User.js: SBv4 & cookies

[Thorin-Oakenpants]

• [x] note to self: if SBv4 doesn't use cookies, add this to the user.js SB header paragraph - https://github.com/ghacksuserjs/ghacks-user.js/commit/e8bfa936966785fe6a167d6728146640945d8ec9

---

https://wiki.mozilla.org/Privacy/Privacy_Task_Force/firefox_about_config_privacy_tweeks

@fmarier Who maintains this? It needs a fixup. Namely browser.safebrowsing.malware.enabled = false and browser.safebrowsing.phishing.enabled = false both claiming to be privacy improvements. Sure, it reduces the "attack" surface but is highly misleading IMO. With all the privacy safeguards you've implemented over the last 5 [edit] SEVEN years or wotnot. I am sick of misinformation about this. I managed to get this article corrected.

To see such misinformation on an official Mozilla domain just blows my mind - people are being pointed to this when asking how to improve their privacy (numerous times on reddit from my own experience browsing there)

[Thorin-Oakenpants]

Might add as well:

• dom.battery.enabled = false is not needed since FF52 - https://bugzilla.mozilla.org/1313580 (limited to chrome/privileged code)
• geo.enabled = false is not needed, as it's behind a prompt and since FF58 - permissions.default.geo (0=always ask (default), 1=allow, 2=block) was added. So if anything a better solution would be the new pref at 2 which allows end users to user site exceptions

[Atavic]

I've read restoreprivacy just yesterday and the explanations there are very useful as a primer.

[fmarier]

I just emailed the author of the wiki page. Thanks for letting me know!

[Thorin-Oakenpants]

The "sources" link at the bottom are

• privacytools.io
• Mozilla Zine about:config

MozillaZine (last updated April 2017 - I actually thought it was abandoned, but I guess someone did an edit, but who knows what) is dated.

privacytools.io's recommendations hardly ever change. Three or four edits in the last couple of years?. I read an issue on their github - found it: https://github.com/privacytoolsIO/privacytools.io/issues/339 - and I considered them totally irresponsible in this regard - they just flat out refuse to listen or change it without even informing people to at least get uBO, or even add a warning. And tens of thousands of people just blindly follow their lead

wiki.mozllla.org would be better off linking to PK or here (just saying)

[Thorin-Oakenpants]

PS: FWIW my SB doesn't use a cookie (because I deny all cookies by default - ccleaner (older portable non-spying version) never shows it). @fmarier would this cause any issues with sending/receiving info when needed (because local storage is denied) - i.e with any real time checking

Side note: I have profile\safebrowsing\google4 files which are updated as of right now, but two files are old. They are goog-downloadwhite-proto.* (dated over a year ago)

[fmarier]

As far as I have observed, the new version of Safe Browsing (v4) doesn't require a cookie anymore.

[Thorin-Oakenpants]

As far as I have observed, the new version of Safe Browsing (v4) doesn't require a cookie anymore.

Nice. BUT while it might not "require" one, the question is does it (EvilCorp™) still "send" (if you don't have one) or "use" (if you have an existing one in the SB cookie jar) a cookie? I can't tell from the wording of your statement.

[fmarier]

I've cleared my old SBv2 cookies a long time ago, so I can't talk about existing cookies, but I haven't noticed a new cookie being sent since the move to V4.

[Thorin-Oakenpants]

when did v4 kick in for general release?

[earthlng]

@fmarier what's up with DXR? It's way out of sync

[fmarier]

v4 was rolled out gradually in 56 and hit 100% of users in 57.

I have no idea what's going on with DXR, I always use https://searchfox.org/.

[Thorin-Oakenpants]

I'll close this. Up to the wiki owner/moderator to "fix", he's been informed. Meanwhile finding out about SB v4 & cookies was awesome :+1: Francois, it would be nice if you updated https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ with the info too

[Thorin-Oakenpants]

I just emailed the author of the wiki page. Thanks for letting me know!

9 days later, no change on the wiki, sigh