# Hardening Firefox ;Thoughts on this article **URL:** https://discuss.privacyguides.net/t/hardening-firefox-thoughts-on-this-article/16944 **Category:** Questions **Tags:** browsers **Created:** 2024-02-18T10:26:33Z **Posts:** 27 ## Post 1 by @anon83734303 — 2024-02-18T10:26:34Z > **[Firefox sends data to Google by default. Here's how to prevent it](https://miloslav.website/blog/2020/10/26/firefox-privacy/)** > > The very names “Mozilla” and Firefox browser particularly are perceived as caring about your privacy. While they claim they don’t buy or sell user data direc... Is this a big deal? Does google collect user info this way? --- ## Post 2 by @KeepItSimple — 2024-02-18T11:06:24Z Google SafeBrowsing list is cached, so when you visit a site, it is looked at cache, not at Google. But the list is refreshed from time to time and here Firefox access Google directly, while Brave does it through proxy, without revealing your IP. Also Google claims they do not collect full IPs, but only part of it, so you can not be tracked easily. I do not use SafeBrowsing, as I think it is useless for me. --- ## Post 3 by @sha123 — 2024-02-18T11:13:09Z Fear mongering. The safe browsing implementation of FF is quite privacy respecting. Also if the author had a bit of browser knowledge, he would know that “Chrome” is a general browser term, and not just used for “Google Chrome”. See [Chrome - Glossary | MDN](https://developer.mozilla.org/en-US/docs/Glossary/Chrome) --- ## Post 4 by @sha123 — 2024-02-18T11:15:28Z > [@KeepItSimple](#): > > I do not use SafeBrowsing, as I think it is useless for me. If your browser has a privacy respecting implementation, you should use it. Nobody is immune to making mistakes, falling for fishing or mistyping a website address. --- ## Post 5 by @fury — 2024-02-18T15:44:42Z I think this interesting. I always remove anything related to google/microsoft/meta. Also I recommend NoScript extension for any websites that you don’t trust. --- ## Post 6 by @widget — 2024-02-18T16:09:21Z [Arkenfox wiki](https://github.com/arkenfox/user.js/wiki) This is the best guide for hardening. **Reading the above wiki is a must.** --- ## Post 7 by @xe3 — 2024-02-18T18:36:50Z The author of that article is misguided and misinformed. So long as Google SafeBrowsing is accessed in a privacy respecting way (which Firefox & Brave both do) SafeBrowsing is a feature not a problem. You are free to disable it if you want. But it won’t meaningfully improve your privacy, and will reduce your security. --- ## Post 8 by @fury — 2024-02-18T19:00:50Z > [@xe3](#): > > Google SafeBrowsing Google will have at least your IP. It’s not good if you want as much privacy as possible --- ## Post 9 by @exaCORE — 2024-02-18T20:09:06Z First of all, it depends on your threat model. Secondly, Just having your IP doesn’t help google much at all. Also a VPN would fix any concerns about the IP anyway. --- ## Post 10 by @fury — 2024-02-18T20:42:21Z I think it’s better to subscribe to blocklist like [this](https://phishing.army/download/phishing_army_blocklist_extended.txt) it will block malicious links faster and will not reveal anything to google --- ## Post 11 by @sha123 — 2024-02-18T20:57:22Z > [@fury](#): > > it will block malicious links faster and will not reveal anything to google Pretty sure it can’t compete with Google’s Safe browsing. --- ## Post 12 by @fury — 2024-02-18T21:22:20Z > [@sha123](#): > > can’t compete with Google’s Safe browsing. > **Data Source and Analysis** > > Generated every 6 hours from [PhishTank](https://www.phishtank.com/), [OpenPhish](https://openphish.com/), > [Cert.pl](https://www.cert.pl/ostrzezenia_phishing/), [PhishFindR](https://github.com/mitchellkrogza/Phishing.Database), [Urlscan.io](https://urlscan.io/) and [Phishunt.io](https://phishunt.io/)reports. > Each domain is analyzed to eliminate false positives, > through the Whitelist of [Anudeep](https://github.com/anudeepND/whitelist) and the [Alexa Rank](https://www.alexa.com/topsites). From their [website](https://phishing.army) --- ## Post 13 by @exaCORE — 2024-02-18T21:38:14Z It doesn’t help protect against bad downloads though. As mentioned previously, the safesearch is cached for the most part, it isn’t really an issue: [Is Google Safe Browsing Service Potentially Bad For Privacy? | Firefox Support Forum | Mozilla