Firefox vs VPN

I also use a number of addons, for various purposes

That requires hardening. Currently I use

* CleanURLs https://addons.mozilla.org/addon/clearurls/ (remove UTM and parameter tracking)
* CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/
* Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ (prevent tracking via CDN)
* Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ (used for sites to keep me logged in)
* HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/
* Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ (no to AMP)
* Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ (Prevents tracking via ETags and other things like IndexDB)
* uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ (block adverts)
* uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ (block 1st party JavaScript)

I use a very similar list of addons. In addition I recommend:

* CanvasBlocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
* Cookie AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...
and I block cookies by default using uMatrix.

Thanks for pointing out CSS Exfil Protection. I hadn't seen that one yet.
Edit: I also recently switched to NoHTTP instead of HTTPS-Everywhere. This way I have to explicitly allow any non-HTTPS connections.



I use a very similar list of addons. In addition I recommend:

> * CanvasBlocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker....
A lot of people recommend that, but you don't need it if you're using ghacks-user.js. The reason is because of privacy.resistFingerprinting.

> * Cookie AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode....
> and I block cookies by default using uMatrix.
I use CookieAutodelete on my mobile because unfortunately the container API isn't available on the Android version of Firefox.
The reason I don't use it on my desktop is because there are certain types of things that cannot be cleared.

> APIs do not exist to allow clearing IndexedDB, Service Workers cache, appCache, or cache by host. Clearing cookies & localStorage on their own, and leaving orphaned persistent data is a false sense of privacy.
* https://github.com/Cookie-AutoDelete/Cookie-AutoDelete/wiki/...
* https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Exte...
> Edit: I also recently switched to NoHTTP instead of HTTPS-Everywhere. This way I have to explicitly allow any non-HTTPS connections.

I might have to check that out.