Replacing Firefox to improve user privacy...

DHOC_TAZH

Based on that list, I'd vouch for LibreWolf if that ends up being the default for the next GhostBSD release. I already use it in Windows 11 and Linux (in addition to Edge in 11, Chrome and Firefox).

ericbsd

DHOC_TAZH Based on that list, I'd vouch for LibreWolf if that ends up being the default for the next GhostBSD release.

The next release will most likely be on Firefox. It is in July.

vimanuelt It would be nice to have a community poll. :-)

Yeah, we could probably do one.

We should ensure that the browser we choose supports extensions without doing extra work to make it work, so that it does not alienate the community, including me.

vimanuelt

It would be nice to have a community poll. :-)

htx80nerd

Easy answer is Librewolf to give the user 'something' then let them make their own choices from there. Just need to give the user 'some browser' then they can use their own judgement after that.

GhostSBH

With this review of potential new web-browsers my concern as a simple user is this:
Will changing to a new browser mean I won't require the following 'Extensions' to manage my privacy and security; And if I still do, are they (or matching alternatives) available in the other browsers...

Decentraleyes extension
"Protects you against tracking through "free", centralised, content delivery."
Disconnect extension
"Make the web faster, more private, and more secure."
DuckDuckGo Privacy Essentials extension
"Privacy, simplified. Protect your data as you search and browse: tracker blocking, smarter encryption, private search, and more."
NoScript extension
"Maximum protection for your browser: NoScript allows active content only for trusted domains of your choice to prevent exploitation."
Opt-out for Analytics™ extension
"Prevents Google Analytics, Adobe Analytics and Tag Manager from collecting data and recording the user"
Privacy Badger extension
"Privacy Badger automatically learns to block invisible trackers."
Privacy Possum extension
"Privacy Possum monkey wrenches common commercial tracking methods by reducing and falsifying the data gathered by tracking companies."
Proton Pass: Free Password Manager extension
"Free and fully encrypted password manager to keep your logins and passwords safe."
Language: English (GB) locale
"Firefox Language Pack for English (GB) (en-GB)"

Giskard

GhostSBH You will need them anyway, because changing from Firefox to an alternative like those, will mainly affect what the browser itself sends to its manufacturer (mozilla in this case).
Some browser will have stricter defaults in terms of privacy, that will affect also what sites can track from you.
In my experience with Firefox, Librewolf and Waterfox, using some of the extensions you listed, I saw that privacy badger still blocks trackers even with Librewolf and Waterfox (meaning that not every tracker are blocked by the browser itself), the same with ublock origin (included in librewolf) and decentraleys or localcdn (which is not made to block tracker, but to substitute some remote services with local ones, limiting some form of tracking from the CDNs).
With Chromium derived browsers there is now the issue with extensions maniferst v3, which dictates what extensions can and cannot do. This new version reduced what adblocker and tracker blockers can do. This means that many *blocker extension are not available anymore, or are available as a under-powered version (eg. ublock lite).

As a personal note, I won't use all of the extensions you cited at the same time. Some of them overlaps in functions and scope and you risk to outweigh the browser making it slower. I prefer to have as little extensions as possible. My list is:

ublock origin (for ads and trackers)
privacy badger (for additional trackers)
localcdn
clear urls (to remove referrers from links)
firefox multi-account containers (to create separate containers for different group of sites with their own isolated cookies and local data)
cookie autodelete (to delete every cookie after the tab is closed, unless I put them in whitelist. this works best when combined with mult-account containers)

These are all available for every Firefox derived browser. In case of Chromium base browsers, I'd replace:

ublock origin with adguard (less powerful)
privacy badger is available
localcdn is available
no alternative for clear urls
no alernative for multi-account containers
cookie autodelete with cookie remover (less powerful)

vpx

I'd suggest staying with Firefox and just adding the user.js from arkenfox + the extensions uBlock Origin and CanvasBlocker.

Later it could be replaced by the new browser Ladybird.
https://ladybird.org/

vimanuelt

vpx
Good idea. We would also need to include a firewall rule. Here is a hardening script for testing.

#!/bin/sh

# Harden Firefox on GhostBSD using Arkenfox, uBlock Origin, CanvasBlocker,
# and ipfw firewall rules to block Mozilla telemetry.

set -e

# Color support
if [ -t 1 ]; then
    RED='\033[0;31m'
    GREEN='\033[0;32m'
    YELLOW='\033[1;33m'
    NC='\033[0m'
else
    RED=''; GREEN=''; YELLOW=''; NC=''
fi

# Variables
ARKENFOX_URL="https://raw.githubusercontent.com/arkenfox/user.js/master/user.js"
PROFILE_NAME="arkenfox"
MOZILLA_TELEMETRY_IP="63.245.208.0/20"
FIREWALL_FILE="/etc/rc.firewall"
BACKUP_DIR="$HOME/firefox-privacy-backup-$(date +%Y%m%d-%H%M%S)"

# Require user
if [ "$(id -u)" -eq 0 ]; then
    printf "%sDo not run this script as root. Use your regular user account.%s\n" "$RED" "$NC"
    exit 1
fi

