Firefox Extensions - My Picks

Firefox Extensions
Contents show

Mozilla Firefox is a popular, extensible, open source (mostly) web browser that is highly configurable and easy to use. Somewhat bare out of the box however, its functionality is easily extended with add-ons, or 'extensions' if you prefer, of which there are many thousands.

Beware

AMO Malware
A typical day at the Mozilla Firefox Add-ons repository, 2019.

With so many "free" add-ons, the casual user might be tempted to install lots of them, however i would strongly suggest installing only those you really like or need since the potential to break things and compromise browser security and your privacy increases with every add-on you install.

Another problem is unethical developers who may include unwanted and unnecessary functionality which is not relevant to the primary purpose of the add-on. Often this results in data collection, tracking your web activities or worse, all of which i categorize as malware. The problem of malware in Mozilla's add-on repository (AMO) has grown exponentially as a result of an automated review process and the company's move to the WebExtension API which made it easy for unethical developers who have infected the Google Chrome Store to port their garbage to Firefox. Although the WebExtension API is greatly limited in its capabilities as opposed to the older XUL/XPCOM extensions, user tracking and advertising are permitted and, on occasion, far more dangerous add-ons escape detection.

Add-on selection guidelines

  • You've been warned. Many extensions will be accompanied by a warning on their AMO pages which indicates that the extension is not monitored by Mozilla and therefore is more risky to install. While monitored extensions are likely to be more trustworthy in general, there are many others which are perfectly fine to install as long as you trust the developer or review the code yourself.
  • Tool-bar or FOOL-bar? Be very wary of all tool-bar add-ons since many of these contain 3rd party spyware/malware components for monetization purposes.
  • 'We care about your privacy ... LOL' If an add-on has a privacy policy, read it and see if it contains anything that isn't related to the functionality of the add-on. In general, if the document is a wall of text (long), it's probably crap.
  • Permissions, permissions. The Mozilla add-on website lists the permissions that add-ons require, though there seems to be some major problems at this time in that all permissions used by an add-on may not be listed, or permissions which the add-on does not use may be listed, so don't trust this completely. That said, look for permissions that seem unnecessary given the expected functionality of the add-on.
  • The 0-day 'bonus'. Never install newly released add-ons from a developer you're not familiar with or who has no other add-ons in the AMO repository. Mozilla uses a deeply flawed automated system to evaluate add-ons, so wait at least a few days until others have had a chance to review it or flag it as abusive. If the add-on quickly disappears or gets poor reviews, be thankful you didn't install it.
  • When "free" isn't. Always check the software license and be wary of developers who use a restrictive license, such as 'All Rights Reserved'. Most ethical developers will use a liberal, open source license, such as the General Public License (GPL) or the Mozilla Public License (MPL).
  • What's under the hood? Avoid developers that attempt to hide their source code. Most ethical developers will publish their source code on platforms like GitLab or GitHub where users can submit proper bug reports and feature requests. In such cases there is usually a homepage and/or support link on the add-on page that leads to the source code repository. If the source code is not published, you can still view it by decompressing the add-on or by using the excellent Extension source viewer add-on, though you will need to have an understanding of JavaScript.
  • HELP!!! Be wary of developers that makes it difficult or impossible to contact them or submit bug reports.
  • He said she said. Always read the user reviews to see how well an add-on is liked and be wary if it is rated 3 stars or less, or not rated at all, or was rated highly by only a few people. Sometimes a developer will be the first to "review" their add-on, giving it 5 stars. Regardless of the rating however, always check the comments of the people that gave it the lowest rating to see if their gripes seem legitimate. There are many add-ons that have been highly rated by hundreds or thousands of people that contain malware.
  • Hey, who are you??? Always check to see what other add-ons the developer has created and how those are rated. Be wary when the developer is named as a company and not an individual, or when the name used is anonymous, such as "Firefox user" followed by a random string of numbers.
  • And where do you live??? See what kind of content is on the developers website if they link to one and look for marketing hype or other unethical activity.
  • But EVERYBODY'S using it! Many developers of hugely popular add-ons have been contacted by malware distributing 3rd parties wanting to buy their add-on or strike a deal with them. Adblock Plus by Eyeo GmbH (Wladimir Palant) is used by many millions of people and yet it is a glaring example of an unethical developer who created an ad blocking extension which allows ads by default. For larger entities, Eyeo GmbH charges advertisers 30% of the revenue from Adblock Plus users who click the ads, so not only does Adblock allow ads, it's also spying on its users. Giorgio Maone, the developer of the very popular NoScript add-on, engaged in similar chicanery a while back.
  • Automatic update mALwarE install. Automatic checking for add-on updates is fine, but always disable automatic installation of updated add-ons. Before updating an add-on, read the version history to see what has changed and make sure the privacy policy, if there is one, remains strong. The problem with automatic add-on updates is that a developer may decide to monetize their work at any time and without warning, or sell their extension to an unethical party such as the developer of Stylish apparently did. Ingo Wennemaring, the well liked developer of the once popular and much loved All-in-One Sidebar add-on, warned about this in a blog post:

