Skip to content

6 Explanations

Jump to bottom
Willie Shen edited this page Sep 15, 2026 · 60 revisions

Introduction

This page contains some explanations about some topics of recent enough versions of Firefox for desktop and Android. Many topics, covered or not, can be tested in links listed in Tests.

Informations about arkenfox and combinedfox user.js are as of the time writing this. Check the files listed in contents of combinedfox user.js for latest state.

arkenfox and combinedfox both set Enhanced Tracking Protection (ETP) Strict mode with user_pref("browser.contentblocking.category", "strict"); and overriding it is not supported.

Cookies and Supercookies

  • Total Cookie Protection (TCP) / dynamic First Party Isolation (dFPI): It is included in Enhanced Tracking Protection (ETP) Standard and Strict modes. Work by maintaining a separate cookie jar for each website you visit. Any time a website, or third-party content embedded in a website, deposits a cookie in your browser, that cookie is confined to the cookie jar assigned to that website, such that it is not allowed to be shared with any other website.
  • State Partitioning: It is enabled by default for all users.
    • Network Partitioning: Networking-related APIs are not intended to be used for websites to store data, but they can be abused for cross-site tracking. As such, the following network APIs and caches are permanently partitioned by the top-level site: HTTP Cache, Image Cache, Favicon Cache, Connection Pooling, Script Cache, Stylesheet Cache, DNS, HTTP Authentication, Alt-Svc, Speculative Connections, Fonts & Font Cache, HSTS, OCSP, Intermediate CA Cache, TLS Client Certificates, TLS Session Identifiers, Prefetch, Preconnect, CORS-preflight Cache, WebRTC deviceID, Backward/forward cache (bfcache).
    • Dynamic State Partitioning: To prevent JavaScript-accessible storage APIs from being used for cross-site tracking, accessible storage is partitioned by top-level site. To improve web compatibility, Firefox currently includes some heuristics to grant unpartitioned access to cookies automatically to third parties that receive user interaction. These heuristics are intended to allow some third-party integrations that are common on the web to continue to function.
  • Fission / Site Isolation (fission.autostart): It is enabled by default for all users. Site Isolation is a security feature that offers additional protection in case of large classes of security bugs. Site Isolation safely sandboxes web pages and web frames, isolating them from each other, further strengthening Firefox security. Fission is added in Firefox for Android in version 147.0.
  • First Party Isolation (FPI): It has been replaced by Total Cookie Protection (TCP) / dynamic First Party Isolation (dFPI), and using it is discouraged.
  • Containers: You can use it to, for example, keep different set of cookies such as login info for a site. However, using profiles is more flexible since containers share the same set of site execeptions while profiles have independent settings. The Firefox Multi-Account Containers (MAC) extension can be used to manage containers. There's no need to use containers for different sites in terms of privacy when Total Cookie Protection (TCP) / dynamic First Party Isolation (dFPI) is turned on for them.
  • Cookie or supercookie-related extensions: Refer to Extensions.

"Cookies" and "Site Data" are set to clear on shutdown in arkenfox. On desktop, you can add site exceptions by Ctrl + I > Permissions > Set cookies > Allow when on the site you want to add an exception or manually adding sites in Settings > Privacy and security > Browsing data > Manage exceptions. The added exceptions can be found in Settings > Privacy and security > Browsing data > Manage exceptions. For cross-site cookies, add exceptions for both sites. If you are using Firefox version less than 154, due to Bug 1767271, adding a site to cookie-clearing exception will also disable it from Total Cookie Protection (TCP) / dynamic First Party Isolation (dFPI) and thus expose you to cross-site cookies. Refer to arkenfox issue 2701 for more information. Manual clearing cookies currently doesn't respect the exceptions as of the time writing this and is disabled in arkenfox. On Android, there is currently no way to add cookie-clearing site exceptions due to Bug 1807118.

Fingerprint

Only Tor Browser and Mullvad Browser with a truthworthy VPN achieve nearly identical fingerprint across their users. Use them if your threat model calls for it. Refer to Tor Browser and Mullvad Browser sections for more information.

According to arkenfox wiki 3.3 Overrides [To RFP or Not],

If you do nothing on desktop, you are already uniquely identifiable - screen, window and font metrics alone are probably enough - add timezone name, preferred languages, and several dozen other metrics and it is game over. Here is a link to the results of a study done in 2016 showing a 99.24% unique hit rate (and that is excluding IP addresses).

Changing a few prefs from default is not going to make you "more unique" - there is no such thing. Not to be confused with simple information paradoxes: such as claiming to be blink rather than gecko.

