\t\t\t\tfalse);\n\n// PREF: Disable automatic captive portal detection (Firefox >= 52.0)\n// https://support.mozilla.org/en-US/questions/1157121\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_network-detection\nuser_pref(\"network.captive-portal-service.enabled\",\t\tfalse);\nuser_pref(\"network.connectivity-service.enabled\",\t\tfalse);\n\n// PREF: Disable (parts of?) \"TopSites\"\nuser_pref(\"browser.topsites.contile.enabled\",\t\t\t\tfalse);\nuser_pref(\"browser.newtabpage.activity-stream.feeds.topsites\",\t\tfalse);\nuser_pref(\"browser.newtabpage.activity-stream.showSponsoredTopSites\",\tfalse);\n\n/******************************************************************************\n * SECTION: HTTP                                                              *\n ******************************************************************************/\n\n// PREF: Disallow NTLMv1\n// https://bugzilla.mozilla.org/show_bug.cgi?id=828183\nuser_pref(\"network.negotiate-auth.allow-insecure-ntlm-v1\",\tfalse);\n// it is still allowed through HTTPS. uncomment the following to disable it completely.\n//user_pref(\"network.negotiate-auth.allow-insecure-ntlm-v1-https\",\t\tfalse);\n\n// PREF: Enable CSP 1.1 script-nonce directive support\n// https://bugzilla.mozilla.org/show_bug.cgi?id=855326\nuser_pref(\"security.csp.experimentalEnabled\",\t\t\ttrue);\n\n// PREF: Enable Content Security Policy (CSP)\n// https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP\nuser_pref(\"security.csp.enable\",\t\t\t\ttrue);\n\n// PREF: Enable Subresource Integrity\n// https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity\n// https://wiki.mozilla.org/Security/Subresource_Integrity\nuser_pref(\"security.sri.enable\",\t\t\t\ttrue);\n\n// PREF: DNT HTTP header (disabled)\n// https://www.mozilla.org/en-US/firefox/dnt/\n// https://en.wikipedia.org/wiki/Do_not_track_header\n// https://dnt-dashboard.mozilla.org\n// https://github.com/pyllyukko/user.js/issues/11\n// NOTICE: Do No Track must be enabled manually\n//user_pref(\"privacy.donottrackheader.enabled\",\t\ttrue);\n\n// PREF: Send a referer header with the target URI as the source (disabled)\n// https://bugzilla.mozilla.org/show_bug.cgi?id=822869\n// https://github.com/pyllyukko/user.js/issues/227\n// NOTICE-DISABLED: Spoofing referers breaks functionality on websites relying on authentic referer headers\n// NOTICE-DISABLED: Spoofing referers breaks visualisation of 3rd-party sites on the Lightbeam addon\n// NOTICE-DISABLED: Spoofing referers disables CSRF protection on some login pages not implementing origin-header/cookie+token based CSRF protection\n// TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs\n//user_pref(\"network.http.referer.spoofSource\",\t\t\ttrue);\n\n// PREF: Don't send referer headers when following links across different domains\n// https://github.com/pyllyukko/user.js/issues/227\n// https://github.com/pyllyukko/user.js/issues/328\n// https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/\n// https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks\n// NOTICE: Blocking referers across same eTLD sites breaks some login flows relying on them, consider lowering this pref to 1\nuser_pref(\"network.http.referer.XOriginPolicy\",\t\t2);\n\n// PREF: Trim HTTP referer headers to only send the scheme, host, and port\n// https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks\nuser_pref(\"network.http.referer.trimmingPolicy\",\t2);\n\n// PREF: When sending Referer across domains, only send scheme, host, and port in the Referer header\n// https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks\nuser_pref(\"network.http.referer.XOriginTrimmingPolicy\",\t2);\n\n// PREF: Accept Only 1st Party Cookies\n// http://kb.mozillazine.org/Network.cookie.cookieBehavior#1\n// NOTICE: Blocking 3rd-party cookies breaks a number of