{"vulnerability": "cve-2013-2566", "sightings": [{"uuid": "9263e3ec-113c-46d2-b6d1-8dede2134619", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:41.000000Z"}, {"uuid": "27198bd2-8738-4b26-b56a-d152df17dc65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://gist.github.com/makeforfun/85ab01bc29a9bdc9bd019a3e320a3f94", "content": "", "creation_timestamp": "2025-03-19T13:54:17.000000Z"}, {"uuid": "76eff260-94e9-4f8d-9497-542f0cd7c5a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:16.000000Z"}, {"uuid": "3f0af49c-701a-4a9a-bf2e-d4b38f1a2748", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb", "content": "", "creation_timestamp": "2022-11-07T22:22:31.000000Z"}, {"uuid": "07e02b52-61e5-4b6f-92e3-95d224fbdc0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://t.me/hex4gon1/908", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T03:02:07.000000Z"}, {"uuid": "aec4abec-ecc4-4f58-9f57-2373b258351e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://t.me/endsodomaofficial/7318", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T00:49:09.000000Z"}, {"uuid": "97b70311-0c8f-4af7-98a2-2aed711c9744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://t.me/jokerssec/1351", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T03:00:05.000000Z"}, {"uuid": "d70dd4c1-9d26-4646-8cf9-4b4849e10d82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://t.me/thegoodfatherag/8840", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T03:24:44.000000Z"}, {"uuid": "fc5c6b22-7aa3-4fab-8125-1bb605935b52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://t.me/marianaalecu/3622", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T00:48:21.000000Z"}, {"uuid": "f019476a-8989-4640-a49c-2d9e1fb2a564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://t.me/fucklulzsecisrahell/6294", "content": "====== Running in file batch mode with file=\"hosts/ips.txt\" ======\n\n==========================\n/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 77.81.101.111\n\n\n Start 2024-02-14 22:13:09                -->> 77.81.101.111:443 (77.81.101.111) <<--\n\n rDNS (77.81.101.111):   --\n Service detected:       HTTP\n\n\n Testing vulnerabilities\n\n Heartbleed (CVE-2014-0160)                not vulnerable (OK), no heartbeat extension\n CCS (CVE-2014-0224)                       not vulnerable (OK)\n Ticketbleed (CVE-2016-9244), experiment.  not vulnerable (OK)\n ROBOT                                     not vulnerable (OK)\n Secure Renegotiation (RFC 5746)           supported (OK)\n Secure Client-Initiated Renegotiation     not vulnerable (OK)\n CRIME, TLS (CVE-2012-4929)                not vulnerable (OK)\n BREACH (CVE-2013-3587)                    no gzip/deflate/compress/br HTTP compression (OK)  - only supplied \"/\" tested\n POODLE, SSL (CVE-2014-3566)               not vulnerable (OK)\n TLS_FALLBACK_SCSV (RFC 7507)              Downgrade attack prevention supported (OK)\n SWEET32 (CVE-2016-2183, CVE-2016-6329)    not vulnerable (OK)\n FREAK (CVE-2015-0204)                     not vulnerable (OK)\n DROWN (CVE-2016-0800, CVE-2016-0703)      not vulnerable on this host and port (OK)\n                                           make sure you don't use this certificate elsewhere with SSLv2 enabled services, see\n                                           https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=84359F27151AC6F21A23D865CCD523FADB0B99CE8E33878E67081E5BFF1D759C\n LOGJAM (CVE-2015-4000), experimental      common prime with 2048 bits detected: HAProxy (2048 bits),\n                                           but no DH EXPORT ciphers\n BEAST (CVE-2011-3389)                     TLS1: ECDHE-RSA-AES256-SHA\n                                                 HE-RSA-AES256-SHA\n                                                 CDHE-RSA-AES128-SHA\n                                                 HE-RSA-AES128-SHA\n                                                 ES256-SHA\n                                                 ES128-SHA\n                                           VULNERABLE -- but also supports higher protocols  TLSv1.1 TLSv1.2 (likely mitigated)\n LUCKY13 (CVE-2013-0169), experimental     potentially VULNERABLE, uses cipher block chaining (CBC) ciphers with TLS. Check patches\n Winshock (CVE-2014-6321), experimental    not vulnerable (OK)\n RC4 (CVE-2013-2566, CVE-2015-2808)        no RC4 ciphers detected (OK)\n\n\n Done 2024-02-14 22:15:15 [ 152s] -->> 77.81.101.111:443 (77.81.101.111) <<--\n\nYou got fucked RealitateaTV MOSSAD ISIS, Zionist Bastard \ud83d\ude01", "creation_timestamp": "2024-02-15T02:55:48.000000Z"}, {"uuid": "b2b6cd8f-55f3-49fb-9e34-b30915c34b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://gist.github.com/vseredi/153fca0b63bab02237be36c7c5e29109", "content": "//\n/******************************************************************************\n * user.js                                                                    *\n * https://github.com/pyllyukko/user.js                                       *\n ******************************************************************************/\n\n/******************************************************************************\n * SECTION: HTML5 / APIs / DOM                                                *\n ******************************************************************************/\n\n// PREF: Disable Service Workers\n// https://developer.mozilla.org/en-US/docs/Web/API/Worker\n// https://developer.mozilla.org/en-US/docs/Web/API/ServiceWorker_API\n// https://wiki.mozilla.org/Firefox/Push_Notifications#Service_Workers\n// NOTICE: Disabling ServiceWorkers breaks functionality on some sites (Google Street View...)\n// NOTICE: Disabling ServiceWorkers breaks Firefox Sync\n// Unknown security implications\n// CVE-2016-5259, CVE-2016-2812, CVE-2016-1949, CVE-2016-5287 (fixed)\nuser_pref(\"dom.serviceWorkers.enabled\",\t\t\t\ttrue);\n\n// PREF: Disable web notifications\n// https://support.mozilla.org/en-US/questions/1140439\nuser_pref(\"dom.webnotifications.enabled\",\t\t\tfalse);\n\n// PREF: Disable DOM timing API\n// https://wiki.mozilla.org/Security/Reviews/Firefox/NavigationTimingAPI\n// https://www.w3.org/TR/navigation-timing/#privacy\n// NOTICE: Disabling DOM timing API breaks item pages in AliExpress (https://github.com/pyllyukko/user.js/issues/561)\nuser_pref(\"dom.enable_performance\",\t\t\t\ttrue);\n\n// PREF: Disable resource timing API\n// https://www.w3.org/TR/resource-timing/#privacy-security\n// NOTICE: Disabling resource timing API breaks some DDoS protection pages (Cloudflare)\nuser_pref(\"dom.enable_resource_timing\",\t\t\t\ttrue);\n\n// PREF: Make sure the User Timing API does not provide a new high resolution timestamp\n// https://trac.torproject.org/projects/tor/ticket/16336\n// https://www.w3.org/TR/2013/REC-user-timing-20131212/#privacy-security\nuser_pref(\"dom.enable_user_timing\",\t\t\t\tfalse);\n\n// PREF: Disable Web Audio API\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1288359\n// NOTICE: Web Audio API is required for Unity web player/games\nuser_pref(\"dom.webaudio.enabled\",\t\t\t\ttrue);\n\n// PREF: Disable Location-Aware Browsing (geolocation)\n// https://www.mozilla.org/en-US/firefox/geolocation/\nuser_pref(\"geo.enabled\",\t\t\t\t\tfalse);\n\n// PREF: When geolocation is enabled, use Mozilla geolocation service instead of Google\n// https://bugzilla.mozilla.org/show_bug.cgi?id=689252\nuser_pref(\"geo.wifi.uri\", \"https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%\");\n\n// PREF: When geolocation is enabled, don't log geolocation requests to the console\nuser_pref(\"geo.wifi.logging.enabled\", false);\n\n// PREF: Disable raw TCP socket support (mozTCPSocket)\n// https://trac.torproject.org/projects/tor/ticket/18863\n// https://www.mozilla.org/en-US/security/advisories/mfsa2015-97/\n// https://developer.mozilla.org/docs/Mozilla/B2G_OS/API/TCPSocket\nuser_pref(\"dom.mozTCPSocket.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable DOM storage (disabled)\n// http://kb.mozillazine.org/Dom.storage.enabled\n// https://html.spec.whatwg.org/multipage/webstorage.html\n// NOTICE-DISABLED: Disabling DOM storage is known to cause`TypeError: localStorage is null` errors\n//user_pref(\"dom.storage.enabled\",\t\tfalse);\n\n// PREF: Disable leaking network/browser connection information via Javascript\n// Network Information API provides general information about the system's connection type (WiFi, cellular, etc.)\n// https://developer.mozilla.org/en-US/docs/Web/API/Network_Information_API\n// https://wicg.github.io/netinfo/#privacy-considerations\n// https://bugzilla.mozilla.org/show_bug.cgi?id=960426\nuser_pref(\"dom.netinfo.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable network API (Firefox < 32)\n// https://developer.mozilla.org/en-US/docs/Web/API/Connection/onchange\n// https://www.torproject.org/projects/torbrowser/design/#fingerprinting-defenses\nuser_pref(\"dom.network.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable WebRTC entirely to prevent leaking internal IP addresses (Firefox < 42)\n// NOTICE: Disabling WebRTC breaks peer-to-peer file sharing tools (reep.io ...)