Firefox addons redundant? #121
Comments
|
All of those addons have their own roles to play, and don't replace any other completely on their own. Perhaps it'd be more useful to suggest combinations of them, and give notes on what is gained and lost from different suggestions. As it seems to always be the case, it's going to really be down to the user and how active a role they want to play. To start: Decentraleyes does a job that after allowing the trusted resources, other addons will not do. That is, it emulates Content Delivery Networks (CDNs) locally by intercepting requests, finding the required resource and injecting it into the environment. This helps with privacy by ultimately reducing your browsing footprint. My suggestion would be: Must haves which also require little user input:
Additional security that requires active user input (not all at simultaneously):
|
|
Replace Disconnect with Privacy Badger. uBlock does what Disconnect does, but not what Privacy Badger does. Both uBlock and Disconnect use a shared list, whereas Privacy Badger learns what are trackers from your browsing. |
|
@Shifterovich So uBlock + Privacy Badger is a good combo? |
|
@privacytoolsIO Please recommend Privacy Badger for Firefox and Firefox for Android. https://addons.mozilla.org/en-US/android/addon/privacy-badger17/ |
|
Here's a combo that I think balances security and ease-of-use fairly well: CanvasBlocker
Decentraleyes
HTTPS Everywhere
NoScript
Privacy Settings
Self-Destructing Cookies
uBlock Origin
|
|
@Marc05 Also, Random Agent Spoofer. |
|
#99 I'll write something about CanvasBlocker vs Canvas Defender. |
|
Using CanvasBlocker to generate a new hash on every API call is best in any situation as far as I can tell. The tracker essentially has two options: Assume it's random, hence useless; or derive a new identity with the hash. Both of which are better than providing a legitimate hash, since best case is there's an extremely common hash, which would provide a higher amount of identifying bits of information. |
|
Some people prefer Canvas Defender. I agree that Canvas Blocker is better than Canvas Defender, but we should mention Canvas Defender too, as neither is a perfect solution. |
|
The only time I can think of someone needing that is to allow sites to track for a certain period of time, then resetting when done. In that situation, one could just whitelist the website, and remove it after. |
|
Would reveal one's native fingerprint. Disabling Canvas Blocker, enabling Canvas Defender, and generating a new hash for such session is optimal. |
|
True... though I'd only go as far as an asterisk. |
|
minimally and without much breakage: NoScript Notifications (Personal Preference) Privacy Settings - set to Privacy (compatible) and Security No Resource URI Leak UBlock and Privacy Badger are both ok but for privacy essentially redundant to NoScript except cosmetic filters can clean up pages but you're blocking the essentials with Noscript and Privacy Settings changes. The only thing I left out is referrer control, some of the fingerprinting stuff, and random user agent stuff because they act a little goofy. There's a bunch of back and forth whether over-blocking fingerprinting in itself makes you unique. Random user agent junk makes webpages look wonky sometimes and I'd rather not fool with it. As for Self-Destructing Cookies, simply going into Firefox and unchecking allowing 3rd party cookies does most of the job already. Regardless, I still can't Disqus to log in without turning off like half the privacy controls out there. |
|
@Marc05 Some Firefox addons listed are redundant, as NoScript and uBlock. Noscript + Adblock Plus was an unrivalled combo, until uBlock Origin made its appearance, substituting both and dropping the acceptable ads. With various Filter Lists available it works great, while uMatrix has no lists at all and is light on resources.
https://www.eff.org/privacybadger
|
|
Privacy Badger has a cookie blocking functionality. I don't know about NoScript. However, I know about uMatrix and I think the cookie functionality of PB is redundant with the one of uMatrix. Apart from this functionality, the only appeal of PB is the list-less feature, which is pretty dubious anyway (no need for discover the wheel again, people have been maintaining great blocking lists for more than 10 years). Regarding HTTPS Everywhere, I prefer to use Smart HTTPS:
@Marc05 |
|
@Marc05
The Browser change The Media changes decrease both security and privacy. The Devices change decreases privacy. The Encryption changes break a website such as the Humble Store: https://www.humblebundle.com/store/ |
|
@woctezuma Disabling clipboard events, e.g. The Disabling the face detection feature seems to be pointless, given that camera permission would have to be given in the first place, and recognizing a face mid-stream wouldn't really add anything without the specifics of the picture. And if you have the picture, local face recognition doesn't really matter. As for ssl negotiation, I should have kept that as OFF, given that many major sites are still using outdated versions. |
|
Just a quick note, when you set |
|
Not sure if this list is updated any more but I found some addons that seam to improve security a bit. Nano Defender: https://jspenguin2017.github.io/uBlockProtector/ Pure URL: https://addons.mozilla.org/en-US/firefox/addon/pure-url/ Unshorten.link: https://addons.mozilla.org/en-US/firefox/addon/unshorten-link/ P.S. are Canvas Blocker and Defender relevant at all for security? I saw them mentioned above in this thread. |
|
I tried Pure URL and I was not too convinced. There were URL which were not stripped, and others which were stripped too much. I'm more satisfied with Neat URL: https://addons.mozilla.org/firefox/addon/neat-url/ As for Canvas, it is just for tracking. No relevance for security. |
|
Hi, I use very similar recommendations on my tutos, do you think there will be redundancy between the new FF 63 anti tracking tool and decentraleyes or privacy badger ? |
ghost
changed the title
|
@kewde @beardog108
|
|
The FF internal anti tracking is a joke compared to uBlock Origin. Also you don't need Privacy Badger |
|
Disconnect uses the same lists as uBlock. Privacy Badger blocks what it thinks are unnecessary tracking requests. Decentraleyes replaces CDN libraries with local cache, I think. So uBlock + Privacy Badger + Decentraleyes is a good combination. |
|
If you have uMatrix, you do not need NoScript. However by default uMatrix does not block all first party scripts. Currently I am using:
I posted about this on Reddit
Using both at the same time is a complete waste of time. There's nothing that can be done with NoScript that cannot be done with uMatrix. I looked at this in the past.