Here are some fingerprint protection basics

  • RULE 1
    • Protect the real value of each metric - it does not matter how it does it
  • NAIVE
    • A script that "swallows" a randomized value is a "naive" script
    • The more randomized metrics, the greater the chance a script becomes naive
    • Fooling naive scripts does not require a crowd
  • ADVANCED
    • All randomizing is detectable [this is a fact] - a script that does this is an "advanced" script
    • Advanced scripts are not all the same - i.e they have levels of sophistication
    • Defeating advanced scripts requires a crowd, the larger the better
  • RULE 2
    • Cover enough metrics
    • Optionally randomized to catch naive scripts
    • Ultimately enough that it becomes too hard or costly or impossible [because all randomizing can be detected]

Only Tor Browser can confidently address advanced scripts: enough metrics covered and a large crowd. The best any other browser can confidently do is fool naive scripts - if you're not convinced, add the loose data points from your IP/VPN.

Refer to W3C Group Note Mitigating Browser Fingerprinting in Web Specifications and thorin's stuff by Thorin Oakenpants for more information.

Fingerprinting protection in Firefox:

  • Known Fingerprinters: It is enabled by default for Enhanced Tracking Protection (ETP) Standard mode. The “Known Fingerprinters” protection feature works by blocking scripts listed in Disconnect's fingerprinting list. This prevents companies specializing in fingerprinting from examining your device and obtaining details about their hardware, software or IP address. While this serves as an initial defense, it does not safeguard you against companies that are not included in the list. Additionally, we sometimes have to create exceptions for this list to ensure that websites continue to work as intended.

  • RFPTargets: The list of all targets can be viewed at RFPTargets.inc. They, as of the time writing this, are listed below, some with descriptions found in Mozilla Support Firefox's protection against fingerprinting, Mozilla Support Resist Fingerprinting, arkenfox user.js, and Bugzilla.

    • TouchEvents: The Radius, Rotation and Force attributes of Touch Events are set to 0.
    • PointerEvents: Several Pointer Event attributes, such as Tilt and Pressure, are set to constant values.
    • KeyboardEvents: The key codes for Keyboard Events are modified to avoid leaking the keyboard layout. Spoofing mimics the content language of the document. Currently it only supports en-US. Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected.
    • ScreenOrientation: Spoof screen orientation based on spoofed screen size and platform.
    • SpeechSynthesis: The WebSpeech API does not report any available voices.
    • CSSPrefersColorScheme: CSS will report the preferred color scheme as Light.
    • CSSPrefersReducedMotion: CSS will report preferred reduced motion as False.
    • CSSPrefersContrast: CSS will report preferred contrast as No Preference.
    • CanvasRandomization, EfficientCanvasRandomization: Random data is introduced to images generated in canvas elements when the website reads back the image. If a website merely renders data to the canvas element, it will render without alteration. Although typically this does not happen, if the website reads the image data (and potentially displays it to you again), it will have subtle noise that may affect how the image is displayed.
    • CanvasImageExtractionPrompt: When a website extracts an image from a canvas element, the returned value is random noise to prevent canvas fingerprinting. This can manifest as strange unexpected vertical lines appears as graphic artifacts.
    • CanvasExtractionFromThirdPartiesIsBlocked
    • CanvasExtractionBeforeUserInputIsBlocked
    • JSLocale: The locale is reported as en-US.
    • NavigatorAppVersion, NavigatorBuildID, NavigatorHWConcurrency, NavigatorOscpu, NavigatorPlatform, NavigatorUserAgent: Several properties of the navigator object are fixed, including the hardware concurrency value, application version and build ID. The User Agent version is reported to be the major version (for example, 119.0 instead of 119.1).
    • PdfjsSpoof: If the user disables PDFJS via a pref, we do not expose that to the web.
    • StreamVideoFacingMode: The Video Facing Mode is a fixed value.
    • JSDateTimeUTC: The timezone is reported as Atlantic/Reykjavik.
    • JSMathFdlibm: Use Fdlibm's sin, cos and tan in JSMath.
    • Gamepad: No gamepads are ever reported as present.
    • HttpUserAgent: Spoof HTTP User-Agent Header as Windows 10 or Android 10 until FF136 then matches JS spoof.
    • WindowOuterSize: The Outer Window dimensions are reported to be the same as the inner window dimensions.
    • WindowScreenXY: The window.screenX and screenY properties, as well as mozInnerScreenX and mozInnerScreenY, and event screen coordinates are always reported as 0,0.
    • WindowInnerScreenXY
    • ScreenPixelDepth: The Screen Pixel Depth is reported as 24.
    • ScreenRect, ScreenAvailRect: The screen top, left, width and height, and screen available top, left, width and height are all reported the same as the window inner dimensions.
    • VideoElementMozFrames
    • VideoElementMozFrameDelay
    • VideoElementPlaybackQuality: Spoof media statistics.
    • ReduceTimerPrecision: The precision of all reported timestamps, timers and clocks are reduced to 16.67ms (to match 60fps).
    • WidgetEvents
    • MediaDevices: Without granting any permission, only one camera and microphone are reported as media devices. Certain device errors may be reported as “not allowed” instead of “not found”. Device Change events are not reported. Video and Audio Streams Labels are fixed to “Internal Camera” or “Internal Microphone”.
    • MediaCapabilities: Media Capabilities are reported as being supported, smooth and not power efficient.
    • AudioSampleRate: The preferred sample rate for Audio is reported as 44100, and the sample rate is reported as 48000.
    • NetworkConnection: The Network Connection type is reported as “Unknown”.
    • WindowDevicePixelRatio: The device pixel ratio is reported as 2.0.
    • MouseEventScreenPoint: Reduce screen co-ordinate fingerprinting in Touch API.
    • FontVisibilityBaseSystem: The only fonts available to be used by websites are those pre-installed in the Operating System. This also excludes fonts in language packs.
    • FontVisibilityLangPack: Locally installed fonts (specifically, fonts that are not in the list of standard fonts shipped by your operating system) will not be used to render text on a page.
    • DeviceSensors: All Device Sensors are disabled.
    • FrameRate: The frame rate is locked at 60fps.
    • RoundWindowSize
    • UseStandinsForNativeColors
    • AudioContext: The Audio Context latency is fixed, and the number of maximum channels is reported as 2.
    • MediaError: Limit MediaError.message to a whitelist.
    • DOMStyleOsxFontSmoothing: On macOS, the OS Font Smoothing preference is not respected.
    • CSSDeviceSize
    • CSSColorInfo: Return "srgb" with color-gamut.
    • CSSResolution: Make spoofed devicePixelRatio and CSS media queries match.
    • CSSPrefersReducedTransparency
    • CSSInvertedColors: Return "none" with inverted-colors.
    • CSSVideoDynamicRange
    • CSSPointerCapabilities: The pointer capabilities are reported to be Coarse (Android) or Fine & Hover (Desktop).
    • WebGLRenderCapability
    • WebGLRenderInfo: Spoof WebGL debug renderer info.
    • SiteSpecificZoom: Disable site specific zoom.
    • FontVisibilityRestrictGenerics
    • WebVTT: Load all subtitles in WebVTT (Video Text Tracks).
    • WebGPULimits
    • WebGPUIsFallbackAdapter
    • WebGPUSubgroupSizes: Return 128 for WebGPU subgroupMaxSize.
    • JSLocalePrompt: Warn when language prefs are not set to "en*".
    • ScreenAvailToResolution: The Available Screen Resolution (your Screen Resolution subtracting any dock or taskbar) is reported as your Screen Resolution.
    • UseHardcodedFontSubstitutes
    • DiskStorageLimit: Return 10GiB for storage estimate until persistent-storage granted.
    • WebCodecs: Disable WebCodecs API.
    • MaxTouchPoints: The Max Touch Pointers for Pointer Events is set to 0.
    • MaxTouchPointsCollapse: The number of simultaneous touches your hardware supports is reported as either 0, 1, and for all other values, 5.
    • NavigatorHWConcurrencyTiered: The number of processor cores is reported as either 4 (if you have 4 or fewer cores) or 8 (if you have more than 4 cores).
    • WebGLRandomization, WebGLVendorSanitize, WebGLVendorConstant, WebGLVendorRandomize, WebGLRendererConstant: Enable some fingerprinting resistance for WebGL.
    • IMEStyle