payment gateways\n// CIS 2.5.1\nuser_pref(\"network.cookie.cookieBehavior\",\t\t\t1);\n\n// PREF: Enable first-party isolation\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1299996\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1260931\n// https://wiki.mozilla.org/Security/FirstPartyIsolation\n// NOTICE: First-party isolation breaks Microsoft Teams\n// NOTICE: First-party isolation causes HTTP basic auth to ask for credentials for every new tab (see #425)\nuser_pref(\"privacy.firstparty.isolate\",\t\t\t\ttrue);\n\n// PREF: Make sure that third-party cookies (if enabled) never persist beyond the session.\n// https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/\n// http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly\n// https://developer.mozilla.org/en-US/docs/Cookies_Preferences_in_Mozilla#network.cookie.thirdparty.sessionOnly\nuser_pref(\"network.cookie.thirdparty.sessionOnly\",\t\ttrue);\n\n// PREF: Spoof User-agent (disabled)\n//user_pref(\"general.useragent.override\",\t\t\t\t\"Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0\");\n//user_pref(\"general.appname.override\",\t\t\t\t\"Netscape\");\n//user_pref(\"general.appversion.override\",\t\t\t\"5.0 (Windows)\");\n//user_pref(\"general.platform.override\",\t\t\t\t\"Win32\");\n//user_pref(\"general.oscpu.override\",\t\t\t\t\"Windows NT 6.1\");\n\n/*******************************************************************************\n * SECTION: Caching                                                            *\n ******************************************************************************/\n\n// PREF: Permanently enable private browsing mode\n// https://support.mozilla.org/en-US/kb/Private-Browsing\n// https://wiki.mozilla.org/PrivateBrowsing\n// NOTICE: You can not view or inspect cookies when in private browsing: https://bugzilla.mozilla.org/show_bug.cgi?id=823941\n// NOTICE: When Javascript is enabled, Websites can detect use of Private Browsing mode\n// NOTICE: Private browsing breaks Kerberos authentication\n// NOTICE: Disables \"Containers\" functionality (see below)\n// NOTICE: \"Always use private browsing mode\" (browser.privatebrowsing.autostart) disables the possibility to use password manager: https://support.mozilla.org/en-US/kb/usernames-and-passwords-are-not-saved#w_private-browsing\nuser_pref(\"browser.privatebrowsing.autostart\",\t\t\ttrue);\n\n// PREF: Do not download URLs for the offline cache\n// http://kb.mozillazine.org/Browser.cache.offline.enable\nuser_pref(\"browser.cache.offline.enable\",\t\t\tfalse);\n\n// PREF: Clear history when Firefox closes\n// https://support.mozilla.org/en-US/kb/Clear%20Recent%20History#w_how-do-i-make-firefox-clear-my-history-automatically\n// NOTICE: Installing user.js will remove your browsing history, caches and local storage.\n// NOTICE: Installing user.js **will remove your saved passwords** (https://github.com/pyllyukko/user.js/issues/27)\n// NOTICE: Clearing open windows on Firefox exit causes 2 windows to open when Firefox starts https://bugzilla.mozilla.org/show_bug.cgi?id=1334945\nuser_pref(\"privacy.sanitize.sanitizeOnShutdown\",\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.cache\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.cookies\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.downloads\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.formdata\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.history\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.offlineApps\",\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.sessions\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.openWindows\",\t\ttrue);\n\n// PREF: Set time range to \"Everything\" as default in \"Clear Recent History\"\nuser_pref(\"privacy.sanitize.timeSpan\",\t\t\t\t0);\n\n// PREF: Clear everything but \"Site Preferences\" in \"Clear