Addons

>The EFFs HTTPSEverywhere. Converts websites to HTTPS(Encrypted) version rather than default unencrypted HTTP. >Noscript comes with strong XSS protection and allows for the blocking of scripts. Great for stopping data collection, bandwidth hogging, advertisements, and other garbage. >UMatrix. A strange addon. Haven't seen any code audits although its open source, might need a bit of some investigating. My testing with it has been great, allows for website-specific rules and global rules to stop requests that Noscript doesn't. Might break a few websites, but I haven't encountered anything that can't be fixed. At the very least block Google, Facebook, Twitter, Sharethis, Akami, Disqus, Youtube, Rubicon, and Cookies globally. Probably the most important and the one I'd keep if I could only have one. The main three to keep one safe. Does anyone have further information on UMatrix? Don't know if spying software or not.

uMatrix is made by gorhill who is legit. Also made uBlock and then uBlock Origin. Really though extensions don't "keep you safe". What you want is your various identities and activities segregated into different environments. Anything less is a false sense of security.

Thoughts on Ghostery? It helps show trackers and other stuff when you visit sites.

>>8293 I've already taken care to maintain security on my part, but the unaudited code of the FOSS that I use is something important. I can expect the linux kernel to be safe due to its massive size and usage, but for something as small as a browser extension, I can't be sure. Heres where my questioning comes: >Pic related Blindly states that uMatrix is not to be trusted. I already have suspicions about Ghostery and Disconnect(Go look at their websites, they are strangely good. This might seem like a minor point but it serves as an easier barrier to entry to those new to the security scene. Additionally, it also gives insight into their existence as companies, companies who have been "endorsed" by major news and journalist websites with strange user testimonies, as if they are trying too hard.) I trust EFF with HTTPS Everywhere and the creators behind Noscript. Canvas blocker I don't know about. New FF doesn't support older version with face logo, but has a newer version.

You say "to stay safe." I don't want to make you divulge anything you shouldn't, but what does that mean? Opsec is radically different depending on what you're doing. If you just generally don't like tracking, the usual extension stew is not bad. Some of them are owned of course. You put forth a lot of trust with extensions. Basically you're multiplying the parties that might possibly be able to track you, hoping they won't. Make sure they're open source and have been reviewed. Of course that's still not a bulletproof guarantee. If you're doing anything... specific.. well you need to be getting a separate machine and doing a lot more work and using some more specialized software. Controversy abounds on that; it's almost like asking a motorcycle mechanic what engine oil is best. Lots of very strong and often conflicting opinions. I don't know if I'm super qualified to give advice on that one honestly.

>>8296 A minimal existence. The lowest data transfer possible, that is, only the necessary scripts and requests present, everything else such as ads, analytics, "experience improvers" gone. Blackmail, being prosecuted for something you did/didn't do, and being doxxed are real threats. My success in the future is reliant on my actions now, and maintaining privacy is far harder than not.

>>8294 IIRC ghostery is spyware, I haven’t looked into it for years though.

>>8292 >The main three to keep one safe. Does anyone have further information on UMatrix? Didn't audit the source code, but I use it every day - it's safer (or at least more convenient) than nonscript, because it has per-site settings and you can block individual website elements - cookies, css, XHR, images (which can track you too), JS, canvas and frames. But if you really care about security, you should stay away from web browsers at all.

>>8297 Could there be a hardened version of elinks out there?

>>8295 >Pic related >Rails against anything made by gorhill using hand-wavey $H1LL accusations instead of substantive arguments. lel Here's my recommended list: CanvasBlocker Decentraleyes HTTPS Everywhere Neat URL Privacy Badger/Possum Smart Referer uBlock Origin uMatrix

>>8303 I think uMatrix makes Privacy Badger/Possum irrelevant if you use it in the most paranoid mode Clear URLs is a better version of NeatURL CSS Exfil could be added if you are extremely paranoid Invidition is useful if you like invidio.us/nitter (less cancerous frontends for YT and twitter) Also, LASER CAT, extremely important addon

>>8303 Decentraleyes is fantastic. It will actually speed your web perusing up since it's serving content locally. I had canvasblocker but now I just go in about:config and set resist.fingerprinting to true. Should I go back to canvasblocker? I used to browse with tons of addons like that, thinking I was protecting my privacy, but lately I just use umatrix and decentraleyes, and firefox multi-account containers. I also use the host file from here and just put it in /etc/hosts: https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/social/hosts I find it infinitely satisfying to blacklist facebook at the system level. It's like it doesn't even exist in my world. So good... I just don't feel like I should need all these addons running just to browse the web. Just disable javascript everywhere using umatrix and only enable it domain by domain until the site works, if you need it.