  • baselineFingerprintingProtection (bFPP) (privacy.baselineFingerprintingProtection): It is enabled by default for Enhanced Tracking Protection (ETP) Standard mode. The list of all targets in bFPP can be viewed at RFPTargetsDefaultBaseline.inc. They, as of the time writing this, are listed below.

    • EfficientCanvasRandomization
    • ScreenAvailToResolution
    • MaxTouchPointsCollapse

  • fingerprintingProtection (FPP) (privacy.fingerprintingProtection): It is enabled by default for Enhanced Tracking Protection (ETP) Strict mode. The list of all targets in FPP can be viewed at RFPTargetsDefault.inc. They, as of the time writing this, are listed below.

    • CanvasRandomization
    • EfficientCanvasRandomization
    • FontVisibilityLangPack
    • JSMathFdlibm
    • ScreenAvailToResolution
    • NavigatorHWConcurrencyTiered
    • MaxTouchPointsCollapse

  • resistFingeprinting / Resist Fingerprinting (RFP) (privacy.resistFingerprinting): It is not enabled by default. It includes all RFPTargets. RFP is a built-in solution in Firefox that blocks or randomizes many metrics without requiring a crowd like Tor Browser. However, expect site-breakings when using it, which is mostly due to canvas randomizing. Refer to arkenfox wiki 3.3 Overrides [To RFP or Not] and MozillaWiki Security/Fingerprinting for more information.