It was always very important for me to be honest and fair to the users. I had very good offers to sell the extension, but I didn't want to see that AiOS turn into adware or spyware.

CSP: The non-bug bug

Another reason to install as few extensions as possible has to do with Content Security Policy (CSP) and HTTP header modification. Some extensions, such as uBlock Origin, uMatrix, Canvas Blocker, etc., can modify HTTP headers in order to do what ever it is they need to do. The problem here is that there's a rather critical bug in Firefox that remains unaddressed, the result of which is that only one extension can modify a given HTTP header and this can break the functionality of other extensions which attempt to modify the same header. What this means for users is that, for example, arbitrary JavaScript may run on a website even if you have scripting disabled with something like uBlock Origin or uMatrix.

There's a few things you can do to minimize the problem: 1), don't install more extensions than necessary, 2), disable any unneeded CSP related options in an extension, 3), check if an extension uses CSP prior to installing it with the Extension source viewer add-on (you can do this by searching the code using !content-security-policy), 4), when starting Firefox, go immediately to the add-on page (about:addons) and disable any critical extensions that use CSP, then re-enable them. For example, the most important add-on to me is uMatrix, therefore when i start Firefox i disable uMatrix and then re-enable in order to be sure that it takes precedence over any other add-on that uses CSP. The last extension that you enable is the one that will have priority regarding CSP header modification.

To learn how you can disable unnecessary CSP related options in some of the add-ons listed here, see the Extensions section of the 'ghacks' user.js wiki.

For more, see the sticky: unofficial: the extension csp header modification game issue on the 'ghacks' user.js repository. Also please vote for the following issues on Bugzilla: 1421725 - finalize how changing headers should work and 1477696 - webExtension: webRequest.onHeadersReceived: accidentally overwriting header from other extensions. You can also gripe to Mozilla about this without having to create an account.

Add-ons

Add-ons are tagged with either [enhancement] or [privacy/security] in order to identify their primary role.

0T Reverse Image Search by ZcnS [enhancement]

0T Reverse Image Search is a privacy friendly add-on used to find different versions of a given image using 3rd party services such as TinEye. Reverse image searching is a great way to find higher resolution versions of an image or to find when an image may have first been published to the web, the latter of which can be beneficial for researchers.

CanvasBlocker by kkapsner [privacy/security]

CanvasBlocker blocks or fakes 'Canvas' which is a JavaScript API used to draw graphics on-the-fly. Canvas poses a substantial threat to privacy in that it can be used to fingerprint the browser.

Caveats: For advanced users. Will likely break some sites until settings are adjusted.

ClearURLs by Kevin R. [privacy/security]

ClearURLs replaces Neat URL as my preferred link cleaner. ClearURLs removes many tracking parameters from links you click, such as the Google utm_* garbage which is used to track where you go on the web. Unlike all of the other link cleaners i've seen and used, ClearURLs doesn't include a static list of parameters, nor does it have any options or whitelist that you need to mess with. This neat little extension pulls a file from the developers GitLab repository which negates having to update the extension when there's a change to the list of parameters. Though i was sure i was going to miss the ability to whitelist certain domains, i have yet to see anything break because of this extension.

CSS Exfil Protection by Mike Gualtieri [privacy/security]

CSS Exfil Protection prevents a certain CSS exploit that can be used to steal data from webpages.

Caveats: Could potentially break some websites, though it is easy to disable the add-on from its toolbar icon.

