Firefox privacy and security hardening guide (2022 revised edition)

[@dinocles]

I just wanted to thank you and say that this is one of the best channels I've seen. The quality, the way of conducting, the amount of knowledge provided with practical solutions in a topic so important today as privacy. Thank you 🙏

[@janommen]

Love the improvements in video quality but the background music is bit to loud in my opinion. Keep up your great and important work!

[@sunknudsen]

Thanks for feedback… tried something new. Would you remove music or make it quieter?

[@DlxyRekt]

Remove please

[@sunknudsen]

Keep please (please vote using like button)

[@jozefserf2024]

The music is fine. Slow and relaxing.

[@janommen]

I like the music, it gives a nice touch to the video! It just has to be more quiet. Not so easy to find the sweet spot.

[@hpac9687]

Your channel is massively underrated! Your videos are really really good and informative. Please keep it up. :)

[@basganreiz]

Thanks for your guide. I have been using firefox as a default browser for 12 years. I find some of the tips very useful.

[@sunknudsen]

Pleasure!

[@gumott]

Hey Sun, I've been waiting for this video for a long time. I really appreciate your user js, since in the past I've tried using arkenfox as is with some overrides, but it still breaks some of the websites I use for work. However, I do have some constructive critisim. Since Firefox 86, firefox enabled total cookie protection for all users, and what this does is store all cookies from a certain page in a "container" so other web pages can't access it. Essentially, it is an easier to use form of containers (firefox manages it in the background for you). I've read on both arkenfox and some firefox forums that containers now just really works if you want to log in to the same pages with 2 separate accounts. Otherwise Total Cookie Protection should work just fine for everyone. Cheers!

[@gumott]

I should also remind y'all or those who still wish to use containers that the extension is not reaaaaally needed. Some about:config changes will activate containers. "privacy.userContext.enabled" set to true "privacy.userContext.ui.enabled" set to true

[@penguinstechden4533]

@@gumott If I understand correctly, you still need to install the extension if you want to create and edit containers.

[@sunknudsen]

Hey guys, what do you think about larger me on thumbnail?

[@sunknudsen]

Yes, I like it! (please like comment to vote)

[@sunknudsen]

I prefer smaller Sun (please like comment to vote)

[@techhawk1543]

Keep it simple and Elegant !

[@lankyjuggler]

Really appreciate you actually weighing usability and friendly UX in with technical details

[@sophiegadoury]

New ingredient 🎵: love it 👍🏼

[@murfdaddydolla]

Great video sun! You've just earned another subscriber. Looking forward to watching more of your content.

[@vihuvac]

Awesome! Excellent video, the script is super handy if you want to perform a quick set up. Thanks a lot Sun 😊

[@xenialxerous2441]

Hey! That was really great. Even though configuring took some time yet I found it interesting. I'll give it a try. Thanks ✌🏻

[@sunknudsen]

Did music help sustain engagement? Tried something new…

[@hvaandres]

Do you have any experience as a DevOps? I would love to see some of your insights about security with deployments

[@sunknudsen]

I do… interesting idea… will keep it in mind.

[@lazer_cs]

@@sunknudsen I would love to see that as well!

[@4FJM]

am I the only one a little confused??? I know there is a step by step guide.. but still confusion. where to put this, paste that. I had no problem with the older version but anyway. Slow it down just bit please Sun. Thanks for great content!

[@peppi7777]

Would firefox be better in using it with tor as a search engine? How about using metamask or other crypto wallets in these containers ? Can you create any videos regarding crypto security with wallets and wallet browsers ? Trezor has Tor in it too. Not much information about that settings or use. Much appreciated and your information is very detailed and specific and clear with great understanding and contents. I don't hear anyone out there that really knows or is not willing to share great knowledge or valued information . I respect your content, time and knowledge. Very valuable and more transparent than any out there as if now. Thank you.

[@k3lash174]

Also interested in what your thoughts are about librewolf

[@marc-andrerobichaud2858]

Merci beaucoup!! Est-ce possible que ça change la grandeur de l'onglet? Par exemple, lorsque j'agrandis ma fenêtre Firefox pour la capacité de mon écran, il y a un espace qui rend l'onglet plus petit que la capacité demandée... ça ressemble à un rectangle dans un rectangle. Ce n'était pas comme ça avant et je le constate en regardant la vidéo également. 2min15sec = grandeur normale 4min11sec = nouvelle grandeur Y a-t-il une solution? Voyez-vous ce que je vois?