  • Global RFPTarget overrides: You can use only a few RFPTargets globally by setting privacy.resistFingerprinting to false and setting privacy.fingerprintingProtection.overrides (if you use FPP) or privacy.baselineFingerprintingProtection.overrides (if you use bFPP) to the RFPTargets you want. The value is a comma-separated list that is either +AllTargets and then - targets you don't want or -AllTargets and then + targets you want. arkenfox uses FPP, while combinedfox adds user_pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-CSSPrefersColorScheme,-CanvasImageExtractionPrompt,-CanvasExtractionBeforeUserInputIsBlocked,-CanvasExtractionFromThirdPartiesIsBlocked,-JSDateTimeUTC,-FrameRate");.

  • Site-specific RFPTarget overrides: You can use only a few RFPTargets for specific sites by setting privacy.resistFingerprinting to false and setting privacy.fingerprintingProtection.granularOverrides (if you use FPP) or privacy.baselineFingerprintingProtection.granularOverrides (if you use bFPP) to the sites and their site-specific RFPTargets you want. The value is a JSON list of objects where sites are firstPartyDomain entry and overrides are in overrides entry, e.g. [ { "firstPartyDomain": "jeffersonscher.com" , "overrides": "+WindowOuterSize" }, { "firstPartyDomain": "reddit.com" , "overrides": "+JSDateTimeUTC" } ], according to Mozilla Support Correct syntax for privacy.fingerprintingProtection.granularOverrides?.

  • Request English versions of web pages for enhanced privacy (privacy.spoof_english) (default: false, combinedfox: true): When privacy.resistFingerprinting = true, a new option becomes available in General > Choose your preferred language for displaying pages > Choose > Request English versions of web pages for enhanced privacy, which changes three config settings: intl.accept_languages = en-US, en, javascript.use_us_english_locale = true, privacy.spoof_english = 2. When privacy.resistFingerprinting = false, javascript.use_us_english_locale and privacy.spoof_english are not available in UI but can be set in user.js or about:config.

  • Letterboxing (privacy.resistFingerprinting.letterboxing) (default: false, combinedfox: true): Dynamically resizes the inner window by applying margins in stepped ranges when privacy.resistFingerprinting.letterboxing = true. This is independent of RFP.

  • Fingerprinting protection extensions: Use FPP, RFP, or FPP+RFPTargets overrdies instead of extensions for fingerprinting protection. The built-in RFPTargets are more robust and performant, defeats naive scripts, and defeats some advanced scripts by standarding fingerprints of users to fewer buckets, according to arkenfox issue 1775. According to arkenfox wiki 4.1 Extensions,

    • Redundant with either
      • RFP (resistfingeprinting) - see this
      • FPP (fingerprintingProtection) - enabled with ETP Strict (FF119) and subtly randomizes canvas (FF120)
    • Most extensions cannot protect what they claim:
      • It's impossible (engine, OS, version)
      • It's not a lie (the sites expect and use a valid value)
      • It's dumb (randomizing is not very usable, and/or successfully spoofing is the same as setting that)
      • It's equivalency
      • It has too many methods (fonts: at least a dozen methods and counting)
      • ... and more
    • Web Extensions lack APIs to properly protect metrics (without breaking basic functionality)
    • Web Extensions are detectable, and often uniquely fingerprintable, when they touch the DOM (and sometimes when they don't)

    As a memorial, CanvasBlocker extension was the best solution for fingerprinting protection without Tor Browser or Mullvad Browser before RFPTargets growed to cover enough metrics. Reasons of not using each CanvasBlocker option now are listed below. Some are according to arkenfox user.js wiki before CanvasBlocker is removed from its recommendation, e.g., arkenfox wiki 4.1 Extensions at commit a13507d59fcdda5494684b601c333a2467403417.

    • Canvas API, Audio API, DOMRect API, TextMetrics API, Navigator API, and Screen API: They are covered by RFPTargets or not worth it.

    • History API: It doesn't help privacy, security, anonymity, etc., according to arkenfox issue 808.

    • Window API: window.opener is already protected by Firefox according to About rel=noopener by Mathias Bynens. window.name is already protected by Firefox according to PrivacyTests.org.

    • SVG API: Spoofing it breaks some sites and doesn't worth it.

    • Block data URL pages: CanvasBlocker settings page claims that

      Data URL pages cannot be protected against fingerprinting (see https://bugzilla.mozilla.org/show_bug.cgi?id=1475831). Blocking them prevents the real fingerprint to reach any server.

      but Bug 1475831 has actually been resolved.

Trusted Recursive Resolver (TRR) / DNS-over-HTTPS (DoH)

DNS-over-HTTPS (DoH) allows DNS to be resolved with enhanced privacy, secure transfers and comparable performance.

The following preferences in Firefox control TRR/DoH behavior: (Only those found in my about:config are listed to prevent listing removed preferences, and default value found there are used.)

  • network.trr.mode: The resolver mode.

    • 0 - Off (default). use standard native resolving only (don't use TRR at all).
    • 1 - Reserved (used to be Race mode)
    • 2 - First. Use TRR first, and only if the name resolve fails use the native resolver as a fallback.
    • 3 - Only (combinedfox). Only use TRR, never use the native resolver except that the native resolver will still be used for portal detection if network.captive-portal-service.enabled = true.
    • 4 - Reserved (used to be Shadow mode)
    • 5 - Off by choice. This is the same as 0 but marks it as done by choice and not done by default.

