better browser extension & add-ons recommendations

[elijh]

The list on https://help.riseup.net/en/security/network-security/better-web-browsing is pretty out of date.

What browser extensions would we now recommend? My proposal:

Firefox

Recommended:

• HTTPS Everywhere https://www.eff.org/https-everywhere
• uBlock https://addons.mozilla.org/en-US/firefox/addon/ublock/
• Self Destructing Cookies https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/
• Disable Flash. Alternately, if you want to use Flash occasionally, install:
  • Flash Block. this will allow 'click to play' even for latest flash version. https://addons.mozilla.org/en-US/firefox/addon/flashblock/ I think firefox just lets you select 'click to activate' now, like chrome.
  • Better Privacy: needed to remove LSO or "flash cookies". https://addons.mozilla.org/en-US/firefox/addon/betterprivacy/
• Disable Java

Additional protection (but likely to cause compatibility problems on many websites):

• Referrer privacy, either:
  • RefControl https://addons.mozilla.org/en-US/firefox/addon/refcontrol/
  • Smart Referrer https://addons.mozilla.org/en-US/firefox/addon/smart-referer/
• Canvas Blocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/
• NoScript https://addons.mozilla.org/en-US/firefox/addon/noscript/
• RequestPolicy https://addons.mozilla.org/en-US/firefox/addon/requestpolicy/
• Random Agent Spoofer https://addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer/

Not recommended:

• TrackMeNot: an interesting idea to generate bogus search data, but better to just use DuckDuckGo.
• Better Privacy: This is only needed if you have Flash installed or enabled. It is used to clean up LSO or the so called "flash cookie".
• AdBlockPlus: uBlock is much better.
• Privacy Badger: uBlock already blocks tracking, as well as ads. Privacy Badger does do social media widget replacement, which could be a reason to recommend installing it. Privacy Badger might be useful if there is a new tracking network that uBlock is not yet configured for, but this happens rarely.
• Disconnect: No benefit over other free software alternatives. It is unclear where the Disconnect company is headed, since if you go to their website there is no link to install the Firefox extension anymore, they just want you to install their VPN.
• Ghostery: Closed source, and no benefit over the free software alternatives.

  Chrome

Recommended

• uBlock

[disturbio]

Adblock plus is always critized for this https://news.ycombinator.com/item?id=8103140 and adblock edge emerged as an alternative.

Anyway, enabling a good privacy focused list on adblock/plus/edge will give you good results but you are forced to mantained or rely in somebody trustable for that. With disconnect you have to trust disconnect for that (you can't add rules for it). Privacy Badger works different, it detects 3rd party content, it learns from it and blocks it... so you don't need to rely on lists.

---

• At least for firefox it's just to switch a config option (Network.http.sendRefererHeader), so even if there is no free software extension should be easy to create one.
• I like the idea of disabling flash more than recommend better privacy, but in the case of using it and the mix with firefox you still need better privacy as firefox control over LSO still sucks.

[elijh]

here are two free software user agent switchers:

• https://github.com/dillbyrne/random-agent-spoofer/ (Firefox)
• https://github.com/tarampampam/random-user-agent (Chrome)

I am using the latter, and it works well. Although some sites, like github, will break if it thinks you are using an older browser.

[elijh]

I like the idea of disabling flash more than recommend better privacy

+1

[elijh]

oh, nevermind, i guess i was just agreeing to you agreeing with me. :)

[elijh]

Why has no one written a simple all-in-one that disables referrer, disables flash, disables third party cookies, and sets a generic user agent string? I want something that you install and then it sets good defaults and warns you if you ever change them.

[elijh]

prism-break recommendations: https://prism-break.org/en/categories/gnu-linux/#web-browser-addons

disconnect vs ghostery discussions:

• https://github.com/nylira/prism-break/issues/280
• https://www.reddit.com/r/firefox/comments/1qkc2b/disconnect_vs_ghostery/

tl;dr ghostery is better but closed source.

[xinomilo]

refcontrol for mozilla (included in debian repos) is a nice referrer addon, for firefox only... http://www.stardrifter.org/refcontrol user-agent-switcher (firefox only) for changing default user agent.. http://chrispederick.com/work/user-agent-switcher/

adblock edge for firefox, adblock(?) for chrome, do the adblocking part nicely. tried ghostery in the past with both chrome/firefox, but lots of memory used and random crashes.. got rid of it and browsing was fun again :)

cookies deletion (on exit), and flash plugin can be disabled manually via regular browser options (not about:config), maybe thats a better "tip", than just filling the browser with addons (?)

[elijh]

this seems better than adblock for chrome: https://github.com/gorhill/uBlock

[disturbio]

And now it supports firefox too! https://github.com/gorhill/uBlock/releases :D

[elijh]

Another long discussion on this very topic: https://www.reddit.com/r/privacy/comments/31ikb0/firefox_addons_what_to_keep_and_what_to_get_rid_of/

[cooperq]

Add https-everywhere, canvas fingerprint block, and webrtc block from chromium
There is also the chameleon plugin which tries to detect and block fingerprinting but it does tend to break some things still.

[cooperq]

I would say that one advantage of privacy badger over µblock is that privacy badger will block third party resources from setting/getting cookies and getting referrers, which µblock will not block at all. For example maps.google.com, amazonaws, cloudflare, etc.

[taggart]

I would like to recommend switching search to DuckDuckGo. They have a page that's a good start at https://duck.co/help/desktop/adding-duckduckgo-to-your-browser But I would recommend:

• installing their browser plugin
• going into the search settings and deleting (or at least disabling) gmail/yahoo/bing/etc

[elijh]

resolved by https://github.com/riseupnet/riseup_help/pull/213