Firefox on Dark Kernel

Firefox Hardening

Sun, 30 Jul 2023 16:43:11 +0530

Using firefox?

Firefox is the best browser for linux nerds and others who want browser other than chromium, it’s being almost 2 decades of firefox and now it is filled with some craps which needs to be removed to increase the quality.

Mozilla and Google have extended their current search deal to keep Google as the default search engine provider inside the Firefox browser until at least 2023, with an estimated price tag of around $400 million to $450 million per year.

Well, today we will see some of the steps to increase the security and surfing experience of firefox.

Update the user.js profile.

. Visit about:profiles on your firefox, don’t touch any profile, create new.
click on open directory, it will open the location where that user profile exists.
create new file user.js in that directory
```
vim user.js
```

Now here the game starts,

This file is used to toggle and set multiple preferences for firefox which cannot be changed directly using firefox ui. So here we will be defining some the important user_preferences.

Increase speed.

user_pref("nglayout.initialpaint.delay", 0);
user_pref("nglayout.initialpaint.delay_in_oopif", 0);
user_pref("content.notify.interval", 100000);
user_pref("browser.startup.preXulSkeletonUI", false);

Set the browser cache limit

user_pref("browser.cache.memory.max_entry_size", 153600);

Increase tracking protections

user_pref("browser.contentblocking.category", "strict");
user_pref("urlclassifier.trackingSkipURLs", "*.reddit.com, *.twitter.com, *.twimg.com, *.tiktok.com");
user_pref("urlclassifier.features.socialtracking.skipURLs", "*.instagram.com, *.twitter.com, *.twimg.com");
user_pref("privacy.query_stripping.strip_list", "__hsfp __hssc __hstc __s _hsenc _openstat dclid fbclid gbraid gclid hsCtaTracking igshid mc_eid ml_subscriber ml_subscriber_hash msclkid oft_c oft_ck oft_d oft_id oft_ids oft_k oft_lk oft_sk oly_anon_id oly_enc_id rb_clickid s_cid twclid vero_conv vero_id wbraid wickedid yclid");
user_pref("browser.uitour.enabled", false);
user_pref("privacy.globalprivacycontrol.enabled", true);
user_pref("privacy.globalprivacycontrol.functionality.enabled", true);

Avoid the usage of disk cache

user_pref("browser.cache.disk.enable", false);
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true);
user_pref("browser.sessionstore.privacy_level", 2);

Disable search prefecher/predictor

user_pref("network.http.speculative-parallel-limit", 0);
user_pref("network.dns.disablePrefetch", true);
user_pref("browser.urlbar.speculativeConnect.enabled", false);
user_pref("browser.places.speculativeConnect.enabled", false);
user_pref("network.prefetch-next", false);
user_pref("network.predictor.enabled", false);
user_pref("network.predictor.enable-prefetch", false);

Disable annoying search suggestions like: topsites, search engines, etc.

user_pref("browser.search.separatePrivateDefault.ui.enabled", true);
user_pref("browser.urlbar.update2.engineAliasRefresh", true);
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false);
user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false);
user_pref("security.insecure_connection_text.enabled", true);
user_pref("security.insecure_connection_text.pbmode.enabled", true);
user_pref("network.IDN_show_punycode", true);
user_pref("browser.urlbar.suggest.engines", false);
user_pref("browser.urlbar.suggest.topsites", false);

/* Adding some features */
user_pref("browser.urlbar.suggest.calculator", true);
user_pref("browser.urlbar.unitConversion.enabled", true);

Disable cross site scripting

user_pref("network.auth.subresource-http-auth-allow", 1);
user_pref("pdfjs.enableScripting", false);
user_pref("extensions.postDownloadThirdPartyPrompt", false);
user_pref("permissions.delegation.enabled", false);

Disbale accessibility and location services.

user_pref("accessibility.force_disabled", 1);
user_pref("identity.fxaccounts.enabled", false);
user_pref("browser.tabs.firefox-view", false);
user_pref("permissions.default.desktop-notification", 2);
user_pref("permissions.default.geo", 2);
user_pref("geo.provider.network.url", "https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%");
user_pref("geo.provider.ms-windows-location", false); // WINDOWS
user_pref("geo.provider.use_corelocation", false); // MAC
user_pref("geo.provider.use_gpsd", false); // LINUX
user_pref("geo.provider.use_geoclue", false); // LINUX
user_pref("permissions.manager.defaultsUrl", "");
user_pref("webchannel.allowObject.urlWhitelist", "");

Disable pockets

user_pref("extensions.pocket.enabled", false);

By adding these preferences your firefox is now more secure, but you also need some other changes.

Ad-blocker (recommended)

UBlock origin
AdGuard AdBlocker

Both are free and opensource.

Search engine

Even after all these you need to change one more thing i.e search engine. By default google is set which sucks lot of user data and also show the ads in search results. That’s why we need to change search engine also.

These are few safe search engines with minimal look & great results without ads.

To add any search engine,

first visit the page of it.
click on search bar and click on add search engine...

Customize look with pywal (optional)

To customize look of firefox you can use pywal to generate colorscheme according to your wallpaper which can improve the look. There’s an extension for this called pywalfox which will be using.