  • network.trr.uri: (default: none, combinedfox: https://mozilla.cloudflare-dns.com/dns-query) set the URI for your DoH server. That's the URL Firefox will issue its HTTP request to. It must be a HTTPS URL. If "useGET" is enabled, Firefox will append "?dns=...." to the URI when it makes its HTTP requests. For the default POST requests, they will be issued to exactly the specified URI.

  • network.trr.custom_uri: (default: none, combinedfox: https://mozilla.cloudflare-dns.com/dns-query) The custom DoH URI supplied by the user in the GUI preferences ("Custom"). This is not necessarily the same URI as will be used for DoH resolution, but is only used to store the user supplied text field value. See network.trr.uri for the setting that actually affects resolution. Modifying this should not be necessary unless you want to update the preferences GUI.

  • network.trr.credentials: (default: none) set credentials that will be used in the HTTP requests to the DoH end-point. It is the right-hand side content, the value, sent in the Authorization: request header.

  • network.trr.allow-rfc1918: (default: false) If set to false, TRR asks the resolver to disable ECS (EDNS Client Subnet: the method where the resolver passes on the subnet of the client asking the question). Some resolvers will use ECS to the upstream if this request is not passed on to them.

  • network.trr.useGET: (default: true) When the browser issues a request to the DoH server to resolve host names, it can do that using POST or GET. If set to false, it uses POST; if set to true, it uses GET.

  • network.trr.confirmationNS: (default: example.com) Firefox will check an NS entry at startup to verify that TRR works to ensure proper configuration. This preference sets which domain to check. The verification only checks for a positive answer, it doesn't actually care what the response data says. Set this to skip to completely avoid confirmation.

  • network.trr.bootstrapAddr (network.trr.bootstrapAddress before Firefox 89): (default: none, combinedfox: 2a06:98c1:52::4) by setting this field to the IP address of the host name used in "network.trr.uri", you can bypass using the system native resolver for it.

  • network.trr.request_timeout_ms: (default: 1500) is the number of milliseconds a request and the corresponding response from the DoH server is allowed to take until considered failed and discarded.

  • network.trr.request_timeout_mode_trronly_ms: (default: 30000) is the number of milliseconds a request and the corresponding response from the DoH server is allowed to take until considered failed and discarded in TRR-only mode.

  • network.trr.max-fails: (default: 15) If this many DoH requests fail in a row, consider TRR broken and go back to verify-NS state. This is meant to detect situations when the DoH server dies.

  • network.trr.disable-ECS: (default: true) If set, TRR asks the resolver to disable ECS (EDNS Client Subnet: the method where the resolver passes on the subnet of the client asking the question). Some resolvers will use ECS to the upstream if this request is not passed on to them.

  • network.trr.excluded-domains: (default: ) Comma separated list of domain names to be resolved using the native resolver instead of TRR. Users may add domains they wish to exclude from TRR to this pref.

  • network.trr.exclude-etc-hosts: (default: true) Make host names from /etc/hosts fall back to platform DNS, which will use the rules in /etc/hosts.

  • network.trr.builtin-excluded-domains: (default: localhost,local) Comma separated list of bulit-in domain names to be resolved using the native resolver instead of TRR.

  • network.trr.send_user-agent_headers: (default: false) When false the User-Agent header will not be set on TRR requests.

  • network.trr.send_accept-language_headers: (default: false) When false the Accept-Language header will not be set on TRR requests.

  • network.trr.clear-cache-on-pref-change: (default: true) When true, the DNS+TRR cache will be cleared when a relevant TRR pref changes.

  • network.trr.retry_on_recoverable_errors: (default: false) Determine the behavior after a first failed lookup attempt with TRR in mode 2. When false, retry with native. When true,

    • Retry with native if the first attempt failed because we got NXDOMAIN, an unreachable address (TRR_DISABLED_FLAG), or we skipped TRR because Confirmation failed.
    • Trigger a "RetryTRR" Confirmation which will start a fresh connection for TRR, and then retry the lookup with TRR.
    • If the second attempt failed, fallback to native if network.trr.strict_native_fallback is false.

  • network.trr.strict_native_fallback: (default false) Described in network.trr.retry_on_recoverable_errors.

  • network.trr.wait-for-portal: According to Mozilla Wiki,

    (default: false) set this boolean to true to tell Firefox to wait for the captive portal detection before TRR is used. (on Android, this will default to false since the captive portal handling is done outside of Firefox, by the OS itself.)

    However, I can't find it in about:config or codebase, and adding it with value false while network.trr.mode = 3, captivedetect.canonicalURL = "http://detectportal.firefox.com/canonical.html", and network.captive-portal-service.enabled = true doesn't eliminate native DNS requests of detectportal.firefox.com on my machine, so I'll assume that it has been removed.