Recent History\"\nuser_pref(\"privacy.cpd.offlineApps\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.cache\",\t\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.cookies\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.downloads\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.formdata\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.history\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.sessions\",\t\t\t\ttrue);\n\n// PREF: Don't remember browsing history\nuser_pref(\"places.history.enabled\",\t\t\t\tfalse);\n\n// PREF: Don't remember recently closed tabs\nuser_pref(\"browser.sessionstore.max_tabs_undo\",\t\t0);\n\n// PREF: Disable disk cache\n// http://kb.mozillazine.org/Browser.cache.disk.enable\nuser_pref(\"browser.cache.disk.enable\",\t\t\t\tfalse);\n\n// PREF: Disable memory cache (disabled)\n// http://kb.mozillazine.org/Browser.cache.memory.enable\n//user_pref(\"browser.cache.memory.enable\",\t\tfalse);\n\n// PREF: Disable Caching of SSL Pages\n// CIS Version 1.2.0 October 21st, 2011 2.5.8\n// http://kb.mozillazine.org/Browser.cache.disk_cache_ssl\nuser_pref(\"browser.cache.disk_cache_ssl\",\t\t\tfalse);\n\n// PREF: Disable download history\n// CIS Version 1.2.0 October 21st, 2011 2.5.5\nuser_pref(\"browser.download.manager.retention\",\t\t\t0);\n\n// PREF: Disable password manager (use an external password manager!)\n// CIS Version 1.2.0 October 21st, 2011 2.5.2\nuser_pref(\"signon.rememberSignons\",\t\t\t\tfalse);\n\n// PREF: Disable form autofill, don't save information entered in web page forms and the Search Bar\nuser_pref(\"browser.formfill.enable\",\t\t\t\tfalse);\n\n// PREF: Cookies expires at the end of the session (when the browser closes)\n// http://kb.mozillazine.org/Network.cookie.lifetimePolicy#2\nuser_pref(\"network.cookie.lifetimePolicy\",\t\t\t2);\n\n// PREF: Require manual intervention to autofill known username/passwords sign-in forms\n// http://kb.mozillazine.org/Signon.autofillForms\n// https://www.torproject.org/projects/torbrowser/design/#identifier-linkability\nuser_pref(\"signon.autofillForms\",\t\t\t\tfalse);\n\n// PREF: Disable formless login capture\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1166947\nuser_pref(\"signon.formlessCapture.enabled\",\t\t\tfalse);\n\n// PREF: When username/password autofill is enabled, still disable it on non-HTTPS sites\n// https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317\nuser_pref(\"signon.autofillForms.http\",\t\t\t\tfalse);\n\n// PREF: Show in-content login form warning UI for insecure login fields\n// https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317\nuser_pref(\"security.insecure_field_warning.contextual.enabled\", true);\n\n// PREF: Disable the password manager for pages with autocomplete=off (disabled)\n// https://bugzilla.mozilla.org/show_bug.cgi?id=956906\n// OWASP ASVS V9.1\n// Does not prevent any kind of auto-completion (see browser.formfill.enable, signon.autofillForms)\n//user_pref(\"signon.storeWhenAutocompleteOff\",\t\t\tfalse);\n\n// PREF: Delete Search and Form History\n// CIS Version 1.2.0 October 21st, 2011 2.5.6\nuser_pref(\"browser.formfill.expire_days\",\t\t\t0);\n\n// PREF: Clear SSL Form Session Data\n// http://kb.mozillazine.org/Browser.sessionstore.privacy_level#2\n// Store extra session data for unencrypted (non-HTTPS) sites only.