search

arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.43k stars 508 forks source link

add FPP granularOverrides for the FYI factor #1857

Closed qxlf closed 1 week ago

qxlf commented 1 week ago

Resist fingerprinting spoofs a couple things, including my time zone. my time zone is utc +2:00, can i change it to that without disabeling resist finger printing?

sertonix commented 1 week ago

I think the best you can get is FPP with all RFPTargets except timezone spoofing.

qxlf commented 1 week ago

how would i do that?

Thorin-Oakenpants commented 1 week ago
  1. https://github.com/arkenfox/user.js/blob/6446d73cf572fcdf631534a5a51276a64eec4a2d/user.js#L735-L741
  2. https://github.com/arkenfox/user.js/issues/1334
qxlf commented 1 week ago

thanks

Thorin-Oakenpants commented 1 week ago

so something like +AllTargets, -JSDateTimeUTC

edit: this is only used if FPP is functioning - i.e ETP Strict is on and RFP is disabled

Thorin-Oakenpants commented 1 week ago

you can also override it for specific sites - e.g. gmail gets the real time but all other sites get UTC (or Atlantic/Reykjavik in FF128+)

Thorin-Oakenpants commented 1 week ago

override it for specific sites

privacy.fingerprintingProtection.granularOverrides - takes a JSON

[ { "firstPartyDomain": "example.com" , "overrides": "+Example1" }, { "firstPartyDomain": "example.org" , "overrides": "+Example2" } ]
qxlf commented 1 week ago

i want my timezone to be the same across the web, i saw in the first link that the command was something like: ITEM_VALUE(AllTargets, 0xFFFFFFFF'FFFFFFFF) what command type would i need to get my timezone the same across the web? when you mentioned my FingerPrintProtection needed to be disabled, does that mean that the privacy.fingerprintingProtection is set to true? im still new to github and i dont know much about coding / command lines for firefox

Thorin-Oakenpants commented 1 week ago

So first things first

(edited: optional keep LBing enabled and webgl disabled since you're only dropping one RFP target)

// my arkenfox overrides

// disable RFP so FPP kicks in
user_pref("privacy.resistFingerprinting", false);
// user_pref("privacy.resistFingerprinting.letterboxing", false); // optional
// user_pref("webgl.disabled", false); // optional

// change FPP to use all RFP (+) protections except the ones I don't want (-) globally
user_pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-JSDateTimeUTC");

NOTE the + and - signs

In arkenfox v128 the "disable RFP so FPP kicks in" will be redundant as they will be the default (if you run prefsCleaner once arkenfox 128 is released)

qxlf commented 1 week ago

im probably blind, but there is no target specified for time on the linked site. and i didnt know arkenfox was gonna disable letterboxing, is that better for privacy? and luckely i allready had an overrides file with a setup

Thorin-Oakenpants commented 1 week ago

I given it to you twice now ... -JSDateTimeUTC

keep letterboxing if you want, since you're keeping all the other RFP targets

edit: and you could keep webgl disabled too if you want

qxlf commented 1 week ago

thanks

crssi commented 1 week ago

@Thorin-Oakenpants do you use RFP or FPP?

...and thank you for all your work for us. Love you ❤️

Thorin-Oakenpants commented 1 week ago

I will forever use RFP because .. reasons

qxlf commented 1 week ago

i think i have both? definately rfp in the about:config

i just copied someone elses overrides and adjusted some things to my liking

this is the overrides i used as my personal base (there also is a great video on it): https://gitlab.com/trafotin/dotfiles/-/blob/main/user-overrides.js the video link: https://www.youtube.com/watch?v=GVOcElOPs8E

after adding user_pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-JSDateTimeUTC");

to my overrides file it still didnt change my utc time from UTC 0:00 to UTC 2:00 (i am still missing something and i am too stupid to figure it out)

i also tried +2:00 on the command and that also didnt work

sertonix commented 1 week ago

You can only use ether RFP or FPP. RFP has a higher priority when enabled.

