Replacing Firefox to improve user privacy...

ericbsd

This was supposed to discuss the best Browser to replace Firefox. Although it derived from that, I still want everyone's opinion.

vimanuelt

It may be worth recognizing that software choices, especially when it comes to browsers, can change over time. For quite a while, Firefox seemed like the best option for privacy and compatibility. However, as things continue to shift, whether in terms of features, direction, or funding, it seems wise to re-evaluate from time to time.

Speaking for myself, I find it difficult to choose a browser that fully meets my expectations. None of the current options feel entirely satisfying, and each one involves certain trade-offs.

That said, here is one way I have been thinking about the situation:

Short term: LibreWolf, using the Gecko web engine
Long term: Iridium, using the Blink web engine
In case of serious disruption: Pale Moon, using the Goanna engine
(In this context, a serious disruption might include legal or funding issues that threaten the viability of Gecko or Blink.)

This is only a personal perspective, not a proposal or conclusion. I am very curious to hear how others in the community view this. How do you balance privacy, performance, and sustainability in your choices?

As Eric mentioned, your insights would be very much appreciated.

DHOC_TAZH

Based on that list, I'd vouch for LibreWolf if that ends up being the default for the next GhostBSD release. I already use it in Windows 11 and Linux (in addition to Edge in 11, Chrome and Firefox).

ericbsd

DHOC_TAZH Based on that list, I'd vouch for LibreWolf if that ends up being the default for the next GhostBSD release.

The next release will most likely be on Firefox. It is in July.

vimanuelt It would be nice to have a community poll. :-)

Yeah, we could probably do one.

We should ensure that the browser we choose supports extensions without doing extra work to make it work, so that it does not alienate the community, including me.

vimanuelt

It would be nice to have a community poll. :-)

htx80nerd

Easy answer is Librewolf to give the user 'something' then let them make their own choices from there. Just need to give the user 'some browser' then they can use their own judgement after that.

GhostSBH

With this review of potential new web-browsers my concern as a simple user is this:
Will changing to a new browser mean I won't require the following 'Extensions' to manage my privacy and security; And if I still do, are they (or matching alternatives) available in the other browsers...

Decentraleyes extension
"Protects you against tracking through "free", centralised, content delivery."
Disconnect extension
"Make the web faster, more private, and more secure."
DuckDuckGo Privacy Essentials extension
"Privacy, simplified. Protect your data as you search and browse: tracker blocking, smarter encryption, private search, and more."
NoScript extension
"Maximum protection for your browser: NoScript allows active content only for trusted domains of your choice to prevent exploitation."
Opt-out for Analytics™ extension
"Prevents Google Analytics, Adobe Analytics and Tag Manager from collecting data and recording the user"
Privacy Badger extension
"Privacy Badger automatically learns to block invisible trackers."
Privacy Possum extension
"Privacy Possum monkey wrenches common commercial tracking methods by reducing and falsifying the data gathered by tracking companies."
Proton Pass: Free Password Manager extension
"Free and fully encrypted password manager to keep your logins and passwords safe."
Language: English (GB) locale
"Firefox Language Pack for English (GB) (en-GB)"

Giskard

GhostSBH You will need them anyway, because changing from Firefox to an alternative like those, will mainly affect what the browser itself sends to its manufacturer (mozilla in this case).
Some browser will have stricter defaults in terms of privacy, that will affect also what sites can track from you.
In my experience with Firefox, Librewolf and Waterfox, using some of the extensions you listed, I saw that privacy badger still blocks trackers even with Librewolf and Waterfox (meaning that not every tracker are blocked by the browser itself), the same with ublock origin (included in librewolf) and decentraleys or localcdn (which is not made to block tracker, but to substitute some remote services with local ones, limiting some form of tracking from the CDNs).
With Chromium derived browsers there is now the issue with extensions maniferst v3, which dictates what extensions can and cannot do. This new version reduced what adblocker and tracker blockers can do. This means that many *blocker extension are not available anymore, or are available as a under-powered version (eg. ublock lite).

