Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix open issues/PRs #197 #108 #111 #236 #238 #239

Merged
merged 17 commits into from
Mar 19, 2017
Merged

Fix open issues/PRs #197 #108 #111 #236 #238 #239

Changes from 1 commit
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
02ec264
add firefox version indication for battery api
nodiscc Mar 14, 2017
621c4e2
add commented out prefs for *effective* default search engine choice
nodiscc Mar 14, 2017
1ab3ffd
document disabling push notifications
nodiscc Mar 14, 2017
9ad47f9
Add missing preferences descriptions
nodiscc Mar 14, 2017
854e5de
set security.ask_for_password to 2 (lock password storage periodically),
nodiscc Mar 14, 2017
0e23e4b
start moving some known problems/limitations to user.js, work on #238…
nodiscc Mar 14, 2017
17f44ce
README: remove TODOs (moved to issues)
nodiscc Mar 14, 2017
dd2f73b
README: rename 'known problems' to 'known problems and limitations'
nodiscc Mar 14, 2017
bb2bdc5
README: move known problems and limitations to relevant user.js prefs…
nodiscc Mar 14, 2017
d1e4b6d
README: improve and reorder FAQ
nodiscc Mar 14, 2017
eb45fd7
rename LICENSE.txt file to LICENSE, link to it from README
nodiscc Mar 14, 2017
581309b
more explicit NOTICE: fields
nodiscc Mar 14, 2017
930967b
gen-readme.sh: add 'known problems and limitations' section generation
nodiscc Mar 14, 2017
b70f602
run make, generate 'kwown problems and limitations' readme section
nodiscc Mar 14, 2017
fe7555a
add network.http.referer.XOriginPolicy: 2 in addition to referer spoo…
nodiscc Mar 15, 2017
f14e293
disable network.http.referer.XOriginPolicy
nodiscc Mar 18, 2017
4659c95
tests: add badssl
nodiscc Mar 19, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions user.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ user_pref("dom.mozTCPSocket.enabled", false);
// PREF: Disable DOM storage (disabled)
// http://kb.mozillazine.org/Dom.storage.enabled
// https://html.spec.whatwg.org/multipage/webstorage.html
// NOTICE: Known to cause`TypeError: localStorage is null` errors
// NOTICE: Disabling DOM storage is known to cause`TypeError: localStorage is null` errors
//user_pref("dom.storage.enabled", false);

// PREF: Whether JS can get information about the network/browser connection
Expand Down Expand Up @@ -117,7 +117,7 @@ user_pref("browser.send_pings.require_same_host", true);
// https://wiki.mozilla.org/Security/Reviews/Firefox4/IndexedDB_Security_Review
// http://forums.mozillazine.org/viewtopic.php?p=13842047
// https://github.com/pyllyukko/user.js/issues/8
// NOTICE: Could be used for tracking purposes, but is required for some add-ons to work (notably uBlock)
// NOTICE: IndexedDB could be used for tracking purposes, but is required for some add-ons to work (notably uBlock), so is left enabled
//user_pref("dom.indexedDB.enabled", true);

// TODO: "Access Your Location" "Maintain Offline Storage" "Show Notifications"
Expand Down Expand Up @@ -506,19 +506,19 @@ user_pref("security.sri.enable", true);
// https://en.wikipedia.org/wiki/Do_not_track_header
// https://dnt-dashboard.mozilla.org
// https://github.com/pyllyukko/user.js/issues/11
// NOTICE: DNT must be enabled manually
// NOTICE: Do No Track must be enabled manually
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could be "Do Not Track (DNT)"

//user_pref("privacy.donottrackheader.enabled", true);

// PREF: Send a referer header with the target URI as the source
// https://bugzilla.mozilla.org/show_bug.cgi?id=822869
// NOTICE: Breaks functionality on websites relying on authentic referer headers
// NOTICE: Breaks visualisation of 3rd-party sites on the Lightbeam addon
// NOTICE: Spoofing referers breaks functionality on websites relying on authentic referer headers
// NOTICE: Spoofing referers breaks visualisation of 3rd-party sites on the Lightbeam addon
// TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs
user_pref("network.http.referer.spoofSource", true);

