notkshitij/Betterfox
1
0
Fork 0
mirror of https://github.com/yokoffing/Betterfox.git synced 2026-06-12 15:40:48 +05:30
Code Issues Releases Wiki Activity

Updated Optional Hardening (markdown)

HJ
2023-08-28 11:36:18 -04:00
parent e5fb0ecb1f
commit 22ed0d6818
1 changed files with 21 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Optional-Hardening.md
+21 -12
@@ -23,20 +23,24 @@ We already:
* [block](https://github.com/yokoffing/Betterfox/blob/df5fc26a1bdccd30e01f3c1dfe69a09a2c050410/Securefox.js#L810-L827) HTTP subresources from loading on HTTPS pages, including insecure downloads * [block](https://github.com/yokoffing/Betterfox/blob/df5fc26a1bdccd30e01f3c1dfe69a09a2c050410/Securefox.js#L810-L827) HTTP subresources from loading on HTTPS pages, including insecure downloads
* [attempt](https://github.com/yokoffing/Betterfox/blob/df5fc26a1bdccd30e01f3c1dfe69a09a2c050410/Securefox.js#L545-L550) to upgrade HTTP site navigation to HTTPS * [attempt](https://github.com/yokoffing/Betterfox/blob/df5fc26a1bdccd30e01f3c1dfe69a09a2c050410/Securefox.js#L545-L550) to upgrade HTTP site navigation to HTTPS
#### Option 1: Enable in private windows only To add to your overrides, choose between two options below.
Firefox will get explicit permission from you before connecting to a site insecurely in [Private Browsing](https://support.mozilla.org/en-US/kb/private-browsing-use-firefox-without-history) windows (Firefox [incognito mode](https://support.mozilla.org/en-US/kb/common-myths-about-private-browsing)).
#### Option 1: Private windows only
Firefox will get explicit permission from you before connecting to a site insecurely in [Private Browsing](https://support.mozilla.org/en-US/kb/private-browsing-use-firefox-without-history) (Firefox [incognito mode](https://support.mozilla.org/en-US/kb/common-myths-about-private-browsing)).
``` ```
// PREF: enable HTTPS-Only Mode // PREF: enable HTTPS-Only Mode
// Strict HTTPS site navigation in Private Browsing. // Warn me before loading sites that don't support HTTPS
// when using Private Browsing windows.
user_pref("dom.security.https_only_mode_pbm", true); user_pref("dom.security.https_only_mode_pbm", true);
user_pref("dom.security.https_only_mode_error_page_user_suggestions", true); user_pref("dom.security.https_only_mode_error_page_user_suggestions", true);
``` ```
#### Option 2: Enable in all windows #### Option 2: All windows
Firefox will get explicit permission from you before connecting to a site insecurely in Normal and Private Browsing windows. Firefox will get explicit permission from you before connecting to a site insecurely in Normal and Private Browsing.
``` ```
// PREF: enable HTTPS-Only Mode // PREF: enable HTTPS-Only Mode
// Strict HTTPS site navigation in Normal and Private Browsing. // Warn me before loading sites that don't support HTTPS
// in both Normal and Private Browsing windows.
user_pref("dom.security.https_only_mode", true); user_pref("dom.security.https_only_mode", true);
user_pref("dom.security.https_only_mode_error_page_user_suggestions", true); user_pref("dom.security.https_only_mode_error_page_user_suggestions", true);
``` ```
@@ -55,15 +59,20 @@ user_pref("network.cookie.sameSite.schemeful", true);
*** ***
### Secure DNS (DoH setup) ### Secure DNS (DoH setup)
1) `network.trr.uri`: Use the one provided, or customize how DoH protects you. #### Provider
* [Create a profile](https://nextdns.io/?from=xujj63g5) with NextDNS and follow our [configuration guide](https://github.com/yokoffing/NextDNS-Config). * Use the one below, or [choose](https://github.com/curl/curl/wiki/DNS-over-HTTPS) your preferred provider.
* We recommend that you [create a profile](https://nextdns.io/?from=xujj63g5) with NextDNS and follow our [configuration guide](https://github.com/yokoffing/NextDNS-Config).
```
// PREF: set DoH provider
user_pref("network.trr.uri", "https://dns.quad9.net/dns-query");
```
2) `network.trr.mode`: Set to `2` if your work or university doesn't allow alternative DNS. #### Mode
* `3` has site-exceptions with a nice UI on the error page: * Set to `2` if your work or university causes issues with alternative DNS.
* Go to `☰` *→ Settings → Privacy & Security → DNS over HTTPS → Manage Exceptions* * `3` has site-exceptions with a nice UI on the error page:
* Go to `☰` *→ Settings → Privacy & Security → DNS over HTTPS → Manage Exceptions*
``` ```
// PREF: enforce DNS-over-HTTPS (DoH) // PREF: enforce DNS-over-HTTPS (DoH)
user_pref("network.trr.uri", "https://dns.quad9.net/dns-query");
user_pref("network.trr.mode", 3); user_pref("network.trr.mode", 3);
user_pref("network.dns.skipTRR-when-parental-control-enabled", false); user_pref("network.dns.skipTRR-when-parental-control-enabled", false);
``` ```