As a personal note, I won't use all of the extensions you cited at the same time. Some of them overlaps in functions and scope and you risk to outweigh the browser making it slower. I prefer to have as little extensions as possible. My list is:

ublock origin (for ads and trackers)
privacy badger (for additional trackers)
localcdn
clear urls (to remove referrers from links)
firefox multi-account containers (to create separate containers for different group of sites with their own isolated cookies and local data)
cookie autodelete (to delete every cookie after the tab is closed, unless I put them in whitelist. this works best when combined with mult-account containers)

These are all available for every Firefox derived browser. In case of Chromium base browsers, I'd replace:

ublock origin with adguard (less powerful)
privacy badger is available
localcdn is available
no alternative for clear urls
no alernative for multi-account containers
cookie autodelete with cookie remover (less powerful)

vpx

I'd suggest staying with Firefox and just adding the user.js from arkenfox + the extensions uBlock Origin and CanvasBlocker.

Later it could be replaced by the new browser Ladybird.
https://ladybird.org/

vimanuelt

vpx
Good idea. We would also need to include a firewall rule. Here is a hardening script for testing.

#!/bin/sh

# Harden Firefox on GhostBSD using Arkenfox, uBlock Origin, CanvasBlocker,
# and ipfw firewall rules to block Mozilla telemetry.

set -e

# Color support
if [ -t 1 ]; then
    RED='\033[0;31m'
    GREEN='\033[0;32m'
    YELLOW='\033[1;33m'
    NC='\033[0m'
else
    RED=''; GREEN=''; YELLOW=''; NC=''
fi

# Variables
ARKENFOX_URL="https://raw.githubusercontent.com/arkenfox/user.js/master/user.js"
PROFILE_NAME="arkenfox"
MOZILLA_TELEMETRY_IP="63.245.208.0/20"
FIREWALL_FILE="/etc/rc.firewall"
BACKUP_DIR="$HOME/firefox-privacy-backup-$(date +%Y%m%d-%H%M%S)"

# Require user
if [ "$(id -u)" -eq 0 ]; then
    printf "%sDo not run this script as root. Use your regular user account.%s\n" "$RED" "$NC"
    exit 1
fi

# Install Firefox if needed
if ! command -v firefox >/dev/null 2>&1; then
    printf "%sFirefox not found. Installing...%s\n" "$YELLOW" "$NC"
    sudo pkg install -y firefox || {
        printf "%sInstallation failed. Install Firefox manually.%s\n" "$RED" "$NC"
        exit 1
    }
fi

# Backup files
backup_files() {
    printf "%sBacking up Firefox config and firewall rules...%s\n" "$YELLOW" "$NC"
    mkdir -p "$BACKUP_DIR"
    [ -d "$HOME/.mozilla/firefox" ] && cp -r "$HOME/.mozilla/firefox" "$BACKUP_DIR/firefox"
    [ -f "$FIREWALL_FILE" ] && sudo cp "$FIREWALL_FILE" "$BACKUP_DIR/rc.firewall"
    printf "%sBackups saved to %s.%s\n" "$GREEN" "$BACKUP_DIR" "$NC"
}

# Setup Firefox profile and Arkenfox config
setup_firefox_profile() {
    printf "%sCreating new Firefox profile...%s\n" "$YELLOW" "$NC"
    TIMESTAMP=$(date +%s)
    PROFILE_BASE="${PROFILE_NAME}.${TIMESTAMP}"
    firefox -CreateProfile "$PROFILE_NAME $PROFILE_BASE"
    PROFILE_DIR="$HOME/.mozilla/firefox/$PROFILE_BASE"

    printf "%sDownloading Arkenfox user.js...%s\n" "$YELLOW" "$NC"
    fetch -q -o "$PROFILE_DIR/user.js" "$ARKENFOX_URL" || {
        printf "%sDownload failed. Check your network connection.%s\n" "$RED" "$NC"
        exit 1
    }

    touch "$PROFILE_DIR/user-overrides.js"
    printf "%suser.js and user-overrides.js installed to %s.%s\n" "$GREEN" "$PROFILE_DIR" "$NC"
}

# Guide for manual extension installation
guide_extensions() {
    printf "%sPlease install extensions manually:%s\n" "$YELLOW" "$NC"
    printf "1. Open Firefox and go to about:profiles\n"
    printf "2. Launch the '%s' profile and set as default\n" "$PROFILE_NAME"
    printf "3. Install uBlock Origin: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/\n"
    printf "4. Install CanvasBlocker: https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/\n"
    printf "5. Configure and test: https://privacytests.org/ and https://browserleaks.com/canvas\n"
}

# Setup firewall to block Mozilla telemetry
setup_firewall() {
    printf "%sConfiguring ipfw to block telemetry...%s\n" "$YELLOW" "$NC"