# Install Firefox if needed
if ! command -v firefox >/dev/null 2>&1; then
    printf "%sFirefox not found. Installing...%s\n" "$YELLOW" "$NC"
    sudo pkg install -y firefox || {
        printf "%sInstallation failed. Install Firefox manually.%s\n" "$RED" "$NC"
        exit 1
    }
fi

# Backup files
backup_files() {
    printf "%sBacking up Firefox config and firewall rules...%s\n" "$YELLOW" "$NC"
    mkdir -p "$BACKUP_DIR"
    [ -d "$HOME/.mozilla/firefox" ] && cp -r "$HOME/.mozilla/firefox" "$BACKUP_DIR/firefox"
    [ -f "$FIREWALL_FILE" ] && sudo cp "$FIREWALL_FILE" "$BACKUP_DIR/rc.firewall"
    printf "%sBackups saved to %s.%s\n" "$GREEN" "$BACKUP_DIR" "$NC"
}

# Setup Firefox profile and Arkenfox config
setup_firefox_profile() {
    printf "%sCreating new Firefox profile...%s\n" "$YELLOW" "$NC"
    TIMESTAMP=$(date +%s)
    PROFILE_BASE="${PROFILE_NAME}.${TIMESTAMP}"
    firefox -CreateProfile "$PROFILE_NAME $PROFILE_BASE"
    PROFILE_DIR="$HOME/.mozilla/firefox/$PROFILE_BASE"

    printf "%sDownloading Arkenfox user.js...%s\n" "$YELLOW" "$NC"
    fetch -q -o "$PROFILE_DIR/user.js" "$ARKENFOX_URL" || {
        printf "%sDownload failed. Check your network connection.%s\n" "$RED" "$NC"
        exit 1
    }

    touch "$PROFILE_DIR/user-overrides.js"
    printf "%suser.js and user-overrides.js installed to %s.%s\n" "$GREEN" "$PROFILE_DIR" "$NC"
}

# Guide for manual extension installation
guide_extensions() {
    printf "%sPlease install extensions manually:%s\n" "$YELLOW" "$NC"
    printf "1. Open Firefox and go to about:profiles\n"
    printf "2. Launch the '%s' profile and set as default\n" "$PROFILE_NAME"
    printf "3. Install uBlock Origin: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/\n"
    printf "4. Install CanvasBlocker: https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/\n"
    printf "5. Configure and test: https://privacytests.org/ and https://browserleaks.com/canvas\n"
}

# Setup firewall to block Mozilla telemetry
setup_firewall() {
    printf "%sConfiguring ipfw to block telemetry...%s\n" "$YELLOW" "$NC"

    # Ensure firewall is enabled
    CURRENT_FW_ENABLE=$(sysrc -n firewall_enable 2>/dev/null || echo "NO")
    if [ "$CURRENT_FW_ENABLE" != "YES" ]; then
        printf "%sSetting firewall_enable=\"YES\" in /etc/rc.conf...%s\n" "$YELLOW" "$NC"
        sudo sysrc firewall_enable="YES"
    else
        printf "%sfirewall_enable=\"YES\" already set.%s\n" "$GREEN" "$NC"
    fi

    # Ensure firewall_type is set
    CURRENT_FW_TYPE=$(sysrc -n firewall_type 2>/dev/null || echo "")
    if [ "$CURRENT_FW_TYPE" != "workstation" ]; then
        printf "%sSetting firewall_type=\"workstation\" in /etc/rc.conf...%s\n" "$YELLOW" "$NC"
        sudo sysrc firewall_type="workstation"
    else
        printf "%sfirewall_type=\"workstation\" already set.%s\n" "$GREEN" "$NC"
    fi

    # Create firewall file if missing
    if [ ! -f "$FIREWALL_FILE" ]; then
        printf "%sCreating basic %s...%s\n" "$YELLOW" "$FIREWALL_FILE" "$NC"
        sudo sh -c "echo '#!/bin/sh\nfwcmd=\"/sbin/ipfw\"\n\${fwcmd} -f flush' > $FIREWALL_FILE"
        sudo chmod 600 "$FIREWALL_FILE"
    fi

    # Ensure fwcmd is defined
    if ! grep -q '^fwcmd=' "$FIREWALL_FILE"; then
        printf "%sInserting fwcmd definition...%s\n" "$YELLOW" "$NC"
        sudo sed -i '' '1i\
fwcmd="/sbin/ipfw"
' "$FIREWALL_FILE"
    fi

    # Add telemetry blocking rule
    if grep -q "$MOZILLA_TELEMETRY_IP" "$FIREWALL_FILE"; then
        printf "%sTelemetry block already in %s.%s\n" "$GREEN" "$FIREWALL_FILE" "$NC"
    else
        printf "%sAdding telemetry block rule...%s\n" "$YELLOW" "$NC"
        sudo sh -c "echo '\n# Block Mozilla telemetry\n\${fwcmd} add 600 deny ip from any to $MOZILLA_TELEMETRY_IP' >> $FIREWALL_FILE"
    fi