Dark Background and Light Text by Mikhail Khvoinitsky [enhancement]

Dark Background and Light Text replaces Dark Reader as my preferred add-on for darkening the entire web. These 'darkify' add-ons, of which there are many, change the colors used by all websites to a darker theme and this one seems to be the best of them.

Caveats: All of these 'dark web' add-ons fail miserably in some cases and this one is no exception, however it seems to work better overall than all of the others i've tested, and i've tested many. Also it offers a few different styles that can be assigned to specific websites when the default style fails.

Extension source viewer by Rob W [enhancement]

Extension source viewer is a handy and well thought out utility to quickly view the source code of a Firefox extension right from the Mozilla add-ons website without having to download and unpack it manually. The extension has the ability to search the contents of the files in the source code by prefixing the search with '!'.

Caveats: For advanced users.

FireMonkey by erosman [enhancement]

FireMonkey is a lightweight utility used to inject JavaScript and/or CSS styles into pages. Unlike Greasemonkey and other add-ons of this type, FireMonkey respects your privacy.

Caveats: For advanced users. Installing user scripts is a security and/or privacy risk. While this holds true for extensions as well, user scripts are generally not scrutinized to the degree that extensions are when they are download from Mozilla.

First Party Isolation by freddyb [privacy/security]

First Party Isolation simply toggles the privacy.firstparty.isolate preference. First Party Isolation, or FPI, is a Firefox privacy feature which plays a very important role in preventing browser tracking and fingerprinting.

Caveats: Could potentially break some websites, though it can be quickly toggled off by clicking its toolbar button.

Flagfox by Dave G [enhancement]

Flagfox is a neat utility that adds an icon to the address bar which represents the flag of the country in which the web server is located. When the icon is right-clicked, a context menu is revealed with many more tools, such as a WHOIS lookup, URL shortening services and more. You can also add your own services.

Caveats: If you choose to display the menu icons, they are not stored locally and have to be fetched the first time you open the menu which some might see as a privacy issue.

HTTPZ by claustromaniac [privacy/security]

HTTPZ is a very simple install-it-and-forget-it add-on that attempts to redirect all all HTTP (insecure) traffic to HTTPS (secure).

Link Text and Location Copier by William Groenendijk [enhancement]

Link Text and Location Copier allows to copy formatted text and a link for a webpage in various ways, plus you can define your own templates. You can also paste content as Rich Text, meaning you can paste the title of a page and its link directly into the visual WordPress editor for example.

LocalCDN by nobody42 [privacy/security]

LocalCDN, a fork of Decentraleyes, is a must-have privacy enhancing add-on that has the additional benefit of decreasing the load time for many websites which depend on 3rd party Content Delivery Networks (CDN) for various functionality. It accomplishes this by storing and loading several common JavaScript resources locally instead of having to fetch them from the server. The developer is also beginning to include common fonts with the add-on including Font Awesome which is widely used to display various icons.

Caveats: Could potentially break some websites, though this seems to happen very rarely in my experience, plus it's easy to white-list any affected domains.

Mark-It by Matt [enhancement]

Mark-It is a simple and handy add-on that replaces your new tab page with one that allows you to write notes in markup format.

Maximize All Windows (Minimalist Version) by ericchase [enhancement]

Maximize All Windows (Minimalist Version) does one thing and does it well, and that is to make sure the Firefox window starts in a maximized state. If you typically maximize Firefox and you have privacy.firstparty.isolate enabled, you may be annoyed when it fails to remember its state after a restart. This add-on solves the problem, but be aware that Firefox may be far more vulnerable to fingerprinting as a result (this is due to various window dimensions, not the extension).

mozlz4-edit by Siarhei Kuzeyeu [enhancement]

mozlz4-edit allows one to edit, format and otherwise manipulate several types of compressed files including the search.json.mozlz4 file which is where Firefox stores all of its search engine plugins.

Caveats: For advanced users.

Privacy Oriented Origin Policy by claustromaniac [privacy/security]

Privacy Oriented Origin Policy (POOP) helps protect your privacy by preventing Firefox from sending Origin headers, though how it works is configurable.

Caveats: For advanced users. May break some websites, though it is easily disabled and sites can be whitelisted. There is a lengthy discussion about what led to the development of this add-on on GitHub if you're interested.