\nuser_pref(\"media.peerconnection.enabled\",\t\t\tfalse);\n\n// PREF: Don't reveal your internal IP when WebRTC is enabled (Firefox >= 42)\n// https://wiki.mozilla.org/Media/WebRTC/Privacy\n// https://github.com/beefproject/beef/wiki/Module%3A-Get-Internal-IP-WebRTC\nuser_pref(\"media.peerconnection.ice.default_address_only\",\ttrue); // Firefox 42-51\nuser_pref(\"media.peerconnection.ice.no_host\",\t\t\ttrue); // Firefox >= 52\n\n// PREF: Disable WebRTC getUserMedia, screen sharing, audio capture, video capture\n// https://wiki.mozilla.org/Media/getUserMedia\n// https://blog.mozilla.org/futurereleases/2013/01/12/capture-local-camera-and-microphone-streams-with-getusermedia-now-enabled-in-firefox/\n// https://developer.mozilla.org/en-US/docs/Web/API/Navigator\nuser_pref(\"media.navigator.enabled\",\t\t\t\ttrue);\nuser_pref(\"media.navigator.video.enabled\",\t\t\ttrue);\nuser_pref(\"media.getusermedia.screensharing.enabled\",\t\ttrue);\nuser_pref(\"media.getusermedia.audiocapture.enabled\",\t\ttrue);\n\n// PREF: Disable battery API (Firefox < 52)\n// https://developer.mozilla.org/en-US/docs/Web/API/BatteryManager\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1313580\nuser_pref(\"dom.battery.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable telephony API\n// https://wiki.mozilla.org/WebAPI/Security/WebTelephony\nuser_pref(\"dom.telephony.enabled\",\t\t\t\ttrue);\n\n// PREF: Disable \"beacon\" asynchronous HTTP transfers (used for analytics)\n// https://developer.mozilla.org/en-US/docs/Web/API/navigator.sendBeacon\nuser_pref(\"beacon.enabled\",\t\t\t\t\tfalse);\n\n// PREF: Disable clipboard event detection (onCut/onCopy/onPaste) via Javascript\n// https://web.archive.org/web/20210416195937/https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/dom.event.clipboardevents.enabled\n// https://github.com/pyllyukko/user.js/issues/287\n// NOTICE: Disabling clipboard events breaks Ctrl+C/X/V copy/cut/paste functionaility in JS-based web applications (Google Docs...)\nuser_pref(\"dom.event.clipboardevents.enabled\",\t\t\ttrue);\n\n// PREF: Disable \"copy to clipboard\" functionality via Javascript (Firefox >= 41)\n// https://hg.mozilla.org/mozilla-central/rev/2f9f8ea4b9c3\n// https://github.com/pyllyukko/user.js/issues/287\n// NOTICE: Disabling clipboard operations will break legitimate JS-based \"copy to clipboard\" functionality\nuser_pref(\"dom.allow_cut_copy\", true);\n\n// PREF: Disable speech recognition\n// https://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html\n// https://developer.mozilla.org/en-US/docs/Web/API/SpeechRecognition\n// https://wiki.mozilla.org/HTML5_Speech_API\nuser_pref(\"media.webspeech.recognition.enable\",\t\t\tfalse);\n\n// PREF: Disable speech synthesis\n// https://developer.mozilla.org/en-US/docs/Web/API/SpeechSynthesis\nuser_pref(\"media.webspeech.synth.enabled\",\t\t\tfalse);\n\n// PREF: Disable sensor API\n// https://wiki.mozilla.org/Sensor_API\nuser_pref(\"device.sensors.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable pinging URIs specified in HTML  ping= attributes\n// http://kb.mozillazine.org/Browser.send_pings\nuser_pref(\"browser.send_pings\",\t\t\t\t\tfalse);\n\n// PREF: When browser pings are enabled, only allow pinging the same host as the origin page\n// http://kb.mozillazine.org/Browser.send_pings.require_same_host\nuser_pref(\"browser.send_pings.require_same_host\",\t\ttrue);\n\n// PREF: Disable IndexedDB (disabled)\n// https://developer.mozilla.org/en-US/docs/IndexedDB\n// https://en.wikipedia.org/wiki/Indexed_Database_API\n// https://wiki.mozilla.org/Security/Reviews/Firefox4/IndexedDB_Security_Review\n// http://forums.mozillazine.org/viewtopic.php?p=13842047\n// https://github.com/pyllyukko/user.js/issues/8\n// NOTICE-DISABLED: IndexedDB could be used for tracking purposes, but is required for some add-ons to work (notably uBlock), so is left enabled\n//user_pref(\"dom.indexedDB.enabled\",\t\tfalse);\n\n// TODO: \"Access Your Location\" \"Maintain Offline Storage\" \"Show Notifications\"\n\n// PREF: Disable gamepad API to prevent USB device enumeration\n// https://www.w3.org/TR/gamepad/\n// https://trac.torproject.org/projects/tor/ticket/13023\nuser_pref(\"dom.gamepad.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable virtual reality devices APIs\n// https://developer.mozilla.org/en-US/Firefox/Releases/36#Interfaces.2FAPIs.2FDOM\n// https://developer.mozilla.org/en-US/docs/Web/API/WebVR_API\nuser_pref(\"dom.vr.enabled\",\t\t\t\t\tfalse);\n\n// PREF: Disable vibrator API\nuser_pref(\"dom.vibrator.enabled\",           false);\n\n// PREF: Disable Archive API (Firefox < 54)\n// https://wiki.mozilla.org/WebAPI/ArchiveAPI\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1342361\nuser_pref(\"dom.archivereader.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable webGL\n// https://en.wikipedia.org/wiki/WebGL\n// https://www.contextis.com/resources/blog/webgl-new-dimension-browser-exploitation/\n// NOTICE: Disabling WebGL breaks WebGL-based websites/applications (windy, meteoblue...)\nuser_pref(\"webgl.disabled\",\t\t\t\t\tfalse);\n// PREF: When webGL is enabled, use the minimum capability mode\nuser_pref(\"webgl.min_capability_mode\",\t\t\t\ttrue);\n// PREF: When webGL is enabled, disable webGL extensions\n// https://developer.mozilla.org/en-US/docs/Web/API/WebGL_API#WebGL_debugging_and_testing\nuser_pref(\"webgl.disable-extensions\",\t\t\t\ttrue);\n// PREF: When webGL is enabled, force enabling it even when layer acceleration is not supported\n// https://trac.torproject.org/projects/tor/ticket/18603\nuser_pref(\"webgl.disable-fail-if-major-performance-caveat\",\ttrue);\n// PREF: When webGL is enabled, do not expose information about the graphics driver\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1171228\n// https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug_renderer_info\nuser_pref(\"webgl.enable-debug-renderer-info\",\t\t\tfalse);\n// somewhat related...\n//user_pref(\"pdfjs.enableWebGL\",\t\t\t\t\tfalse);\n\n// PREF: Spoof dual-core CPU\n// https://trac.torproject.org/projects/tor/ticket/21675\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1360039\nuser_pref(\"dom.maxHardwareConcurrency\",\t\t\t\t4);\n\n// PREF: Disable WebAssembly\n// https://webassembly.org/\n// https://en.wikipedia.org/wiki/WebAssembly\n// https://trac.torproject.org/projects/tor/ticket/21549\n// NOTICE: WebAssembly is required for Unity web player/games\nuser_pref(\"javascript.options.wasm\",\t\t\t\ttrue);\n\n/******************************************************************************\n * SECTION: Misc                                                              *\n ******************************************************************************/\n\n// PREF: Disable face detection\nuser_pref(\"camera.control.face_detection.enabled\",\t\tfalse);\n\n// PREF: Disable GeoIP lookup on your address to set default search engine region\n// https://trac.torproject.org/projects/tor/ticket/16254\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_geolocation-for-default-search-engine\nuser_pref(\"browser.search.countryCode\",\t\t\t\t\"US\");\nuser_pref(\"browser.search.region\",\t\t\t\t\"US\");\nuser_pref(\"browser.search.geoip.url\",\t\t\t\t\"\");\n\n// PREF: Set Accept-Language HTTP header to en-US regardless of Firefox localization\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Language\nuser_pref(\"intl.accept_languages\",\t\t\t\t\"en-US, en\");\n\n// PREF: Don't use OS values to determine locale, force using Firefox locale setting\n// http://kb.mozillazine.org/Intl.locale.matchOS\nuser_pref(\"intl.locale.matchOS\",\t\t\t\tfalse);\n\n// Use LANG environment variable to choose locale (disabled)\n//pref(\"intl.locale.requested\", \"\");\n\n// PREF: Don't use Mozilla-provided location-specific search engines\nuser_pref(\"browser.search.geoSpecificDefaults\",\t\t\tfalse);\n\n// PREF: Do not automatically send selection to clipboard on some Linux platforms\n// http://kb.mozillazine.org/Clipboard.autocopy\nuser_pref(\"clipboard.autocopy\",\t\t\t\t\tfalse);\n\n// PREF: Prevent leaking application locale/date format using JavaScript\n// https://bugzilla.mozilla.org/show_bug.cgi?id=867501\n// https://hg.mozilla.org/mozilla-central/rev/52d635f2b33d\nuser_pref(\"javascript.use_us_english_locale\",\t\t\ttrue);\n\n// PREF: Do not submit invalid URIs entered in the address bar to the default search engine\n// http://kb.mozillazine.org/Keyword.enabled\nuser_pref(\"keyword.enabled\",\t\t\t\t\ttrue);\n\n// PREF: Don't trim HTTP off of URLs in the address bar.\n// https://bugzilla.mozilla.org/show_bug.cgi?id=665580\nuser_pref(\"browser.urlbar.trimURLs\",\t\t\t\tfalse);\n\n// PREF: Disable preloading of autocomplete URLs.