    # Ensure firewall is enabled
    CURRENT_FW_ENABLE=$(sysrc -n firewall_enable 2>/dev/null || echo "NO")
    if [ "$CURRENT_FW_ENABLE" != "YES" ]; then
        printf "%sSetting firewall_enable=\"YES\" in /etc/rc.conf...%s\n" "$YELLOW" "$NC"
        sudo sysrc firewall_enable="YES"
    else
        printf "%sfirewall_enable=\"YES\" already set.%s\n" "$GREEN" "$NC"
    fi

    # Ensure firewall_type is set
    CURRENT_FW_TYPE=$(sysrc -n firewall_type 2>/dev/null || echo "")
    if [ "$CURRENT_FW_TYPE" != "workstation" ]; then
        printf "%sSetting firewall_type=\"workstation\" in /etc/rc.conf...%s\n" "$YELLOW" "$NC"
        sudo sysrc firewall_type="workstation"
    else
        printf "%sfirewall_type=\"workstation\" already set.%s\n" "$GREEN" "$NC"
    fi

    # Create firewall file if missing
    if [ ! -f "$FIREWALL_FILE" ]; then
        printf "%sCreating basic %s...%s\n" "$YELLOW" "$FIREWALL_FILE" "$NC"
        sudo sh -c "echo '#!/bin/sh\nfwcmd=\"/sbin/ipfw\"\n\${fwcmd} -f flush' > $FIREWALL_FILE"
        sudo chmod 600 "$FIREWALL_FILE"
    fi

    # Ensure fwcmd is defined
    if ! grep -q '^fwcmd=' "$FIREWALL_FILE"; then
        printf "%sInserting fwcmd definition...%s\n" "$YELLOW" "$NC"
        sudo sed -i '' '1i\
fwcmd="/sbin/ipfw"
' "$FIREWALL_FILE"
    fi

    # Add telemetry blocking rule
    if grep -q "$MOZILLA_TELEMETRY_IP" "$FIREWALL_FILE"; then
        printf "%sTelemetry block already in %s.%s\n" "$GREEN" "$FIREWALL_FILE" "$NC"
    else
        printf "%sAdding telemetry block rule...%s\n" "$YELLOW" "$NC"
        sudo sh -c "echo '\n# Block Mozilla telemetry\n\${fwcmd} add 600 deny ip from any to $MOZILLA_TELEMETRY_IP' >> $FIREWALL_FILE"
    fi

    # Restart firewall and verify
    printf "%sRestarting ipfw...%s\n" "$YELLOW" "$NC"
    sudo service ipfw restart

    if sudo ipfw list | grep -q "00600 deny ip from any to $MOZILLA_TELEMETRY_IP"; then
        printf "%sFirewall rule active. Telemetry blocked.%s\n" "$GREEN" "$NC"
    else
        printf "%sFirewall rule missing. Check %s.%s\n" "$RED" "$FIREWALL_FILE" "$NC"
        exit 1
    fi
}

# Run all
main() {
    printf "%sStarting Firefox hardening on GhostBSD...%s\n" "$GREEN" "$NC"
    backup_files
    setup_firefox_profile
    guide_extensions
    setup_firewall
    printf "%sAll tasks completed.%s\n" "$GREEN" "$NC"
    printf "%sNext steps:%s\n" "$YELLOW" "$NC"
    printf "1. Launch Firefox, go to about:profiles, select '%s', and set as default.\n" "$PROFILE_NAME"
    printf "2. Install the privacy extensions as instructed above.\n"
    printf "3. Edit %s/user-overrides.js to customize Arkenfox settings.\n" "$PROFILE_DIR"
    printf "4. Enable logging with: sudo sysrc firewall_logdeny=YES\n"
    printf "5. Monitor telemetry blocks: tail -f /var/log/security\n"
}

main

Robin

This site has comparisons of browsers based on privacy / spyware, and it's very enlightening. Firefox rates very high on the "spyware" index, as does Brave, much to my surprise.

I'm currently running two of the recommended browsers according to the site, ungoogled-chromium and Librewolf. Both are excellent, very fast browsers. One is chromium-based and the other is a fork of Firefox. I would probably be running Seamonkey with some mitigations if it was packaged for GhostBSD.

Perhaps some people come here from Linux or Windows to GhostBSD for the same reasons I did - to escape the corporate / spyware /advertising games and political software silliness. It wouldn't make sense to default to a well-known-for-spying web browser like either Firefox or Brave.

« Previous Page