DEV Community

Weather Clock Dash
Weather Clock Dash

Posted on

arkenfox user.js: The Documented Firefox Hardening Config (Setup, Breakage, and Overrides)

#firefox #privacy #linux #security

arkenfox user.js is a hardened Firefox configuration maintained by the community. It sets hundreds of about:config preferences to improve privacy and security. Here's what it does, how to use it, and what to be careful about.

What arkenfox Is

arkenfox is a user.js file — a JavaScript config file that Firefox reads on startup to set preferences. The arkenfox project maintains a carefully researched set of preferences with inline documentation explaining why each setting is chosen.

Source: https://github.com/arkenfox/user.js

The configuration is aggressive: it's designed for people who prioritize privacy and security over convenience. Expect some breakage.

Installation 

# Download the user.js to your Firefox profile
cd ~/.mozilla/firefox/YOUR-PROFILE.default-release/

# Download the file
curl -O https://raw.githubusercontent.com/arkenfox/user.js/master/user.js

# Keep updater.sh for future updates
curl -O https://raw.githubusercontent.com/arkenfox/user.js/master/updater.sh
chmod +x updater.sh

# Run with: ./updater.sh
Enter fullscreen mode Exit fullscreen mode

Find your profile directory: about:support → Profile Directory → click "Open Directory."

Important: Read the documentation before applying. arkenfox has extensive inline comments in user.js explaining every setting.

What arkenfox Configures

Privacy

  • privacy.resistFingerprinting = true — standardizes many browser properties
  • Letterboxing (standardizes window size)
  • RFP (Resist Fingerprinting) for canvas, WebGL, audio, fonts
  • Strict Enhanced Tracking Protection
  • Total Cookie Protection (already Firefox default)
  • Disable navigator.language leaking browser locale
  • Disable performance.timeOrigin for timing attacks

Security

  • Disable form autofill
  • Disable password save prompts
  • Disable OCSP soft-fail (certificate validation)
  • Disable WebRTC by default
  • Disable JavaScript eval() (warning: this breaks many sites)
  • Disable service workers (warning: breaks PWA features)
  • Strict SSL/TLS settings

Anti-Telemetry

  • All telemetry, crash reports, studies disabled
  • No sponsored content
  • No Pocket
  • No Firefox Accounts integration preferences

Cache and Storage

  • Clear data on shutdown (configurable)
  • Disk cache disabled or limited
  • No session restore across restarts

The Overrides File

arkenfox recognizes that its defaults are too aggressive for some legitimate use cases. The solution: a user-overrides.js file in the same profile directory.

// user-overrides.js — your personal overrides
user_pref("javascript.options.asmjs", true); // Re-enable asm.js
user_pref("media.eme.enabled", true); // Re-enable DRM for streaming
user_pref("dom.serviceWorkers.enabled", true); // Re-enable service workers
user_pref("signon.rememberSignons", true); // Re-enable password manager
Enter fullscreen mode Exit fullscreen mode

Run updater.sh to apply both files — arkenfox's settings are applied first, then your overrides.

Common Breakage and Fixes

Login flows broken:

  • Cause: form autofill disabled, possibly privacy.resistFingerprinting interfering with fingerprint-based CAPTCHA
  • Fix: Add exceptions or re-enable signon.autofillForms in overrides

Service workers / PWAs not working:

  • Cause: dom.serviceWorkers.enabled = false
  • Fix: user_pref("dom.serviceWorkers.enabled", true) in overrides

Netflix / Spotify broken:

  • Cause: DRM (Widevine) disabled or media.eme.enabled = false
  • Fix: user_pref("media.eme.enabled", true) in overrides

eval() errors in console:

  • Cause: JavaScript's eval() disabled
  • Fix: user_pref("javascript.options.asmjs", true) and related flags — though this is intentional for security

WebRTC broken (video calls):

  • Cause: WebRTC may be disabled
  • Fix: user_pref("media.peerconnection.enabled", true) in overrides (or use media.peerconnection.ice.no_host = true for leak protection without disabling)

Sites detecting you as a bot:

  • Cause: privacy.resistFingerprinting = true spoofs properties inconsistently
  • Fix: Create site-specific exceptions or disable RFP for affected sites

Updating arkenfox 

cd ~/.mozilla/firefox/YOUR-PROFILE/
./updater.sh
Enter fullscreen mode Exit fullscreen mode

The updater downloads the latest user.js and re-applies it, then re-applies your overrides.

Important: After Firefox updates, always re-run the updater to get any new settings for the new Firefox version.

arkenfox vs LibreWolf

arkenfox LibreWolf
Approach user.js (settings) Build-level changes
DRM Can override Requires Widevine install
Sync Firefox Accounts intact Removed
Breakage risk High (configurable) Moderate
Update lag None (Firefox updates apply instantly) Days behind Firefox
Transparency Fully documented inline Open source

arkenfox is more configurable. LibreWolf is easier to deploy (download and run). For advanced users who want to understand every setting, arkenfox. For users who want "hardened Firefox out of the box," LibreWolf.

Who Should Use arkenfox

  • Users who want to understand exactly what their browser does and why
  • Privacy researchers who need documented, auditable settings
  • Advanced users comfortable troubleshooting breakage
  • Organizations that want a customizable privacy baseline with a paper trail (the documented comments)

Not recommended for:

  • Non-technical users
  • Users who need extensive web app compatibility (banking, enterprise web apps)
  • Users who want a "set and forget" solution (LibreWolf is better for that)

arkenfox is the gold standard for documented Firefox hardening, but it requires active maintenance and willingness to debug breakage.

Top comments (0)