\n// CIS Version 1.2.0 October 21st, 2011 2.5.7\n// NOTE: CIS says 1, we use 2\nuser_pref(\"browser.sessionstore.privacy_level\",\t\t\t2);\n\n// PREF: Delete temporary files on exit\n// https://bugzilla.mozilla.org/show_bug.cgi?id=238789\nuser_pref(\"browser.helperApps.deleteTempFileOnExit\",\t\ttrue);\n\n// PREF: Do not create screenshots of visited pages (relates to the \"new tab page\" feature)\n// https://support.mozilla.org/en-US/questions/973320\n// https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/browser.pagethumbnails.capturing_disabled\nuser_pref(\"browser.pagethumbnails.capturing_disabled\",\t\ttrue);\n\n// PREF: Don't fetch and permanently store favicons for Windows .URL shortcuts created by drag and drop\n// NOTICE: .URL shortcut files will be created with a generic icon\n// Favicons are stored as .ico files in $profile_dir\\shortcutCache\nuser_pref(\"browser.shell.shortcutFavicons\",\t\t\t\t\tfalse);\n\n// PREF: Disable bookmarks backups (default: 15)\n// http://kb.mozillazine.org/Browser.bookmarks.max_backups\nuser_pref(\"browser.bookmarks.max_backups\", 0);\n\n// PREF: Export bookmarks to HTML automatically when closing Firefox (disabled)\n// https://support.mozilla.org/en-US/questions/1176242\n//user_pref(\"browser.bookmarks.autoExportHTML\", \t\t\t\ttrue);\n//user_pref(\"browser.bookmarks.file\",\t'/path/to/bookmarks-export.html');\n\n// PREF: Disable downloading of favicons in response to favicon fingerprinting techniques\n// https://github.com/jonasstrehle/supercookie\n// http://kb.mozillazine.org/Browser.chrome.site_icons\n// https://blog.mozilla.org/security/2021/01/26/supercookie-protections/\nuser_pref(\"browser.chrome.site_icons\",\t\t\t\tfalse);\n\n/*******************************************************************************\n * SECTION: UI related                                                         *\n *******************************************************************************/\n\n// PREF: Enable insecure password warnings (login forms in non-HTTPS pages)\n// https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-over-http-please/\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1319119\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1217156\nuser_pref(\"security.insecure_password.ui.enabled\",\t\ttrue);\n\n// PREF: Disable right-click menu manipulation via JavaScript (disabled)\n//user_pref(\"dom.event.contextmenu.enabled\",\t\tfalse);\n\n// PREF: Disable \"Are you sure you want to leave this page?\" popups on page close\n// https://support.mozilla.org/en-US/questions/1043508\n// NOTICE: disabling \"beforeunload\" events may lead to losing data entered in web forms\n// Does not prevent JS leaks of the page close event.\n// https://developer.mozilla.org/en-US/docs/Web/Events/beforeunload\n//user_pref(\"dom.disable_beforeunload\",    true);\n\n// PREF: Disable Downloading on Desktop\n// CIS 2.3.2\nuser_pref(\"browser.download.folderList\",\t\t\t2);\n\n// PREF: Always ask the user where to download\n// https://developer.mozilla.org/en/Download_Manager_preferences (obsolete)\nuser_pref(\"browser.download.useDownloadDir\",\t\t\tfalse);\n\n// PREF: Disable the \"new tab page\" feature and show a blank tab instead\n// https://wiki.mozilla.org/Privacy/Reviews/New_Tab\n// https://support.mozilla.org/en-US/kb/new-tab-page-show-hide-and-customize-top-sites#w_how-do-i-turn-the-new-tab-page-off\nuser_pref(\"browser.newtabpage.enabled\",\t\t\t\tfalse);\nuser_pref(\"browser.newtab.url\",\t\t\t\t\t\"about:blank\");\n\n// PREF: Disable Snippets\n// https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service\n// https://support.mozilla.org/en-US/kb/snippets-firefox-faq\nuser_pref(\"browser.newtabpage.activity-stream.feeds.snippets\",\tfalse);\n\n// PREF: Disable Activity Stream\n// https://wiki.mozilla.org/Firefox/Activity_Stream\nuser_pref(\"browser.newtabpage.activity-stream.enabled\",\t\tfalse);\n\n// PREF: Disable new tab tile ads & preload\n// http://www.thewindowsclub.com/disable-remove-ad-tiles-from-firefox\n// http://forums.mozillazine.org/viewtopic.php?p=13876331#p13876331\n// https://wiki.mozilla.org/Tiles/Technical_Documentation#Ping\n// https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-source\n// https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-ping\n// TODO: deprecated? not in DXR, some dead