How to hide Browser Plugin Details in firefox for more privacy?

Question

I'm trying to trick the results in this page to have more privacy/anonymity: https://panopticlick.eff.org/index.php?action=log&js=yes

So far the best I could do is change the user agent, with the "User Agent Switcher" plugin.

Any ideas on how to change the other values? Like the plugin details and the system fonts.

Solution 1

There isn't a way to do this yet in Firefox. This is necessary so that the server you are connecting to can know what form to send the content back to you in. The closest analogy I can draw is how SSL sends all of the acceptable connection types (SSL1, TSL, etc.) and the server can pick what it wants to use to communicate. When we are sending all this information to the server we are letting it know that we have these plugins and it can send us content we will be able to use.

If you're concerned about security on your browser, you could use NoScript to block unnecessary scripts from running on your browser. That's means it'll more likely make your browser less "unique".

Solution 2

I know this question is quite old, but when searching for this problem, this is one of the first results.

Short Answer: Set "plugins.enumerable_names" to "" (empty string) on Firefox 29+.

Apparently, from version 29 onwards, Firefox has a setting on about:config that controls the enumerable plugins. It does not solve the problem completely, because it is possible to query individual plugins, but it helps.

This property is "plugins.enumerable_names", and it has a list of allowed prefixes that can be enumerated. So, for the default setting, "Java,Nexus Personal,QuickTime,Shockwave", all plugin names starting with "Java", "Nexus Personal", ... will be enumerated, and all others will be hidden. To hide everything, just clear that string (set it to "").

More info: https://mail.mozilla.org/pipermail/firefox-dev/2013-November/001186.html

UPDATE: As Pointy has mentioned in the comments, this feature has been removed, since it didn't really prevent plugin enumeration (but made it slightly harder).

Here is the bugzilla page for the patch: https://bugzilla.mozilla.org/show_bug.cgi?id=1169945

UPDATE2: After a quick search, it seems like the only thing that prevents plugins from being enumerated is setting them to "Never activate". In the meantime, removing extra plugins and randomizing the user agent might help.

Solution 3

For user-agent, you can use "about:config" to create a value called "general.useragent.override" and setting the value to blank (or your favourite user agent).

Setting "plugins.click_to_play" to "true" stops the font enumeration.

"dom.storage.enabled" to "false" might also be useful.

Solution 4

fyi, check out this Firefox Addon: Random Agent Spoofer

View more solutions

Comments

[superuser]

What are you trying to accomplished by doing this?

[HappyDeveloper]

@David More privacy. Not letting random websites gather every bit of information about you is generally a good idea.

[Memming]

This is actually a better answer! The system fonts are read through flash, so "plugins.click_to_play" effectively solves the problem.

[rhavin]

shure about that? i have that value set to true and my fonts stil gt enumerated

[Pointy]

There's no plugins.enumerable_names config property in Firefox 42.

[Daniel Vaz]

Thanks for the warning. It appears they removed because it was pretty much useless (you could still have a list of plugins and test one by one). I'll update the post with what I find in the meantime

[leopld]

@rhavin with Javascript, a browser can be tested to see whether it supports a specific font, Javascript won't hand out a full list of system fonts, though.

[Spectraljump]

Random Agent Spoofer is the right answer. Because it recently added options to turn off plugin enumeration: github.com/dillbyrne/random-agent-spoofer/issues/283 As an alternative, as showed in Mechazawa's comment in that link, you can use his Greasemonkey or Tampermonkey script (both firefox and chrome) to take care of this without any extension. I can confirm that this shows plugins as "undefined" in the panopticlick test.

[Motsel]

ahh thanks for the info, that userscript is awesome since it works in Chromium also... :) github.com/dillbyrne/random-agent-spoofer/issues/…

[Zoe stands with Ukraine]

this plugin no longer exists