// ============================================================================
// Firefox Hardened user.js -- Pentesting + Privacy Profile
// Based on arkenfox/user.js with pentesting additions
// Place in: ~/.mozilla/firefox/<profile>/user.js
// ============================================================================
// === STARTUP ===
user_pref("browser.aboutConfig.showWarning", false); // no warning on about:config
user_pref("browser.startup.homepage", "about:blank"); // blank homepage
user_pref("browser.newtabpage.enabled", false); // blank new tab
user_pref("browser.startup.homepage_override.mstone", "ignore"); // no whats-new page
// === TELEMETRY / DATA COLLECTION -- kill it all ===
user_pref("datareporting.policy.dataSubmissionEnabled", false); // no data submission
user_pref("datareporting.healthreport.uploadEnabled", false); // no health reports
user_pref("toolkit.telemetry.enabled", false); // no telemetry
user_pref("toolkit.telemetry.unified", false); // no unified telemetry
user_pref("toolkit.telemetry.server", "data:,"); // empty telemetry server
user_pref("toolkit.telemetry.archive.enabled", false); // no telemetry archive
user_pref("toolkit.telemetry.newProfilePing.enabled", false); // no new profile ping
user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // no shutdown ping
user_pref("toolkit.telemetry.updatePing.enabled", false); // no update ping
user_pref("toolkit.telemetry.bhrPing.enabled", false); // no background hang ping
user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // no first shutdown ping
user_pref("toolkit.telemetry.coverage.opt-out", true); // coverage opt-out
user_pref("toolkit.coverage.opt-out", true); // coverage opt-out
user_pref("toolkit.coverage.endpoint.base", ""); // no coverage endpoint
user_pref("browser.ping-centre.telemetry", false); // no ping-centre
user_pref("beacon.enabled", false); // no beacon API
user_pref("app.shield.optoutstudies.enabled", false); // no shield studies
user_pref("app.normandy.enabled", false); // no normandy/recipes
user_pref("app.normandy.api_url", ""); // no normandy API
user_pref("breakpad.reportURL", ""); // no crash reports
user_pref("browser.tabs.crashReporting.sendReport", false); // no tab crash reports
user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // no auto crash submit
user_pref("browser.discovery.enabled", false); // no extension recommendations
user_pref("extensions.getAddons.showPane", false); // no addon recommendations
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false); // no addon recommendations
// === GEOLOCATION ===
user_pref("geo.enabled", false); // disable geolocation
user_pref("geo.wifi.uri", ""); // no wifi geolocation
user_pref("browser.region.network.url", ""); // no region detection
user_pref("browser.region.update.enabled", false); // no region updates
// === NETWORK / DNS ===
user_pref("network.prefetch-next", false); // no link prefetching
user_pref("network.dns.disablePrefetch", true); // no DNS prefetching
user_pref("network.predictor.enabled", false); // no network predictor
user_pref("network.http.speculative-parallel-limit", 0); // no speculative connections
user_pref("browser.places.speculativeConnect.enabled", false); // no speculative connects
user_pref("network.dns.disableIPv6", true); // disable IPv6 DNS (leak prevention)
user_pref("network.proxy.socks_remote_dns", true); // DNS through SOCKS proxy
user_pref("network.trr.mode", 2); // DNS over HTTPS (2=preferred, 3=forced)
user_pref("network.trr.uri", "https://dns.quad9.net/dns-query"); // Quad9 DoH (malware blocking)
// === WEBRTC -- critical for IP leak prevention ===
user_pref("media.peerconnection.enabled", false); // disable WebRTC entirely
user_pref("media.peerconnection.ice.default_address_only", true); // fallback: only default route
user_pref("media.peerconnection.ice.no_host", true); // no host candidates
user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true); // force proxy
// === TLS / SSL ===
user_pref("security.tls.version.min", 3); // TLS 1.2 minimum
user_pref("security.tls.enable_0rtt_data", false); // no 0-RTT (replay risk)
user_pref("security.ssl.require_safe_negotiation", true); // require safe renegotiation
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true); // warn on unsafe
user_pref("browser.xul.error_pages.expert_bad_cert", true); // show cert details on error
user_pref("security.cert_pinning.enforcement_level", 2); // strict cert pinning
user_pref("security.pki.sha1_enforcement_level", 1); // forbid SHA-1 certs
user_pref("security.OCSP.enabled", 1); // enable OCSP checking
user_pref("security.OCSP.require", true); // hard-fail on OCSP error
// === COOKIES ===
user_pref("network.cookie.cookieBehavior", 1); // block third-party cookies
user_pref("network.cookie.lifetimePolicy", 2); // session-only cookies
user_pref("network.cookie.thirdparty.sessionOnly", true); // third-party session only
user_pref("privacy.firstparty.isolate", true); // first-party isolation
// === FINGERPRINTING RESISTANCE ===
user_pref("privacy.resistFingerprinting", true); // resist fingerprinting (changes canvas, timezone, etc.)