  • Bug 1593873: When network.trr.mode = 3,

    While quitting, it also resolves incoming.telemetry.mozilla.org with the native resolver.

    which is also cited by Mozilla Wiki,

    The native resolver will still be used for portal detection and telemetry (Bug 1593873)

    However, I can't reproduce such connection and the bug is labeled RESOLVED INVALID, so I'll assume that it doesn't exist now. The behavior about detectportal.firefox.com is expected and can be disabled with network.captive-portal-service.enabled = false. Refer to Captive Portal Detection section for more information.

Captive Portal Detection

When you connect to public Wi-Fi, like an airport, coffee shop, or a corporate guest network, you often see a web page asking you to sign in, accept terms, or enter a password before you can use the internet. This page is called a captive portal. Most captive portals ask you to agree to an Acceptable Use Policy (AUP).

The following preferences in Firefox control TRR/DoH behavior:

  • captivedetect.canonicalURL: (default: http://detectportal.firefox.com/canonical.html, arkenfox, combinedfox: )
  • network.captive-portal-service.enabled: (default: true, arkenfox, combinedfox: false) When captivedetect.canonicalURL is set to http://detectportal.firefox.com/canonical.html and network.captive-portal-service.enabled is set to true, Firefox tests if the connection is a captive portal by regularly connecting to http://detectportal.firefox.com/canonical.html and make connections to this URL to check if your current network supports certain technologies such as IPv6. Any DNS request of detectportal.firefox.com in Firefox is sent to native DNS resolver no matter what TRR preferences are when network.captive-portal-service.enabled is true.

Some captive portal can only be detected but can't be connected when network.trr.mode = 3, with the cost of DNS leak, you can set Privacy and Security > DNS over HTTPS to Off or set network.ttr.mode preference to 5 in about:config temporarily.

On network with outdated TLS configurations, you may need to disable Trusted Recursive Resolver (TRR) / DNS-over-HTTPS (DoH) in your browser. For Firefox, that is, setting Privacy and Security > DNS over HTTPS to Off or setting network.ttr.mode preference to 5 in about:config. To avoid DNS leak in this condition, configure your system DNS to use custom servers with tools such as dnscrypt-proxy. Refer to my WPA-PEAP-TLS-network-Linux repo for how to connect to a such network on Linux.

Referrer Policy

The HTTP Referer request header contains the absolute or partial address from which a resource has been requested. There are problematic uses such as tracking or stealing information, or even just side effects such as inadvertently leaking sensitive information.

Referrer-Policy header: The Referrer-Policy header provides fine-grained control over how and when browsers transmit the Referer header.

  • no-referrer: Never send the Referer header.
  • same-origin: Send the Referrer header, but only on same-origin requests.
  • strict-origin: Send the Referrer header to all origins, but only include the URL without the path (e.g., https://example.com/).
  • strict-origin-when-cross-origin: Send the full Referrer header on same-origin requests and only the URL without the path on cross-origin requests.

The following preferences in Firefox control Referrer-Policy:

  • network.http.referer.defaultPolicy: set the default referrer policy (default: 2)
    • 0 - no-referrer
    • 1 - same-origin
    • 2 - strict-origin-when-cross-origin
  • network.http.referer.defaultPolicy.pbmode: same as network.http.referer.defaultPolicy but only for Private Browsing (default: 2)
  • network.http.referer.defaultPolicy.trackers: same as network.http.referer.defaultPolicy but only for trackers (default: 2)
  • network.http.referer.defaultPolicy.trackers.pbmode: same as network.http.referer.defaultPolicy.trackers but only for Private Browsing (default: 2)
  • network.http.sendRefererHeader: controls whether or not to send a referrer regardless of origin (default: 2)
    • 0 - never send the header
    • 1 - send the header only when clicking on links and similar elements
    • 2 - send on all requests (e.g. images, links, etc.)
  • network.http.referer.trimmingPolicy: controls how much referrer to send regardless of origin (default: 0). There's no need to set it other than 0. Only cross-origin requests matter.
    • 0 - send the full URL
    • 1 - send the URL without its query string
    • 2 - only send the origin
  • network.http.referer.XOriginTrimmingPolicy: same as network.http.referer.trimmingPolicy but only for referrers across origins (default: 0, arkenfox, combinedfox: 2).
  • network.http.referer.XOriginPolicy: controls whether or not to send a referrer across origins (default: 0)
    • 0 - (default) send the referrer in all cases
    • 1 - send a referrer only when the base domains are the same
    • 2 - send a referrer only on same-origin
  • network.http.referer.spoofSource: (default: false). False is recommended since spoofing can affect Cross-Site Request Forgery (CSRF) protection according to arkenfox.
    • false - use real referrer
    • true - spoof with URI of the current request
  • network.http.referer.disallowCrossSiteRelaxingDefault: controls whether or not a referrer across origins can relax default Referrer-Policy, true means not (default: true)
  • network.http.referer.disallowCrossSiteRelaxingDefault.pbmode: same as network.http.referer.disallowCrossSiteRelaxingDefault but only for Private Browsing (default: true)
  • network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation: same as network.http.referer.disallowCrossSiteRelaxingDefault but only for top navigations (default: false due to Bug 1734328, ETP Strict mode set to true).
  • network.http.referer.disallowCrossSiteRelaxingDefault.pbmode.top_navigation: same as network.http.referer.disallowCrossSiteRelaxingDefault but only for Private Browsing (default: true)