\n// https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks\nuser_pref(\"browser.urlbar.speculativeConnect.enabled\", false);\n\n// PREF: Don't try to guess domain names when entering an invalid domain name in URL bar\n// http://www-archive.mozilla.org/docs/end-user/domain-guessing.html\nuser_pref(\"browser.fixup.alternate.enabled\",\t\t\tfalse);\n\n// PREF: When browser.fixup.alternate.enabled is enabled, strip password from 'user:password@...' URLs\n// https://github.com/pyllyukko/user.js/issues/290#issuecomment-303560851\nuser_pref(\"browser.fixup.hide_user_pass\", true);\n\n// PREF: Send DNS request through SOCKS when SOCKS proxying is in use\n// https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers\nuser_pref(\"network.proxy.socks_remote_dns\",\t\t\ttrue);\n\n// PREF: Don't monitor OS online/offline connection state\n// https://trac.torproject.org/projects/tor/ticket/18945\nuser_pref(\"network.manage-offline-status\",\t\t\tfalse);\n\n// PREF: Enforce Mixed Active Content Blocking\n// https://support.mozilla.org/t5/Protect-your-privacy/Mixed-content-blocking-in-Firefox/ta-p/10990\n// https://developer.mozilla.org/en-US/docs/Site_Compatibility_for_Firefox_23#Non-SSL_contents_on_SSL_pages_are_blocked_by_default\n// https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/\nuser_pref(\"security.mixed_content.block_active_content\",\ttrue);\n\n// PREF: Enforce Mixed Passive Content blocking (a.k.a. Mixed Display Content)\n// NOTICE: Enabling Mixed Display Content blocking can prevent images/styles... from loading properly when connection to the website is only partially secured\nuser_pref(\"security.mixed_content.block_display_content\",\ttrue);\n\n// PREF: Disable JAR from opening Unsafe File Types\n// http://kb.mozillazine.org/Network.jar.open-unsafe-types\n// CIS Mozilla Firefox 24 ESR v1.0.0 - 3.7 \nuser_pref(\"network.jar.open-unsafe-types\",\t\t\tfalse);\n\n// CIS 2.7.4 Disable Scripting of Plugins by JavaScript\n// http://forums.mozillazine.org/viewtopic.php?f=7&t=153889\nuser_pref(\"security.xpconnect.plugin.unrestricted\",\t\tfalse);\n\n// PREF: Set File URI Origin Policy\n// http://kb.mozillazine.org/Security.fileuri.strict_origin_policy\n// CIS Mozilla Firefox 24 ESR v1.0.0 - 3.8\nuser_pref(\"security.fileuri.strict_origin_policy\",\t\ttrue);\n\n// PREF: Disable Displaying Javascript in History URLs\n// http://kb.mozillazine.org/Browser.urlbar.filter.javascript\n// CIS 2.3.6 \nuser_pref(\"browser.urlbar.filter.javascript\",\t\t\ttrue);\n\n// PREF: Disable asm.js\n// http://asmjs.org/\n// https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/\n// https://www.mozilla.org/en-US/security/advisories/mfsa2015-50/\n// https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2712\nuser_pref(\"javascript.options.asmjs\",\t\t\t\ttrue);\n\n// PREF: Disable SVG in OpenType fonts\n// https://wiki.mozilla.org/SVGOpenTypeFonts\n// https://github.com/iSECPartners/publications/tree/master/reports/Tor%20Browser%20Bundle\nuser_pref(\"gfx.font_rendering.opentype_svg.enabled\",\t\ttrue);\n\n// PREF: Disable in-content SVG rendering (Firefox >= 53) (disabled)\n// NOTICE-DISABLED: Disabling SVG support breaks many UI elements on many sites\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1216893\n// https://github.com/iSECPartners/publications/raw/master/reports/Tor%20Browser%20Bundle/Tor%20Browser%20Bundle%20-%20iSEC%20Deliverable%201.3.pdf#16\n//user_pref(\"svg.disabled\", true);\n\n// PREF: Disable video stats to reduce fingerprinting threat\n// https://bugzilla.mozilla.org/show_bug.cgi?id=654550\n// https://github.com/pyllyukko/user.js/issues/9#issuecomment-100468785\n// https://github.com/pyllyukko/user.js/issues/9#issuecomment-148922065\nuser_pref(\"media.video_stats.enabled\",\t\t\t\tfalse);\n\n// PREF: Don't reveal build ID\n// Value taken from Tor Browser\n// https://bugzilla.mozilla.org/show_bug.cgi?id=583181\nuser_pref(\"general.buildID.override\",\t\t\t\t\"20100101\");\nuser_pref(\"browser.startup.homepage_override.buildID\",\t\t\"20100101\");\n\n// PREF: Don't use document specified fonts to prevent installed font enumeration (fingerprinting)\n// https://github.com/pyllyukko/user.js/issues/395\n// https://browserleaks.com/fonts\n// https://github.com/pyllyukko/user.js/issues/120\nuser_pref(\"browser.display.use_document_fonts\",\t\t\t1);\n\n// PREF: Enable only whitelisted URL protocol handlers\n// http://kb.mozillazine.org/Network.protocol-handler.external-default\n// http://kb.mozillazine.org/Network.protocol-handler.warn-external-default\n// http://kb.mozillazine.org/Network.protocol-handler.expose.%28protocol%29\n// https://news.ycombinator.com/item?id=13047883\n// https://bugzilla.mozilla.org/show_bug.cgi?id=167475\n// https://github.com/pyllyukko/user.js/pull/285#issuecomment-298124005\n// NOTICE: Disabling nonessential protocols breaks all interaction with custom protocols such as mailto:, irc:, magnet: ... and breaks opening third-party mail/messaging/torrent/... clients when clicking on links with these protocols\n// TODO: Add externally-handled protocols from Windows 8.1 and Windows 10 (currently contains protocols only from Linux and Windows 7) that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)\n// TODO: Add externally-handled protocols from Mac OS X that might pose a similar threat (see e.g. https://news.ycombinator.com/item?id=13044991)\n// If you want to enable a protocol, set network.protocol-handler.expose.(protocol) to true and network.protocol-handler.external.(protocol) to:\n//   * true, if the protocol should be handled by an external application\n//   * false, if the protocol should be handled internally by Firefox\nuser_pref(\"network.protocol-handler.warn-external-default\",\ttrue);\nuser_pref(\"network.protocol-handler.external.http\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.https\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.javascript\",\tfalse);\nuser_pref(\"network.protocol-handler.external.moz-extension\",\tfalse);\nuser_pref(\"network.protocol-handler.external.ftp\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.file\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.about\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.chrome\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.blob\",\t\tfalse);\nuser_pref(\"network.protocol-handler.external.data\",\t\tfalse);\nuser_pref(\"network.protocol-handler.expose-all\",\t\tfalse);\nuser_pref(\"network.protocol-handler.expose.http\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.https\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.javascript\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.moz-extension\",\ttrue);\nuser_pref(\"network.protocol-handler.expose.ftp\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.file\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.about\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.chrome\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.blob\",\t\ttrue);\nuser_pref(\"network.protocol-handler.expose.data\",\t\ttrue);\n\n// PREF: Always block media autoplay\n// https://support.mozilla.org/en-US/kb/block-autoplay\nuser_pref(\"media.autoplay.default\",\t\t\t\t5);\n\n/******************************************************************************\n * SECTION: Extensions / plugins                                                       *\n ******************************************************************************/\n\n// PREF: Ensure you have a security delay when installing add-ons (milliseconds)\n// http://kb.mozillazine.org/Disable_extension_install_delay_-_Firefox\n// http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/\nuser_pref(\"security.dialog_enable_delay\",\t\t\t1000);\n\n// PREF: Require signatures\n// https://wiki.mozilla.org/Addons/Extension_Signing\n//user_pref(\"xpinstall.signatures.required\",\t\ttrue);\n\n// PREF: Opt-out of add-on metadata updates\n// https://blog.mozilla.org/addons/how-to-opt-out-of-add-on-metadata-updates/\nuser_pref(\"extensions.getAddons.cache.enabled\",\t\t\tfalse);\n\n// PREF: Opt-out of themes (Persona) updates\n// https://support.mozilla.org/t5/Firefox/how-do-I-prevent-autoamtic-updates-in-a-50-user-environment/td-p/144287\nuser_pref(\"lightweightThemes.update.enabled\",\t\t\tfalse);\n\n// PREF: Disable Flash Player NPAPI plugin\n// http://kb.mozillazine.org/Flash_plugin\nuser_pref(\"plugin.state.flash\",\t\t\t\t\t0);\n\n// PREF: Disable Java NPAPI plugin\nuser_pref(\"plugin.state.java\",\t\t\t\t\t0);\n\n// PREF: Disable sending Flash Player crash reports\nuser_pref(\"dom.ipc.plugins.flash.subprocess.crashreporter.enabled\",\tfalse);\n\n// PREF: When Flash crash reports are enabled, don't send the visited URL in the crash report\nuser_pref(\"dom.ipc.plugins.reportCrashURL\",\t\t\tfalse);\n\n// PREF: When Flash is enabled, download and use Mozilla SWF URIs blocklist\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1237198\n// https://github.com/mozilla-services/shavar-plugin-blocklist\nuser_pref(\"browser.safebrowsing.blockedURIs.enabled\", true);\n\n// PREF: Disable Gnome Shell Integration NPAPI plugin\nuser_pref(\"plugin.state.libgnome-shell-browser-plugin\",\t\t0);\n\n// PREF: Disable the bundled OpenH264 video codec (disabled)\n// http://forums.mozillazine.org/viewtopic.php?p=13845077&sid=28af2622e8bd8497b9113851676846b1#p13845077\n//user_pref(\"media.gmp-provider.enabled\",\t\tfalse);\n\n// PREF: Enable plugins click-to-play\n// https://wiki.mozilla.org/Firefox/Click_To_Play\n// https://blog.mozilla.org/security/2012/10/11/click-to-play-plugins-blocklist-style/\nuser_pref(\"plugins.click_to_play\",\t\t\t\ttrue);\n\n// PREF: Updates addons automatically\n// https://blog.mozilla.org/addons/how-to-turn-off-add-on-updates/\nuser_pref(\"extensions.update.enabled\",\t\t\t\ttrue);\n\n// PREF: Enable add-on and certificate blocklists (OneCRL) from Mozilla\n// https://wiki.mozilla.org/Blocklisting\n// https://blocked.cdn.mozilla.net/\n// http://kb.mozillazine.org/Extensions.blocklist.enabled\n// http://kb.mozillazine.org/Extensions.blocklist.url\n// https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/\n// Updated at interval defined in extensions.blocklist.interval (default: 86400)\nuser_pref(\"extensions.blocklist.enabled\",\t\t\ttrue);\nuser_pref(\"services.blocklist.update_enabled\",\t\t\ttrue);\n\n// PREF: Decrease system information leakage to Mozilla blocklist update servers\n// https://trac.torproject.org/projects/tor/ticket/16931\nuser_pref(\"extensions.blocklist.url\",\t\t\t\t\"https://blocklist.addons.mozilla.org/blocklist/3/%APP_ID%/%APP_VERSION%/\");\n\n// PREF: Disable system add-on updates (hidden & always-enabled add-ons from