>>8292 Isn't NoScript with uMatrix redundant? Both can block scripts. The difference is that with uMatrix you have a lot more control over domains and what you block (besides scripts). My recommendations (and what I run) are: Cookie AutoDelete (delete cookies after leaving site) HTTPS Everywhere Privacy Settings (for easy access to about:config settings, should you need it) uBlock Origin (obvious choice for an adblocker) uMatrix These should suffice. If you need more protection/anonymity then you should check out TOR Browser as your main browser. >>8300 >But if you really care about security, you should stay away from web browsers at all. That's like saying "If you really care about security, then don't connect your device to the internet." It's not really practical, is it?

>>9372 Thanks for these! Glad to see Clear URLs is pretty actively developed.

I havent read umatrix's source code enough to be considered an "audit" (just little bits every now and then to see how something works) but it has been at the center of my web browsing workflow for years and I really can't complain. I basically just run a ublock/umatrix combo for most things with a couple single purpose addons like httpseverywhere to fill in the gaps. I use ublock as kind of the always-on baseline with a somewhat permissive list that only really blocks actual ads and trackers which never really break things (that way if I just turn umatrix off in frustration to just get a website to load I'm not dropping all defences). Also the element zapper and ease of adding new rules by simply clicking on the thing you want to block is brilliant. However umatrix is irreplaceable for the way it lets you deal with cookies, frames, xhr, scripts, and even images in a relatively straightforward way. Aggressive defaults and whitelisting is the way to go even if you are like me and do a lot of exploring online rather than just visiting the same few sites. You'll pretty quickly figure out which domains do what and what you have to do to unfuck things. I will say I think noscript is a better javascript blocker than umatrix but its not enough of an improvement for me to want to run both unless I'm in a situation where defending against serious javascript exploits (instead of just regular tracking soykaf) is important. Something else I've recently added to my workflow and have grown to really like is this addon called "temporary containers". Conceptually it works like namespaces for your browser. You can have persistent containers or temporary containers that are deleted after the tab is closed and you set rules to define which URLs open in which containers. For instance if you use Facebook you could set it so that when you click a link to Facebook it opens in a special persistent Facebook container which saves your Facebook cookies so you don't have to constantly log in but at the same time keeps those cookies inaccessible to beacons on third party sites. Then there are the temporary containers which can also be spawned according to the rules you set or manually by clicking a little thing in the toolbar. They essentially work like private windows which still save your history. Firefox has built this container functionality into the browser so the addon doesn't cause as much of a performance hit as you might expect. In fact I recently learned Mozilla has their own version of the temporary containers addon that I havent used yet but might end up switching to once I do a little research. Finally there's tampermonkey which isn't a privacy tool per se but can be used as one if you need to counter more advanced behavior on a website you use often enough to make writing a bit of js worth it. I don't use things like privacybadger although I'm happy they exist for other people. It's just that they don't do anything I'm not already doing with ublock/umatrix and tend to just slow down my browser.

>>9408 >tampermonkey use violentmonkey Mozilla's account container extension is used to contain multiple browsing identities e.g. one for school, one for banking, one for work, etc. The Temporary Containers people recommend using both at the same time.

>>8295 >pic related This guy has a lot of confidence in his opinions for someone who all but admitted he can't read code in the second image.

>>9409 Thanks for the tips. What's the deal with violentmonkey?

>>9411 oh duh tampermonkey is closed source I didnt even realize that I thought it was a gm fork

>>9410 Not them, but what makes you say that? Just curious.

>>8292 It doesnt matter if you have lots of "privacy" extensions installed and still visit botnet sites and services. What i would suggest is to limit your time on internet and cut out youtube, all google/MS/amazon/discord... services. Good extensions are uMatrix(dont bother with uBlock Orgin), decentraleyes, HTTPS everywhere (with all sites ON) and modify settings in about.config, refer to https://www.privacytools.io/. Also use a DNS like https://blahdns.com/, or VPN (best option is to buy VPS or selfhost). Then test your browser via https://panopticlick.eff.org. To sum up, only visit sites you trust and spend less time on internet.