// PREF: Accept Only 1st Party Cookies
// http://kb.mozillazine.org/Network.cookie.cookieBehavior#1
// NOTICE: Breaks a number of payment gateways
// NOTICE: Blocking 3rd-party cookies breaks a number of payment gateways
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should have some refs to back this up

// CIS 2.5.1
user_pref("network.cookie.cookieBehavior", 1);

Expand Down Expand Up @@ -558,7 +558,7 @@ user_pref("browser.cache.offline.enable", false);

// PREF: Clear history when Firefox closes
// https://support.mozilla.org/en-US/kb/Clear%20Recent%20History#w_how-do-i-make-firefox-clear-my-history-automatically
// NOTICE: Will **remove your saved passwords** (https://github.com/pyllyukko/user.js/issues/27)
// NOTICE: Installing user.js will **remove your saved passwords** (https://github.com/pyllyukko/user.js/issues/27)
user_pref("privacy.sanitize.sanitizeOnShutdown", true);
user_pref("privacy.clearOnShutdown.cache", true);
user_pref("privacy.clearOnShutdown.cookies", true);
Expand Down Expand Up @@ -744,9 +744,9 @@ user_pref("network.stricttransportsecurity.preloadlist", true);
// https://wiki.mozilla.org/CA:OCSP-HardFail
// https://news.netcraft.com/archives/2014/04/24/certificate-revocation-why-browsers-remain-affected-by-heartbleed.html
// https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html
// NOTICE: Leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host
// NOTICE: Vulnerable to replay attacks when nonce is not configured on the OCSP responder
// NOTICE: Adds latency (performance)
// NOTICE: OCSP leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host
// NOTICE: OCSP is vulnerable to replay attacks when nonce is not configured on the OCSP responder
// NOTICE: OCSP adds latency (performance)
// NOTICE: Short-lived certificates are not checked for revocation (security.pki.cert_short_lifetime_in_days, default:10)
// CIS Version 1.2.0 October 21st, 2011 2.2.4
user_pref("security.OCSP.enabled", 1);
Expand All @@ -761,14 +761,14 @@ user_pref("security.ssl.enable_ocsp_stapling", true);
// https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/
// https://www.entrust.com/ocsp-must-staple/
// https://github.com/schomery/privacy-settings/issues/40
// NOTICE: Falls back on plain OCSP when must-staple is not configured on the host certificate
// NOTICE: Firefox falls back on plain OCSP when must-staple is not configured on the host certificate
user_pref("security.ssl.enable_ocsp_must_staple", true);

// PREF: Require a valid OCSP response for OCSP enabled certificates
// https://groups.google.com/forum/#!topic/mozilla.dev.security/n1G-N2-HTVA
// Disabling this will make OCSP bypassable by MitM attacks suppressing OCSP responses
// NOTICE: Will make the connection fail when the OCSP responder is unavailable
// NOTICE: Known to break browsing on some [captive portals](https://en.wikipedia.org/wiki/Captive_portal)
// NOTICE: `security.OCSP.require` will make the connection fail when the OCSP responder is unavailable
// NOTICE: `security.OCSP.require` is known to break browsing on some [captive portals](https://en.wikipedia.org/wiki/Captive_portal)
user_pref("security.OCSP.require", true);

// PREF: Disable TLS Session Tickets
Expand Down Expand Up @@ -810,7 +810,7 @@ user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
// PREF: Disallow connection to servers not supporting safe renegotiation
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this have the "(disabled)" suffix, as the setting is still disabled.

// https://wiki.mozilla.org/Security:Renegotiation#security.ssl.require_safe_negotiation
// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555
// NOTICE: Makes browsing next to impossible (2012-2014-... - `ssl_error_unsafe_negotiation` error)
// TODO: `security.ssl.require_safe_negotiation` is more secure but makes browsing next to impossible (2012-2014-... - `ssl_error_unsafe_negotiation` errors), so is left disabled
//user_pref("security.ssl.require_safe_negotiation", true);

// PREF: Disable automatic reporting of TLS connection errors
Expand Down