Mozilla)\n// https://firefox-source-docs.mozilla.org/toolkit/mozapps/extensions/addon-manager/SystemAddons.html\n// https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/\n// https://github.com/pyllyukko/user.js/issues/419\n// https://dxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManager.jsm#1248-1257\n// NOTICE: Disabling system add-on updates prevents Mozilla from \"hotfixing\" your browser to patch critical problems (one possible use case from the documentation)\nuser_pref(\"extensions.systemAddon.update.enabled\",\t\tfalse);\n\n/******************************************************************************\n * SECTION: Firefox (anti-)features / components                              *                            *\n ******************************************************************************/\n\n// PREF: Disable Extension recommendations (Firefox >= 65)\n// https://support.mozilla.org/en-US/kb/extension-recommendations\n// https://brokkr.net/2025/08/10/firefox-aboutconfig-tricks-3-dont-recommend-extensions/\nuser_pref(\"browser.newtabpage.activity-stream.asrouter.userprefs.cfr\",\tfalse);\nuser_pref(\"extensions.htmlaboutaddons.recommendations.enabled\",\t\tfalse);\n\n// PREF: Trusted Recursive Resolver (DNS-over-HTTPS) (disabled)\n// https://wiki.mozilla.org/Trusted_Recursive_Resolver\n//user_pref(\"network.trr.mode\",\t\t\t\t\t0);\n\n// PREF: Disable WebIDE\n// https://trac.torproject.org/projects/tor/ticket/16222\n// https://developer.mozilla.org/docs/Tools/WebIDE\nuser_pref(\"devtools.webide.enabled\",\t\t\t\tfalse);\nuser_pref(\"devtools.webide.autoinstallADBHelper\",\t\tfalse);\nuser_pref(\"devtools.webide.autoinstallFxdtAdapters\",\t\tfalse);\n\n// PREF: Disable remote debugging\n// https://developer.mozilla.org/en-US/docs/Tools/Remote_Debugging/Debugging_Firefox_Desktop\n// https://developer.mozilla.org/en-US/docs/Tools/Tools_Toolbox#Advanced_settings\nuser_pref(\"devtools.debugger.remote-enabled\",\t\t\tfalse);\nuser_pref(\"devtools.chrome.enabled\",\t\t\t\tfalse);\nuser_pref(\"devtools.debugger.force-local\",\t\t\ttrue);\n\n// PREF: Disable Mozilla telemetry/experiments\n// https://wiki.mozilla.org/Platform/Features/Telemetry\n// https://wiki.mozilla.org/Privacy/Reviews/Telemetry\n// https://wiki.mozilla.org/Telemetry\n// https://www.mozilla.org/en-US/legal/privacy/firefox.html#telemetry\n// https://support.mozilla.org/t5/Firefox-crashes/Mozilla-Crash-Reporter/ta-p/1715\n// https://wiki.mozilla.org/Security/Reviews/Firefox6/ReviewNotes/telemetry\n// https://gecko.readthedocs.io/en/latest/browser/experiments/experiments/manifest.html\n// https://wiki.mozilla.org/Telemetry/Experiments\n// https://support.mozilla.org/en-US/questions/1197144\n// https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html#id1\nuser_pref(\"toolkit.telemetry.enabled\",\t\t\t\tfalse);\nuser_pref(\"toolkit.telemetry.unified\",\t\t\t\tfalse);\nuser_pref(\"toolkit.telemetry.archive.enabled\",\t\t\tfalse);\nuser_pref(\"experiments.supported\",\t\t\t\tfalse);\nuser_pref(\"experiments.enabled\",\t\t\t\tfalse);\nuser_pref(\"experiments.manifest.uri\",\t\t\t\t\"\");\n\n// PREF: Disable daily usage ping\n// https://support.mozilla.org/1/firefox/140.2.0/Linux/en-US/usage-ping-settings\nuser_pref(\"datareporting.usage.uploadEnabled\",\t\t\tfalse);\n\n// PREF: Disallow Necko to do A/B testing\n// https://trac.torproject.org/projects/tor/ticket/13170\nuser_pref(\"network.allow-experiments\",\t\t\t\tfalse);\n\n// PREF: Disable sending Firefox crash reports to Mozilla servers\n// https://wiki.mozilla.org/Breakpad\n// http://kb.mozillazine.org/Breakpad\n// https://dxr.mozilla.org/mozilla-central/source/toolkit/crashreporter\n// https://bugzilla.mozilla.org/show_bug.cgi?id=411490\n// A list of submitted crash reports can be found at about:crashes\nuser_pref(\"breakpad.reportURL\",\t\t\t\t\t\"\");\n\n// PREF: Disable sending reports of tab crashes to Mozilla (about:tabcrashed), don't nag user about unsent crash reports\n// https://hg.mozilla.org/mozilla-central/file/tip/browser/app/profile/firefox.js\nuser_pref(\"browser.tabs.crashReporting.sendReport\",\t\tfalse);\nuser_pref(\"browser.crashReports.unsubmittedCheck.enabled\",\tfalse);\n\n// PREF: Disable FlyWeb (discovery of LAN/proximity IoT devices that expose a Web interface)\n// https://wiki.mozilla.org/FlyWeb\n// https://wiki.mozilla.org/FlyWeb/Security_scenarios\n// https://docs.google.com/document/d/1eqLb6cGjDL9XooSYEEo7mE-zKQ-o-AuDTcEyNhfBMBM/edit\n// http://www.ghacks.net/2016/07/26/firefox-flyweb\nuser_pref(\"dom.flyweb.enabled\",\t\t\t\t\tfalse);\n\n// PREF: Disable the UITour backend\n// https://trac.torproject.org/projects/tor/ticket/19047#comment:3\nuser_pref(\"browser.uitour.enabled\",\t\t\t\tfalse);\n\n// PREF: Enable Firefox Tracking Protection\n// https://wiki.mozilla.org/Security/Tracking_protection\n// https://support.mozilla.org/en-US/kb/tracking-protection-firefox\n// https://support.mozilla.org/en-US/kb/tracking-protection-pbm\n// https://kontaxis.github.io/trackingprotectionfirefox/\n// https://feeding.cloud.geek.nz/posts/how-tracking-protection-works-in-firefox/\nuser_pref(\"privacy.trackingprotection.enabled\",\t\t\ttrue);\nuser_pref(\"privacy.trackingprotection.pbmode.enabled\",\t\ttrue);\n\n// PREF: Enable contextual identity Containers feature (Firefox >= 52)\n// NOTICE: Containers are not available in Private Browsing mode\n// https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers\nuser_pref(\"privacy.userContext.enabled\",\t\t\ttrue);\n\n// PREF: Enable Firefox's anti-fingerprinting mode (\"resist fingerprinting\" or RFP) (Tor Uplift project)\n// https://wiki.mozilla.org/Security/Tor_Uplift/Tracking\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1333933\n// https://wiki.mozilla.org/Security/Fingerprinting\n// NOTICE: RFP breaks some keyboard shortcuts used in certain websites (see #443)\n// NOTICE: RFP changes your time zone\n// NOTICE: RFP breaks some DDoS protection pages (Cloudflare)\nuser_pref(\"privacy.resistFingerprinting\",\t\t\ttrue);\n\n// PREF: disable mozAddonManager Web API [FF57+]\n// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330\n// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1406795\n// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1415644\n// https://bugzilla.mozilla.org/buglist.cgi?bug_id=1453988\n// https://trac.torproject.org/projects/tor/ticket/26114\nuser_pref(\"privacy.resistFingerprinting.block_mozAddonManager\", true);\nuser_pref(\"extensions.webextensions.restrictedDomains\", \"\");\n\n// PREF: enable RFP letterboxing / resizing of inner window [FF67+] (disabled)\n// https://bugzilla.mozilla.org/1407366\n//user_pref(\"privacy.resistFingerprinting.letterboxing\", true);\n//user_pref(\"privacy.resistFingerprinting.letterboxing.dimensions\", \"800x600, 1000x1000, 1600x900\");\n\n// PREF: disable showing about:blank/maximized window as soon as possible during startup [FF60+]\n// https://bugzilla.mozilla.org/1448423\nuser_pref(\"browser.startup.blankWindow\", false);\n\n// PREF: Disable the built-in PDF viewer\n// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2743\n// https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/\n// https://www.mozilla.org/en-US/security/advisories/mfsa2015-69/\nuser_pref(\"pdfjs.disabled\",\t\t\t\t\ttrue);\n\n// PREF: Disable collection/sending of the health report (healthreport.sqlite*)\n// https://support.mozilla.org/en-US/kb/firefox-health-report-understand-your-browser-perf\n// https://gecko.readthedocs.org/en/latest/toolkit/components/telemetry/telemetry/preferences.html\nuser_pref(\"datareporting.healthreport.uploadEnabled\",\t\tfalse);\nuser_pref(\"datareporting.healthreport.service.enabled\",\t\tfalse);\nuser_pref(\"datareporting.policy.dataSubmissionEnabled\",\t\tfalse);\n// \"Allow Firefox to make personalized extension recommendations\"\nuser_pref(\"browser.discovery.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable Shield/Heartbeat/Normandy (Mozilla user rating telemetry)\n// https://wiki.mozilla.org/Advocacy/heartbeat\n// https://trac.torproject.org/projects/tor/ticket/19047\n// https://trac.torproject.org/projects/tor/ticket/18738\n// https://wiki.mozilla.org/Firefox/Shield\n// https://github.com/mozilla/normandy\n// https://support.mozilla.org/en-US/kb/shield\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1370801\n// https://wiki.mozilla.org/Firefox/Normandy/PreferenceRollout\nuser_pref(\"app.normandy.enabled\", false);\nuser_pref(\"app.normandy.api_url\", \"\");\nuser_pref(\"extensions.shield-recipe-client.enabled\",\t\tfalse);\nuser_pref(\"app.shield.optoutstudies.enabled\",\t\t\tfalse);\n\n\n// PREF: Disable Firefox Hello (disabled) (Firefox < 49)\n// https://wiki.mozilla.org/Loop\n// https://support.mozilla.org/t5/Chat-and-share/Support-for-Hello-discontinued-in-Firefox-49/ta-p/37946\n// NOTICE-DISABLED: Firefox Hello requires setting `media.peerconnection.enabled` and `media.getusermedia.screensharing.enabled` to true, `security.OCSP.require` to false to work.\n//user_pref(\"loop.enabled\",\t\tfalse);\n\n// PREF: Disable Firefox Hello metrics collection\n// https://groups.google.com/d/topic/mozilla.dev.platform/nyVkCx-_sFw/discussion\nuser_pref(\"loop.logDomains\",\t\t\t\t\tfalse);\n\n// PREF: Enable Auto Update (disabled)\n// NOTICE: Fully automatic updates are disabled and left to package management systems on Linux. Windows users may want to change this setting.