To fix your issue you probable need these:

user_pref("privacy.resistFingerprinting", false);
user_pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-JSDateTimeUTC");
Thorin-Oakenpants commented 1 week ago

i am still missing something

run the updater so your overrides get added to the user.js

qxlf commented 1 week ago

nope, still didnt work. time is still on UTC 0:00 instead of UTC +2:00 i updated my config, i cleaned my prefs, updated my config again and still nothing and this is only on firefox, because info gets spoofed due to arkenfox, when i go to ungoogled chromium the time is as it should be

Thorin-Oakenpants commented 1 week ago

open the user.js and check if your overrides are added to the bottom

Thorin-Oakenpants commented 1 week ago

closing since I've added it to the next PR

@qxlf feel free to keep asking about how to get your overrides working - I've tried to step you thru it, and it should work

Jee-Hex commented 1 week ago
  • [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults

Maybe it would be a good idea to also point out what the FPP defaults are? Currently (128) this can be found in https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargetsDefault.inc.

qxlf commented 1 week ago

i could just drop my full overrides in, maybe that would be easier to problem solve it? here is my full overrides file: https://pastebin.com/jKuAZe7Y and i tried to use these 2 commands, but that changed nothing:

// change FPP to use all RFP (+) protections except the ones I don't want (-) globally
user_pref("privacy.resistFingerprinting", false);
user_pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-JSDateTimeUTC");
Thorin-Oakenpants commented 1 week ago

the whole point of having a separate user-overrides.js is so that when you update they get appended to the bottom and not lost

Thorin-Oakenpants commented 1 week ago

https://github.com/arkenfox/user.js/issues/1857#issuecomment-2180394803

overrides-user.js

well, fuck. i just corrected it, but it's user-overrides.js - but going by your link that's not the problem

try this

This is the first step - because it's still not clear if you are actually applying user-overrides.js -> user.js

qxlf commented 1 week ago

did all steps, the user.js indeed removes all notes from my overrides and applys them when it needs to.

Thorin-Oakenpants commented 1 week ago

OK, I'll have a play later, just for you - because I do not support this config myself personally nor have time for arkenfox to either (because I am arkenfox)

user_pref("browser.search.suggest.enabled.private, false);

this line (line 124 in your overrides linked to) has a syntax error - it is missing a closing " on the pref name

user_pref("browser.search.suggest.enabled.private", false);

so any prefs under that line might not be applied - see https://github.com/arkenfox/user.js/wiki/2.1-User.js#-usage - the link about it syntax errors and parsing being aborted

in your linked user-overrides.js I do not see these lines - this is required (i.e you need to disable RFP) in order for FPP to kick in and for privacy.fingerprintingProtection.overrides to be used

some quick observations

// this is deprecated, remove it and reset it in about:config
user_pref("network.cookie.lifetimePolicy", 0);

// these are commented out in arkenfox, no need to set them - remove them
user_pref("network.dns.disableIPv6", false);
user_pref("media.eme.enabled", true);

// these are already set false in arkenfox, no need to duplicate - remove them
user_pref("browser.cache.disk.enable", false);
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.urlbar.suggest.searches", false);

// these are already set true in arkenfox, no need to duplicate - remove them
user_pref("privacy.userContext.enabled", true);
user_pref("privacy.userContext.ui.enabled", true);

// this is already set strict in arkenfox (and required for FPP which you want), no need to duplicate - remove it
user_pref("browser.contentblocking.category", "strict");
Thorin-Oakenpants commented 1 week ago

Can I also check that you're on FF127 ? and not ESR115 - thanks

qxlf commented 1 week ago

im on 127, i am using Opensuse Tumbleweed (Linux) so im up to date and these 2 lines are set to false:

user_pref("privacy.userContext.enabled", false);
user_pref("privacy.userContext.ui.enabled", false);

keep or remove? and the reason the last 2 lines werent present is because the version i have on Pastebin is the one that is fully intact and not in an experimental phase / stage

i didnt remove the line to enable DRM content, since if i remove it it never wants to stay on

i also cant safe my preferences when it comes to always being asked where i want my files saved, despite me adding a lot of command lines to try and enable it

and the timezone issue is finally fixed, i now have the right time of UTC +2

thanks for all the help

and a small bit of info, the pastebin link wont work anymore since i set the post back to private since the issue is now fixed

rindeal commented 6 days ago

For anyone interested, I've created a web tool for easily editing privacy.fingerprintingProtection.overrides. https://github.com/rindeal/Firefox-FPP-Override-List-Editor

Thorin-Oakenpants commented 6 days ago

^ https://github.com/arkenfox/user.js/issues/1334#issuecomment-2191364911

I saw it yesterday and thought neat (for testing) but didn't add anything - but given your enthusiasm in sharing, I'll count you as dependable in keeping it up to date :) thanks