Privacy Redirect by Simon Brazell [privacy/security]

Privacy Redirect redirects requests to several privacy-hating platforms to privacy-friendly alternatives. YouTube videos, including embedded, can be redirected to several alternatives, as can Twitter, Bibliogram and Google Maps requests.

Caveats: Sometimes the requested alternative service may be overloaded or down, however you can always switch to another provider very quickly from the toolbar icon.

Redirector by Einar Egilsson [enhancement]

Redirector automatically redirects selected pages, links and more to another resource of your choosing. For some examples of how you can use Redirector, see the Redirecting this to that section of the Firefox Tweaks and Fixes and Styles and Things page.

RSS Preview by Aurelien David [enhancement]

RSS Preview simply displays a styled and formatted version of news feeds like Firefox used to do before the geniuses at Mozilla removed it. In addition it has an option to provide your own CSS.

Scroll Up Folder by Bruce Bujon [enhancement]

Scroll Up Folder adds an icon in the address bar that, when clicked, opens a list of the segments of the current document address. Clicking the list items makes it really easy to navigate up to a higher level of the address without having to manually edit it.

Site Bleacher by wooque [privacy/security]

Site Bleacher automatically removes cookies, local storage, IndexedDB storage and service workers. It is not perfect, but given the limitations of the Web Extension API and Mozilla's foot-dragging in fixing its problems, it is the only add-on at this time that automatically cleans IndexedDB and Service Workers storage automatically on a tab by tab basis.

Caveats: May break some websites, however the add-on includes a whitelist.

Skip Redirect by Sebastian Blask [privacy/security]

Redirects sometimes happen when you click on a hyperlink expecting to go directly to the destination and, instead, your request is passed through an intermediary. Redirects are often used to track your browsing history or display ads before you are forwarded to the target domain. Skip Redirect simply tries to bypass this annoying behavior. I would suggest keeping the notification enabled when Skip Redirect does its thing as this makes it easy to troubleshoot a problem.

Caveats: May break the functionality of some websites in which case they can be added to a whitelist.

Smart RSS Reader by zakius [enhancement]

Smart RSS Reader is a 3-pane news feed reader and a pretty good one at that. It hasn't been around all that long and so there's some little niggles with it and it's missing some features, but it functions quite well as a basic reader. The developer is very friendly and open to suggestions.

Stylus by Armin Sebastian [enhancement]

Stylus is used to write, store and apply custom CSS styles to websites, or even the entire web if you wish. Though you can use FireMonkey for this, working with Stylus is much nicer. Note: Do not use Stylish, a similar add-on which the developer sold to an unethical party.

Toggle Fonts by Manuel Reimer [enhancement]

Toggle Fonts provides a simple toggle switch that forces all websites to use your preferred font settings as set in Firefox preferences.

Caveats: May occasionally break how a website is looks, but the add-on is easily disabled by clicking its toolbar icon. Only dictates what fonts a webpage can use; it does not prevent the downloading of fonts.

uBlock Origin by Raymond Hill [privacy/security]

uBlock Origin is a superior content filter (or firewall, if you like) that can replace several other content/ad blockers including Adblock Plus/Edge, NoScript, etc.. It is capable of using the same filter lists as Adblock Plus/Edge as well as many more that they cannot. Two of the most welcome differences with uBlock Origin is that it does not slow page loading to any noticeable degree and it uses less memory then the competition. Another major advantage is that it can block both 1st and 3rd party requests for images, scripts and frames when configured to use its advanced mode. See my Firefox Configuration Guide for Privacy Freaks and Performance Buffs article for more information regarding uBlock Origin. Lastly, use only uBlock Origin by Raymond Hill and not any other ripoff.

Caveats: For advanced users. As with any content filtering extension, uBlock Origin has the potential to break website functionality until it is configured correctly.

uMatrix by Raymond Hill [privacy/security]

uMatrix is another powerful content blocker by Raymond Hill and though it is similar to uBlock Origin, it offers more granular control like blocking cookies, CSS, images, plug-ins, scripts, XHR, frames and more. You can use uMatrix and uBlock Origin together. See my guide, Firefox Configuration Guide for Privacy Freaks and Performance Buffs, for further information.

Caveats: For advanced users. As with any content filtering extension, uMatrix has the potential to break website functionality until it is configured correctly.