\n// CIS 2.1.1\n//user_pref(\"app.update.auto\",\t\t\t\t\ttrue);\n\n// PREF: Enforce checking for Firefox updates\n// http://kb.mozillazine.org/App.update.enabled\n// NOTICE: Update check page might incorrectly report Firefox ESR as out-of-date\nuser_pref(\"app.update.enabled\",                 true);\n\n// PREF: Enable blocking reported web forgeries\n// https://wiki.mozilla.org/Security/Safe_Browsing\n// http://kb.mozillazine.org/Safe_browsing\n// https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work\n// http://forums.mozillazine.org/viewtopic.php?f=39&t=2711237&p=12896849#p12896849\n// CIS 2.3.4\nuser_pref(\"browser.safebrowsing.enabled\",\t\t\ttrue); // Firefox < 50\nuser_pref(\"browser.safebrowsing.phishing.enabled\",\t\ttrue); // firefox >= 50\n\n// PREF: Enable blocking reported attack sites\n// http://kb.mozillazine.org/Browser.safebrowsing.malware.enabled\n// CIS 2.3.5\nuser_pref(\"browser.safebrowsing.malware.enabled\",\t\ttrue);\n\n// PREF: Disable querying Google Application Reputation database for downloaded binary files\n// https://www.mozilla.org/en-US/firefox/39.0/releasenotes/\n// https://wiki.mozilla.org/Security/Application_Reputation\nuser_pref(\"browser.safebrowsing.downloads.remote.enabled\",\tfalse);\n\n// PREF: Disable Pocket\n// https://support.mozilla.org/en-US/kb/save-web-pages-later-pocket-firefox\n// https://github.com/pyllyukko/user.js/issues/143\nuser_pref(\"browser.pocket.enabled\",\t\t\t\tfalse);\nuser_pref(\"extensions.pocket.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable \"Recommended by Pocket\" in Firefox Quantum\nuser_pref(\"browser.newtabpage.activity-stream.feeds.section.topstories\",\tfalse);\n\n// PREF: Enable Global Privacy Control (GPC) (Firefox >= 120)\n// https://support.mozilla.org/1/firefox/126.0/Linux/en-US/global-privacy-control\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-GPC\n// https://globalprivacycontrol.org/\nuser_pref(\"privacy.globalprivacycontrol.enabled\",\t\ttrue);\n\n// PREF: Hide weather on New Tab\nuser_pref(\"browser.newtabpage.activity-stream.showWeather\",\tfalse);\n\n/******************************************************************************\n * SECTION: Automatic connections                                             *\n ******************************************************************************/\n\n// PREF: Limit the connection keep-alive timeout to 15 seconds (disabled)\n// https://github.com/pyllyukko/user.js/issues/387\n// http://kb.mozillazine.org/Network.http.keep-alive.timeout\n// https://httpd.apache.org/docs/current/mod/core.html#keepalivetimeout\n//user_pref(\"network.http.keep-alive.timeout\",\t\t\t15);\n\n// PREF: Disable prefetching of  URLs\n// http://kb.mozillazine.org/Network.prefetch-next\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#Is_there_a_preference_to_disable_link_prefetching.3F\nuser_pref(\"network.prefetch-next\",\t\t\t\tfalse);\n\n// PREF: Disable DNS prefetching\n// http://kb.mozillazine.org/Network.dns.disablePrefetch\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching\nuser_pref(\"network.dns.disablePrefetch\",\t\t\ttrue);\nuser_pref(\"network.dns.disablePrefetchFromHTTPS\",\t\ttrue);\n\n// PREF: Disable the predictive service (Necko)\n// https://wiki.mozilla.org/Privacy/Reviews/Necko\nuser_pref(\"network.predictor.enabled\",\t\t\t\tfalse);\n\n// PREF: Reject .onion hostnames before passing the to DNS\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1228457\n// RFC 7686\nuser_pref(\"network.dns.blockDotOnion\",\t\t\t\ttrue);\n\n// PREF: Disable search suggestions in the search bar\n// http://kb.mozillazine.org/Browser.search.suggest.enabled\nuser_pref(\"browser.search.suggest.enabled\",\t\t\tfalse);\n\n// PREF: Disable \"Show search suggestions in location bar results\"\nuser_pref(\"browser.urlbar.suggest.searches\",\t\t\tfalse);\n// PREF: When using the location bar, don't suggest URLs from browsing history\nuser_pref(\"browser.urlbar.suggest.history\",\t\t\tfalse);\n// PREF: Disable Firefox Suggest\n// https://www.ghacks.net/2021/09/09/how-to-disable-firefox-suggest/\n// https://support.mozilla.org/en-US/kb/navigate-web-faster-firefox-suggest\nuser_pref(\"browser.urlbar.groupLabels.enabled\", false); // Firefox >= 93\n\n// PREF: Disable SSDP\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1111967\nuser_pref(\"browser.casting.enabled\",\t\t\t\tfalse);\n\n// PREF: Disable automatic downloading of OpenH264 codec\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_media-capabilities\n// https://andreasgal.com/2014/10/14/openh264-now-in-firefox/\nuser_pref(\"media.gmp-gmpopenh264.enabled\",\t\t\tfalse);\nuser_pref(\"media.gmp-manager.url\",\t\t\t\t\"\");\n\n// PREF: Disable speculative pre-connections\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_speculative-pre-connections\n// https://bugzilla.mozilla.org/show_bug.cgi?id=814169\nuser_pref(\"network.http.speculative-parallel-limit\",\t\t0);\n\n// PREF: Disable downloading homepage snippets/messages from Mozilla\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_mozilla-content\n// https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service\nuser_pref(\"browser.aboutHomeSnippets.updateUrl\",\t\t\"\");\n\n// PREF: Never check updates for search engines\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_auto-update-checking\nuser_pref(\"browser.search.update\",\t\t\t\tfalse);\n\n// PREF: Disable automatic captive portal detection (Firefox >= 52.0)\n// https://support.mozilla.org/en-US/questions/1157121\n// https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections#w_network-detection\nuser_pref(\"network.captive-portal-service.enabled\",\t\tfalse);\nuser_pref(\"network.connectivity-service.enabled\",\t\tfalse);\n\n// PREF: Disable (parts of?) \"TopSites\"\nuser_pref(\"browser.topsites.contile.enabled\",\t\t\t\tfalse);\nuser_pref(\"browser.newtabpage.activity-stream.feeds.topsites\",\t\tfalse);\nuser_pref(\"browser.newtabpage.activity-stream.showSponsoredTopSites\",\tfalse);\n\n/******************************************************************************\n * SECTION: HTTP                                                              *\n ******************************************************************************/\n\n// PREF: Disallow NTLMv1\n// https://bugzilla.mozilla.org/show_bug.cgi?id=828183\nuser_pref(\"network.negotiate-auth.allow-insecure-ntlm-v1\",\tfalse);\n// it is still allowed through HTTPS. uncomment the following to disable it completely.\n//user_pref(\"network.negotiate-auth.allow-insecure-ntlm-v1-https\",\t\tfalse);\n\n// PREF: Enable CSP 1.1 script-nonce directive support\n// https://bugzilla.mozilla.org/show_bug.cgi?id=855326\nuser_pref(\"security.csp.experimentalEnabled\",\t\t\ttrue);\n\n// PREF: Enable Content Security Policy (CSP)\n// https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy\n// https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP\nuser_pref(\"security.csp.enable\",\t\t\t\ttrue);\n\n// PREF: Enable Subresource Integrity\n// https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity\n// https://wiki.mozilla.org/Security/Subresource_Integrity\nuser_pref(\"security.sri.enable\",\t\t\t\ttrue);\n\n// PREF: DNT HTTP header (disabled)\n// https://www.mozilla.org/en-US/firefox/dnt/\n// https://en.wikipedia.org/wiki/Do_not_track_header\n// https://dnt-dashboard.mozilla.org\n// https://github.com/pyllyukko/user.js/issues/11\n// NOTICE: Do No Track must be enabled manually\n//user_pref(\"privacy.donottrackheader.enabled\",\t\ttrue);\n\n// PREF: Send a referer header with the target URI as the source (disabled)\n// https://bugzilla.mozilla.org/show_bug.cgi?id=822869\n// https://github.com/pyllyukko/user.js/issues/227\n// NOTICE-DISABLED: Spoofing referers breaks functionality on websites relying on authentic referer headers\n// NOTICE-DISABLED: Spoofing referers breaks visualisation of 3rd-party sites on the Lightbeam addon\n// NOTICE-DISABLED: Spoofing referers disables CSRF protection on some login pages not implementing origin-header/cookie+token based CSRF protection\n// TODO: https://github.com/pyllyukko/user.js/issues/94, commented-out XOriginPolicy/XOriginTrimmingPolicy = 2 prefs\n//user_pref(\"network.http.referer.spoofSource\",\t\t\ttrue);\n\n// PREF: Don't send referer headers when following links across different domains\n// https://github.com/pyllyukko/user.js/issues/227\n// https://github.com/pyllyukko/user.js/issues/328\n// https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/\n// https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks\n// NOTICE: Blocking referers across same eTLD sites breaks some login flows relying on them, consider lowering this pref to 1\nuser_pref(\"network.http.referer.XOriginPolicy\",\t\t2);\n\n// PREF: Trim HTTP referer headers to only send the scheme, host, and port\n// https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks\nuser_pref(\"network.http.referer.trimmingPolicy\",\t2);\n\n// PREF: When sending Referer across domains, only send scheme, host, and port in the Referer header\n// https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks\nuser_pref(\"network.http.referer.XOriginTrimmingPolicy\",\t2);\n\n// PREF: Accept Only 1st Party Cookies\n// http://kb.mozillazine.org/Network.cookie.cookieBehavior#1\n// NOTICE: Blocking 3rd-party cookies breaks a number of payment gateways\n// CIS 2.5.1\nuser_pref(\"network.cookie.cookieBehavior\",\t\t\t1);\n\n// PREF: Enable first-party isolation\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1299996\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1260931\n// https://wiki.mozilla.org/Security/FirstPartyIsolation\n// NOTICE: First-party isolation breaks Microsoft Teams\n// NOTICE: First-party isolation causes HTTP basic auth to ask for credentials for every new tab (see #425)\nuser_pref(\"privacy.firstparty.isolate\",\t\t\t\ttrue);\n\n// PREF: Make sure that third-party cookies (if enabled) never persist beyond the session.