links\nuser_pref(\"browser.newtabpage.enhanced\",\t\t\tfalse);\nuser_pref(\"browser.newtab.preload\",\t\t\t\tfalse);\nuser_pref(\"browser.newtabpage.directory.ping\",\t\t\t\"\");\nuser_pref(\"browser.newtabpage.directory.source\",\t\t\"data:text/plain,{}\");\n\n// PREF: Disable Mozilla VPN ads on the about:protections page\n// https://support.mozilla.org/en-US/kb/what-mozilla-vpn-and-how-does-it-work\n// https://en.wikipedia.org/wiki/Mozilla_VPN\n// https://blog.mozilla.org/security/2021/08/31/mozilla-vpn-security-audit/\n// https://www.mozilla.org/en-US/security/advisories/mfsa2021-31/\nuser_pref(\"browser.vpn_promo.enabled\",\t\t\tfalse);\n\n// PREF: Enable Auto Notification of Outdated Plugins (Firefox < 50)\n// https://wiki.mozilla.org/Firefox3.6/Plugin_Update_Awareness_Security_Review\n// CIS Version 1.2.0 October 21st, 2011 2.1.2\n// https://hg.mozilla.org/mozilla-central/rev/304560\nuser_pref(\"plugins.update.notifyUser\",\t\t\t\ttrue);\n\n// PREF: Force Punycode for Internationalized Domain Names\n// http://kb.mozillazine.org/Network.IDN_show_punycode\n// https://www.xudongz.com/blog/2017/idn-phishing/\n// https://wiki.mozilla.org/IDN_Display_Algorithm\n// https://en.wikipedia.org/wiki/IDN_homograph_attack\n// https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/\n// CIS Mozilla Firefox 24 ESR v1.0.0 - 3.6\nuser_pref(\"network.IDN_show_punycode\",\t\t\t\ttrue);\n\n// PREF: Disable inline autocomplete in URL bar\n// http://kb.mozillazine.org/Inline_autocomplete\nuser_pref(\"browser.urlbar.autoFill\",\t\t\t\tfalse);\nuser_pref(\"browser.urlbar.autoFill.typed\",\t\t\tfalse);\n\n// PREF: Disable CSS :visited selectors\n// https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/\n// https://dbaron.org/mozilla/visited-privacy\nuser_pref(\"layout.css.visited_links_enabled\",\t\t\tfalse);\n\n// PREF: Disable URL bar autocomplete and history/bookmarks suggestions dropdown\n// http://kb.mozillazine.org/Disabling_autocomplete_-_Firefox#Firefox_3.5\nuser_pref(\"browser.urlbar.autocomplete.enabled\",\t\tfalse);\n\n// PREF: Do not check if Firefox is the default browser\nuser_pref(\"browser.shell.checkDefaultBrowser\",\t\t\tfalse);\n\n// PREF: When password manager is enabled, lock the password storage periodically\n// CIS Version 1.2.0 October 21st, 2011 2.5.3 Disable Prompting for Credential Storage\nuser_pref(\"security.ask_for_password\",\t\t\t\t2);\n\n// PREF: Lock the password storage every 1 minutes (default: 30)\nuser_pref(\"security.password_lifetime\",\t\t\t\t1);\n\n// PREF: Display a notification bar when websites offer data for offline use\n// http://kb.mozillazine.org/Browser.offline-apps.notify\nuser_pref(\"browser.offline-apps.notify\",\t\t\ttrue);\n\n/******************************************************************************\n * SECTION: Cryptography                                                      *\n ******************************************************************************/\n\n// PREF: Enable HTTPS-Only Mode\n// https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/\n// https://www.feistyduck.com/bulletproof-tls-newsletter/issue_71_firefox_introduces_https_only_mode\nuser_pref(\"dom.security.https_only_mode\",\t\t\ttrue);\n\n// PREF: Enable HSTS preload list (pre-set HSTS sites list provided by Mozilla)\n// https://blog.mozilla.org/security/2012/11/01/preloading-hsts/\n// https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List\n// https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security\nuser_pref(\"network.stricttransportsecurity.preloadlist\",\ttrue);\n\n// PREF: Enable Online Certificate Status