user_pref("privacy.resistFingerprinting.block_mozAddonManager", true); // block addon manager fingerprinting
user_pref("webgl.disabled", true); // disable WebGL (fingerprint vector)
user_pref("media.navigator.enabled", false); // hide camera/mic enumeration
user_pref("dom.battery.enabled", false); // no battery API
user_pref("dom.event.clipboardevents.enabled", false); // no clipboard events
user_pref("dom.gamepad.enabled", false); // no gamepad API
user_pref("dom.vr.enabled", false); // no VR API
user_pref("dom.vibrator.enabled", false); // no vibration API
user_pref("dom.enable_performance", false); // no performance API
user_pref("dom.enable_resource_timing", false); // no resource timing API
user_pref("dom.maxHardwareConcurrency", 4); // spoof CPU count
user_pref("font.system.whitelist", ""); // restrict system fonts
// === REFERRER POLICY ===
user_pref("network.http.referer.XOriginPolicy", 2); // no cross-origin referrers
user_pref("network.http.referer.XOriginTrimmingPolicy", 2); // trim to scheme+host+port
user_pref("network.http.sendRefererHeader", 0); // never send referrer
// === SAFE BROWSING (Google) -- disable phoning home ===
user_pref("browser.safebrowsing.malware.enabled", false); // no Google safe browsing
user_pref("browser.safebrowsing.phishing.enabled", false); // no phishing check
user_pref("browser.safebrowsing.downloads.enabled", false); // no download check
user_pref("browser.safebrowsing.downloads.remote.enabled", false); // no remote download check
user_pref("browser.safebrowsing.downloads.remote.url", ""); // no remote URL
// === DOWNLOADS ===
user_pref("browser.download.useDownloadDir", false); // always ask where to save
user_pref("browser.download.manager.addToRecentDocs", false); // no recent docs
// === FORMS / AUTOFILL ===
user_pref("browser.formfill.enable", false); // no form history
user_pref("extensions.formautofill.addresses.enabled", false); // no address autofill
user_pref("extensions.formautofill.creditCards.enabled", false); // no credit card autofill
user_pref("signon.rememberSignons", false); // no password saving
user_pref("signon.autofillForms", false); // no password autofill
user_pref("signon.formlessCapture.enabled", false); // no formless capture
// === DRM / PLUGINS ===
user_pref("media.eme.enabled", false); // no DRM
user_pref("media.gmp-widevinecdm.enabled", false); // no Widevine
user_pref("media.gmp-manager.url", "data:text/plain,"); // no plugin manager
// === PDF.js ===
user_pref("pdfjs.disabled", true); // disable built-in PDF (attack surface)
// === MISC HARDENING ===
user_pref("dom.disable_window_move_resize", true); // no window manipulation
user_pref("dom.disable_open_during_load", true); // block popups during load
user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown"); // strict popup events
user_pref("accessibility.force_disabled", 1); // disable accessibility services
user_pref("browser.helperApps.deleteTempFileOnExit", true); // clean temp files
user_pref("browser.pagethumbnails.capturing_disabled", true); // no page thumbnails
user_pref("browser.uitour.enabled", false); // no UI tours
user_pref("permissions.manager.defaultsUrl", ""); // no default permissions
user_pref("webchannel.allowObject.urlWhitelist", ""); // no webchannel
user_pref("permissions.delegation.enabled", false); // no permission delegation
user_pref("browser.contentblocking.category", "strict"); // strict content blocking
// === DISK AVOIDANCE (reduce forensic footprint) ===
user_pref("browser.cache.disk.enable", false); // no disk cache
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // media to memory
user_pref("browser.sessionstore.privacy_level", 2); // no session store for any site
user_pref("browser.shell.shortcutFavicons", false); // no favicon cache
user_pref("browser.cache.memory.capacity", 65536); // 64MB memory cache max
// === PENTESTING SPECIFIC ===
user_pref("devtools.chrome.enabled", true); // enable browser console
user_pref("devtools.debugger.remote-enabled", true); // enable remote debugging
user_pref("devtools.inspector.showAllAnonymousContent", true); // show shadow DOM
user_pref("network.http.max-persistent-connections-per-proxy", 48); // more proxy connections
user_pref("network.http.max-persistent-connections-per-server", 12); // more server connections
user_pref("security.mixed_content.block_active_content", false); // allow mixed content (testing)
user_pref("security.mixed_content.block_display_content", false); // allow mixed display
user_pref("network.stricttransportsecurity.preloadlist", false); // disable HSTS preload (testing)
user_pref("security.csp.enable", false); // disable CSP (testing only)