Firefox Privacy: 2021 Update
A lot changed between 2019 and now, not least in regards to Firefox. Since our last post, Mozilla has improved privacy with Enhanced Tracking Protection (ETP). Earlier this year Mozilla introduced Total Cookie Protection (Dynamic First Party Isolation dFPI). This was then further tightened with Enhanced Cookie Clearing. We’re also looking very forward to Site Isolation (code named Fission) being enabled by default in the coming releases.
Now that so many privacy features are built into the browser, there is little need for extensions made by third-party developers. Accordingly, we have updated our very outdated browser section. If you’ve got an old browser profile we suggest creating a new one. Some of the old advice may make your browser more unique.
Privacy Tweaks “about:config”¶
We’re no longer recommending that users set
about:config switches manually. Those switches need to be up to date and continuously maintained. They should be studied before blindly making modifications. Sometimes their behaviour changes in between Firefox releases, is superseded by other keys or they are removed entirely. We do not see any point in duplicating the efforts of the community Arkenfox project. Arkenfox has very good documentation in their wiki and we use it ourselves.
LocalCDN and Decentraleyes¶
These extensions aren’t required with Total Cookie Protection (TCP), which is enabled if you’ve set Enhanced Tracking Protection (ETP) to Strict.
Replacing scripts on CDNs with local versions is not a comprehensive solution and is a form of enumeration of badness. While it may work with some scripts that are included it doesn’t help with most other third-party connections.
CDN extensions never really improved privacy as far as sharing your IP address was concerned and their usage is fingerprintable as this Tor Project developer points out. They are the wrong tool for the job and are not a substitute for a good VPN or Tor. Its worth noting the resources for Decentraleyes are hugely out of date and would not be likely used anyway.
NeatURLs and ClearURLS¶
Previously we recommended ClearURLs to remove tracking parameters from URLs you might visit. These extensions are no longer needed with uBlock Origin’s
The EFF announced back in September they were deprecating HTTPS-Everywhere as most browsers now have an HTTPS-Only feature. We are pleased to see privacy features built into the browser and Firefox 91 introduced HTTPS by Default in Private Browsing.
Multi Account Containers and Temporary Containers¶
Container extensions aren’t as important as they used to be for privacy now that we have Total Cookie Protection.
Multi Account Container will still have some use if you use Mozilla VPN as it is going to be integrated allowing you to configure specified containers to use a particular VPN server. Another use might be if you want to login to multiple accounts on the same domain.
Just-In-Time Compilation (JIT)¶
Mozilla browsers on Android¶
We don’t recommend any Mozilla based browsers on Android. This is because we don’t feel that GeckoView is quite as secure as it could be as it doesn’t support site isolation, soon to be coming in desktop browsers or isolated processes.
This includes all extensions that try to change the user agent or other browser behaviour to prevent fingerprinting. We see these often recommended on Reddit and would like to say that they will likely make you more unique and can be circumvented. Arkenfox has a good list of extensions you shouldn’t be using. They also have another list of extensions you needn’t bother with either. We also like to say testing sites which show you how unique you are in a set of users are often using hugely tainted results that are not indicative of real-world usage.