Web Archives by Armin Sebastian [enhancement]

Web Archives makes it easy to find archived version of webpages. It is fairly configurable, though it does not have an option to add your own archive resources, nor does it have an option to send a webpage to an archive, however i find the latter unnecessary since the archive sites i use allow you easily archive a page if one isn't isn't found.

Troubleshooting add-on related issues

See Firefox Tweaks and Fixes and Styles and Things.

Listing removed add-ons

While i'm sure there's a more geeky way of listing extensions which one has removed, this one works for me: In your Firefox profile folder, navigate to /extensions/staged and there should be folders with the names of the removed extensions. You can delete this folder if you like.

Doing it without an add-on

The fewer add-ons you install, the better, and there's a lot of things you can do to customize Firefox without add-ons.

Enhancing privacy and security

See: Firefox Configuration Guide for Privacy Freaks and Performance Buffs and The Firefox Privacy Guide For Dummies!

More tweaks

See: Firefox Tweaks and Fixes and Styles and Things

Giving back

If you like an add-on, or any other free and open source software, please donate to the developer. Trust me when i tell you that most developers of free software usually receive little or nothing for all the hours of hard work and support they provide. Developers are usually very appreciative of a donation regardless of how small it may be.

Recent changes

This list contains only the most recent changes

  • removed 'Disable Tab Detach' add-on - not needed since FFv74
  • replaced 'Feed Preview' add-on with 'RSS Preview'
  • minor edits and clarifications

54 thoughts on “Firefox Extensions - My Picks”

    1. hi Dan – regarding privacy i think TM is next in line after FM, however regarding functionality it appears GM offers the most and it’s the one recommended by the ‘ghacks’ crew since one or more of their privacy scripts depend on it (more info here)

          1. If I may ask, what scripts do you use?

            On greasyfork.org it’s a mess of scripts for kid’s games. A useful script in there is like finding a needle in a hay stack.

    1. i would advise against any security/privacy extension that is domain specific – my thinking here is, what’s the point of sanitizing google if you allow everyone else to track you?

      if you use uBlock Origin and/or uMatrix, you can filter or block any domain you want – with uBlock you can subscribe to a variety of filter lists that also protect against google and other domain tracking

      lastly, i would advise against using any google services directly – if you want to use their search engine, consider doing so through a proxy, such as DuckDuckGo, Startpage, etc. (there are many) – if you do use google directly, at least disable cookies and JavaScript for their domains

    1. as far as privacy and tracking, i believe it’s useless – all it seems to do is hide page elements (and only temporarily) which i assume it does with CSS – it doesn’t prevent resources from being downloaded

        1. i prefer uBlock and uMatrix, but it’s a personal choice – in my case uBO (and uM to an extent) is mandatory, so i see NS as largely redundant, plus i’m a fan of simplicity and don’t care for any “suite” software – also the NS developer pulled some very unethical crap a while back

          that Snowden recommends NS carries little weight in my book – has he compared it to uBO/uM? if you’re using the Tor browser, then yes, you’ll be using NS since it comes bundled with it

          that said, NS may offer some additional protection against XSS, but JS, malware and CSRF are all covered by Firefox and/or uBO/uM with the proper lists enabled

  1. Useful collection on extensions! I have it linked to go over more carefully – there were a few I have never seen before, including “Toggle fonts” which I have already installed:-) and ‘Site Bleacher’ which I want to study more carefully as a replacement for some add-ons I already use.

    One that I find very useful is: “Drag-Select Link Text” by Kestrel

    It’s a productivity add-on which lets you select/highlight text within a link. This has been a personal FF annoyance of mine for too many years and the extension has worked flawlessly in the many months I’ve used it.

    1. re: Site Bleacher – it’s the only cleaner i’m aware of that can remove IndexedDB storage, other than something like Temporary Containers, but that creates new problems

      re: Drag-Select Link Text – press the Alt key while dragging the cursor over a link – you can do this even in the middle of a link

        1. hi Ray – Forget Me Not, and all other cleaners with the exception of Site Bleacher, only clean IDB storage on browser start, close, or manually – Site Bleacher is the only one i know of that cleans automatically per-domain

          maybe one day, far far away, Mozilla will FINALLY improve the WebExtension API to allow proper auto-cleaning of IDB… maybe (not holding breath)

          thanks for mentioning though :)

          1. I would use Site Bleacher, but it doesn’t offer enough options for whitelisting, etc. I’m actually looking for an addon that clears indexedDB manually. Got any recommendations? I used to use StoragErazor, but that appears to no longer work for v65 and up.