Protocol\n// https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol\n// https://www.imperialviolet.org/2014/04/19/revchecking.html\n// https://www.maikel.pro/blog/current-state-certificate-revocation-crls-ocsp/\n// https://wiki.mozilla.org/CA:RevocationPlan\n// https://wiki.mozilla.org/CA:ImprovingRevocation\n// https://wiki.mozilla.org/CA:OCSP-HardFail\n// https://news.netcraft.com/archives/2014/04/24/certificate-revocation-why-browsers-remain-affected-by-heartbleed.html\n// https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html\n// NOTICE: OCSP leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host\n// NOTICE: OCSP is vulnerable to replay attacks when nonce is not configured on the OCSP responder\n// NOTICE: OCSP adds latency (performance)\n// NOTICE: Short-lived certificates are not checked for revocation (security.pki.cert_short_lifetime_in_days, default:10)\n// CIS Version 1.2.0 October 21st, 2011 2.2.4\nuser_pref(\"security.OCSP.enabled\",\t\t\t\t1);\n\n// PREF: Enable OCSP Stapling support\n// https://en.wikipedia.org/wiki/OCSP_stapling\n// https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/\n// https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx\nuser_pref(\"security.ssl.enable_ocsp_stapling\",\t\t\ttrue);\n\n// PREF: Enable OCSP Must-Staple support (Firefox >= 45)\n// https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/\n// https://www.entrust.com/ocsp-must-staple/\n// https://github.com/schomery/privacy-settings/issues/40\n// NOTICE: Firefox falls back on plain OCSP when must-staple is not configured on the host certificate\nuser_pref(\"security.ssl.enable_ocsp_must_staple\",\t\ttrue);\n\n// PREF: Require a valid OCSP response for OCSP enabled certificates (disabled)\n// https://groups.google.com/forum/#!topic/mozilla.dev.security/n1G-N2-HTVA\n// https://www.feistyduck.com/newsletter/issue_121_the_slow_death_of_ocsp\n// Disabling this will make OCSP bypassable by MitM attacks suppressing OCSP responses\n// NOTICE: `security.OCSP.require` will make the connection fail when the OCSP responder is unavailable\n// NOTICE: `security.OCSP.require` is known to break browsing on some [captive portals](https://en.wikipedia.org/wiki/Captive_portal)\n//user_pref(\"security.OCSP.require\",\t\t\t\ttrue);\n\n// PREF: Disable TLS Session Tickets\n// https://www.blackhat.com/us-13/briefings.html#NextGen\n// https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-Slides.pdf\n// https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-WP.pdf\n// https://bugzilla.mozilla.org/show_bug.cgi?id=917049\n// https://bugzilla.mozilla.org/show_bug.cgi?id=967977\nuser_pref(\"security.ssl.disable_session_identifiers\",\t\ttrue);\n\n// PREF: Only allow TLS 1.[2-3]\n// http://kb.mozillazine.org/Security.tls.version.*\n// 1 = TLS 1.0 is the minimum required / maximum supported encryption protocol. (This is the current default for the maximum supported version.)\n// 2 = TLS 1.1 is the minimum required / maximum supported encryption protocol.\n// 3 = TLS 1.2 is the minimum required / maximum supported encryption protocol.\n// 4 = TLS 1.3 is the minimum required / maximum supported encryption protocol.\nuser_pref(\"security.tls.version.min\",\t\t\t\t3);\nuser_pref(\"security.tls.version.max\",\t\t\t\t4);\nuser_pref(\"security.tls.version.enable-deprecated\",\t\tfalse);\n\n// PREF: Disable insecure TLS version fallback\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1084025\n// https://github.com/pyllyukko/user.js/pull/206#issuecomment-280229645\nuser_pref(\"security.tls.version.fallback-limit\",\t\t4);\n\n// PREF: Enforce Public Key Pinning\n// https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning\n// https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning\n// \"2. Strict. Pinning is always enforced.