[Cialug] Firefox for paranoid people

[Josh More]

Since this has been a popular project in the past, and I just spent the weekend building myself a new laptop, I thought I'd share my firefox config with everyone.

I started with my basic add ons:
* Adblock Plus to prevent those annoying ads (and ad-based malware infections)
* Neo Diggler to give me a quick way to clear the location bar and give me the ability to add custom stuff
* No Script to prevent scripts from running.  I did a quick whitelisting of the sites I use a lot (Google, Amazon, Alliance, LinkedIn, etc)
* Web of Trust to give me a hint before I click on a link.
* Tiny Menu to maximize screen real estate.  (I love me the tiny laptops)
* TorButton for quickly accessing The Onion Router (requires installing additional software to utilize)

Sadly, LongURL is not supported on the new Firefox yet.

I restarted Firefox to activate everything and configured the plugins the way I like.  I also customized the Nav bar and moved everything up to the Menu bar that TinyMenu made nice and small.  Then I used the View menu to turn off Navigation and Bookmarks.

Then I went into Preferences->Privacy and set Firefox to "Never remember history" and suggest "Nothing".  I also cleared my history that was created thus far.  In Preferences->Security, I told it to never remember passwords, block reported attack sites, web forgeries and add ons.  (By not remembering passwords, I render myself less vulnerable to risk from theft of my profile directories, but more vulnerable to keyloggers... it's a good tradeoff to me.)

I then shutdown Firefox and went into ~/.mozilla/firefox.  I did a cp -a of my profile directory to other names:

cd ~/.mozilla/firefox
cp -a blahblah.default research
cp -a blahblah.default secure
cp -a blahblah.default webdev

Then I edited profiles.ini and copied the four top lines of [Profile0] to new blocks of Profiles 1 through 3.  I edited the Name and Path to reflect each of my new profile directories (research, secure, webdev).  Then I edited the FIrefox launcher and appended "-ProfileManager" to the "run command".  This way, when I click on the little icon, Firefox will prompt me for the profile I want each time I launch it.

I then launched it and selected my "research" profile.

Here, I went back into Preferences->Privacy and told it to go ahead and remember history and make suggestions (as when I'm researching things, I often forget where I found things and what I searched on.)  Then I installed the following add ons:

* Add N Edit Cookies for cookie manipulations
* HackBar for SQL injection fun
* PassiveRecon for exactly what it sounds like
* RefControl for mangling HTTP headers 

Then I added the following search engines to the dropbox:

* Offensive Security Exploit Database
* Security Focus Vulns Search
* Security Wire Search

I'll probably add more as I play with it.  I'm still not used to using this feature to search the deep web.  (Wonder if one could be written to access our corporate wiki?)


Then it was time to restart Firefox and activate, set preferences, yada yada yada.

After that, I restarted to access the "secure" profile.  Really, I should have named this one "paranoid".  I went into Preferences->Security and turned on ALL warning messages.  It's annoying to use now, but that's partly the point.

I set StartPage to my initial home page, using the "Generate Custom URL" feature on the site.  Since I'm not storing any cookies at all, this is how it has to be done.  I removed all search engines and added IxQuick HTTPS, Startpage HTTPS and Scroogle SSL.   On the AddOn side, I added Force-TLS, though it really doesn't do all I'd like it to.

Lastly, I installed the Orange Fox theme, which is ugly and garish, but since I wanted a visual reminder that I was in the paranoid profile, it was exactly what I wanted.


After another restart I entered the webdev side.  The fun new add ons here were:

* Firebug for tracing DOM and CSS issues, which I don't do much anymore, but it's still nice to have.
* FlashGot for massive download fun on archive.org
* Greasemonkey for fixing stupid sites (and integrating with FlashGot to bypass trivial Javascript-implemented "security" checks)
* Live HTTP Headers for watching traffic in real time, when I don't want to launch a real proxy
* Web Developer for the same reason as Firebug


So, can any of you think of anything that I missed?



-Josh More, CISSP, GIAC-GSLC, GIAC-GCIH, RHCE, NCLP
morej at alliancetechnologies.net
515-245-7701