[@marvean2519]

Dans about:config “privacy.resistFingerprinting.letterboxing” to “false” in user.js

[@Fotogoscar]

Thank you for this updated version. I have multiple computers (devices), now that I've completed my setup on my Macbook, how do I apply the same settings to my ie mac mini? do I start over again?

[@jim8790]

Could you please review and share your thoughts on PreSearch as a search engine! Also, could you please do an updated video re max privacy and security setup for Firefox? Thanks in advance.

[@sunknudsen]

Hey Jim, adding PreSearch to backlog… about Firefox hardening. This guide is actually pretty solid… for more privacy, I would recommend using Tor. For more than that, I would recommend using Tor on Tails. tails.boum.org/

[@jim8790]

@@sunknudsen thanks for the reply, Sun. Look forward to more great content from you.

[@noame]

Thank you for this quality lecture..I'm using Little Snitch with Alert operation mode and figured out that since I configured firefox with provided user.js rules appears with IP adresses and not Domain names. This no longer allows me to identify instantly which domain name allow ou block it. Do you have advice about this ? I tested disabling lines 28 to 30 (network.trr.*), changed to True line 53 and 70 (browser.urlbar.speculativeConnect.enabled & network.predictor.enabled) and to False line 68 (network.dns.disablePrefetch): but this didn't help.

[@lovebaja]

Constructive criticism: remove the redundant word "essential" from your vocabulary. Thanks a million for everything, Sun!

[@Sam-xz4cx]

I am curious to know why you have not recommended Ublock Origin extension?

[@lussor1]

Hes noob

[@MyDogSteppedOnaBeee]

Thank you so much I have been waiting for this. Appreciate it Sun!!! Since your last settings video 2 years ago that stupid DRM popup shows up on websites with videos. Does this stop that? is there any way to? I don't have it enabled at all. It keeps popping up, so annoying 🙄No more HTTPS secure everywhere extension Sun? Have you any opinion on Orion web browser?

[@circuitmoon137]

Great video mate! Mind taking a look at Brave? I have weird font issues with Firefox on Windows and it's Android app doesn't render a few web pages properly so I just keep switching away from Firefox after using it for a while.

[@sunknudsen]

Hey, will do… I prefer Firefox but Brave has pretty solid too.

[@romanpower3]

@@sunknudsen I have been using brave and configuring it. It's shields do wonders for everything. I hope it's the best chromium option. I need some extensions for games/work stuffs and would love to see if there is a container option for that. hmmm!

[@TheMichaelGrace]

THIS IS AWESOME!!!!

[@EnjoyerofYoutube]

Thank you so much, Sun! Containers are so cool!

[@pablogaztelu4316]

Hello Everyone! I'm trying to add the sync between desktop and phone and I'm having a weird issue that I wasn't having before updating the privacy settings. When trying to enter my user to accounts.firefox it keeps loading without ever changing the screen. Does anyone else have this issue? Could you help me to solve it or see what I have to change in privacy in order to make it work?

[@outlawandtattoos9481]

Hello Sun Can you details what couses you took to be a security expert and also is the video for the new mac os. Soon Thanks and have a great day

[@sunknudsen]

Hey, I am self-taught… I essentially spent a lot of time down rabbit holes experimenting. Guide should work on most versions of macOS… episode was recorded on macOS Ventura.

[@outlawandtattoos9481]

@@sunknudsen thanks man

[@FrancescoTessi]

I had to reset mac thats a good way to restart fresh with Firefox :D

[@sunknudsen]

The configuration is so much easier (and deterministic) now thanks to user.js.

[@danishmullaji9924]

Imp: What do you think about LibraWolf? Would still prefer your setup?

[@penguinstechden4533]

LibreWolf is great, but it tends to break pages that require HTML5 or WebGL. Not good for convenience.

[@JohnSmith-zl8rz]

You trust on Firefox Sync to store bookmarks?

[@Maisonier]

How does it compares with FireFox-Privacy-Script of simeononsecurity?

[@Nyowind]

What do you think of uBlock Origin?

[@marthaceciliasierrasaenz5662]

Libre wolf and mull is good??

[@armafam]

Is a luna VPN safe for iOS? Personally thinking it is not what is your thought about that.