\"\nuser_pref(\"security.cert_pinning.enforcement_level\",\t\t2);\n\n// PREF: Disallow SHA-1\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1302140\n// https://shattered.io/\nuser_pref(\"security.pki.sha1_enforcement_level\",\t\t1);\n\n// PREF: Warn the user when server doesn't support RFC 5746 (\"safe\" renegotiation)\n// https://wiki.mozilla.org/Security:Renegotiation#security.ssl.treat_unsafe_negotiation_as_broken\n// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555\nuser_pref(\"security.ssl.treat_unsafe_negotiation_as_broken\",\ttrue);\n\n// PREF: Disallow connection to servers not supporting safe renegotiation\n// https://wiki.mozilla.org/Security:Renegotiation#security.ssl.require_safe_negotiation\n// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555\n// https://github.com/pyllyukko/user.js/issues/237\nuser_pref(\"security.ssl.require_safe_negotiation\",\t\ttrue);\n\n// PREF: Disable automatic reporting of TLS connection errors\n// https://support.mozilla.org/en-US/kb/certificate-pinning-reports\n// we could also disable security.ssl.errorReporting.enabled, but I think it's\n// good to leave the option to report potentially malicious sites if the user\n// chooses to do so.\n// you can test this at https://pinningtest.appspot.com/\nuser_pref(\"security.ssl.errorReporting.automatic\",\t\tfalse);\n\n// PREF: Pre-populate the current URL but do not pre-fetch the certificate in the \"Add Security Exception\" dialog\n// http://kb.mozillazine.org/Browser.ssl_override_behavior\n// https://github.com/pyllyukko/user.js/issues/210\nuser_pref(\"browser.ssl_override_behavior\",\t\t\t1);\n\n// PREF: Encrypted SNI (when TRR is enabled)\n// https://www.cloudflare.com/ssl/encrypted-sni/\n// https://wiki.mozilla.org/Trusted_Recursive_Resolver#ESNI\n// https://en.wikipedia.org/wiki/Server_Name_Indication#Security_implications_(ESNI)\nuser_pref(\"network.security.esni.enabled\",\t\t\ttrue);\n\n// PREF: Disable the Enterprise Roots preference\n// https://support.mozilla.org/en-US/kb/how-disable-enterprise-roots-preference\n// https://github.com/pyllyukko/user.js/issues/560\nuser_pref(\"security.certerrors.mitm.auto_enable_enterprise_roots\",\tfalse);\nuser_pref(\"security.enterprise_roots.enabled\",\t\t\t\tfalse);\n\n/******************************************************************************\n * SECTION: Cipher suites                                                     *\n ******************************************************************************/\n\n// PREF: Disable null ciphers\nuser_pref(\"security.ssl3.rsa_null_sha\",\t\t\t\tfalse);\nuser_pref(\"security.ssl3.rsa_null_md5\",\t\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_rsa_null_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_null_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_rsa_null_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_ecdsa_null_sha\",\t\t\tfalse);\n\n// PREF: Disable SEED cipher\n// https://en.wikipedia.org/wiki/SEED\nuser_pref(\"security.ssl3.rsa_seed_sha\",\t\t\t\tfalse);\n\n// PREF: Disable 40/56/128-bit ciphers\n// 40-bit ciphers\nuser_pref(\"security.ssl3.rsa_rc4_40_md5\",\t\t\tfalse);\nuser_pref(\"security.ssl3.rsa_rc2_40_md5\",\t\t\tfalse);\n// 56-bit ciphers\nuser_pref(\"security.ssl3.rsa_1024_rc4_56_sha\",\t\t\tfalse);\n// 128-bit ciphers\nuser_pref(\"security.ssl3.rsa_camellia_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_rsa_aes_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_aes_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_rsa_aes_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_ecdsa_aes_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.dhe_rsa_camellia_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.dhe_rsa_aes_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256\",\tfalse); // 0xc02b TLSv1.2\nuser_pref(\"security.ssl3.ecdhe_rsa_aes_128_gcm_sha256\",\t\tfalse); // 0xc02f TLSv1.2\nuser_pref(\"security.tls13.aes_128_gcm_sha256\",\t\t\tfalse); // 0x1301 TLSv1.3\n\n// PREF: Disable