Firefox Privacy: 2021 Update

A lot changed between 2019 and now, not least in regards to Firefox. Since our last post, Mozilla has improved privacy with Enhanced Tracking Protection (ETP). Earlier this year Mozilla introduced Total Cookie Protection (Dynamic First Party Isolation dFPI). This was then further tightened with Enhanced Cookie Clearing. We’re also looking very forward to Site Isolation (code named Fission) being enabled by default in the coming releases.

Now that so many privacy features are built into the browser, there is little need for extensions made by third-party developers. Accordingly, we have updated our very outdated browser section. If you’ve got an old browser profile we suggest creating a new one. Some of the old advice may make your browser more unique.

Privacy Tweaks “about:config”

We’re no longer recommending that users set about:config switches manually. Those switches need to be up to date and continuously maintained. They should be studied before blindly making modifications. Sometimes their behaviour changes in between Firefox releases, is superseded by other keys or they are removed entirely. We do not see any point in duplicating the efforts of the community Arkenfox project. Arkenfox has very good documentation in their wiki and we use it ourselves.

LocalCDN and Decentraleyes

These extensions aren’t required with Total Cookie Protection (TCP), which is enabled if you’ve set Enhanced Tracking Protection (ETP) to Strict.

Replacing scripts on CDNs with local versions is not a comprehensive solution and is a form of enumeration of badness. While it may work with some scripts that are included it doesn’t help with most other third-party connections.

CDN extensions never really improved privacy as far as sharing your IP address was concerned and their usage is fingerprintable as this Tor Project developer points out. They are the wrong tool for the job and are not a substitute for a good VPN or Tor. Its worth noting the resources for Decentraleyes are hugely out of date and would not be likely used anyway.

NeatURLs and ClearURLS

Previously we recommended ClearURLs to remove tracking parameters from URLs you might visit. These extensions are no longer needed with uBlock Origin’s removeparam feature.

HTTPS Everywhere

The EFF announced back in September they were deprecating HTTPS-Everywhere as most browsers now have an HTTPS-Only feature. We are pleased to see privacy features built into the browser and Firefox 91 introduced HTTPS by Default in Private Browsing.

Multi Account Containers and Temporary Containers

Container extensions aren’t as important as they used to be for privacy now that we have Total Cookie Protection.

Multi Account Container will still have some use if you use Mozilla VPN as it is going to be integrated allowing you to configure specified containers to use a particular VPN server. Another use might be if you want to login to multiple accounts on the same domain.

Just-In-Time Compilation (JIT)

What is “Disable JIT” in Bromite? This option disables the JavaScript performance feature JIT. It can increase security but at the cost of performance. Those trade-offs vary wildly and are explored in this publication by Johnathan Norman from the Microsoft Edge team. This option is very much a security vs performance option.

Mozilla browsers on Android

We don’t recommend any Mozilla based browsers on Android. This is because we don’t feel that GeckoView is quite as secure as it could be as it doesn’t support site isolation, soon to be coming in desktop browsers or isolated processes.

We also noticed that there isn’t an option for HTTPS-Only mode. The only way to get something similar is to install the deprecated extension HTTPS Everywhere.

There are places which Firefox on Android shines for example browsing news websites where you may want to partially load some JavaScript (but not all) using medium or hard blocking mode. The reader view is also pretty cool. We expect things will change in the future, so we’re keeping a close eye on this.

Fingerprinting

Firefox has the ability to block known third party fingerprinting resources. Mozilla has advanced protection against fingerprinting (RFP is enabled with Arkenfox).

We do not recommend extensions that promise to change your browser fingerprint. Some of those extensions are detectable by websites through JavaScript and CSS methods, particularly those which inject anything into the web content.

This includes all extensions that try to change the user agent or other browser behaviour to prevent fingerprinting. We see these often recommended on Reddit and would like to say that they will likely make you more unique and can be circumvented. Arkenfox has a good list of extensions you could use, and a list of ones you needn't bother with. We also like to say testing sites which show you how unique you are in a set of users are often using hugely tainted results that are not indicative of real-world usage.

Special thanks to Thorin-Oakenpants and Tommy for their help with providing advice and further documentation during the research phase.