cross-posted from: https://lemmy.ml/post/282143

It is a better practice to make your own browser setups rather than following someone else’s setup blindly IMO. There are several guides for Firefox that just suggest prefs they copy-paste from arkenfox’s user.js. As for Chromium based browsers, you will only rarely find some actually good recommendations. This guide will first take you through how you can make your privacy and security friendly setup for Firefox and then, recommendations for Chromium browsers (+my personal browser extension recommendations). The reason why I am writing this is that there’s just a lot of crap on the internet and I have wasted time with many of them when I was still new to all of this. So without further ado, let’s start…

For Firefox:

1. You should create a new profile in which you can comfortably use a custom user.js. Do NOT modify default profiles, keep them as backups.
2. Firstly, try arkenfox’s user.js without any modifications and see if you are comfortable with it, if not you should identify what’s making you uncomfortable with it and note down your problems somewhere (believe me, it makes the next step much faster). e.g.: some of you can have problmes with user_pref("media.eme.enabled", false); which disables DRM and can break sites like Spotify, Netflix etc.
3. Read arkenfox’s user.js, every word, it took me >2hrs and it was one of my best investments in 2020. The maintainers have explained almost everything in the comments, if you can’t understand something, just look it up on the internet or open a GitHub issue in arkenfox/user.js repository.
4. Create a seperate user-overrides.js in the same directory and make your own changes, firstly fixing your problems you identied in the 2nd step. e.g.: adding user_pref("media.eme.enabled", true); to the user-overrides.js to enable DRM
5. Once you are done doing this, append the contents of user-overrides.js to the arkenfox’s user.js (this is the simplest way to use arkenfox’s user.js with your own modifications)

You should definitely read https://github.com/arkenfox/user.js/wiki/3.1-Overrides and in fact, all the 3.x wiki pages. Here’s my own, updated, user-overrides.js(consider uploading it somewhere if you find it useful so that if anyone wants to use it after June 3, 2022, they can find it in the comments) for example. You can also use it for yourself if you wish, of course after reading it properly. It is a convenient setup IMO with optional hardening and some extra spice from Kellegram’s user.js(special thanks to him).
You might ask why did I suggest making a user-overrides.js instead of directly editing the user.js, I suggested so because Mozilla adds/removes/modifies prefs with updates and thus a new updated version of arkenfox’s user.js is also released every month after Firefox stable update. Using the user-overrides.js method, as suggested by arkenfox themselves, is a better idea. You can even use scripts provided by arkenfox if you follow this method.
Here are some general recommendations for Firefox users: make sure you put the firefox profile in an encrypted partiton, I am using Full disk encryption on my openSUSE Tumbleweed install, on windows you can use Bitlocker to encrypt a partition in which you will put your firefox profile. You should use the official flatpak on Linux for the sake of sandboxing and more control over the permissions. Consider NOT to use forks like Librewolf and such, I have usually observed them to be lagging behind the official stable releases of Firefox(I am hoping that they don’t lag behind too much anymore). On Android, use Firefox Nightly or the forks like Fennec F-droid if you want to modify about:config.

For Chromium-based Browsers: Even though you don’t have as much control over the configurations as you do in Firefox, you can still improve a few things in Chromium-based browsers.

1. From the Settings, disable any type of telemetry.
2. From the Settings, enable safe browsing, block 3rd party cookies, enable ‘Clear cookies and site data when you close all windows’(just whitelist the site you want to stay logged in in by adding them to ‘Sites that can always use cookies’), enable ‘Always use Secure connections’ and enable ‘Use Secure DNS’(and use DoH of your own choice)
3. Goto chrome://flags and do the following:
   • Set ‘SetIpv6ProbeFalse’ to ‘Enabled’
   • Set ‘Handling of extension MIME type requests’ to ‘Always prompt for install’
   • Set ‘Force punycode hostnames’ to ‘Enabled’
   • Set ‘Enable get*ClientRects() fingerprint deception’ to ‘Enabled’
   • Set ‘Enable Canvas::measureText() fingerprint deception’ to ‘Enabled’
   • Set ‘Enable Canvas image data fingerprint deception’ to ‘Enabled’
   • Set ‘Block insecure private network requests.’ to ‘Enabled’
   • Set ‘Parallel downloading’ to ‘Enabled’
   • Set ‘Strict-Origin-Isolation’ to ‘Enabled’
   • Set ‘Strict site isolation’ to ‘Enabled’
   • Set ‘Site isolation for Password sites’ to ‘Enabled’
   • Set ‘Reduce User-agent request header’ to ‘Enabled’
   • Set ‘Reduce the minor version in the User-agent string’ to ‘Enabled’
   • Set ‘Sanitizer API’ to ‘Enabled’

Chromium based browsers provide descriptions with these flags so make sure you read them. Also, note that you won’t find some of these flags in some Chromium based browsers, you can skip them in that case.
Here are some general recommendations: do NOT use Microsoft Edge(although Edge has some extra flags for security), Google Chrome, Opera and such, instead use Ungoogled Chromium, Brave Browser or even just vanilla Chromium. If you are on Linux, use Flatpaks for the sake of sandboxing and more control over permissions. On Android, use Bromite.

Extensions I recommend(read their descriptions on AMO and Chrome Webstore):

• uBlock Origin with Custom filters and Medium Mode
  • Must read: https://github.com/gorhill/uBlock/wiki
  • I recommend the following filterlists: Energized Basic, d3ward’s d3Host, jjjxu’s NSO Pegasus Blocklist and Actually legitimate URL shortener tool. You can also enable the filterlists provided by the extension alongwith these, notably the Privacy ones.
• Smart Referrer (Firefox only)
• Bypass Paywalls Clean
• Greasemonkey(Firefox) and Violentmonkey(both Chrome and Firefox)
• FastForward
• CanvasBlocker(Firefox only, only use it when you are not using resistFingerprinting pref in user.js/about:config)

Do NOT expect any revisions from my side as I will be deleting this account soon. I am hoping that the community will revise this guide from time to time in their own ways. I know that this is very time consuming but it is definitely worth it, this way you become self-reliant in your pursuit towards a more private and secure internet usage that is for you. Thank you for reading this guide, I hope this helps.