My combinedfox project contains user.js combining arkenfox, Betterfox, and combinedfox overrides for Firefox-based browsers for desktop, and instructions and extensions settings for Firefox-based browsers for desktop and Android, for privacy, security, and usability.
The v2.0.0 release switches to dev branch of arkenfox since their latest release was 5 months ago for Firefox v144.
I'll quote fingerprint and telemetry, the most easily misunderstood and the most controversial part in my opinion, of combinedfox wiki Explanations below in hope that they may be helpful. Some quotes, lists, and links are removed here due to character limit of Lemmy.
No artificial intelligence except for machine translation of references is used in the development of this project, including its wiki, and this post.
Fingerprint
Only Tor Browser and Mullvad Browser with a truthworthy VPN achieve nearly identical fingerprint across their users. Use them if your threat model calls for it.
links and quote removed
Fingerprinting protection in Firefox:
-
Known Fingerprinters: It is enabled by default for Enhanced Tracking Protection (ETP) Standard mode. The “Known Fingerprinters” protection feature works by blocking scripts listed in Disconnect's fingerprinting list. This prevents companies specializing in fingerprinting from examining your device and obtaining details about their hardware, software or IP address. While this serves as an initial defense, it does not safeguard you against companies that are not included in the list. Additionally, we sometimes have to create exceptions for this list to ensure that websites continue to work as intended.
-
RFPTargets: The list of all targets can be viewed at RFPTargets.inc. They, as of the time writing this, are listed below, some with descriptions found in links removed
-
baselineFingerprintingProtection (bFPP) (privacy.baselineFingerprintingProtection): It is enabled by default for Enhanced Tracking Protection (ETP) Standard mode. The list of all targets in bFPP can be viewed at RFPTargetsDefaultBaseline.inc. They, as of the time writing this, are listed below.
-
fingerprintingProtection (FPP) (privacy.fingerprintingProtection): It is enabled by default for Enhanced Tracking Protection (ETP) Strict mode. The list of all targets in FPP can be viewed at RFPTargetsDefault.inc. They, as of the time writing this, are listed below.
-
resistFingeprinting / Resist Fingerprinting (RFP) (privacy.resistFingerprinting): It is not enabled by default. It includes all RFPTargets. RFP is a built-in solution in Firefox that blocks or randomizes many metrics without requiring a crowd like Tor Browser. However, expect site-breakings when using it, which is mostly due to canvas randomizing. links removed
-
Global RFPTarget overrides: You can use only a few RFPTargets globally by setting privacy.resistFingerprinting to false and setting privacy.fingerprintingProtection.overrides (if you use FPP) or privacy.baselineFingerprintingProtection.overrides (if you use bFPP) to the RFPTargets you want. The value is a comma-separated list that is either +AllTargets and then - targets you don't want or -AllTargets and then + targets you want. arkenfox uses FPP, while combinedfox adds user_pref("privacy.fingerprintingProtection.overrides", "+AllTargets,-CSSPrefersColorScheme,-CanvasImageExtractionPrompt,-CanvasExtractionBeforeUserInputIsBlocked,-CanvasExtractionFromThirdPartiesIsBlocked,-JSDateTimeUTC,-FrameRate");.
-
Site-specific RFPTarget overrides: You can use only a few RFPTargets for specific sites by setting privacy.resistFingerprinting to false and setting privacy.fingerprintingProtection.granularOverrides (if you use FPP) or privacy.baselineFingerprintingProtection.granularOverrides (if you use bFPP) to the sites and their site-specific RFPTargets you want. The value is a JSON list of objects where sites are firstPartyDomain entry and overrides are in overrides entry, e.g. [ { "firstPartyDomain": "jeffersonscher.com" , "overrides": "+WindowOuterSize" }, { "firstPartyDomain": "reddit.com" , "overrides": "+JSDateTimeUTC" } ], according to Mozilla Support Correct syntax for privacy.fingerprintingProtection.granularOverrides?.