I looked into keeping myself safe online a lot. Here is my previous setup: extensions: >HTTPS Everywhere (always on) >uBlock origin >NoScript I also changed these settings around for more defense in depth: >private mode always ON >tracking protection set to STRICT >privacy.resistFingerprinting ON and then I decided to put my setup to test with panopticlick. As you can see in pic related, my efforts was not only counterproductive, I also wasted a lot of my time only to make my setup unique among hundreds of thousands of browsers. Google reCAPTCHA became a bitch to solve anyway. I use Tor Browser now. This is the only true solution.

>>9457 In my experience you only really need uMatrix for blocking, uBlock is redundant and does less than uMatrix. >>9435 For future reference, I'm pretty sure tracking protection in Firefox actually connects to Googles servers so if you're serious about avoiding Google it's better to keep it off.

>>9435 Did you disable webgl and document fonts?

>>9462 I use Palemoon and of course, I get a unique signature. It seems like you can't escape fingerprinting.

As a privacy conscious person, I send Do Not Track HTTP header to every website so they would definitely know I have something to hide and apply additional measures ;-)

>>9462 >uBlock is redundant and does less than uMatrix. if you're just using both of them as host blockers then sure, but they do diverge in their more advanced usage. first of all, ublock can block by full resource path instead of just by subdomain (e.g. example.tld/images/advertisements/*.jpg instead of blocking all of example.tld). this doesn't come up too often but i've used it often enough to be glad it's a feature. secondly, ublock can access and manipulate the DOM on the fly, which beyond ads is a really powerful tool for just cleaning up things about a website that annoy you. as a result of these two features, it tends to be better at blocking custom first party ad implementations that are deliberately harder to deal with than just blacklisting a hostname. it's also great at getting rid of annoying popup nag bar overlay things (idk if they have an actual name but i get them on news sites all the time). without ublock you basically have to edit the page html every time it loads to deal with it, but ublock can automate this process that would be impossible with simpler host-based blocking. the benefits of umatrix are obvious so i wont get into that. i personally use and heavily rely on both. there definitely is some overlap in the sense that they both do host based blocking but i deal with this by having ublock set to blacklist domains that i absolutely never want to load content from (beacon and ad domains, essentially) then set umatrix to 3rd party whitelist mode. if i'm playing umatrix minesweeper to get a page to load correctly and disable it out of frustration, ublock still provides baseline tracking protection.

>>9484 from a fingerprinting standpoint it's probably worth considering not setting the do not track header, but >they would definitely know I have something to hide and apply additional measures this is bullshit. we're mostly talking about avoiding dragnet surveillance. they don't care about what you're trying to hide. they don't even care who you are, really. they just want to pin a tracking number to you and build an advertising profile. what would these "additional measures" you're talking about even look like? >>9425 this bit: >disconnect: CNN, WALL STREET, made by former google employee >>inb4 hue hue open source. >can you read code? did you examine it yourself? when translated from his "i'm a genius and everyone else is a retard" language, this should be read as "i don't know enough about how this piece of software works to say much about it, but there are some circumstantial aspects that make me hesitant to use it" which is fair enough. intuition like that is often good to have. but stating it as if disconnect is CONFIRMED BOTNET is disingenuous FUD.

>>9485 Do you use uBlock on hard mode? I have uMatrix with everything blocked by default, and unblock 1st party as needed. I only used a couple of more specific rules and I left those websites for good anyway. >>9486 >they just want to pin a tracking number to you and build an advertising profile. It's really not an advertising profile, it's a profile - that is right now mostly used for advertising and serving you personalized content to sway your opinions. Do not track is definitely used to help with fingerprinting, so you should leave it off.

>>9488 >Do you use uBlock on hard mode? Not typically. It seems redundant when I'm pairing it with umatrix anyway (assuming youre talking about the advanced switch thing that gives you first/third party script blocking switches and whatnot). That being said, I do think the post I was replying to has it backwards. With advanced mode and some thoughtful tag blocking rules for things like iframes ublock features are almost a total superset of umatrix. It's just that umatrix has a better ui for digging into those more fine grain controls.