\n// https://feeding.cloud.geek.nz/posts/tweaking-cookies-for-privacy-in-firefox/\n// http://kb.mozillazine.org/Network.cookie.thirdparty.sessionOnly\n// https://developer.mozilla.org/en-US/docs/Cookies_Preferences_in_Mozilla#network.cookie.thirdparty.sessionOnly\nuser_pref(\"network.cookie.thirdparty.sessionOnly\",\t\ttrue);\n\n// PREF: Spoof User-agent (disabled)\n//user_pref(\"general.useragent.override\",\t\t\t\t\"Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0\");\n//user_pref(\"general.appname.override\",\t\t\t\t\"Netscape\");\n//user_pref(\"general.appversion.override\",\t\t\t\"5.0 (Windows)\");\n//user_pref(\"general.platform.override\",\t\t\t\t\"Win32\");\n//user_pref(\"general.oscpu.override\",\t\t\t\t\"Windows NT 6.1\");\n\n/*******************************************************************************\n * SECTION: Caching                                                            *\n ******************************************************************************/\n\n// PREF: Permanently enable private browsing mode\n// https://support.mozilla.org/en-US/kb/Private-Browsing\n// https://wiki.mozilla.org/PrivateBrowsing\n// NOTICE: You can not view or inspect cookies when in private browsing: https://bugzilla.mozilla.org/show_bug.cgi?id=823941\n// NOTICE: When Javascript is enabled, Websites can detect use of Private Browsing mode\n// NOTICE: Private browsing breaks Kerberos authentication\n// NOTICE: Disables \"Containers\" functionality (see below)\n// NOTICE: \"Always use private browsing mode\" (browser.privatebrowsing.autostart) disables the possibility to use password manager: https://support.mozilla.org/en-US/kb/usernames-and-passwords-are-not-saved#w_private-browsing\nuser_pref(\"browser.privatebrowsing.autostart\",\t\t\ttrue);\n\n// PREF: Do not download URLs for the offline cache\n// http://kb.mozillazine.org/Browser.cache.offline.enable\nuser_pref(\"browser.cache.offline.enable\",\t\t\tfalse);\n\n// PREF: Clear history when Firefox closes\n// https://support.mozilla.org/en-US/kb/Clear%20Recent%20History#w_how-do-i-make-firefox-clear-my-history-automatically\n// NOTICE: Installing user.js will remove your browsing history, caches and local storage.\n// NOTICE: Installing user.js **will remove your saved passwords** (https://github.com/pyllyukko/user.js/issues/27)\n// NOTICE: Clearing open windows on Firefox exit causes 2 windows to open when Firefox starts https://bugzilla.mozilla.org/show_bug.cgi?id=1334945\nuser_pref(\"privacy.sanitize.sanitizeOnShutdown\",\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.cache\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.cookies\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.downloads\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.formdata\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.history\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.offlineApps\",\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.sessions\",\t\t\ttrue);\nuser_pref(\"privacy.clearOnShutdown.openWindows\",\t\ttrue);\n\n// PREF: Set time range to \"Everything\" as default in \"Clear Recent History\"\nuser_pref(\"privacy.sanitize.timeSpan\",\t\t\t\t0);\n\n// PREF: Clear everything but \"Site Preferences\" in \"Clear Recent History\"\nuser_pref(\"privacy.cpd.offlineApps\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.cache\",\t\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.cookies\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.downloads\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.formdata\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.history\",\t\t\t\ttrue);\nuser_pref(\"privacy.cpd.sessions\",\t\t\t\ttrue);\n\n// PREF: Don't remember browsing history\nuser_pref(\"places.history.enabled\",\t\t\t\tfalse);\n\n// PREF: Don't remember recently closed tabs\nuser_pref(\"browser.sessionstore.max_tabs_undo\",\t\t0);\n\n// PREF: Disable disk cache\n// http://kb.mozillazine.org/Browser.cache.disk.enable\nuser_pref(\"browser.cache.disk.enable\",\t\t\t\tfalse);\n\n// PREF: Disable memory cache (disabled)\n// http://kb.mozillazine.org/Browser.cache.memory.enable\n//user_pref(\"browser.cache.memory.enable\",\t\tfalse);\n\n// PREF: Disable Caching of SSL Pages\n// CIS Version 1.2.0 October 21st, 2011 2.5.8\n// http://kb.mozillazine.org/Browser.cache.disk_cache_ssl\nuser_pref(\"browser.cache.disk_cache_ssl\",\t\t\tfalse);\n\n// PREF: Disable download history\n// CIS Version 1.2.0 October 21st, 2011 2.5.5\nuser_pref(\"browser.download.manager.retention\",\t\t\t0);\n\n// PREF: Disable password manager (use an external password manager!)\n// CIS Version 1.2.0 October 21st, 2011 2.5.2\nuser_pref(\"signon.rememberSignons\",\t\t\t\tfalse);\n\n// PREF: Disable form autofill, don't save information entered in web page forms and the Search Bar\nuser_pref(\"browser.formfill.enable\",\t\t\t\tfalse);\n\n// PREF: Cookies expires at the end of the session (when the browser closes)\n// http://kb.mozillazine.org/Network.cookie.lifetimePolicy#2\nuser_pref(\"network.cookie.lifetimePolicy\",\t\t\t2);\n\n// PREF: Require manual intervention to autofill known username/passwords sign-in forms\n// http://kb.mozillazine.org/Signon.autofillForms\n// https://www.torproject.org/projects/torbrowser/design/#identifier-linkability\nuser_pref(\"signon.autofillForms\",\t\t\t\tfalse);\n\n// PREF: Disable formless login capture\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1166947\nuser_pref(\"signon.formlessCapture.enabled\",\t\t\tfalse);\n\n// PREF: When username/password autofill is enabled, still disable it on non-HTTPS sites\n// https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317\nuser_pref(\"signon.autofillForms.http\",\t\t\t\tfalse);\n\n// PREF: Show in-content login form warning UI for insecure login fields\n// https://hg.mozilla.org/integration/mozilla-inbound/rev/f0d146fe7317\nuser_pref(\"security.insecure_field_warning.contextual.enabled\", true);\n\n// PREF: Disable the password manager for pages with autocomplete=off (disabled)\n// https://bugzilla.mozilla.org/show_bug.cgi?id=956906\n// OWASP ASVS V9.1\n// Does not prevent any kind of auto-completion (see browser.formfill.enable, signon.autofillForms)\n//user_pref(\"signon.storeWhenAutocompleteOff\",\t\t\tfalse);\n\n// PREF: Delete Search and Form History\n// CIS Version 1.2.0 October 21st, 2011 2.5.6\nuser_pref(\"browser.formfill.expire_days\",\t\t\t0);\n\n// PREF: Clear SSL Form Session Data\n// http://kb.mozillazine.org/Browser.sessionstore.privacy_level#2\n// Store extra session data for unencrypted (non-HTTPS) sites only.\n// CIS Version 1.2.0 October 21st, 2011 2.5.7\n// NOTE: CIS says 1, we use 2\nuser_pref(\"browser.sessionstore.privacy_level\",\t\t\t2);\n\n// PREF: Delete temporary files on exit\n// https://bugzilla.mozilla.org/show_bug.cgi?id=238789\nuser_pref(\"browser.helperApps.deleteTempFileOnExit\",\t\ttrue);\n\n// PREF: Do not create screenshots of visited pages (relates to the \"new tab page\" feature)\n// https://support.mozilla.org/en-US/questions/973320\n// https://developer.mozilla.org/en-US/docs/Mozilla/Preferences/Preference_reference/browser.pagethumbnails.capturing_disabled\nuser_pref(\"browser.pagethumbnails.capturing_disabled\",\t\ttrue);\n\n// PREF: Don't fetch and permanently store favicons for Windows .URL shortcuts created by drag and drop\n// NOTICE: .URL shortcut files will be created with a generic icon\n// Favicons are stored as .ico files in $profile_dir\\shortcutCache\nuser_pref(\"browser.shell.shortcutFavicons\",\t\t\t\t\tfalse);\n\n// PREF: Disable bookmarks backups (default: 15)\n// http://kb.mozillazine.org/Browser.bookmarks.max_backups\nuser_pref(\"browser.bookmarks.max_backups\", 0);\n\n// PREF: Export bookmarks to HTML automatically when closing Firefox (disabled)\n// https://support.mozilla.org/en-US/questions/1176242\n//user_pref(\"browser.bookmarks.autoExportHTML\", \t\t\t\ttrue);\n//user_pref(\"browser.bookmarks.file\",\t'/path/to/bookmarks-export.html');\n\n// PREF: Disable downloading of favicons in response to favicon fingerprinting techniques\n// https://github.com/jonasstrehle/supercookie\n// http://kb.mozillazine.org/Browser.chrome.site_icons\n// https://blog.mozilla.org/security/2021/01/26/supercookie-protections/\nuser_pref(\"browser.chrome.site_icons\",\t\t\t\tfalse);\n\n/*******************************************************************************\n * SECTION: UI related                                                         *\n *******************************************************************************/\n\n// PREF: Enable insecure password warnings (login forms in non-HTTPS pages)\n// https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-over-http-please/\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1319119\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1217156\nuser_pref(\"security.insecure_password.ui.enabled\",\t\ttrue);\n\n// PREF: Disable right-click menu manipulation via JavaScript (disabled)\n//user_pref(\"dom.event.contextmenu.enabled\",\t\tfalse);\n\n// PREF: Disable \"Are you sure you want to leave this page?\" popups on page close\n// https://support.mozilla.org/en-US/questions/1043508\n// NOTICE: disabling \"beforeunload\" events may lead to losing data entered in web forms\n// Does not prevent JS leaks of the page close event.