Install pywalfox

pip install pywalfox --break-system-packages

Run command

pywalfox install

Add the extension then, open it and click Fetch pywal colors.

Set custom home/new tab (optional)

Read this blog to configure it.

Set master password.

Yes, you need to set master password, by default when you save password it is stored in firefox’s profile directory; which can be decrypted easily using tools like firefox_decrypt; see demo

Go to settings -> Privacy & Security -> under ‘Login and Passwords’ section.
Check ‘Use Primary Password’ -> Enter you super secret master password.

So that’s how you can make your firefox more secure and usable.

Reference: Betterfox | Mozilla Support

Decrypt firefox's & chrome's saved passwords

Sat, 29 Jul 2023 00:00:00 +0000

Firefox

There are many tools available out there to decrypt firefox passwords, but we will using firefox_decrypt tool. Which is efficient and fast.

Steps:

First clone it to local system and cd into it.

git clone https://github.com/unode/firefox_decrypt.git 
cd firefox_decrypt

Here we have our script firefox_decrypt.py, execute it with -h option to get help menu.
```
python firefox_decrypt.py -h
```
Get all the available profiles using -l option.
```
python firefox_decrypt.py -l 
```
Decrypt passwords, use any format like json, tabular, human, etc.
```
python firefox_decrypt.py -f tabular
```
Select your profile number 1 / 2 / 3 …

And voila, you have your passwords.

Chrome

There are tools too to decrypt google chrome’s password, and we will use decrypt-chrome-passwords

Steps:

First clone the repository to local and cd into it.

git clone https://github.com/ohyicong/decrypt-chrome-passwords
cd decrypt-chrome-passwords

Install dependencies
```
pip install -r requirements.txt
```
Decrypt passwords using decrypt_chrome_password.py.
```
python decrypt_chrome_password.py
```

And now, we have all the credentials.

How to secure your passwords?

We just saw how we can easily decrypt passwords from browser dumps, so now to avoid this kinds of thing we can secure our passwords using either ways

Firefox

Using extensions: Bitwarden, 1Password, Lastpass, etc.
Using Primary/Master under settings -> Privacy & security -> Login & Passwords.

Chrome

Using extensions same as firefox.

chrome doesn’t provide built-in feature of master/primary password.

So that’s it.

Set custom HTML file as a new tab in Firefox

Mon, 24 Jul 2023 16:21:22 +0000

You might want to set up your custom HTML page which contains all the links which you want to access frequently or might want to use StartTree and something like that.

We will be using AutoConfig, which is used to set and lock preferences that are not covered by group policy, This requires an autoconfig.js file in the “defaults/pref” folder where the channel-prefs.js file is located that specifies to use autoconfig.cfg.

Steps:

Go the settings → Home → Set HomePage and new window => cutom_urls → Enter the file path.
Set new tab to Firefox Home.
Make sure no other extension is managing your new tab, Go to Settings → Extension.

Create autoconfig.cfg file

sudo vim /usr/lib/firefox/autoconfig.cfg

<h1>Hello</hello>

Paste this:

JS autoconfig.cfg


    /* first line must be comment */
    var {classes:Cc,interfaces:Ci,utils:Cu} = Components;

    /* set new tab page */
    try {
      Cu.import("resource:///modules/AboutNewTab.jsm");
      var newTabURL = "file:///home/stroky/.cache/StartTree/index.html";
      AboutNewTab.newTabURL = newTabURL;
    } catch(e){Cu.reportError(e);} // report errors in the Browser Console

Then create autoconfig.js

sudo vim /usr/lib/firefox/defaults/pref/autoconfig.js

Paste this:

JS autconfig.js


    // *First line must be a comment*
    pref("general.config.filename", "autoconfig.cfg");
    pref("general.config.obscure_value", 0);
    pref("general.config.sandbox_enabled", false);

Quit the Firefox, and relaunch it.

And we are done.

Reference: Mozilla support | AutoConfig Docs

Set custom HTML file as a new tab in Firefox

Mon, 24 Jul 2023 00:00:00 +0000

You might want to set up your custom HTML page which contains all the links which you want to access frequently or might want to use StartTree and something like that. [–more–]

Steps:

Go the settings → Home → Set HomePage and new window => cutom_urls → Enter the file path.
Set new tab to Firefox Home.
Make sure no other extension is managing your new tab, Go to Settings → Extension.
Create autoconfig.cfg file

sudo vim /usr/lib/firefox/autoconfig.cfg

Paste this:

//
var {classes:Cc,interfaces:Ci,utils:Cu} = Components;

/* set new tab page */
try {
  Cu.import("resource:///modules/AboutNewTab.jsm");
  var newTabURL = "file:///home/stroky/.cache/StartTree/index.html";
  AboutNewTab.newTabURL = newTabURL;
} catch(e){Cu.reportError(e);} // report errors in the Browser Console

Then create autoconfig.js

sudo vim /usr/lib/firefox/defaults/pref/autoconfig.js

Paste this:

// *First line must be a comment*
pref("general.config.filename", "autoconfig.cfg");
pref("general.config.obscure_value", 0);
pref("general.config.sandbox_enabled", false);

Quit the Firefox, and relaunch it.

And we are done.

Reference: Mozilla support | AutoConfig Docs