Do Not Track (DNT) and Global Privacy Control (GPC)

  • Do Not Track (DNT): DNT header and navigator object. Can be not sent or

    • 0: The user prefers to allow tracking on the target site.
    • 1: The user prefers not to be tracked on the target site.
    • null: The user has not specified a preference about tracking.

    According to Wikipedia,

    Do Not Track (DNT) is a deprecated non-standard HTTP header field designed to allow internet users to opt out of tracking by websites, which includes the collection of data regarding a user's activity across multiple distinct contexts, and the retention, use, or sharing of data derived from that activity outside the context in which it occurred.

    However, the header failed to find widespread respect among publishers, due to the lack of legislation requiring companies to support the DNT header and confusion about the header's meaning. The DNT header was abandoned by standards bodies such as the W3C.

  • Global Privacy Control (GPC): Sec-GPC header and navigator object. Can be not sent or:

    • 1: The user has indicated that they prefer their information not be shared with, or sold to, third parties. Otherwise, the header is not sent, which indicates that either the user has not made a decision or the user is okay with their information being shared with or sold to third parties.

    According to Wikipedia,

    Global Privacy Control (GPC) is a set of web technologies that can be used to inform websites of the user's wish to have their information not be sold or used by ad trackers. Unlike the now-deprecated Do Not Track header, which was unsuccessful as it was ignored by third parties, GPC is intended to have legal force under privacy laws.

  • DNT is controlled by privacy.donottrackheader.enabled preference. (default, combined: false)

  • GPC in non-private browsing mode is controlled by privacy.globalprivacycontrol.enabled preference (default: false, combinedfox: true)

  • GPC in non-private browsing mode is controlled by privacy.globalprivacycontrol.pbmode.enabled preference (default: true)

  • Since Firefox 135,

    The “Do Not Track” checkbox has been removed from preferences. If you wish to ask websites to respect your privacy, you can use the “Tell websites not to sell or share my data” setting instead. This option is built on top of the Global Privacy Control (GPC).

  • Since Firefox 141, DNT is no longer sent with Enhanced Tracking Protection Strict mode, according to Bug 1951781.

Avoid changing your fingerprint out of the big buckets is the most important part since gain in tracking protection by sending them is little, if not none, with Total Cookie Protection (TCP) / dynamic First Party Isolation (dFPI) enabled.

Thus, arkenfox recommends and leaves it following the Firefox default behavior, which is privacy.donottrackheader.enabled = false, privacy.globalprivacycontrol.enabled = false, privacy.globalprivacycontrol.pbmode.enabled = true.

combinedfox, however, changes privacy.globalprivacycontrol.enabled to true because

  • the bucket of sending GPC is probably not that small now since
    • privacy.globalprivacycontrol.pbmode.enabled is true by default and
    • there are more people enabling the “Tell websites not to sell or share my data” setting now, and
  • GPC is now honored by a lot of highly ranked sites and enforced in many regions.

They have both HTTP header and navigator object and changing preferences in about:config changing both. If you only changes one (such as using an extension that only removes or adds HTTP header) and makes the two inconsistent, it will be an even more unique fingerprint.

You can check whether the HTTP headers are sent using BrowserLeaks HTTP/2 Fingerprinting and whether the navigator objects are sent using BrowserLeaks JavaScript Browser Information.

Refer to Bug 1670058, arkenfox issue 1542, and 2032 for more information.

CSS History Leak

According to Plugging the CSS History Leak,

Links can look different on web sites based on whether or not you've visited the page they reference. You've probably seen this before: in some cases, visited links are purple instead of blue. This is just one of the many features web designers use to make the web the best it can be, and for the most part that's a good thing.

The problem is that appearance can be detected by the page showing you links, cluing the page into which of the presented pages you've been to. The result: not only can you see where you've been, but so can the web site!

Firefox has deployed ways to mitigate the attack, but this can't block attacks that involve user interaction. To block such attacks, combinedfox sets layout.css.visited_links_enabled to false with the cost of disabling the coloring of visited links. Refer to Mozilla Security Blog Plugging the CSS History Leak and Preventing attacks on a user's history through CSS :visited selectors by David Baron for more information.