\n// https://developer.mozilla.org/en-US/docs/Web/Events/beforeunload\n//user_pref(\"dom.disable_beforeunload\",    true);\n\n// PREF: Disable Downloading on Desktop\n// CIS 2.3.2\nuser_pref(\"browser.download.folderList\",\t\t\t2);\n\n// PREF: Always ask the user where to download\n// https://developer.mozilla.org/en/Download_Manager_preferences (obsolete)\nuser_pref(\"browser.download.useDownloadDir\",\t\t\tfalse);\n\n// PREF: Disable the \"new tab page\" feature and show a blank tab instead\n// https://wiki.mozilla.org/Privacy/Reviews/New_Tab\n// https://support.mozilla.org/en-US/kb/new-tab-page-show-hide-and-customize-top-sites#w_how-do-i-turn-the-new-tab-page-off\nuser_pref(\"browser.newtabpage.enabled\",\t\t\t\tfalse);\nuser_pref(\"browser.newtab.url\",\t\t\t\t\t\"about:blank\");\n\n// PREF: Disable Snippets\n// https://wiki.mozilla.org/Firefox/Projects/Firefox_Start/Snippet_Service\n// https://support.mozilla.org/en-US/kb/snippets-firefox-faq\nuser_pref(\"browser.newtabpage.activity-stream.feeds.snippets\",\tfalse);\n\n// PREF: Disable Activity Stream\n// https://wiki.mozilla.org/Firefox/Activity_Stream\nuser_pref(\"browser.newtabpage.activity-stream.enabled\",\t\tfalse);\n\n// PREF: Disable new tab tile ads & preload\n// http://www.thewindowsclub.com/disable-remove-ad-tiles-from-firefox\n// http://forums.mozillazine.org/viewtopic.php?p=13876331#p13876331\n// https://wiki.mozilla.org/Tiles/Technical_Documentation#Ping\n// https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-source\n// https://gecko.readthedocs.org/en/latest/browser/browser/DirectoryLinksProvider.html#browser-newtabpage-directory-ping\n// TODO: deprecated? not in DXR, some dead links\nuser_pref(\"browser.newtabpage.enhanced\",\t\t\tfalse);\nuser_pref(\"browser.newtab.preload\",\t\t\t\tfalse);\nuser_pref(\"browser.newtabpage.directory.ping\",\t\t\t\"\");\nuser_pref(\"browser.newtabpage.directory.source\",\t\t\"data:text/plain,{}\");\n\n// PREF: Disable Mozilla VPN ads on the about:protections page\n// https://support.mozilla.org/en-US/kb/what-mozilla-vpn-and-how-does-it-work\n// https://en.wikipedia.org/wiki/Mozilla_VPN\n// https://blog.mozilla.org/security/2021/08/31/mozilla-vpn-security-audit/\n// https://www.mozilla.org/en-US/security/advisories/mfsa2021-31/\nuser_pref(\"browser.vpn_promo.enabled\",\t\t\tfalse);\n\n// PREF: Enable Auto Notification of Outdated Plugins (Firefox < 50)\n// https://wiki.mozilla.org/Firefox3.6/Plugin_Update_Awareness_Security_Review\n// CIS Version 1.2.0 October 21st, 2011 2.1.2\n// https://hg.mozilla.org/mozilla-central/rev/304560\nuser_pref(\"plugins.update.notifyUser\",\t\t\t\ttrue);\n\n// PREF: Force Punycode for Internationalized Domain Names\n// http://kb.mozillazine.org/Network.IDN_show_punycode\n// https://www.xudongz.com/blog/2017/idn-phishing/\n// https://wiki.mozilla.org/IDN_Display_Algorithm\n// https://en.wikipedia.org/wiki/IDN_homograph_attack\n// https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/\n// CIS Mozilla Firefox 24 ESR v1.0.0 - 3.6\nuser_pref(\"network.IDN_show_punycode\",\t\t\t\ttrue);\n\n// PREF: Disable inline autocomplete in URL bar\n// http://kb.mozillazine.org/Inline_autocomplete\nuser_pref(\"browser.urlbar.autoFill\",\t\t\t\tfalse);\nuser_pref(\"browser.urlbar.autoFill.typed\",\t\t\tfalse);\n\n// PREF: Disable CSS :visited selectors\n// https://blog.mozilla.org/security/2010/03/31/plugging-the-css-history-leak/\n// https://dbaron.org/mozilla/visited-privacy\nuser_pref(\"layout.css.visited_links_enabled\",\t\t\tfalse);\n\n// PREF: Disable URL bar autocomplete and history/bookmarks suggestions dropdown\n// http://kb.mozillazine.org/Disabling_autocomplete_-_Firefox#Firefox_3.5\nuser_pref(\"browser.urlbar.autocomplete.enabled\",\t\tfalse);\n\n// PREF: Do not check if Firefox is the default browser\nuser_pref(\"browser.shell.checkDefaultBrowser\",\t\t\tfalse);\n\n// PREF: When password manager is enabled, lock the password storage periodically\n// CIS Version 1.2.0 October 21st, 2011 2.5.3 Disable Prompting for Credential Storage\nuser_pref(\"security.ask_for_password\",\t\t\t\t2);\n\n// PREF: Lock the password storage every 1 minutes (default: 30)\nuser_pref(\"security.password_lifetime\",\t\t\t\t1);\n\n// PREF: Display a notification bar when websites offer data for offline use\n// http://kb.mozillazine.org/Browser.offline-apps.notify\nuser_pref(\"browser.offline-apps.notify\",\t\t\ttrue);\n\n/******************************************************************************\n * SECTION: Cryptography                                                      *\n ******************************************************************************/\n\n// PREF: Enable HTTPS-Only Mode\n// https://blog.mozilla.org/security/2020/11/17/firefox-83-introduces-https-only-mode/\n// https://www.feistyduck.com/bulletproof-tls-newsletter/issue_71_firefox_introduces_https_only_mode\nuser_pref(\"dom.security.https_only_mode\",\t\t\ttrue);\n\n// PREF: Enable HSTS preload list (pre-set HSTS sites list provided by Mozilla)\n// https://blog.mozilla.org/security/2012/11/01/preloading-hsts/\n// https://wiki.mozilla.org/Privacy/Features/HSTS_Preload_List\n// https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security\nuser_pref(\"network.stricttransportsecurity.preloadlist\",\ttrue);\n\n// PREF: Enable Online Certificate Status Protocol\n// https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol\n// https://www.imperialviolet.org/2014/04/19/revchecking.html\n// https://www.maikel.pro/blog/current-state-certificate-revocation-crls-ocsp/\n// https://wiki.mozilla.org/CA:RevocationPlan\n// https://wiki.mozilla.org/CA:ImprovingRevocation\n// https://wiki.mozilla.org/CA:OCSP-HardFail\n// https://news.netcraft.com/archives/2014/04/24/certificate-revocation-why-browsers-remain-affected-by-heartbleed.html\n// https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html\n// NOTICE: OCSP leaks your IP and domains you visit to the CA when OCSP Stapling is not available on visited host\n// NOTICE: OCSP is vulnerable to replay attacks when nonce is not configured on the OCSP responder\n// NOTICE: OCSP adds latency (performance)\n// NOTICE: Short-lived certificates are not checked for revocation (security.pki.cert_short_lifetime_in_days, default:10)\n// CIS Version 1.2.0 October 21st, 2011 2.2.4\nuser_pref(\"security.OCSP.enabled\",\t\t\t\t1);\n\n// PREF: Enable OCSP Stapling support\n// https://en.wikipedia.org/wiki/OCSP_stapling\n// https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/\n// https://www.digitalocean.com/community/tutorials/how-to-configure-ocsp-stapling-on-apache-and-nginx\nuser_pref(\"security.ssl.enable_ocsp_stapling\",\t\t\ttrue);\n\n// PREF: Enable OCSP Must-Staple support (Firefox >= 45)\n// https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/\n// https://www.entrust.com/ocsp-must-staple/\n// https://github.com/schomery/privacy-settings/issues/40\n// NOTICE: Firefox falls back on plain OCSP when must-staple is not configured on the host certificate\nuser_pref(\"security.ssl.enable_ocsp_must_staple\",\t\ttrue);\n\n// PREF: Require a valid OCSP response for OCSP enabled certificates (disabled)\n// https://groups.google.com/forum/#!topic/mozilla.dev.security/n1G-N2-HTVA\n// https://www.feistyduck.com/newsletter/issue_121_the_slow_death_of_ocsp\n// Disabling this will make OCSP bypassable by MitM attacks suppressing OCSP responses\n// NOTICE: `security.OCSP.require` will make the connection fail when the OCSP responder is unavailable\n// NOTICE: `security.OCSP.require` is known to break browsing on some [captive portals](https://en.wikipedia.org/wiki/Captive_portal)\n//user_pref(\"security.OCSP.require\",\t\t\t\ttrue);\n\n// PREF: Disable TLS Session Tickets\n// https://www.blackhat.com/us-13/briefings.html#NextGen\n// https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-Slides.pdf\n// https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-WP.pdf\n// https://bugzilla.mozilla.org/show_bug.cgi?id=917049\n// https://bugzilla.mozilla.org/show_bug.cgi?id=967977\nuser_pref(\"security.ssl.disable_session_identifiers\",\t\ttrue);\n\n// PREF: Only allow TLS 1.[2-3]\n// http://kb.mozillazine.org/Security.tls.version.*\n// 1 = TLS 1.0 is the minimum required / maximum supported encryption protocol. (This is the current default for the maximum supported version.)\n// 2 = TLS 1.1 is the minimum required / maximum supported encryption protocol.\n// 3 = TLS 1.2 is the minimum required / maximum supported encryption protocol.\n// 4 = TLS 1.3 is the minimum required / maximum supported encryption protocol.\nuser_pref(\"security.tls.version.min\",\t\t\t\t3);\nuser_pref(\"security.tls.version.max\",\t\t\t\t4);\nuser_pref(\"security.tls.version.enable-deprecated\",\t\tfalse);\n\n// PREF: Disable insecure TLS version fallback\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1084025\n// https://github.com/pyllyukko/user.js/pull/206#issuecomment-280229645\nuser_pref(\"security.tls.version.fallback-limit\",\t\t4);\n\n// PREF: Enforce Public Key Pinning\n// https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning\n// https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning\n// \"2. Strict. Pinning is always enforced.