            I do use Site Bleacher on Chromium though due to the lack of options there.

            1. hi Ray – you can whitelist sites with Site Bleacher, though i suspect you already know this

              as for alternatives for manual cleaning, search AMO for ‘indexeddb’ – there are a few – also see if Cookie AutoDelete can do IDB

              just know that only SB will auto-clean by domain – all others will only clean manually or at browser start/exit

  2. Follow-on to my post from 6/27/16: The End is near. XUL extensions end in August for the ESR branch of FF — which is where you have had to be for awhile now in order to continue using them. (And we’ve already seen where you had to revert Greasemonkey back to v. 3.17, in order to retain the use of many existing scripts. Even the possibility of that reversion became much more difficult, outside of ESR.) Every other discussion of extensions or scripts now becomes tantamount to rearranging deck chairs on the Titanic. I read the blog from the developers of the excellent DownThemAll extension, who stated that the replacement APIs are **feeble** in comparison to what was in place before, very much calling in to question the future of such extensions, and pointing the way towards these developers simply quitting altogether. And I take them at their word. This is all supposedly in the service of browser security, but then you really have to ask “At What Price, Security ?|

    1. thanks for the comment Gene

      i suspect there are others besides myself who have become disillusioned with Firefox – i’ve been using it since before the 1.0 stable release and, for a long time, enjoyed watching its growth – at this point however, the only reason i still use it is because there is nothing else out there that can match its functionality given its extensibility and Google Chrome is out of the question – and actually i don’t use FF, but rather Waterfox which will apparently continue to support XUL extensions into the foreseeable future – the problem with that is, although all is ok now, the developers of the XUL extensions who can’t port their work to web extensions because of the feeble API, aren’t going to continue to develop their extensions

          1. Icecat is a fork I had not previously heard of, but I’ll check into it.
            I’m continuing to use the final “5290 / Legacy” release of Portable FF — because the functionality provided by certain extensions is absolutely essential to my use of a browser — and will continue using it to the *bitter end*, whatever that may be. (Quite possibly a comparable situation to my use of Win 7, which supports some key software that the W-10 I happen to despise does not.) At some point, I suppose that stance could become untenable. Already some hints on that: e.g., a leading VPN product reports that it requires FF 57 or later. But I’ll cross that bridge when I must.

            Others I correspond with on some mailing lists and online forums, both here and abroad, are in agreement on this. I’ve had major arguments about the prior XUL extensions with the proprietor over at portableapps.com, who maintained the FF portables and others. He’d say things like, “Well, that extension only had 50K users.” Even if that were true, the dude just does not get it ! And, from what I saw of the crop of current, suggested “instead of” extensions, they are simply pathetic and woefully inadequate.

            One partial silver lining here is that we may be able to cope by doing something that is arguably necessary, anyway. There is no reason why we must be restricted to one browser, particularly since the portable editions make this coexistence a lot easier. The OS is minimally aware of their presence, and so they should not clash. Depending on which computer it is, I run a mix of FF, Opera, and Chrome. (IE too. Although I never could stand it, sometimes you just can’t avoid having to use it.) Either due to poor web-page design, errors, or browser-centric formatting, it often happens that a particular page will not display or print properly in one or more browsers, but will in another. All too often, text will be super-imposed over other text making it unreadable, or will run off of the margins, now matter how you adjust your screen, etc. So, having alternatives becomes a virtual necessity. Even if their functionality begins to erode, the longer I can continue to use those FF extensions — at least in some places — the better.