-
Request English versions of web pages for enhanced privacy (privacy.spoof_english) (default: false, combinedfox: true): When privacy.resistFingerprinting = true, a new option becomes available in General > Choose your preferred language for displaying pages > Choose > Request English versions of web pages for enhanced privacy, which changes three config settings: intl.accept_languages = en-US, en, javascript.use_us_english_locale = true, privacy.spoof_english = 2. When privacy.resistFingerprinting = false, javascript.use_us_english_locale and privacy.spoof_english are not available in UI but can be set in user.js or about:config.
-
Letterboxing (privacy.resistFingerprinting.letterboxing) (default: false, combinedfox: true): Dynamically resizes the inner window by applying margins in stepped ranges when privacy.resistFingerprinting.letterboxing = true. This is independent of RFP.
-
Fingerprinting protection extensions: Use FPP, RFP, or FPP+RFPTargets overrdies instead of extensions for fingerprinting protection. The built-in RFPTargets are more robust and performant, defeats naive scripts, and defeats some advanced scripts by standarding fingerprints of users to fewer buckets, according to arkenfox issue 1775. links removed
quote removed
As a memorial, CanvasBlocker extension was the best solution for fingerprinting protection without Tor Browser or Mullvad Browser before RFPTargets growed to cover enough metrics. Reasons of not using each CanvasBlocker option now are listed below. Some are according to arkenfox user.js wiki before CanvasBlocker is removed from its recommendation, e.g., links removed
Telemetry
According to links removed, if browser.profiles.enabled is set to true (default since FF150 and set to true in Peskyfox), all profiles share the same settings for Settings > Permissions and data > Firefox data collection and use and the corresponding user.js prefs are not honored. You might want to check and manually adjust those settings in the GUI of one of your profiles.
combinedfox overrides for arkenfox user.js arkenfox-overrides.js link removed re-enables the disabled telemetry in TELEMETRY section in arkenfox because
- Arkenfox and combinedfox do not consider these Firefox telemetry to be a privacy or security concern.
- Building a browser is hard; building a good browser inevitably requires gathering a lot of data to make sure that things that work in the lab work in the field, according to moz://a HACKS Testing Privacy-Preserving Telemetry with Prio.
- There are several problems with opt-in telemetry and asking users: they are prone to inaccurate and misleading data, they're undiscoverable for less technical users, and if they are discoverable, then they are usually displayed in such a way they aggressively shift users' focus, according to Opt-in Telemetry and Asking Users for Feedback May Not Work in Practice.
- No Personally Identifiable Information (PII) is collected, according to arkenfox commit 3d76c74c.
- Every new profile on first use provides data collection and use policy and the ability to opt-out.
- It can be disabled at any time.
- Data collected can be viewed in
about:telemetry.
Refer to the following sources for more information:
Reverse them to disabled in your overrides if your threat model calls for it.
However, the followings that are disabled in arkenfox and remain disabled in combinedfox.
- Crash Reports: arkenfox/combinedfox modify a lot of preferences, which makes the crash reports not productive to be sent to Mozilla, and the recommended way is to reproduce it in a new profile then send your crash report, according to links removed.
- Firefox Home/Activity Stream telemetry: links removed
- Shield Studies/Normandy (Shield Recipe Client): Refer to
- Nimbus rollouts/experiments: Refer to:
There are two main ways of gathering data in Firefox:
- Desktop Telemetry, which is used in Firefox Desktop. Refer to:
- Glean, which is Mozilla's newer telemetry framework and used in all Mozilla projects needing data collection. Refer to:
There are three way of sending collected data:
- Regular telemetry: It discards your IP immediately, according to ritter.vg telemetry helps. you still get to turn it off
- Oblivious HTTP (OHTTP): It works by routing encrypted data through an intermediary to conceal its source. Refer to
- Prio/Distributed Aggregation Protocol (DAP): It splits the data into two shares and sends each share to a different server. Refer to