Support](https://support.mozilla.org/en-US/questions/1400401) Also see: [How does built-in Phishing and Malware Protection work? | Firefox Help](https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work#w_what-information-is-sent-to-mozilla-or-its-partners-when-phishing-and-malware-protection-is-enabled) --- ## Post 14 by @xe3 — 2024-02-18T22:39:19Z > [@fury](#): > > I think it’s better to subscribe to blocklist like [this](https://phishing.army/download/phishing_army_blocklist_extended.txt) I have no issues with that blocklist. But Blocklists and SafeBrowsing are not mutually exclusive. Its up to you whether you use SafeBrowsing or not, but I still don’t understand what specifically you fear will be “revealed to Google” with a privacy-preserving implementation of SafeBrowsing. (my recollection is that even privacy projects towards the extreme end of the spectrum (like Arkenfox) leave most SafeBrowsing stuff enabled). If not revealing your IP to Google _ever, in any context_ is part of your threat model, you’d need to be using Tor or a VPN permanently anyways, and/or possibly blocking all known Google domains and IPs, regardless of whether you use SafeBrowsing or not (Google is present on a large majority of websites). And if that is not part of your threat model, I’m not sure what value disabling SB would provide. edit: with that said, I do think it would be nice if Mozilla implemented SB in such a way that the connection was proxied. Even if there is no PII shared. > **Further Reading** > > It would be too slow (and privacy-invasive) to contact a trusted server every time the browser wants to establish a connection with a web server. Instead, Firefox downloads a list of bad URLs every 30 minutes from the server (`browser.safebrowsing.provider.google.updateURL`) and does a [lookup against its local database](https://dxr.mozilla.org/mozilla-central/rev/494289c72ba3997183e7b5beaca3e0447ecaf96d/netwerk/base/nsBaseChannel.cpp#303-320) before displaying a page to the user. > > # Privacy > > One of the most persistent misunderstandings about Safe Browsing is the idea that the browser needs to send all visited URLs to Google in order to verify whether or not they are safe. > > While this was [an option](https://www.google.com/tools/firefox/safebrowsing/faq.html#q11) in [version 1](https://wiki.mozilla.org/Safe_Browsing:_Server_Spec) of the Safe Browsing protocol (as disclosed in their [privacy policy](https://web.archive.org/web/20051230133135/http://www.google.com/tools/firefox/extensions_privacy.html) at the time), support for this [“enhanced mode” was removed in Firefox 3](https://bugzilla.mozilla.org/show_bug.cgi?id=388652) and the version 1 server was [decommissioned in late 2011](https://security.googleblog.com/2011/05/safe-browsing-protocol-v2-transition.html) in favor of [version 2 of the Safe Browsing API](https://developers.google.com/safe-browsing/developers_guide_v2) which doesn’t offer this type of real-time lookup. > > Google explicitly states that the information collected as part of operating the Safe Browsing service [“is only used to flag malicious activity and is never used anywhere else at Google”](https://blog.chromium.org/2012/01/all-about-safe-browsing.html) and that [“Safe Browsing requests won’t be associated with your Google Account”](https://www.google.com/intl/en/chrome/browser/privacy/whitepaper.html#malware). In addition, Firefox adds a few privacy protections: > > - Query string parameters are [stripped](https://dxr.mozilla.org/mozilla-central/rev/494289c72ba3997183e7b5beaca3e0447ecaf96d/toolkit/components/downloads/ApplicationReputation.cpp#684-710) from URLs we check as part of the download protection feature. > - Cookies set by the Safe Browsing servers to protect the service from abuse are stored in a [separate cookie jar](https://bugzilla.mozilla.org/show_bug.cgi?id=897516) so that they are not mixed with regular browsing/session cookies. > - When requesting complete hashes for a 32-bit prefix, Firefox throws in a number of extra [“noise” entries](https://dxr.mozilla.org/mozilla-central/rev/494289c72ba3997183e7b5beaca3e0447ecaf96d/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp#283-289) to obfuscate the original URL further. > > On balance, we believe that most users will want to keep Safe Browsing enabled, but we also make it easy for [users with particular