search

tasket / Qubes-VM-hardening

Fend off malware at Qubes VM startup
GNU General Public License v3.0
74 stars 11 forks source link

ibrowse tag ineffective w Firefox v67 and later #39

Open tasket opened 5 years ago

tasket commented 5 years ago

Firefox releases after the current ESR (version 66) don't permit simple creation or management of generic browser profiles such as .mozilla/firefox/profile.default. This means the ibrowse tag currently only works with Firefox 66 and earlier, since ibrowse depends on this profile remaining viable.

For now, this doesn't present an issue with a default Debian 10 config, which uses Firefox ESR.

Newer Firefox versions perform a kind of (hash based?) locking of a profile to a specific binary installation of the program. When FF detects the absence of such a lock, it dumps the user into a freshly-created empty profile and urges them to sign up for Mozilla's cloud-based profile management. See bugzilla issue.

Since Mozilla appear committed to this new (and ethically questionable) behavior, we may want to find a workaround for Qubes-VM-Hardening that bypasses it. Of initial interest are Firefox configs profiles.ini, installs.ini, compatibility.ini and specific filesystem paths of the 'firefox' executable.

adrelanos commented 5 years ago

I have only a superficial understanding of this issue as of now. But sounds like, there should be some online news reporting, outrage about this?

I would guess that such a feature would be disabled by Tor Browser. And...

SecBrowser ™: A Security-hardened, Non-anonymous Browser

https://www.whonix.org/wiki/SecBrowser

https://www.whonix.org/wiki/SecBrowser/Qubes

SecBrowser ™ is a derivative of Tor® Browser, produced independently from the Tor® anonymity software and carries no guarantee from The Tor® Project about quality, suitability or anything else.

Would SecBrowser ™ be an alternative?