[@sunknudsen]

I would recommend Mullvad when possible or Firefox VPN (which uses Mullvad infrastructure behind the scenes).

[@Marinate305]

Will KZbin fall under the Google container bucket? Do I need to create a separate container for KZbin? Thanks.

[@ChasMusic]

¿Will using a private window be the same protective effect as using a separate container? I realize this means I would have to remember to do that.

[@sunknudsen]

Private windows don’t do much in the means of privacy except making sure history is not preserved… which is the default when one uses the provided user.js. Using provided user.js, when one quits Firefox, all cookies, history and website data is purged (which is a little annoying but amazing for privacy).

[@AG058]

Can you make an updated video about ad blocks?

[@thenageone]

What's your opinion on LibreWolf?

[@dangerousgameofbilliards9998]

what do you think of searX and searXNG?

[@pashayk]

Hello sun! After following the steps from your video I now have a frame around every website in Firefox. I noticed you have it in your video too. How can get rid of it? And why is it actually there? Thank you!

[@sunknudsen]

Hey, frame is there to help mitigate fingerprinting using window size… this feature was developed by Tor team. It can be disabled by setting to privacy.resistFingerprinting.letterboxing to false… see sunknudsen.com/privacy-guides/how-to-configure-firefox-for-privacy-and-security/user.js.

[@Poppin023]

How does Firefox compare to Safari on macOS? How much more private is it compared to Safari?

[@stiro536]

What lines should i change in the user.js to disable 'delete cookies at shutdown' and 'delete history at shutdown'? I know it's not good for privacy to diable those options but i just want the convenience. Help would be appreciated.

[@FlagstaffslowTV]

Try changing these 3 lines to these values, this worked for me: user_pref("network.cookie.cookieBehavior", 0); user_pref("network.cookie.lifetimePolicy", 0); user_pref("privacy.sanitize.sanitizeOnShutdown", false)

[@GooseWurkz]

Great guide sun! I was using a stone-alone Facebook container add-on, but this multi-account one is a great alternative. Thanks for the quality guides and info! #SuperBacked

[@sunknudsen]

Pleasure, thanks for being part of the privacy guides community.

[@weaponengineer]

Hi Sun, I'm a big fan of your work and I wish I could meet and take your autograph 😇

[@sunknudsen]

That is flattering… who knows, maybe one day I will give a talk near you. Glad you are part of the privacy guides community. 🤓

[@alex2980]

Unrelated question but is there a way to transfer my current Firefox to a new operating system. As in bookmarks, saved passwords etc

[@sunknudsen]

I believe you can move your profile to new computer… see support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data.

[@davegebbings7632]

Hi can do a video explaining in more detail Apples new End to End encryption announcement. Thanks

[@OH2023-cj9if]

You don't need privacy badger now according to EFF.

[@jor9463]

What is your opinion on smartdust/nanodust (i.e. applied through waxqqines), and do you think 5g networks could be used to surveille people without any devices only with their body (it's possible to write data on a baceria, so why shouldn't that somehow be possible with mrna and grapheneoxide)

[@eliotcole]

I think that Firefox automatically comes with a Facebook container built in these days. At least ... nightly seems to!

[@everydaysebra]

why does this user profile zoom out of webpages and how to I prevent it?

[@oreo123cookie123]

This is happening to me too and I don't know how to fix it.

[@oreo123cookie123]

Update: after some searching I think I found the culprit. One of the Firefox "resist fingerprinting" settings is to use letterbox mode. In the user.js file it is towards the bottom: user_pref("privacy.resistFingerprinting.letterboxing", true); // Used to help resist fingerprinting… set to `false` to disable letterboxing If you change "true" to "false," it should fix the resizing of webpages.

[@darccau7204]

Wow thanks for this informations

[@tomerva22]

Awsome!

[@thenbaplayer9485]

Thanks for this video

[@gforce1102]

Hey Got a question this video was made in 2022 does this still work for This Year 2023? Will it work in Fire Fox or is there an update since this video was created ???? Thank you !!

[@sunknudsen]

Hey, yes! Reference material has been updated… see sunknudsen.com/privacy-guides/how-to-configure-firefox-for-privacy-and-security.

[@spx2338]

Tried the user.js but now the browse area is smaller, boxed. How to make this got to the normal size again?

[@sunknudsen]

Hey, letterboxing is used to help mitigate fingerprinting… you can disable that specific “feature” by setting “privacy.resistFingerprinting.letterboxing” to false in “user.js”.

