4.1 Extensions
github.com
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening - arkenfox/user.js

I'm sure a lot of us are already using Firefox with uBlock Origin, and I'm also sure that most of us already know about Arkenfox.

Despite this, one thing that I'm still noticing on the internet are people recommending extensions that, as per the Arkenfox wiki, are frankly just not needed anymore.

So people, please stop using:

  • Cookie extensions like Cookie Auto Delete
  • URL cleaning extensions like ClearURLs
  • Anti-fingerprinting extensions
  • Redundant privacy extensions like Ghostery or Privacy Badger
  • NoScript

And also please note that Firefox Multi-Account Containers is probably overkill for most threat models, and that Firefox's builtin Total Cookie Protection is probably just fine.

  • AtHeartEngineerEnglish
    73•9 months ago

    Multi account containers are super useful for managing multiple accounts though. Keeping work/personal/hobby stuff separate is awesome.

    • @fnie@lemm.ee
      2•9 months ago

      I find the temporary containers extension essential. Set automatic mode and forget.

  • @MigratingtoLemmy@lemmy.world
    37•9 months ago

    How exactly are my URLs going to be cleaned without ClearURLs?

    My extensions are:

    • UBlock Origin
    • Dark Reader
    • ClearURLs
    • NoScript
    • Multi-Account Containers
    • Cookie Quick Manager (probably not required since I don't deal much with cookies other than flushing them)
    • LocalCDN
  • @hottari@lemmy.ml
    32•9 months ago

    NoScript and Cookies Auto Delete are very much needed. uBlock's JavaScript control is extremely basic and doesn't toggle WebGL.

    As for cookies, I only set them for sites I have accounts or ones that need to remember user data in Chromium. I personally don't use CAD but I can certainly appreciate its convenience.

  • @dampfnudel@lemmy.zipEnglish
    29•9 months ago

    Yes but…

    • Most people want a quick-fix… "just install these extensions and all your web privacy issues will be handled automatically, in the background and you don't ever have to do anything at all." The "no user effort required" approach isn't realistic and arkenfox is not a quick-fix. It's a lot of tough love imo.
    • To use arkenfox and also not get frustrated that the entire internet is broken you will need to create a good user-overrides.js file. Creating a good one takes time. So take it and create a good one.
    • RFP breaks a lot of things. If you choose to disable RFP, the arkenfox wiki suggests you use the anti-fingerprinting extension, CanvasBlocker.
    • If you use arkenfox's user.js you'll probably want to create multiple profiles with different levels of arkenfox strength, which can be determined by your user-overrides.js file.

    I mostly use arkenfox… but I also have a TCP + uBO only profile for when I need it.

  • Sinnerman
    29•9 months ago

    The link says that NoScript is "redundant with uBlock Origin"

    I like NoScript because I can click on its icon on the toolbar, and easily select which scripts on a given page to whitelist, or which to whitelist temporarily (until browser quit.) And on any page, I can select which set of scripts (by domain name) on that page to run or whitelist.

    With uBlock Origin, it's only "all script on the page" or "no scripts on the page", right?

    • ikiru
      6•9 months ago

      Also wondering how much more effective Arkenfox is to tightened security settings, uBlock, Decentraleyes, Ghostery, etc. on Firefox?

          • ikiru
            10•9 months ago

            Ah, damn. I didn't know that. Coincidentally, I also already have Privacy Badger.

            Thanks, by the way!

          • @tyrant@lemmy.world
            8•9 months ago

            Ghost constantly tries to phone home I've noticed. Maybe for good reason but it freaked me out.

  • @NiaTheCat@lemmy.blahaj.zone
    19•9 months ago

    This is likely a very unpopular opinion, but I'm not a fan of the "only use uBlock origin" view that seems to be going around, yes using just that makes you less fingerprintable, but you're also just giving yourself a single point of failure and giving full control of your privacy to whatever the uBlock Origin devs want to add or refuse to add, who are at the end of the day still only human and can make mistakes.

    • @JubilantJaguar@lemmy.world
      6•9 months ago

      Agreed. Ideally, any such single point of failure needs to be under a distributed or accountable kind of control. Perhaps EFF could take over uBO, for example.

  • Mikelius
    19•9 months ago

    I personally prefer NoScript not for just the privacy stuff, but for the security of knowing that an accidental click to a malicious site using some zeroday JavaScript exploit won't kick in like it would, had it not been default blocked.

    My NoScript profile is also fairly populated with things I've trusted over the years, so it's really only new websites that require JavaScript that I have to worry about.

    Maybe just me being over cautious, but just keeps me at ease, personally.

    • @Potatos_are_not_friends@lemmy.world
      7•9 months ago

      NoScript is fantastic.

      As a web developer, I have to build tools for the SEO/ad team to turn my beautiful optimized sites to be ad-filled garbage. And frequently, that involves fetching data from third party sites that even I feel disgusted by, that can be easily blocked with NoScript.

  • Helix 🧬
    18•9 months ago

    Okay, which settings specifically replace these extensions? They usually also have a nice GUI with validation which is a better UX than editing text files and checking if it works by yourself.

  • @bobby_hill@lemmy.world
    10•9 months ago

    To add to the other fine points here, I almost exclusively do all my personal browsing on my phone. Arkenfox isn't designed to work on Firefox mobile.

  • @taladar@sh.itjust.worksEnglish
    6•9 months ago

    My personal view is that anyone who forks a browser is probably not experienced enough to know how much work it is to patch security holes in a timely manner in such a large code base.

    • Lemongrab
      3•9 months ago

      Good thing arkenfox is not a FF fork and you still get the same updates from Firefox main.

    • @dampfnudel@lemmy.zipEnglish
      15•9 months ago

      Cookie management is now handled by firefox natively. In your FF browser bar, go to about:preferences#privacy and choose Strict. Then you can remove AutoCookie Delete extension. If you want to know more, find the the Firefox blog posts about Total Cookie Protection. There are multiple posts on the topic.

      Edit: If you want to be super intense, you can also check the box, "Delete cookies and site data when Firefox is closed" although that isn't strictly necessary if your ETP is set to strict.

  • @sub_ubi@lemmy.ml
    4•9 months ago

    Is it possible to limit permissions for an extension to just a few domains? Most of them I'm using just for specific sites

  • GammaEnglish
    3•9 months ago

    Love when you install a boring extension on vscode and it has a telemetry setting…