user.js

user.js Firefox configuration hardening A user.js configuration file for Mozilla Firefox designed to harden browser settings and make it more secure. This is a default template with every possible hardening measure enforced. See the relaxed branch for a variant providing more usability Main goals Limit the possibilities to track the user through web analytics. Harden the browser against known data disclosure or code execution vulnerabilities. Limit the browser from storing anything even remotely sensitive persistently. Make sure the browser doesn't reveal too much information to shoulder surfers. Harden the browser's encryption (cipher suites, protocols). Limit possibilities to uniquely identify the browser/device using browser fingerprinting. Hopefully limit the attack surface by disabling various features. Still be usable in daily use. How to achieve this? There are several parts to all this and they are: Downloading and installing the user.js file. Reading about and applying further hardening techniques. Optional: Modifying user.js to adapt it to your web browser usage. Download Installation What does it do? Further hardening Known problems and limitations FAQ Contributing Online tests References Maintenance Download Different download methods are available: Clone using git: git clone https://github.com/pyllyukko/user.js Download and extract the ZIP file containing the latest version. Download the latest user.js directly Installation Backups Do note that these settings alter your browser behaviour quite a bit, so it is recommended to either create a completely new profile for Firefox or backup your existing profile directory before putting the user.js file in place. To enable the Profile Manager, run Firefox with command-line arguments: firefox --no-remote -P Single profile installation Copy user.js in your current user profile directory, or (recommended) to a fresh, newly created Firefox profile directory. The file should be located at: OS Path Windows 7 %APPDATA%\Mozilla\Firefox\Profiles\XXXXXXXX.your_profile_name\user.js Linux ~/.mozilla/firefox/XXXXXXXX.your_profile_name/user.js OS X ~/Library/Application Support/Firefox/Profiles/XXXXXXXX.your_profile_name Android /data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name and see issue #14 Sailfish OS + Alien Dalvik /opt/alien/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name Windows (portable) [firefox directory]\Data\profile\ With this installation method, if you change any of user.js settings through about:config or Firefox preferences dialogs, they will be reset to the user.js defined values after you restart Firefox. This makes sure they're always back to secure defaults when starting the browser. However this prevents persistently changing settings you don't consider appropriate. Either edit user.js directly, or use the system-wide installation method described below. System-wide installation (all platforms) Generate a file suitable for system-wide installation, by running make with one of the following targets: systemwide_user.js: (the value will be used as default value for all Firefox Profiles where it is not explicitly set, it can be changed in about:config and is kept across browser sessions) locked_user.js: (the value will be used as default value on Firefox profile creation, will be locked and can't be changed) in user.js or in Firefox's about:config or settings. debian_locked.js: Debian specific. Users are not able to override preferences. See #415. Copy the produced file to the Firefox installation directory. The file should be located at: OS Path Windows C:\Program Files (x86)\Mozilla Firefox\mozilla.cfg Linux /etc/firefox/syspref.js, for older versions: /etc/firefox/firefox.js Linux (Debian) /etc/firefox-esr/firefox-esr.js Linux (Gentoo, Archlinux) /usr/lib/firefox/mozilla.cfg, might also be /usr/lib32/ or /usr/lib64/ OS X /Applications/Firefox.app/Contents/Resources/mozilla.cfg Additional installation steps for Windows / OS X / Gentoo / Archlinux Create local-settings.js in Firefox installation directory, with the following contents: pref("general.config.obscure_value", 0); pref("general.config.filename", "mozilla.cfg"); This file should be located at: OS Path Windows C:\Program Files (x86)\Mozilla Firefox\defaults\pref\ OS X /Applications/Firefox.app/Contents/Resources/defaults/pref Linux (Gentoo, Archlinux) /usr/lib/firefox/defaults/pref/, might also be /usr/lib32/ or /usr/lib64/ If mozilla.cfg still fails to load, you must add a blank comment to the top of mozilla.cfg like so: // Additional settings (policies) Not all Firefox settings can be changed through user.js - some must be set in a separate policies.json file [1]. These policies apply system-wide. To install policies.json from this repository, simply copy it to the appropriate directory (create it if it does not exist): OS Path Windows C:\Program Files (x86)\Mozilla Firefox\distribution\ OS X /Applications/Firefox.app/distribution\ Linux (Debian) /etc/firefox-esr/policies/ Note that JSON does not support comments, hence settings are documented in custom *_comment keys. Mozilla maintains a list of available policies: [1] [2](https://github.com/mozilla/policy-templates). The Enterprise Policy Generator add-on can be used to generate policies.json files from a graphical interface. Updating using git For any of the above methods, you can keep your browser's user.js with the latest version available here: Clone the repository, and create a symbolic link from the appropriate location to the user.js file in the repository. Just run git pull in the repository when you want to update, then restart Firefox: cd ~/.mozilla/firefox git clone 'https://github.com/pyllyukko/user.js.git' cd XXXXXXXX.your_profile_name ln -s ${HOME}/.mozilla/firefox/user.js/user.js user.js Verifying Verify that the settings are effective from about:support (check the "Import