Cross-Site Leaks (XS-Leaks)

According to XS-Leaks Wiki,

Cross-site leaks (aka XS-Leaks, XSLeaks) are a class of vulnerabilities derived from side-channels built into the web platform. They take advantage of the web's core principle of composability, which allows websites to interact with each other, and abuse legitimate mechanisms to infer information about the user.

Virtually all browsers, including Tor Browser, are subjected to it. You can test it on XSinator XS-Leak Browser Test Suite. Note that many tests may have different results on multiple runs on the same setup and may be influenced by features such as fingerprint spoofing.

Refer to:

WebGPU

To enable WebGPU in Firefox, go to about:config, and set dom.webgpu.enabled and gfx.webrender.all to true. This may not work on some GPUs and platforms.

Telemetry

According to 62f1346c-4576-42b3-afcb-23ef1820da34's comment on arkenfox pull request 2056 and arkenfox issue 2076, if browser.profiles.enabled is set to true (default since FF150 and set to true in Peskyfox), all profiles share the same settings for Settings > Permissions and data > Firefox data collection and use and the corresponding user.js prefs are not honored. You might want to check and manually adjust those settings in the GUI of one of your profiles.

combinedfox overrides for arkenfox user.js arkenfox-overrides.js re-enables the disabled telemetry in TELEMETRY section in arkenfox because

  • Arkenfox and combinedfox do not consider these Firefox telemetry to be a privacy or security concern.
  • Building a browser is hard; building a good browser inevitably requires gathering a lot of data to make sure that things that work in the lab work in the field, according to moz://a HACKS Testing Privacy-Preserving Telemetry with Prio.
  • There are several problems with opt-in telemetry and asking users: they are prone to inaccurate and misleading data, they're undiscoverable for less technical users, and if they are discoverable, then they are usually displayed in such a way they aggressively shift users' focus, according to Opt-in Telemetry and Asking Users for Feedback May Not Work in Practice.
  • No Personally Identifiable Information (PII) is collected, according to arkenfox commit 3d76c74c.
  • Every new profile on first use provides data collection and use policy and the ability to opt-out.
  • It can be disabled at any time.
  • Data collected can be viewed in about:telemetry.

Refer to the following sources for more information:

Reverse them to disabled in your overrides if your threat model calls for it.

However, the followings that are disabled in arkenfox and remain disabled in combinedfox.

There are two main ways of gathering data in Firefox:

There are three way of sending collected data:

Tor Browser

Tor Browser is available for desktop and Android.

Tor Browser is a privacy-focused web browser that routes your traffic through the Tor network, hiding your real IP address, preventing tracking, and protecting you against surveillance and censorship. Tor Browser uses the Tor network to protect your privacy and anonymity.

Tor is a program you can run on your computer that helps keep you safe on the Internet. It protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. This set of volunteer relays is called the Tor network.

Tor Browser uses resistfingeprinting (RFP) and letterboxing as well as other anti-fingerprinting features to mitigate browser fingerprinting and protect user privacy and achieve nearly identical fingerprint across its users. Refer to Fingerprint for more information. Expect site-breakings when using it.

Tor Browser includes NoScript Security Suite by default to help control JavaScript. It's strongly discouraged to install new add-ons or change configs in Tor Browser because they can compromise your privacy and security by making your fingerprint unique.

Refer to Tor Project for more information.

Mullvad Browser

Mullvad Browser is available for desktop.

By using a trustworthy VPN in combination with a privacy-focused browser, you can put up a better resistance against the mass surveillance of today. That's why Mullvad partnered with the Tor Project to develop Mullvad Browser – a browser designed to minimize tracking and fingerprints.

Mullvad Browser is roughly the Tor Browser without the Tor Network, typically used with a trustworthy VPN. Mullvad Browser uses resistfingeprinting (RFP) and letterboxing as well as other anti-fingerprinting features to mitigate browser fingerprinting and protect user privacy and achieve nearly identical fingerprint across its users. Refer to Fingerprint for more information. Expect site-breakings when using it.

Differences with Tor Browser:

  • No Tor Network patches
  • No multilanguage support
  • No onboarding patches
  • Different branding/installer metadata
  • WebRTC is enabled
  • Web Audio API is enabled (needed for WebRTC)
  • uBlock Origin / Mullvad Browser Extension
  • NoScript Cross-tab Identity Leak Protection is disabled by default
  • Mullvad DoH
  • A Tor Browser specific cryptocurrency targeted protection is removed
  • No drag and drop protections (it's a specific proxy-bypass measure)
  • No download warning popup (the one that says that you should use Tails to open downloads)

Refer to Mullvad and Tor Project for more information.

Tests

Some tests may be outdated or failing as expected for your case. Failing a test doesn't necessarily mean that you have something broken.

According to arkenfox wiki Appendix B Test Sites [Fingerprinting],

Any probabilities or entropy from test sites are COMPLETE NONSENSE

Security / browser features:

Leaks:

Fingerprint all-in-one:

Fingerprint multiple pages:

Fingerprint specific:

Next: 7. References

Clone this wiki locally