>>9434 that dns seems interesting, i'll look more into it... however, it's just another service you just gotta trust ¯\_(ツ)_/¯ and dns over https isn't really as secure as everyone pretends it to be... the website you visit still get leaked through metadata (which are sent unencrypted by their very purpose) now i am not saying you shouldn't use it i also don't wanna be soykafting on you or your choice of services, just wanted to point it out so you are aware it's not a foolproof thing (also - and this is purely personal thing - i feel a bit uneasy about the person behind the service using cloudflare :/ )

>>9462 >uBlock is redundant and does less than uMatrix. I used to believe this, but its not true. uBlock can filter requests by URL including directories, and mangle the DOM. uMatrix offers amazing control over cookies and XHR though. I think a complete solution requires both.

I can't grasp the purpose of HTTPS Everywhere. It literally does the opposite of it's name, the operation is based of whitelist of websites curated in their central directory. It doesn't even store their certificate fingerprints, so it's not really saving users from anything. 50% of the times I have to manually type in https because it doesn't know the website, the other 50% are anti-http warning pages, Mozilla style: I know it's an http site, I deliberately clicked the link, because I know it doesn't serve https, you treat me like an idiot who doesn't know what he's doing, then why don't you redirect me to https version automatically? Why can't this thing probe website for https connection and fall back to http page when no valid certificate is received, fully transparent, it shouldn't bother me with stupid pages to the point of disabling it's main function and leaving it hang there, passively-aggressively blinking in red when I visit http page. Yeah so what, ever got an idea that webpage last updated in 2001 doesn't need your silly encryption, it's not like I'm retarded enough to send my bank account details there.

>>9634 >why can't it just do it for me >what is MITM >what is content injection Dude certs are free. There's zero reason to not use it. There is no argument for HTTP without SSL for public sites.

>>9641 To be pedantic: TLS There is no reason to use SSL

>>9642 SSL and TLS are used interchangeably. The real crime is that people are going to be slow as hell to adopt to TLS 1.3 due to most languages just outright not supporting it fully right now. None of this makes >>9641's argument any less valid. You're an idiot if you don't use at least self-signed certificates. It gives to the borderline security. mTLS is cool & more services should use mTLS. How to get the common CA onto all machines is the real challenge.

>>9641 Not an argument. You did not answer the question. HTTPS Everywhere would not prevent injections and mitm on site not in their whitelist, neither it is aware of any previous site's certificates, it's useless outside of visiting Facebook. They get sites in their whitelist by running SSL Observatory spyware on your computer. I repeat again: HTTPS not Everywhere does not force https on all sites because it checks them in whitelist! Do you know what a whitelist is? >There is no argument for HTTP without SSL for public sites. There is. it's called cryptographic hash addresses and cryptographically signed content. http://pebble.ink/~imt/2014/12/08/signing-all-pages-with-gnupg.html Read the post till end before idiotposting next time.

>9645 >I repeat again: HTTPS not Everywhere does not force https on all sites because it checks them in whitelist! Do you know what a whitelist is? This is a pretty compelling criticism of https everywhere. Whats the point of a https whitelist ? Why can't it just redirect all services to https, observe response, if timeout, then allow http and whitelist http for 24 hours ?

>>9646 I'm not the same person you're quoting but HTTPS Everywhere fundamentally makes no sense. If the server isn't serving HTTPS traffic (and has no server cert) there's no way to actually provide HTTPS traffic (i.e. there is no root of trust and you're connection is insecure). None of this matters because most HTTP servers are just some nginx reverse proxy and the internal networks of all of these services are probably just running HTTP so your data is still in the open for everyone to see.

>None of this matters because most HTTP servers are just some nginx reverse proxy and the internal networks of all of these services are probably just running HTTP so your data is still in the open for everyone to see. If an edge HTTPS host proxys for an intranet HTTP host inside a trusted intranet, I don't care. I am concerned about pervasiveness surveillance, commercial surveillance, and my ISP. The fact that somewhere, a corporation stores a fake address for me in clear text isn't an issue, as long as it traverses the public untrusted internet in ciphertext.

>>9645 You're right. I completely misread the whole point of your post, and wrote something dumb. Still, without integrity checking being deployed on a large portion of HTTP content, it's just more feasible right now to use SSL. Realistically, if it's not something boomers and normal people can use intuitively, it won't be adopted on a large enough scale to matter. >here's one counterexample Great, now when signature verification for active content served over HTTP is actually enforced, you'll have a point. As for the whitelist, you're right, that's trash. >>9644 Correct, I was trying to say (poorly) that SSLv2 and SSLv3 cipher suites are still in use. It's not super common, but it is out there. And I also agree, even using self-signed certs is better than plain HTTP.