            1. I’m continuing to use the final “5290 / Legacy” release of Portable FF — because the functionality provided by certain extensions is absolutely essential to my use of a browser

              i thought the same thing, but i managed to find WebExtensions to replace nearly all of the XUL add-ons – if you want i can try and find replacements for you if you tell me what you need

              Already some hints on that: e.g., a leading VPN product reports that it requires FF 57 or later

              that sounds strange – no VPN should have any dependency on any browser since the browser is not in the VPN loop, unless you’re referring to a VPN browser add-on, in which case i wouldn’t recommend that – if you’re looking for a VPN, have a look at AirVPN – that’s my referral link which helps me out a little bit – also NordVPN – i’m just testing out their service now

    1. in the interest of privacy, i would personally recommend against doing this unless you’re going to use your own server, unless you find a service with a strong privacy policy and will encrypt your data

    1. fingerprinting by analyzing keystroke timings doesn’t sound like a far-fetched idea, but this attack relies on JavaScript which means it wouldn’t work for sites where JS is disabled (and it should be disabled globally by default in my opinion)

      also, unless the extension randomizes the dwell and gap times, i would think that its effectiveness would be very limited since your dwell and gap times are now perfectly consistent and therefore quite unique assuming that few people use the extension (currently only 20 for Firefox), however even if a lot of people used it, you could still be easily fingerprinted if you set the timings to something other than the defaults – assuming the min and max values are 0 to 99, and assuming i’m calculating correctly, that allows for 9800 unique possibilities (excluding the default of 50-50) and if the max were 999, then 998,000 possibilities (excluding the default of 50-50)

      even given the above, i’m not sure it’s a bad thing, but i think you would really want to change the dwell-gap times once in a while

  3. I last posted here on 6/6/15 (above). Awhile ago, when the switch to semi-mandatory Signed extensions came along, many developers (such as for the excellent ‘DownThemAll’) started making noises about dropping out entirely. However, it turned out that we users still had the option of circumventing this issue via a setting in About:Config.

    I don’t know how many of you are aware of it, but there is an even bigger sea change fast approaching, and it looks to be HUGE. Check out the following:

    http://www.zdnet.com/article/new-versions-of-firefox-prepare-for-its-biggest-change-ever/#comments-1e50e84a-27cb-4d26-b723-1f3fd3ffbe05

    and a discussion thread I started in response

    http://portableapps.com/node/54471

    So, if you didn’t know before now you do, and won’t be shocked when this occurs. A whole lot of our favorite extensions may simply be going away, for good. Some very major ones like Greasemonkey may avoid that, adapting with special updates. I don’t know what the implications may be for various scripts we may be running under GM . . . .

    If you have some encouraging words to add — maybe some positive details that have not yet come to light — I’d be very glad to read them.

    1. hi Gene – i’m aware of E10S and also what appear to be other major changes coming regarding extensions

      i don’t know how this will pan out, but, to be honest, i’m ready to get of the FF bus anyway and maybe this will be the push that does it

      however this seems to suggest that there is a method to disable the feature…

      If we run into issues, we can slow the roll-out, pause it, or even disable E10sS for those who got it.

  4. So to clarify, for the Clean Links addon, Event Delegation Mode is purely cosmetics and enabling/disabling it doesn’t affect the fact that links will always be cleaned when entered into the browser or clicked to go to that page? Is the only reason they want to disable it is that you want to see the clean version of links just because it looks nicer? Lastly, were you able to convert the garbage fields from Pure-URL addon to rules for Clean Links and if so, can you share them?

    Garbage fields from Pure-URL:

    utm_source, utm_medium, utm_term, utm_content, utm_campaign, utm_reader, utm_place, ga_source, ga_medium, ga_term, ga_content, ga_campaign, ga_place, yclid, openstat, feature@youtube.com, fb_action_ids, fb_action_types, fb_ref, fb_source, action_object_map, action_type_map, action_ref_map, ref@facebook.com, fref@facebook.com, hc_location@facebook.com, ref<ref_@imdb.com, src@addons.mozilla.org

    Thank you.

    1. actually the DOM traversal mode is cosmetic because it allows you to see what links are rewritten before clicking on them, but yes, basically you are right in that links are cleaned in either mode, however Event Delegation Mode is recommended by the dev

      i haven’t bothered incorporating the Pure URL garbage fields and, so far, haven’t seen a need to

  5. I noticed that you recommended Shim Storage, then it was replaced with HTTP UserAgent, which was eventually dropped because development was abandoned. Do you still use Shim Storage? If not, how do manage DOM storage (if you bother)? For example, uMatrix clears DOM storage of the webpage if the cookies was blocked, but if it isn’t the storage is created–do you simply let it persist throughout the session? I don’t feel comfortable with that (I have cookies and cache deleted every 30 minutes), but haven’t found a way to clear DOM storage throughout the session.