    # Restart firewall and verify
    printf "%sRestarting ipfw...%s\n" "$YELLOW" "$NC"
    sudo service ipfw restart

    if sudo ipfw list | grep -q "00600 deny ip from any to $MOZILLA_TELEMETRY_IP"; then
        printf "%sFirewall rule active. Telemetry blocked.%s\n" "$GREEN" "$NC"
    else
        printf "%sFirewall rule missing. Check %s.%s\n" "$RED" "$FIREWALL_FILE" "$NC"
        exit 1
    fi
}

# Run all
main() {
    printf "%sStarting Firefox hardening on GhostBSD...%s\n" "$GREEN" "$NC"
    backup_files
    setup_firefox_profile
    guide_extensions
    setup_firewall
    printf "%sAll tasks completed.%s\n" "$GREEN" "$NC"
    printf "%sNext steps:%s\n" "$YELLOW" "$NC"
    printf "1. Launch Firefox, go to about:profiles, select '%s', and set as default.\n" "$PROFILE_NAME"
    printf "2. Install the privacy extensions as instructed above.\n"
    printf "3. Edit %s/user-overrides.js to customize Arkenfox settings.\n" "$PROFILE_DIR"
    printf "4. Enable logging with: sudo sysrc firewall_logdeny=YES\n"
    printf "5. Monitor telemetry blocks: tail -f /var/log/security\n"
}

main

Robin

This site has comparisons of browsers based on privacy / spyware, and it's very enlightening. Firefox rates very high on the "spyware" index, as does Brave, much to my surprise.

I'm currently running two of the recommended browsers according to the site, ungoogled-chromium and Librewolf. Both are excellent, very fast browsers. One is chromium-based and the other is a fork of Firefox. I would probably be running Seamonkey with some mitigations if it was packaged for GhostBSD.

Perhaps some people come here from Linux or Windows to GhostBSD for the same reasons I did - to escape the corporate / spyware /advertising games and political software silliness. It wouldn't make sense to default to a well-known-for-spying web browser like either Firefox or Brave.

Giskard

I'm trying Ugoogled Chromium and found some workaround for common issues. If you are interested, I wrote about it here: https://forums.ghostbsd.org/d/437-some-tips-for-ungoogled-chromium

Still, it is less user friendly to start with it, when compared to the Firefox forks, but could be a good alternative if packaged with some user friendly defaults like:

workaround for the File dialog crash
preinstalled Chroumium Web Store addon
pre set default Search Engine

ericbsd

Giskard We can probably modify the ports to have everything set up so it is usable, then Chromium. I sure want to be able to install add-ons by default.

Robin

Since @ericbsd wanted to know about Brave as the default browser, I would say yes - except for all the "Linux stuff" that has to be installed to make it work. Since the last update Brave has been crashing frequently. And Evolution takes 28 seconds to load!, and some of the games quit working. I assume it's some conflict between earlier and later versions of Xorg, Xfce, GTK, or something. I also believe the next release will probably fix those little issues.

But I would vote with heart and soul for Brave as default - again, if it was ported to FreeBSD and didn't require all that "Linux stuff."

ericbsd

Robin I am not interested in the Linux hack for that. I want it native, and the Linux hack will cause issues.

stonedenali

vimanuelt
I have been running Librewolf as my primary browser. I do have concerns regarding the politics, but am willing to make accommodations for privacy sake.

vimanuelt

In a prototype, I created a "Featured" application button to allow you to easily select your favorite browser.

hank2121

Robin agree with You on Brave! a lot of Linux stuff, and it doesn t even work stable on Linux itself.
We use(d) (in company) Linux Mint, now the Debian based LMDE distribution with Chrome, Firefox, Edge and Brave ( for several login reasons) and Brave developed into a piece of s*** over the years, unstabilities, crashes on several portals, no good TAB management and now even unable to update itself, off my list as well.
Ungoogled-Chromium, good idea, but only if I don t have to go thru that complicated DRM (content) enabling process with almost every bigger update/upgrade on GBSD again and again.
I just left Seamonkey in fave of Thunderbird (for mail), cause there was no installable package for GhostBSD for long time!?
I still use Firefox - privacy back n force considering - for compatibility reasons with, for ex. online banking, streaming other than DRM based streamers etc.
Trying Waterfox as well now, but still at the beginning...
So, not to change again, i d love to keep Thunderbird for Email, but would consider a shift to something other than Firefox, if easily to be updated and with ONE browser, easily to handle DRM content without adjusting all the time...

Robin

Our friend @RoboNuggie made a video on how to get the latest version of Seamonkey on GhostBSD! Clickly here to watch it on youtube. It does require some "Linux stuff" to work (Linux compatibility layer), but it's a nice workaround until our friends at FreeBSD learn that Seamonkey is not "abandonware."

hank2121

Robin I guess, I even tried this but was not able to start Seamonkey. There was just no reaction..That s when I switched to Thunderbird and learned new use of this with email and printing... ;-)

« Previous Page Next Page »