\"\nuser_pref(\"security.cert_pinning.enforcement_level\",\t\t2);\n\n// PREF: Disallow SHA-1\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1302140\n// https://shattered.io/\nuser_pref(\"security.pki.sha1_enforcement_level\",\t\t1);\n\n// PREF: Warn the user when server doesn't support RFC 5746 (\"safe\" renegotiation)\n// https://wiki.mozilla.org/Security:Renegotiation#security.ssl.treat_unsafe_negotiation_as_broken\n// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555\nuser_pref(\"security.ssl.treat_unsafe_negotiation_as_broken\",\ttrue);\n\n// PREF: Disallow connection to servers not supporting safe renegotiation\n// https://wiki.mozilla.org/Security:Renegotiation#security.ssl.require_safe_negotiation\n// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3555\n// https://github.com/pyllyukko/user.js/issues/237\nuser_pref(\"security.ssl.require_safe_negotiation\",\t\ttrue);\n\n// PREF: Disable automatic reporting of TLS connection errors\n// https://support.mozilla.org/en-US/kb/certificate-pinning-reports\n// we could also disable security.ssl.errorReporting.enabled, but I think it's\n// good to leave the option to report potentially malicious sites if the user\n// chooses to do so.\n// you can test this at https://pinningtest.appspot.com/\nuser_pref(\"security.ssl.errorReporting.automatic\",\t\tfalse);\n\n// PREF: Pre-populate the current URL but do not pre-fetch the certificate in the \"Add Security Exception\" dialog\n// http://kb.mozillazine.org/Browser.ssl_override_behavior\n// https://github.com/pyllyukko/user.js/issues/210\nuser_pref(\"browser.ssl_override_behavior\",\t\t\t1);\n\n// PREF: Encrypted SNI (when TRR is enabled)\n// https://www.cloudflare.com/ssl/encrypted-sni/\n// https://wiki.mozilla.org/Trusted_Recursive_Resolver#ESNI\n// https://en.wikipedia.org/wiki/Server_Name_Indication#Security_implications_(ESNI)\nuser_pref(\"network.security.esni.enabled\",\t\t\ttrue);\n\n// PREF: Disable the Enterprise Roots preference\n// https://support.mozilla.org/en-US/kb/how-disable-enterprise-roots-preference\n// https://github.com/pyllyukko/user.js/issues/560\nuser_pref(\"security.certerrors.mitm.auto_enable_enterprise_roots\",\tfalse);\nuser_pref(\"security.enterprise_roots.enabled\",\t\t\t\tfalse);\n\n/******************************************************************************\n * SECTION: Cipher suites                                                     *\n ******************************************************************************/\n\n// PREF: Disable null ciphers\nuser_pref(\"security.ssl3.rsa_null_sha\",\t\t\t\tfalse);\nuser_pref(\"security.ssl3.rsa_null_md5\",\t\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_rsa_null_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_null_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_rsa_null_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_ecdsa_null_sha\",\t\t\tfalse);\n\n// PREF: Disable SEED cipher\n// https://en.wikipedia.org/wiki/SEED\nuser_pref(\"security.ssl3.rsa_seed_sha\",\t\t\t\tfalse);\n\n// PREF: Disable 40/56/128-bit ciphers\n// 40-bit ciphers\nuser_pref(\"security.ssl3.rsa_rc4_40_md5\",\t\t\tfalse);\nuser_pref(\"security.ssl3.rsa_rc2_40_md5\",\t\t\tfalse);\n// 56-bit ciphers\nuser_pref(\"security.ssl3.rsa_1024_rc4_56_sha\",\t\t\tfalse);\n// 128-bit ciphers\nuser_pref(\"security.ssl3.rsa_camellia_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_rsa_aes_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_aes_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_rsa_aes_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_ecdsa_aes_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.dhe_rsa_camellia_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.dhe_rsa_aes_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256\",\tfalse); // 0xc02b TLSv1.2\nuser_pref(\"security.ssl3.ecdhe_rsa_aes_128_gcm_sha256\",\t\tfalse); // 0xc02f TLSv1.2\nuser_pref(\"security.tls13.aes_128_gcm_sha256\",\t\t\tfalse); // 0x1301 TLSv1.3\n\n// PREF: Disable RC4\n// https://developer.mozilla.org/en-US/Firefox/Releases/38#Security\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1138882\n// https://rc4.io/\n// https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2566\nuser_pref(\"security.ssl3.ecdh_ecdsa_rc4_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_rsa_rc4_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_rc4_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_rsa_rc4_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.rsa_rc4_128_md5\",\t\t\tfalse);\nuser_pref(\"security.ssl3.rsa_rc4_128_sha\",\t\t\tfalse);\nuser_pref(\"security.tls.unrestricted_rc4_fallback\",\t\tfalse);\n\n// PREF: Disable 3DES (effective key size is < 128)\n// https://en.wikipedia.org/wiki/3des#Security\n// http://en.citizendium.org/wiki/Meet-in-the-middle_attack\n// http://www-archive.mozilla.org/projects/security/pki/nss/ssl/fips-ssl-ciphersuites.html\nuser_pref(\"security.ssl3.dhe_dss_des_ede3_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.dhe_rsa_des_ede3_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_ecdsa_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_rsa_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_ecdsa_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.ecdhe_rsa_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.rsa_des_ede3_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.rsa_fips_des_ede3_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.deprecated.rsa_des_ede3_sha\",\t\tfalse);\n\n// PREF: Disable ciphers with ECDH (non-ephemeral)\nuser_pref(\"security.ssl3.ecdh_rsa_aes_256_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.ecdh_ecdsa_aes_256_sha\",\t\tfalse);\n\n// PREF: Disable 256 bits ciphers without PFS\nuser_pref(\"security.ssl3.rsa_camellia_256_sha\",\t\t\tfalse);\n\n// PREF: Enable GCM ciphers (TLSv1.2 only) (disabled)\n// https://en.wikipedia.org/wiki/Galois/Counter_Mode\n//user_pref(\"security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256\",\ttrue); // 0xc02b\n//user_pref(\"security.ssl3.ecdhe_rsa_aes_128_gcm_sha256\",\t\ttrue); // 0xc02f\n\n// PREF: Disable non-ECDHE RSA ciphers\n// https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites\nuser_pref(\"security.ssl3.rsa_aes_128_gcm_sha256\",\t\tfalse);\nuser_pref(\"security.ssl3.rsa_aes_256_gcm_sha384\",\t\tfalse);\n\n// PREF: Enable ChaCha20 and Poly1305 (Firefox >= 47)\n// https://www.mozilla.org/en-US/firefox/47.0/releasenotes/\n// https://tools.ietf.org/html/rfc7905\n// https://bugzilla.mozilla.org/show_bug.cgi?id=917571\n// https://bugzilla.mozilla.org/show_bug.cgi?id=1247860\n// https://cr.yp.to/chacha.html\nuser_pref(\"security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256\",\ttrue);\nuser_pref(\"security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256\",\ttrue);\n\n// PREF: Disable ciphers susceptible to the logjam attack\n// https://weakdh.org/\nuser_pref(\"security.ssl3.dhe_rsa_camellia_256_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.dhe_rsa_aes_256_sha\",\t\t\tfalse);\n\n// PREF: Disable ciphers with DSA (max 1024 bits)\nuser_pref(\"security.ssl3.dhe_dss_aes_128_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.dhe_dss_aes_256_sha\",\t\t\tfalse);\nuser_pref(\"security.ssl3.dhe_dss_camellia_128_sha\",\t\tfalse);\nuser_pref(\"security.ssl3.dhe_dss_camellia_256_sha\",\t\tfalse);\n\n// PREF: Disable ciphers with CBC & SHA-1\nuser_pref(\"security.ssl3.rsa_aes_256_sha\",\t\t\tfalse); // 0x35\nuser_pref(\"security.ssl3.rsa_aes_128_sha\",\t\t\tfalse); // 0x2f\nuser_pref(\"security.ssl3.ecdhe_rsa_aes_256_sha\",\t\tfalse); // 0xc014\nuser_pref(\"security.ssl3.ecdhe_ecdsa_aes_256_sha\",\t\tfalse); // 0xc00a\n\n// PREF: Enable X25519Kyber768Draft00 (post-quantum key exchange) [FF Nightly 2024-01-18+]\n// https://datatracker.ietf.org/doc/draft-tls-westerbaan-xyber768d00/\n// https://twitter.com/bwesterb/status/1748017372764475519\n// https://pq.cloudflareresearch.com/\nuser_pref(\"security.tls.enable_kyber\",\t\t\t\ttrue);\n", "creation_timestamp": "2026-08-05T15:26:51.154146Z"}, {"uuid": "3b8a1049-ee42-4029-8009-d3a33274eecf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2013-2566", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb", "content": "{\"actions\": [], \"aliases\": [\"auxiliary/scanner/http/ssl\", \"auxiliary/scanner/http/ssl_version\"], \"arch\": \"\", \"author\": [\"todb \", \"et \", \"Chris John Riley\", \"Veit Hailperin \", \"h00die\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"Check if a server supports a given version of SSL/TLS and cipher suites.\\n\\n        The certificate is stored in loot, and any known vulnerabilities against that\\n        SSL version and cipher suite combination are checked. These checks include\\n        POODLE, deprecated protocols, expired/not valid certs, low key strength, null cipher suites,\\n        certificates signed with MD5, DROWN, RC4 ciphers, exportable ciphers, LOGJAM, and BEAST.\", \"disclosure_date\": \"2014-10-14\", \"fullname\": \"auxiliary/scanner/ssl/ssl_version\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"SSL/TLS Version Detection\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/ssl/ssl_version.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ssl/ssl_version\", \"references\": [\"URL-https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html\", \"CVE-2014-3566\", \"URL-http://web.archive.org/web/20240319071045/https://www.openssl.org/~bodo/ssl-poodle.pdf\", \"URL-https://datatracker.ietf.org/doc/rfc8996/\", \"URL-https://datatracker.ietf.org/doc/html/rfc6176\", \"URL-https://datatracker.ietf.org/doc/html/rfc7568\", \"URL-https://www.win.tue.nl/hashclash/rogue-ca/\", \"CWE-328\", \"URL-https://drownattack.com/\", \"CVE-2016-0800\", \"CVE-2011-3389\", \"URL-http://web.archive.org/web/20240607160328/https://www.isg.rhul.ac.uk/tls/\", \"CVE-2013-2566\", \"CVE-2015-4000\", \"CVE-2022-3358\", \"CWE-319\", \"CWE-298\", \"CWE-327\", \"CWE-326\"], \"rport\": 443, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:09.888513Z"}]}