[@abcdefgoodluck]

@@sunknudsen how do you edit the file?

[@seranagod909]

Do a video on performance, Firefox running really slow for me when chrome run these sites no issues fast

[@gaciscosony117]

Muchas gracias por tu trabajo

[@secretstoryofthe12]

Can we do the same on Android phones??

[@yakov9ify]

So with this user.js it seems like it completely breaks the JSTOR website (I can't download or log in through my university at all where as I can do that perfectly fine on a fresh profile) which I use almost daily as a researcher and I need this functionality, could somebody point me to what I should be removing from the user.js to make the website work again? EDIT: after some binary searching I found that the culprit was the line user_pref("beacon.enabled", false); can anybody explain to me what this does and what this line does and what are the security trade-offs for setting it to true.

[@danishmullaji9924]

What are your thoughts on LibraWolf instead of using Firefox

[@russellcooper153]

Why the explicit disable of DoH?

[@sunknudsen]

Hey Russell, my understanding is that DoH is powered by CloudFlare, a large American multinational. Enabling DoH routes all DNS queries there. For many, this may hurt privacy. When ISP is not trusted, I prefer using a VPN which allows one to choose provider and its jurisdiction (I currently use Mullvad but not all use cases justify using VPN).

[@thenbaplayer9485]

Do you have any update about the course?

[@Zaptosis]

Where is uBlock Origin? Also for donations on your site you should accept Monero, if privacy is a concern then Bitcoin certainly doesn't meet those needs.

[@penguinstechden4533]

Neither does Monero or crypto in general.

[@Zaptosis]

@@penguinstechden4533 Your joking right? Obviously operation under the assumption its privacy will be broken eventually, but that doesn't take away from what it has to offer. Please show me any electronic payment method which is more private than Monero, I doubt you'll find anything which comes close. Also nothing matches it in terms of censorship resistance, the Canadian trucker protest showed this clearly. The only crypto the government couldn't blacklist was Monero.

[@penguinstechden4533]

@@Zaptosis If privacy is a concern, don't rely on electronic payments altogether. Sure, if you absolutely need it, Monero would be the most (for now) private option. Once it cracks, however, not only will the alphabet agencies see what the transactions were, but the public as well.

[@nary8261]

This is so frustrating to follow as a Mac user and noob in tech. R we supposed to download user.js and where do we place it?

[@tristen_grant]

He explains how and where to place it.

[@thercrazether]

How come you skipped the https everywhere extension in this guide or did I just miss it?

[@8ftad3p6bo]

This arkenfox user profile have 'https mode only' enabled. With extensions you want to keep it has minimal as possible (we dont know what they are looking at right?)! HTTPS only on and https everywhere would be redundant

[@Karti200]

I really enjoy my time on Firefox after I switched to it 3 months ago as for my daily drive web browser..> tho, I am really frustrated how it is getting randomly crashes / freeze over Linux, while Google Chrome works there flawlessly :/

[@leriku2270]

Thanks m8 :)

[@paulm5935]

Why "NO" mention of "NO"-Script?

[@karelvo]

The Multi-account Containers lately gives a lot of issues with Google, KZbin, .... I can't login to these websites without disabling this add-on. Any comments or solution on this?

[@sunknudsen]

I also experienced this issue… have you tried disabling “Limit to Designated Sites” for Google profile? The alternative (which I use) is to add all Google sites one by one including the ones used during login redirects.

[@karelvo]

@@sunknudsen If I disable that setting then it works but it's not ideal ofcourse. But I'm glad I'm not the only one with this issue.

[@liljuj5933]

I found this very confusing and was not able to complete the guide. I am using Windows perhaps that’s why.

[@tristen_grant]

I followed along and it worked fine in Windows.

[@dominiccartier428]

Hi ! I never succeeded to do the profiles switch stuff in the older version I always had 2 default profile iirc and now even following step by step EVERYTHING I can't even pass the cd "" stuff. I think I m doomed. I m exhausted I m let google and Fb do whatever they want

[@sunknudsen]

Man, feel the pain… this stuff can be daunting. When I hit this kind of wall, I typically take a long break and give it another try.

[@YumeCanPvp]

Sun how to configure firefox for mobile?

[@sunknudsen]

Firefox hardening is very limited on iOS… see kzbin.info/www/bejne/e5qnpaKje5lkp7s which should still be relevant.

