In addition to adding "-ProfileManager" to the run command, you should also add "--no-remote" so you can run (for example) the research and the webdev profiles at the same time.<div><br></div><div>Other than that, I would add the following for web development:</div>
<div>CodeBurner for Firebug</div><div>ColorZilla</div><div>Firecookie</div><div>Html Validator</div><div>View Source Chart (I don't use it much anymore, it was handy until I learned more about Firebug)</div><div>XPather</div>
<div><br></div><div>I did have Tamper Data, but it doesn't appear to be updated.</div><div><br></div><div>General addons, I like Tab Mix Plus, Hide Tabbar, "Open link in...", and Image Zoom. I hate the default behavior of tab handling in Firefox, TMP gets it closer. Hide Tabbar is good if you're paranoid about people seeing what you have open. You can have a bunch of tabs open, but still hide the tab bar so they only see the active tab. "Open link in..." gives you control over where to open each link. So if you let Firefox open tabs/windows however it sees fit, and you're at a site that you know will open a link in a new window, you can right-click the link and tell it where to open. Not sure if Image Zoom works on Linux.</div>
<div><br></div><div>I'd also add CustomizeGoogle for the research profile. You probably don't need it for the paranoid profile since you have that locked down pretty tight.</div><div><br></div><div>For search engines, I have Wikipedia, Delicious, Merriam-Webster, and Bugzilla for work.</div>
<div><br><br><div class="gmail_quote">On Mon, Apr 26, 2010 at 1:45 PM, Josh More <span dir="ltr"><<a href="mailto:MoreJ@alliancetechnologies.net">MoreJ@alliancetechnologies.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Hmm.<br>
<br>
Perspectives looks very interesting, but hasn't been updated to the current Firefox, so I can't play with it. (Same with Cert Alert.)<br>
<br>
Chungwa is Taiwanese.<br>
<br>
The CNNIC is an interesting idea. I'm going to play with that.<br>
<div class="im"><br>
<br>
<br>
-Josh More, CISSP, GIAC-GSLC, GIAC-GCIH, RHCE, NCLP<br>
<a href="mailto:morej@alliancetechnologies.net">morej@alliancetechnologies.net</a><br>
515-245-7701<br>
<br>
________________________________________<br>
</div>From: <a href="mailto:cialug-bounces@cialug.org">cialug-bounces@cialug.org</a> [<a href="mailto:cialug-bounces@cialug.org">cialug-bounces@cialug.org</a>] on behalf of Matt Stanton [<a href="mailto:inflatablesoulmate@brothersofchaos.com">inflatablesoulmate@brothersofchaos.com</a>]<br>
Sent: Sunday, April 25, 2010 14:31<br>
To: Central Iowa Linux Users Group<br>
Subject: Re: [Cialug] Firefox for paranoid people<br>
<div><div></div><div class="h5"><br>
I can think of a couple of things you might be interested in, from a<br>
paranoid browser standpoint... First, the latest firefox (3.6.x) has a<br>
new certificate authority that is controlled by the chinese government.<br>
I disable its ability to identify anything whatsoever. The CA is for<br>
CNNIC (I also disable Chunghwa, simply because it looks chinese).<br>
Deleting the certs does you no good, since FF will just re-add them.<br>
<br>
Second, there is a browser add-on called 'perspectives', which adds<br>
another layer of security for people who actually pay attention to<br>
browser warnings. The perspectives network has a list of sites and<br>
their certificates, and checks the certificates/sites on a regular basis<br>
from several discreet network locations to make sure that they all come<br>
back the same to each location, and they come back the same each time it<br>
checks. It will pop up a warning if different locations come back with<br>
different information, or if the information has changed recently. I am<br>
no security expert, but I believe this gives you a best-guess that a<br>
site is not being hijacked by a man-in-the-middle attack, or that a<br>
large-scale attack has changed the authority of the site internet-wide.<br>
While both are probably extremely rare, it would identify a rogue CA if<br>
you paid attention.<br>
<br>
On 4/25/2010 2:04 PM, Josh More wrote:<br>
> Since this has been a popular project in the past, and I just spent the weekend building myself a new laptop, I thought I'd share my firefox config with everyone.<br>
><br>
> I started with my basic add ons:<br>
> * Adblock Plus to prevent those annoying ads (and ad-based malware infections)<br>
> * Neo Diggler to give me a quick way to clear the location bar and give me the ability to add custom stuff<br>
> * No Script to prevent scripts from running. I did a quick whitelisting of the sites I use a lot (Google, Amazon, Alliance, LinkedIn, etc)<br>
> * Web of Trust to give me a hint before I click on a link.<br>
> * Tiny Menu to maximize screen real estate. (I love me the tiny laptops)<br>
> * TorButton for quickly accessing The Onion Router (requires installing additional software to utilize)<br>
><br>
> Sadly, LongURL is not supported on the new Firefox yet.<br>