RC4\n// https://developer.mozilla.org/en-US/Firefox/Releases/38#Security\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1138882\n// https://rc4.io/\n// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2566\nuser_pref(\"security.ssl3.ecdh_ecdsa_rc4_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_rsa_rc4_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_rc4_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_rsa_rc4_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.rsa_rc4_128_md5\",\t\t\tfalse);\nuser_pref(\"security.ssl3.rsa_rc4_128_sha\",\t\t\tfalse);\nuser_pref(\"security.tls.unrestricted_rc4_fallback\",\t\tfalse);\n\n// PREF: Disable 3DES (effective key size is < 128)\n// https://en.wikipedia.org/wiki/3des#Security\n// http://en.citizendium.org/wiki/Meet-in-the-middle_attack\n// http://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html\nuser_pref(\"security.ssl3.dhe_dss_des_ede3_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.dhe_rsa_des_ede3_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_ecdsa_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_rsa_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_rsa_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.rsa_des_ede3_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.rsa_fips_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.deprecated.rsa_des_ede3_sha\",\t\tfalse);\n\n// PREF: Disable ciphers with ECDH (non-ephemeral)\nuser_pref(\"security.ssl3.ecdh_rsa_aes_256_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_ecdsa_aes_256_sha\",\t\tfalse);\n\n// PREF: Disable 256 bits ciphers without PFS\nuser_pref(\"security.ssl3.rsa_camellia_256_sha\",\t\t\tfalse);\n\n// PREF: Enable GCM ciphers (TLSv1.2 only) (disabled)\n// https://en.wikipedia.org/wiki/Galois/Counter_Mode\n//user_pref(\"security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256\",\ttrue); // 0xc02b\n//user_pref(\"security.ssl3.ecdhe_rsa_aes_128_gcm_sha256\",\t\ttrue); // 0xc02f\n\n// PREF: Disable non-ECDHE RSA ciphers\n// https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites\nuser_pref(\"security.ssl3.rsa_aes_128_gcm_sha256\",\t\tfalse);\nuser_pref(\"security.ssl3.rsa_aes_256_gcm_sha384\",\t\tfalse);\n\n// PREF: Enable ChaCha20 and Poly1305 (Firefox >= 47)\n// https://www.mozilla.org/en-US/firefox/47.0/releasenotes/\n// https://tools.ietf.org/html/rfc7905\n// https://bugzilla.mozilla.org/show_bug.cgi?id=917571\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1247860\n// https://cr.yp.to/chacha.html\nuser_pref(\"security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256\",\ttrue);\nuser_pref(\"security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256\",\ttrue);\n\n// PREF: Disable ciphers susceptible to the logjam attack\n// https://weakdh.org/\nuser_pref(\"security.ssl3.dhe_rsa_camellia_256_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.dhe_rsa_aes_256_sha\",\t\t\tfalse);\n\n// PREF: Disable ciphers with DSA (max 1024 bits)\nuser_pref(\"security.ssl3.dhe_dss_aes_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.dhe_dss_aes_256_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.dhe_dss_camellia_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.dhe_dss_camellia_256_sha\",\t\tfalse);\n\n// PREF: Disable ciphers with CBC & SHA-1\nuser_pref(\"security.ssl3.rsa_aes_256_sha\",\t\t\tfalse); // 0x35\nuser_pref(\"security.ssl3.rsa_aes_128_sha\",\t\t\tfalse); // 0x2f\nuser_pref(\"security.ssl3.ecdhe_rsa_aes_256_sha\",\t\tfalse); // 0xc014\nuser_pref(\"security.ssl3.ecdhe_ecdsa_aes_256_sha\",\t\tfalse); // 0xc00a\n\n// PREF: Enable X25519Kyber768Draft00 (post-quantum key exchange) [FF Nightly 2024-01-18+]\n// https://datatracker.ietf.org/doc/draft-tls-westerbaan-xyber768d00/\n// https://twitter.com/bwesterb/status/1748017372764475519\n// https://pq.cloudflareresearch.com/\nuser_pref(\"security.tls.enable_kyber\",\t\t\t\ttrue);\n", "creation_timestamp": "2026-08-05T15:26:51.154146Z"}