[@YumeCanPvp]

@@sunknudsen i mean is firefox for android, because it updated

[@gaysalad4178]

my bitdefender went NOPE

[@AG-en5y]

❤❤❤❤❤❤

[@burhanbudak6041]

Some addons for Android is redundant.

[@electricpeople7826]

How do we do this on windows

[@penguinstechden4533]

The same way, instead of using the curl command, you have to download the file and move it to the profile directory manually.

[@lagboat]

Imagine talking about privacy and you just use Mac instead of Linux.

[@rame.]

im a hardener

[@DustyBrushy]

This may be a bit of tin foil hat thinking since the amount of people looking for this much privacy browsing is pretty small compared to the rest of the user base 🤷‍♀ but a significant portion of Mozilla revenue comes form including these search engines. Assuming metrics like this are tracked, if a lot of people remove them, in a weird way, changing some of the defaults related to search will jeopardize Firefox's long term health since Google et al will be greatly disincentivized to keep these generous deals going. I wish for Mozilla to keep improving their other ways of making money so this does not become a long term danger.

[@penguinstechden4533]

Mozilla is paid to include them. Not to force their users to use it.

[@bikeny]

Please do not use any background music. It's distracting while you are speaking. There is no need for any background music in a KZbin video where the host is talking. I find more and more are doing this. Thanks in advance.

[@sunknudsen]

Hey Stephen, I believe music may help many stay engaged (attention span is shorter than ever), but I agree with you… I also prefer no music.

[@justinjustinjustin10]

@@sunknudsenlol why make their attention span worse then

[@LunaticTheCat]

100% agree. It's very distracting.

[@bk24708]

I prefer brave mostly because Firefox is a resource hog.

[@bk24708]

But I will say features for Firefox are cool and probably better.

[@عبدربالنبيعبدالمجيد]

The music in your video is so annoying. I could not focus

[@OH2023-cj9if]

This is not gor Windows!

[@R50_J0]

Feedback: Anything after "Download user.js to default profile root directory." in Step 2 in your Guide is nonsense. Why are you giving people examples using a path on your machine? And inappropriate use of that "heads-up" thing. Apparently you can't write a few simple instruction steps.

[@sunknudsen]

Hey Louis, thanks for feedback. Did others find that part of guide hard to follow?

[@fabianmiron2782]

@@sunknudsen I am an absolut noob when it come to anything PC. I would have made the steps a little slower and explained them more but only 2 or 3 minutes of the total video. I can still follow the guide so the first poster was unnecessarily rude but it feels a little fast paced at the middle off-the-peg explanation

[@R50_J0]

Most others are more polite and less rude than me and wouldn't tell you. Also, that since no one else has complained then there must not be a problem is unsound reasoning, no? If you smell like fish, I'll usually tell you you smell like fish. Would you want to smell like fish and not know it, or would you rather somebody be "rude" and tell you? And my comment wasn't on the video, it was aimed at the written instructions in the link.

[@Mateo-el6nf]

𝐩𝓻Ỗ𝓂Ø𝓈Ｍ

[@ludo237]

Please don't use Duckduckgo as a search engine, the company behind it is a sellout

[@karelvo]

Any alternative than?

[@ludo237]

@@karelvo startpage is a good alternative

[@sunknudsen]

@TrainedLizard, can you please expand on why company is a sellout?

[@gumott]

@@sunknudsen I think he might be referring to the news that DDG was caught letting microsoft trackers through its tracker blocker on their app (and I imagine their extension too). This was done due to their search syndication agreement with microsoft for bing results. Yet they never disclosed this to users anywhere, so it was a huge blunder for them. They have since fixed that, but I would be more wary of just outright recommending their apps. Just to further my example, I was using DDG email protection service, and contacted customer support so they would tell me if their servers are their own hardware or a cloud based solution. Turns out they do run on microsoft azure servers, and have no in code guarantees that microsoft wont see or steal the data. I will quote the representative I spoke to here "We trust microsoft would keep their end of the agreement." So yeah I would keep in mind that when using duckduckgo, by proxy you end up relying on microsoft in one way or another.

[@sparrowcide]

Fingerprint shows nearly identical on coveryourtracks. This really helped 👍

[@user-kf5zw8uq7r]

How can I revert back to original? I lost sync/sign in options. Option is not available after prompts were followed.