If you want it that way, or you can How to block 1st party scripts everywhere by default.
Not if you How to create rules which apply everywhere, on all web sites. Others have mentioned uMatrix has better documentation and UI. uMatrix also has some unique features such as Ruleset recipes and umatrix hosts files (they show up as dark red for bad hosts). The uMatrix logger is really handy to determine what is happening. NoScript is also terrible at handling subdomains. When you enable List full addresses in the permissions popup (https://www.noscript.net), you get a mess. An example of that with NoScript. Which is a lot easier in uMatrix. I only needed JavaScript on It is clearly something that was an afterthought. uMatrix's UI handles subdomains and whitelisting parts of domains a LOT more efficiently. Also, uMatrix is available for Chrome, where as NoScript never got ported (you'd have to use an alternative like ScriptSafe). Raymond Hill (gorhill) has done an excellent job. I did use NoScript for many years, but I think uMatrix is better, particularly after you realize it's power. Edit:
For the moment. Wow, fancy that. Web ad giant Google to block ad-blockers in Chrome. For safety, apparently I like this How many ad blocks could an ad slinger block if an ad slinger could block blocks? |
|
@tya99 instead of blocking cookies better use container |
I have done a bit of research and I think you might be right. I was having a look at https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Extensions looking to see how I could improve things. I do think that page might be outdated. It would appear currently I wasn't protecting against cache related tracking with HTTP ETags. Using this website https://lucb1e.com/rp/cookielesscookies/ I was able to test it. That recommended extensions page mentions ETag Stoppa however it does say:
Additionally it seems there's some types of cookies that cannot be deleted through the WebExtension API:
It appears for many of those APIs they do exist now. As it says in that link on the Cookie-AutoDelete FAQ "(API available, but none to clean by host)" so this must mean it was added at some point. So I am thinking Temporary Containers might be the way to go instead of Cookie AutoDelete in the global container. I was also thinking of installing ClearURLs. I think it might be better than NeatURLs, more maintained and mature. I really hate those tracking parameters. I noticed they recommend Violentmonkey. I was surprised about that after reading Discussion: Greasemonkey, Tampermonkey, Violentmonkey, which one is best for a privacy conscious person?. I have been using Greasemonkey without any issues. I use it with I also noticed CSS Exfil Protection. I'm not sure if anything I've got currently can satisfy this but I don't think so. According to the developer's test site my browser was vulnerable. In the past I had been using Perhaps I should install something like CanvasBlocker. When using that with the Block mode "fake" it said Uniqueness 100% (0 of 358283 user agents have the same signature). Come to think of it the only non-privacy related addon I use is Tree Style Tab and Markdown Here. The internet is such a cesspool of tracking and advertising these days. |
|
Resist fingerprinting is fine and recommend in gHacks user.js |
I might just do that then. I like to avoid addons if I can help it. On mobile Android it seems Temporary Container isn't supported because of tabs.create API on Android does not support cookieStoreId. I guess there I will go with ETag Stoppa instead. I find I'm not currently using https://github.com/ghacksuserjs/ghacks-user.js/blob/master/user.js I am however just using most of the tweaks from https://www.privacytools.io/#about_config |
ghost
mentioned this issue
There's a nice writeup about that here https://medium.com/@stoically/enhance-your-privacy-in-firefox-with-temporary-containers-33925cd6cd21 @stoically points out that in that post that:
Also ghacks-user points out:
|
|
What I am missing in all lists are the performance implications of add-ons. Privacy badger, for example, adds, at least on my machine, a significant amount of time to page loads (think ~1s). This is in combination with uBlock Origin. I'll try to see if I can get some dependable performance metrics sometime soon. |
|
@abuisman try without privacy badger ;) |
|
@beerisgood that is what I did, how else do you think I found out about the difference? ;) For now, I am using firefox’s built in ad blocking and new protections against crypto mining and I block all third party cookies. That last thing is what I used privacy badger most for anyway |
|
Remember that the internal feature (disconnect list) only block few ads. You should use uBlock Origin instead. |
|
Also the internal disconnect list has whitelists (connections that will be always allowed). |
|
@beerisgood and @Atavic I meant instead of privacy badger. I also have ublock origin running with blocks for all third-party requests by default. I then allow them 1-by-1 to make websites work |