>>8295 Seriously why not ublock origin? https://github.com/gorhill/uBlock/

Personally I use ublock origin plus a pihole on my network to block all sorts of junk, malware domains, tracking and just anything known to be nasty. Also I use Quad9 DNS which block harmful domains. https://pi-hole.net/

>>11094 Your comment is very helpful to this thread's topic, considering you answered to 4chan troll infographic from 2015. >>11095 Your router probably has "parental settings" option, aka DNS sinkhole in nerdspeak, it does all the things you described, but better.

anti-addon: came to my attention that Stylish has been sold in about 2016 and now is an "ad-analytics" spyware since 2017 January that reports like every url you open. (Stylish has previously been a great addon overriding CSS stylesheet on sites and posting them on user styles dot org.) Avoid sources: look it up...

Generally I work with some of the add-ons described here. Good recommendations and informative. https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Extensions

How the fuarrrk do so many people here not understand the EASE mode in HTTPS Everywhere? fuarrrking ignorant. You're all railing against something that has already been solved.

>>11099 Thanks. I switched to stylus. You can export stylish rules as a json.soykafty_suffix file. Stylus loads the file without having to rename it.

Is there any reason to not just use SmartHTTPS instead?

>>11109 I replaced HTTPS Everywhere by HTTPZ. Addon made by a dev really active in the sec/privacy firefox community. https://github.com/claustromaniac

>>9392 >resist.fingerprinting One thing to keep in mind about this setting is it changes the behavior of firefox to report the size of the website view as screen size instead of your actual screen size. This means that if you fulscreen or otherwise resize firefox you are actually *more* vulnerable to fingerprinting as the resolution of the website view will be fairly unique. If you want to be secure you have to use the default size of firefox just like with tor.

>>11939 Is there a full writeup anywhere about everything the resist fingerprinting setting does?

Here's everything I use, plus some comments

these days i've been going with a stripped down list of addons because a lot of the privacy tweaks i'd want have been integrated into firefox itself. i mostly just use umatrix, ublock, and an addon to make managing tab containers more convenient. other than that, i just have a few minor addons that are very specific to my use case: foxyproxy, browserpass, user agent switcher (not for fingerprinting concerns, but because sometimes i need a host to think i'm on a phone), plus a bunch of tiny userscripts i've written myself to fix things i don't like about frequently used sites. anyone have recs for good canvas/webgl/webrtc blockers/spoofers? i know there are many schools of thought here but the one i've been using just gives dummy values that change periodically so that i have a somewhat unique but changing fingerprint rather than trying to somehow have a very generic fingerprint (which seems pretty hard to do, given how e.g. webgl fingerprinting works).

I really lost it for mozilla. Firefox just dropped a lot of addons for no reason every update and enforced those fingerprint-able webextensions while the addon store had everything deleted. There's not even any way to delete LSO cookies anymore since the addon page is gone because of webextensions and the only way to get it is to find some german article where they mirrored the addon. All addons I used to use stopped working properly, even Pale moon somehow made a switch to australis or something and became slower, plus the problem with JS engine that even mainline Firefox also had. The web is being controlled and directed into some form of governance and censorship.

>>8303 >>9392 >>9434 >Decentraleyes I've started using a variant called LocalCDN that appears to be getting updates much more frequently than Decentraleyes and supports a LOT more libraries. Only downside is that it doesn't have the Mozilla "seal of approval". In my comparison, Decentraleyes had intercepted 2,781 requests over the course of 688 days, coming out to a little over 4 requests per day. LocalCDN has intercepted 598 requests over the course of 26 days, coming out to 23 requests per day. Seems in my experience that LocalCDN is about 6x more effective. It's also received two or three updates in the short period of time I've had in installed, where Decentraleyes seems to have stagnated.

>>12001 Ublock and cookie prompt remover seem to be doing the same thing with right lists.

>>12133 >with the right lists Any in particular? I have enabled most of the lists that come preconfigured in ublock but I still get a lot of cookie popups

>>12135 I think he's talking about: >AdGuard Annoyances >Fanboy’s Annoyance >uBlock filters – Annoyances All of them include cookie notification filters. I've read about "I don't care about cookies" but I don't use it so I can't really say anything about that. Irc. it's not just using static filters but some kind of "smart filtering".

>>8295 Link to the white noise one? can't find it anywhere.

>>9435 Tor browser has a very unique fingerprint also, funny enough.