DEV Community

Weather Clock Dash
Weather Clock Dash

Posted on

Firefox Privacy Hardening: Specific about:config Settings, What Each Does, and Trade-offs

#firefox #privacy #security #tutorial

This is a practical hardening guide for Firefox — specific settings to change, what each does, and what trade-offs you accept. Not a theoretical list: each setting here has a concrete privacy benefit.

about:config Changes

Open about:config in Firefox's address bar. Click "Accept the Risk" to continue.

Telemetry (Disable Firefox's Data Collection) 

datareporting.healthreport.uploadEnabled = false
app.shield.optoutstudies.enabled = false
browser.discovery.enabled = false
browser.newtabpage.activity-stream.feeds.telemetry = false
browser.newtabpage.activity-stream.telemetry = false
Enter fullscreen mode Exit fullscreen mode

Effect: Firefox stops sending usage data and shield studies. No functional change.
Trade-off: You won't participate in feature studies (beneficial research, but opt-out is fine).

Tracking Protection 

privacy.trackingprotection.enabled = true
privacy.trackingprotection.socialtracking.enabled = true
privacy.trackingprotection.cryptomining.enabled = true
privacy.trackingprotection.fingerprinting.enabled = true
Enter fullscreen mode Exit fullscreen mode

Effect: Enables tracking protection for all windows (not just Private). Blocks social tracking, cryptominers, and fingerprinting scripts.
Trade-off: Occasional breakage on sites that use blocked third-party scripts for legitimate functionality.

DNS over HTTPS 

network.trr.mode = 3
network.trr.uri = https://dns.quad9.net/dns-query
Enter fullscreen mode Exit fullscreen mode

Mode 3 = DNS only over HTTPS (no fallback to OS resolver).
Effect: DNS queries go to Quad9 (privacy-respecting, DNSSEC-validating resolver). ISP can't see your DNS queries.
Trade-off: If Quad9 is down, no DNS resolution. Mode 2 (TRR with fallback) is more reliable.

Alternatives to Quad9:

  • https://cloudflare-dns.com/dns-query — fast, privacy policy
  • https://dns.nextdns.io/YOURPROFILE — NextDNS with filtering
  • https://doh.mullvad.net/dns-query — Mullvad, very private

Fingerprint Resistance 

privacy.resistFingerprinting = true
Enter fullscreen mode Exit fullscreen mode

Effect:

  • Canvas fingerprint randomized per session
  • Timezone reported as UTC
  • Screen size generalized
  • Font list restricted
  • User-Agent simplified
  • AudioContext fingerprint restricted

Trade-off: Sites using canvas for functionality may break. Scheduling apps with timezone auto-detection won't work correctly. Some captchas become harder. Worth enabling in Private Browsing mode specifically.

First-Party Isolation 

privacy.firstparty.isolate = true
Enter fullscreen mode Exit fullscreen mode

Effect: Cookies and storage are partitioned by the first-party domain. Prevents cross-site tracking via cookies even for cookies that weren't explicitly blocked.
Trade-off: Some OAuth/SSO login flows break. If you get stuck in login loops, this is why. Can usually fix by reloading the specific site.

Note: Firefox's dFPI (dynamic First Party Isolation) is now enabled by default in Firefox 86+ via network.cookie.cookieBehavior = 5. The manual privacy.firstparty.isolate setting uses a different implementation.

HTTPS 

dom.security.https_only_mode = true
dom.security.https_only_mode_ever_enabled = true
Enter fullscreen mode Exit fullscreen mode

Effect: HTTPS-Only mode. Firefox shows a warning page before loading any HTTP site.
Trade-off: Occasional breakage on sites that redirect incorrectly or don't support HTTPS. You can override per-visit.

Geolocation 

geo.enabled = false
Enter fullscreen mode Exit fullscreen mode

Effect: Browser won't reveal your location even with user permission. Sites asking for geolocation will get a "not available" response instead of a permission prompt.
Trade-off: Legitimate location-based services (maps, weather, local business search) won't work without manually entering location.

Camera/Microphone 

permissions.default.camera = 2
permissions.default.microphone = 2
Enter fullscreen mode Exit fullscreen mode

(2 = Block)
Effect: Camera and microphone access denied globally. No prompt.
Trade-off: Video calling (Zoom, Google Meet, etc.) requires changing this setting or setting per-site permissions.

WebRTC 

media.peerconnection.enabled = false
Enter fullscreen mode Exit fullscreen mode

Effect: Disables WebRTC entirely. Prevents WebRTC IP leaks (which can reveal your real IP even when using a VPN).
Trade-off: WebRTC-based calling (Jitsi, Google Meet, some voice features) won't work.

More nuanced alternative (don't disable, just use mDNS):

media.peerconnection.ice.default_address_only = true
media.peerconnection.ice.no_host = true
Enter fullscreen mode Exit fullscreen mode

These limit which interfaces are exposed via WebRTC without disabling it entirely.

Referer Header 

network.http.referer.XOriginPolicy = 2
network.http.referer.XOriginTrimmingPolicy = 2
Enter fullscreen mode Exit fullscreen mode

Effect: Cross-origin referer headers send only the origin (scheme + domain), not the full URL. Prevents the destination site from seeing exactly what page you came from.
Trade-off: Some sites use the referer for navigation (back buttons, anti-CSRF). Occasional breakage.

PDF Viewer 

pdfjs.enableScripting = false
Enter fullscreen mode Exit fullscreen mode

Effect: Disables JavaScript in PDF files opened in Firefox's built-in PDF viewer. Prevents PDF-based JS attacks.
Trade-off: PDFs that require JavaScript for form functionality won't work fully.

Privacy Settings GUI Changes

These are in Settings → Privacy & Security, not about:config:

  1. Enhanced Tracking Protection → Strict
  2. Send websites a "Do Not Track" signal → Always (limited effectiveness, but costs nothing)
  3. Cookies and Site Data → Clear data → check Cookies and Site Data on close (optional, harsh)
  4. History → Firefox will: Use custom settings → Clear history when Firefox closes (optional)
  5. Security → Block dangerous and deceptive content → All three checked

Extensions to Complete the Setup

uBlock Origin (from AMO):

  • Enable all default filter lists
  • Add extra lists: EasyPrivacy, Malware Domain List, uBlock's built-in lists

LocalCDN or Decentraleyes (from AMO):

  • Serves common CDN files (jQuery, Bootstrap) locally
  • Prevents CDN providers (Cloudflare, Google, jsDelivr) from tracking you via CDN requests

The Privacy vs. Usability Spectrum

This table shows which settings are safe vs. which break things:

Setting Privacy Impact Breakage Risk
Disable telemetry Low None
Strict ETP High Low
DNS over HTTPS Medium Low
resistFingerprinting High Medium
First-party isolation High Medium
HTTPS-only Medium Low
Disable geolocation Medium Low
Disable WebRTC Medium High (breaks video calls)

Recommended minimum set (good privacy, low breakage):

  1. Disable telemetry
  2. Strict ETP
  3. DNS over HTTPS (mode 2 or 3)
  4. HTTPS-only mode
  5. uBlock Origin

For more privacy (accept some breakage):

  1. resistFingerprinting (especially in Private Browsing)
  2. First-party isolation
  3. Disable geolocation

Only if you know what you're doing:

  1. Disable WebRTC
  2. Disable camera/microphone globally

Your actual threat model should drive which settings you enable.

Top comments (0)