    I’m also interested in the specifics of your Clean Links settings–do you mind posting a full screenshot of it? I’m not technical or patient enough to personalize my own settings and it would help a lot if I can use your specific configuration and then remove or add things as needed if things break for me (couldn’t find much information of other people’s configurations because it doesn’t seem to be a popular addon). Have you configured it to at least replace the defaults of Pure-URL addon?

    1. hi Yuri – no, i don’t use Shim Storage and actually development has been resumed on HTTPUserAgent Cleaner (update: and then removed again) – although i think this extension is a worthwhile addition, there’s 3 reasons i’m no longer using it; 1), i wrote the English manual for it and found it very difficult (to put it mildly) to work with the dev because of the language barrier (he can barely understand/write EN) and his lack of helpfulness in providing answers to questions, 2), because it’s yet another extension that people will have to fiddle with when something breaks and 3), given the capability of uMatrix and the other add-ons listed here, i think it’s usefulness is somewhat limited, particularly as far as spoofing certain system and browser details – for example, spoofing your display/browser resolution will often render a page that will look horrible

      regarding uMatrix and DOM storage, i disallow cookies by default (as per the guide) and only allow them for the few domains i visit were they are actually needed – all of this is dumped when the browser exits as per my settings privacy.clearOnShutdown.* – so no, i don’t clear at regular intervals, but i will occasionally do a manual clear with the built-in history manager (selected are: cookies, cache, active logins, offline website data and site preferences)

      regarding Clean Links, the default settings are OK – the only real thing to be aware of is whether you enable Event Delegation Mode (it is enabled by default) – if you do not enable it, then you can take advantage of real-time link highlighting which i much prefer, however the dev has told me that the code driving this mode is not maintained, so i use the default mode (i’m trying to persuade him to work on this) – Redirect Watcher, HTTP Observer, CopyLink Controller and Link Tracking are also enabled

      Highlight Cleaned Links, Highlight Style and Replay Delay are all either of limited use or not used at all when running in Event Delegation Mode

      i think it is important to understand how to add strings to the Remove From Links regular expression, as well as what to look for in a URL that can be removed – unfortunately, learning regular expressions will present a lot more hassle than it’s worth for the average user and so i’d like to see a UI incorporated for building them where no knowledge of RegEx is necessary

      hope that answers your questions

  6. Can you share your complete settings (screenshot would be easier) for Clean Links addon? I used to use your recommendation of Pure-URL with its default settings because I haven’t had the time or knowledge to configure it to find a good balance between privacy and usability and apparently Clean Links is better than Pure-URL in every way. Cheers.

    1. i have event delegation mode enabled – all of the rest is personal preference

      so event delegation mode means that links are not rewritten (cleaned) when the page loads, but rather only when you actually click on a link that needs to be rewritten

      i much prefer the other mode, but the developer says the code driving it is not maintained – the non-event mode rewrites links at page load time and therefore you can make use of the CSS (highlight style) to give a visual cue as to what links on the page were rewritten

      if you need help with anything else, let me know

  7. For some time now, I’ve been using these Greasemonkey scripts: Anti-Adblock Killer 8.1, AdsBypasser 5.24.0 (gets around the very annoying Ad.fly, Linkbucks, etc. pages), and Ad Host Cleaner 1.3.4 — the last version I could find of this. Its motto was “Bye Bye Download Accelerator/Manager”, and for awhile it thwarted file hosts that wanted to force you to accept an .Exe file version each time, rather than a standard .Rar piece of an archive. Of course, this is very bad practice, easily giving a free ride to malware or who knows what. However, Ad Host Cleaner seems to no longer be effective. I was hoping you might know of some later script or extension (for FireFox or for Chrome) that still provides control over this ?

    1. hi Shadylayman – funny you mention uBlock as i looked at it a short while ago, but too quickly to realize it’s advantages

      uBlock will certainly replace both Adblock Edge and Element Hiding Helper as it is a much more capable extension in every way

      thanks for mentioning it :)

      regarding HTTP UserAgent cleaner however, that one stays – it covers a whole lot more than just the user-agent string

Leave a Reply

Your email address will not be published. Required fields are marked *