I think it should be considered to move applicaiton specific hardening to its ow…n repository.
Even if this happens or not, consider firefox as the default browser. Hardening might seem like a big undertaking, but it's not. There is a more maintainable way to harden mozilla applications, and that is to set policies. This allows more than just setting preferences. There are many useful macros to disable studies and/or telemetry. Ping and crash reports can also be disabled within the policy easily with preferences. To demonstrate the possibility of control and also the ease of maintainability, I want to present the following policy I created for firefox:
```
{
"policies": {
"Bookmarks": [
{
"Title": "Kicksecure",
"URL": "https://kicksecure.com",
"Favicon": "https://www.kicksecure.com/favicon.ico",
"Placement": "toolbar",
"Folder": "Kicksecure"
}
],
"DisableFeedbackCommands": true,
"DisableFirefoxAccounts": true,
"DisableTelemetry": true,
"DisableFirefoxStudies": true,
"DisableFormHistory": true,
"DisablePocket": true,
"DisableSystemAddonUpdate": false,
"EncryptedMediaExtensions": {
"Enabled": false,
"Locked": false
},
"ExtensionSettings": {
"uBlock0@raymondhill.net": {
"installation_mode": "force_installed",
"install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
}
},
"ExtensionUpdate": true,
"FirefoxHome": {
"SponsoredTopSites": false,
"SponsoredPocket": false,
"Locked": true
},
"FirefoxSuggest": {
"SponsoredSuggestions": false,
"ImproveSuggest": false,
"Locked": true
},
"PasswordManagerEnabled": false,
"PDFjs": {
"Enabled": false,
"EnablePermissions": false
},
"Preferences": {
"browser.contentblocking.category": {
"Value": "strict",
"Status": "locked"
}
},
"PromptForDownloadLocation": true,
"SearchEngines": {
"Default": "DuckDuckGo",
"PreventInstalls": true,
"Remove": ["Google", "Amazon"]
},
"SearchSuggestEnabled": false,
"StartDownloadsInTempDirectory": true,
"UserMessaging": {
"WhatsNew": false,
"ExtensionRecommendations": false,
"FeatureRecommendations": false,
"UrlbarInterventions": false,
"SkipOnboarding": false,
"MoreFromMozilla": false,
"Locked": true
}
}
}
```
What is done:
* Remove all sponsor junk
* Remove telemetry
* Remove studies
* Force install ublock origin and lock it
* Enable ETP in strict mode and lock it
* Remove mozilla recommending and shilling random stuff
* Disable scripting and permissions for pdf viewer
* Kicksecure default bookmark
* Privacy respectin search engine
* Disable drm
* And some other stuff, more can be added, possibilities are limitless
For this vast amount of settings, I would agree the policy file is very intuitive and human readable and brief and maintainable. It is also very solid, it provides more possibilites than just global preferences for firefox. We can control addons and stuff. A similar policy file can be maintained also for thunderbird. Kicksecure can lock security related settings this way too, like enforcing strong cipher, ssl etc. settings and locking them.
Locking settings results in this: the user can't change the setting in the browser, not in settings, not in about:config, nowhere, it is locked. Disabling the policy is the only way to get rid of our defaults, if we wish so.
Now, I already have some several suggestions for policies for firefox and thunderbird. I guarantee you they are all human understandable and reasonably brief to maintain. I suggest having a separate repository for ease.
I already suggest, we reconsider the default applications Kicksecure ships. My comments:
* Thunderbird - Already good, should stay
* Firefox - Should be included (doubles as a secure pdf viewer)
* Hexchat - Thunderbird has IRC, so why have this. Also, IRC is not common place, shipping a default application seems superfluous.
* Bitcoin - Ok, understandable, maybe, niche, but passable
* Electron - Superfluous since btc core is already present
* Monero - Passable, I guess, but not necessary, like bitcoin
* VLC - good, vital component for daily usage, should stay
* Some Office - Unsurprisingly, an office suite is probably more seeked by an average user than hexchat