needs](https://www.torproject.org/projects/torbrowser.html) to turn it off. * * * > [@](#): > > it will block malicious links faster I highly doubt that (but I could be wrong). --- ## Post 15 by @stnert — 2024-02-19T16:27:41Z Here, too → [Firefox — Spyware Watchdog](https://spyware.neocities.org/articles/firefox) --- ## Post 16 by @user1 — 2024-02-19T16:49:25Z > [@stnert](#): > > Here, too → [Firefox — Spyware Watchdog](https://spyware.neocities.org/articles/firefox) > Version tested: 52.5.0 Seriously? --- ## Post 17 by @KeepItSimple — 2024-02-19T17:29:24Z > [@user1](#): > > Seriously? Mostly still same, but now also one needs to opt out of ads, disabling firefox suggest. --- ## Post 18 by @stnert — 2024-02-19T18:19:07Z Telemetry remains present in the current version, so what? --- ## Post 19 by @user1 — 2024-02-19T19:12:58Z Well, I tell you what. You’re not doing anyone a favor linking an extremely obsolete “guide” from a random unknown dubious source. Here at PG we try to be as accurate as possible and avoiding FUD. And that is possible only if the points you make are supported by evidence that can be validated. Now a 3 years old obscure blog post is simply not a good source of information. I feel that a lot of new people are joining the forum lately and they start posting as they never read the site and like be on reddit. PG has already recommendation settings for [Firefox](https://www.privacyguides.org/en/desktop-browsers/#firefox) and for [hardening it](https://www.privacyguides.org/en/desktop-browsers/#arkenfox-advanced) which follow valid criteria and up to date information. If you think something isn’t correct or should be changed you’ve to raise better and well backed points. --- ## Post 20 by @exaCORE — 2024-02-19T19:41:51Z Agreed, furthermore, labelling Firefox as being “spyware” is unproductive and incorrect --- ## Post 21 by @FlipSid — 2024-02-19T22:38:27Z Spyware.neocitys: “52.5.0, with the default settings…” Dude we are in 2024 now, not 1980 :joy::joy::joy: Even if it where up to date, the other members already wrote enough. Basically I had to start somewhere as well, like others These days I am more relaxed, have my places to go for information, this page is one of them, and a few other sites (like GrapheneOS) I disregard the rest. It’s the internet, where there’s a high level of just blabla. So my advice to new guys is: Narrow sources down to a absolute minimum (and make sure the source is valid)…spywareneocity is not one of them. --- ## Post 22 by @xe3 — 2024-02-20T00:45:43Z > [@FlipSid](#): > > Dude we are in 2024 now, not 1980 No need to blow it out of proportion.. Its _Only **71** major releases out of date_ :joy: > [@FlipSid](#): > > (and make sure the source is valid)…spywareneocity is not one of them. I’m shocked! :wink: --- ## Post 23 by @stnert — 2024-03-03T23:00:12Z Ok, the website in question may have cited an old version. But how do you explain the fact that Mozilla Firefox still has telemetry active by default? --- ## Post 24 by @FlipSid — 2024-03-04T00:48:18Z This is what Firefox says: > **[Manage technical and interaction data collection settings in Firefox |...](https://support.mozilla.org/en-US/kb/technical-and-interaction-data?redirectslug=telemetry-clientid&redirectlocale=en-US)** > > Learn what technical and interaction data Firefox collects, how it’s used, and how to manage or opt out on desktop, Android and iOS. By the way: On the link in question, the one you @stnert posted, I really tried hard to take it seriously but I didn’t get very far :laughing: Go to the link… Spyware Level **high** Klick on the link After following **the mitigation** guide, this software is **Not Spyware.** The first sentence is **Note: This guide is deprecated** What??!?!?! :laughing::laughing::laughing: If your still worried about it just use Fennec or Mull…Or Brave, … --- ## Post 25 by @stnert — 2024-03-04T00:59:04Z Brave? Nope. I really prefer Firefox, I already use it with Arkefox configured. --- ## Post 26 by @exaCORE — 2024-03-04T01:36:17Z > [@stnert](#): > > But how do you explain the fact that Mozilla Firefox still has telemetry active by default? Mozilla has a good privacy policy and it is easy to turn off. It would be nice if it was toggleable on first use, but not a big issue IMO --- ## Post 27 by @FlipSid — 2024-03-04T18:34:09Z Then, for mobile, Mull is your friend.