><br>
> I restarted Firefox to activate everything and configured the plugins the way I like. I also customized the Nav bar and moved everything up to the Menu bar that TinyMenu made nice and small. Then I used the View menu to turn off Navigation and Bookmarks.<br>
><br>
> Then I went into Preferences->Privacy and set Firefox to "Never remember history" and suggest "Nothing". I also cleared my history that was created thus far. In Preferences->Security, I told it to never remember passwords, block reported attack sites, web forgeries and add ons. (By not remembering passwords, I render myself less vulnerable to risk from theft of my profile directories, but more vulnerable to keyloggers... it's a good tradeoff to me.)<br>
><br>
> I then shutdown Firefox and went into ~/.mozilla/firefox. I did a cp -a of my profile directory to other names:<br>
><br>
> cd ~/.mozilla/firefox<br>
> cp -a blahblah.default research<br>
> cp -a blahblah.default secure<br>
> cp -a blahblah.default webdev<br>
><br>
> Then I edited profiles.ini and copied the four top lines of [Profile0] to new blocks of Profiles 1 through 3. I edited the Name and Path to reflect each of my new profile directories (research, secure, webdev). Then I edited the FIrefox launcher and appended "-ProfileManager" to the "run command". This way, when I click on the little icon, Firefox will prompt me for the profile I want each time I launch it.<br>
><br>
> I then launched it and selected my "research" profile.<br>
><br>
> Here, I went back into Preferences->Privacy and told it to go ahead and remember history and make suggestions (as when I'm researching things, I often forget where I found things and what I searched on.) Then I installed the following add ons:<br>
><br>
> * Add N Edit Cookies for cookie manipulations<br>
> * HackBar for SQL injection fun<br>
> * PassiveRecon for exactly what it sounds like<br>
> * RefControl for mangling HTTP headers<br>
><br>
> Then I added the following search engines to the dropbox:<br>
><br>
> * Offensive Security Exploit Database<br>
> * Security Focus Vulns Search<br>
> * Security Wire Search<br>
><br>
> I'll probably add more as I play with it. I'm still not used to using this feature to search the deep web. (Wonder if one could be written to access our corporate wiki?)<br>
><br>
><br>
> Then it was time to restart Firefox and activate, set preferences, yada yada yada.<br>
><br>
> After that, I restarted to access the "secure" profile. Really, I should have named this one "paranoid". I went into Preferences->Security and turned on ALL warning messages. It's annoying to use now, but that's partly the point.<br>
><br>
> I set StartPage to my initial home page, using the "Generate Custom URL" feature on the site. Since I'm not storing any cookies at all, this is how it has to be done. I removed all search engines and added IxQuick HTTPS, Startpage HTTPS and Scroogle SSL. On the AddOn side, I added Force-TLS, though it really doesn't do all I'd like it to.<br>
><br>
> Lastly, I installed the Orange Fox theme, which is ugly and garish, but since I wanted a visual reminder that I was in the paranoid profile, it was exactly what I wanted.<br>
><br>
><br>
> After another restart I entered the webdev side. The fun new add ons here were:<br>
><br>
> * Firebug for tracing DOM and CSS issues, which I don't do much anymore, but it's still nice to have.<br>
> * FlashGot for massive download fun on <a href="http://archive.org" target="_blank">archive.org</a><br>
> * Greasemonkey for fixing stupid sites (and integrating with FlashGot to bypass trivial Javascript-implemented "security" checks)<br>
> * Live HTTP Headers for watching traffic in real time, when I don't want to launch a real proxy<br>
> * Web Developer for the same reason as Firebug<br>
><br>
><br>
> So, can any of you think of anything that I missed?<br>
><br>
><br>
><br>
> -Josh More, CISSP, GIAC-GSLC, GIAC-GCIH, RHCE, NCLP<br>
> <a href="mailto:morej@alliancetechnologies.net">morej@alliancetechnologies.net</a><br>
> 515-245-7701<br>
> _______________________________________________<br>
> Cialug mailing list<br>
> <a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br>
> <a href="http://cialug.org/mailman/listinfo/cialug" target="_blank">http://cialug.org/mailman/listinfo/cialug</a><br>
><br>
<br>
_______________________________________________<br>
Cialug mailing list<br>
<a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br>
<a href="http://cialug.org/mailman/listinfo/cialug" target="_blank">http://cialug.org/mailman/listinfo/cialug</a><br>
_______________________________________________<br>
Cialug mailing list<br>
<a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br>
<a href="http://cialug.org/mailman/listinfo/cialug" target="_blank">http://cialug.org/mailman/listinfo/cialug</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Tim<br>Required reading: <a href="http://bccplease.com/">http://bccplease.com/</a><br>
</div>