Unlock origin and Firefox tweaks are good enough. https://github.com/notracking/hosts-blocklists (Although webannoyance is not security list and is an annoyance filterlist and may you don't like them but it was great for me) Also I think Firefox blocker is redundant with unlock and will lower speed of browser but its fingerprinting and cryptominer blocklists are good. Also there are great lists in firebog.net and filterlists.com Also these prefs are really good: require safe negotiation (it breaks some websites that uses bad ssl config) Also a good pref for security (in this case may be not privacy very much) is enabling trr.mode to 2 (you also should set bootstrap address to 1.1.1.1) Although the treat model in everyone differs for example I prefer some privacy downgrades for better protection against my ISP. |
I hightly not recommend that lists. They're outdated and just stealed work from other guys, without any notice about. Also stay with https://github.com/ghacksuserjs/ghacks-user.js/blob/master/user.js |
|
Thanks
Agree, Thanks :)
Thanks, I downloaded it but was busy and coudn't look at it till now :D What is your opinion about other outdated blocklists if they don't affect browsing? Worth mentioning that Also what I noticed is that using lists with low amount of eyes in them can have potential to whitelist some trackers/... by their own. |
|
I just want to give an update, there's a fork of ublock made by the same guy who made nano defender called nano adblocker. Apparently he called it so because he cleaned up the code making it lighter and faster, or so claimed. It does have the advantage though of requiring less configuration when used with nano defender, but mainly that's because it was designed to work with it. Also Raymond Hill (the guy who made ublock) has his own accessory addon for ublock/nano called ubo-scope and it measures your 3rd party exposure. Also, I just want to say I tried to configure all these with waterfox and it didn't go so well as it's extension api is still based on firefox 57. I tried it due to some people voicing concerns of mozilla's recent choices with respect to privacy. Lastly, privacytools.io has added canvasblocker to it's recommended list as of late, but there seem to be several alternatives to the https forcing, canvas fingerprinting protection, cookie purging/isolating and url decluttering/cleaning extensions available, such as smart https. Curious to know what you guys think would be the best combination of the four. Also the guy who made smart https also has fingerprint protection extensions for webgl and certain types of audio content; didn't even know those could be fingerprinted. |
|
If your browser is based on a previous version of Firefox, you can get a previous version of the addon that still works with FF 57. |
That doesn't seam like a very good idea for security addons, like the ones discussed here. Older version could have security flaws, in addition some, like nano adblocker and defender as well as redirect amp to html, don't have compatible older versions period. |
I think we should adjust to Mozilla choices, they started to make Firefox more efficient so I think we should just wait for them to rise up more. I believe that may be their choices be sometimes disappointing for paranoid users but some of them are really necessary. or about old addons, I agree that some of them was great but Mozilla with this decision will waste lower time to compatibility fix and spend more resources for developing the core browser.
I think the first party isolation, prevent fingerprinting and clear data on exit options in Firefox is sufficient for that because every action you do for prevention, make your fingerprint more unique, so we should just use them to get lost in our crowd. especially it has convas prevention built in, cookie, web storage and ... separation built in (first party isolation) plus many more. |
|
I'm closing this issue because I believe our extensions list is fairly comprehensive with no significant overlap of tasks. |
It is getting rather long! But ... reading through, I see there is variation over time, as add-ons are improved, abandoned or new ones added. Is there a need for PT to do a regular review of such add-ons, say quarterly, or more realistically, annually? And should this be raised as a separate issue? |
|
I think you may be looking for https://github.com/privacytoolsIO/privacytools.io/issues/1328 or something listed there. |
Hi guys,
I've been removing several Firefox addons in the past weeks because they were redundant with each other. We should not recommend several Firefox addons that are doing the same job. I'm not sure about these four addons at the moment: uBlock, Decentraleyes, uMatrix and NoScript.
Please help me out. Should we remove some more?
Thanks
The text was updated successfully, but these errors were encountered: