How to set up your browser for user privacy (Firefox, Brave, Edge, Safari, Chrome, Chromium, Icecat): a step by step guide for each browser

The title here is a bit misleading. We will indeed show you how to set up Firefox, Brave and Chromium to protect your privacy. We won’t show you how to set up Edge, Safari, Chrome or Opera to protect your privacy. Why not?

It’s impossible to protect your privacy on Safari, Opera, Chrome or Edge. Why not? It’s not a short answer but we’ve published a dedicated article to explain why not. Even a privacy cynic like myself was surprised by the results. I expected Safari and Opera to be salvageable even if Chrome and Edge were lost causes. Hélas, no.

Firefox

Firefox is often the first privacy-oriented browser that which occurs to a a privacy conscious individual. Careful though, while Firefox is not as intrusive as its other big competitors, especially Google Chrome, MS Edge or Apple Safari, which are more or less official spyware, there are some hidden gotchas. Still after applying a few tweaks, Firefox can serve as a nice compromise between privacy and usability. Indeed, Firefox might be the most adjustable and flexible of all the major ones browsers. So, let’s take a look at it.

First of all, browsers use telemetry. This seemingly benign word means that browsers track your online activity and collect data such as performance metrics. This feature is commonly justified by companies’ struggle to improve user experience. UX enthusiasts call it sympathizing with a customer, I call it what it really is – tracking.

To stay clear from Firefox’s (stalking) sympathizing with you, go to browser settings and choose Privacy & Security section.

Then scroll down to Firefox Data Collection and Use to make sure that telemetry is disabled.

Another important step in privacy configuration is to set up your default search engine. Firefox defaults to Google for financial reasons; Google pays them rather generous amount of money, around $400-$450 million annually, to keep their spying search engine as default. While I can understand Mozilla’s reason for such decision, I can’t understand the ones who mindlessly follow it without setting the default search engine of their own preference.

To opt Google out, go to Search section in browser settings and choose your default search engine. It’s definitely not easy to choose the most private search engine, since data harvesting has become a big deal over last couple of year. To address this shortly, from the offered ones only DuckDuckGo is the one that allows you to hope for some kind of privacy.

Sure, websites are clearly starved to track you. Adjusting their user interface to improve their goal completions, targeting personalized ads or even selling your data to third parties nicely contributes to their revenue, but in Firefox you can mostly avoid these tricky practices by tweaking your browser. There is a a nice option to enable “Do Not Track”:

Sadly, this “industry standard” hasn’t worked well since Windows 10 (i.e. 2015). Why? Do not track is optional, with no legal force. There’s a very short list of companies which respect the “Do not track” token. Here’s most of the list as of 2019: Twitter, Medium, Reddit, and Pinterest.

Happily there are stronger user-enforceable options available to prevent websites potential to track. Start by enabling Allow Enhanced Tracking Protection in Privacy & Security settings. Firefox recommends standard protection, as it blocks cross-site tracking cookies, social media trackers, cryptominers, and fingerprinting.

Strict protection may break some sites but will do much more to protect your privacy. My own experience is that most sites in 2021 do just fine with strict protection enabled in Brave. The exceptions are very bad websites like NFL.com, overloaded with too much technology, too many services, unwelcome auto-play video and endless advertising.

Here’s where you enable strict protection.

After this basic set up you can configure Firefox in more advanced way by typing about:config in the address bar. Ignore the scare tactics warning.

Since Firefox apparently doesn’t trust its end users, you’ll have to click show all button despite you accepted the risks in the previous step.

Having done that, what seems like an endless list of various options shows up. Here you can improve your privacy a bit further.

There’s a set of values to be turned false by double clicking on them.

First step includes turning off geolocation by setting the value false once you type geo.enabled into the search bar.

Many privacy ethusiasts are adamant that another step should lead to disabling Google Safe Browsing. While this bold move imposes a security risks (this function protects you from phishing and malware websites), it radically improves your privacy, because your data won’t be sent to Google anymore. Once again, the choice is up to the user. If you have reason to value your privacy, you’ll turn off Safe Browsing.

browser.safebrowsing.enabled = false browser.safebrowsing.downloads.enabled = false browser.safebrowsing.malware.enabled = false

On the other hand, these settings can be really hazardous, because this way you’re getting stripped of the protection against malicious phishing and malware websites. Paradoxically, GSB is one of more private Safe Browsing clients compared to MS Smartscreen or even Opera Fraud and Malware Protection. To learn more check our comprehensive article which also explains Safe Browsing topic in further detail along with primary source references. In result, I wouldn’t recommend opting out Safe Browsing. Furthermore, Firefox uses separate “cookie jar” for cookies set by Safe Browsing servers, so they won’t mix up with regular browsing session cookies.

Most of the time, I browse with Safe Browsing enabled as the risk of not having access to the industry-standard blacklist worries me. Really that blacklist should be in someone else’s hands other than Google and it shouldn’t be necessary to send private data to Google in order to benefit from blacklists of known malware websites.

Following tweak disables visited websites from getting notifications if you copy, paste or cut something from the webpage.

dom.event.clipboardevents.enabled = false

In the next round we can take care of the cookies. Type network.cookie.cookieBehavior and network.cookie.lifetimePolicy in the search bar. In case of the cookies behaviour, opt for the value 1, which only accepts cookies from originating sites but blocks third party cookies. The lifetime policy should be assigned value 2, which accepts cookies only for the current session.

You can also improve your set up by disabling offline cache by typing browser.cache.offline.enable in the search bar and choosing false value.

After having so many false values, when it comes to disabling Web GL, it’s smart to choose true value, since this feature represents potential security risk.

webgl.disabled = true

It’s highly unlikely that 98% of web browser users would require 3D animations to browse the web, read articles or watch videos, so there’s very little loss here by not having WebGL available.

Furthermore, privacy.resistFingerprinting (true) enables Firefox’s native fingerprint protection along with privacy.trackingprotection.fingerprinting.enabled (true), which provides additional fingerprint protection. privacy.trackingprotection.cryptomining.enabled (true) protects you from cryptominers, and finally, privacy.trackingprotection.enabled (true) blocks known third party trackers.

Tracking information about your microphone and camera are yet another pieces of puzzle in fingerprinting. You can stop sites from gathering these information by setting false value next to media.navigator.enabled.

Another important thing to do is to stop sending anything you’re typing to the search engine. To do so, it requires you to change the value next to the browser.search.suggest.enabled false. Those search suggestions do not come free: the price is having everything you type or paste in your URL bar sent to your search provider. The data is sent, even if you change your mind about the query.

Next, DRM (digital rights management) is also an issue. It basically controls what can users do with digital media. DRM restricts unauthorized usage or spreading of copyrighted digital content. As explained on DefectiveByDesign.org:

When a program is designed to prevent you from copying or sharing a song, reading an ebook on another device, or playing a single-player game without an Internet connection, you are being restricted by DRM.

The shady part of this function is that it monitors and controls our activity and interactions with digital media. Inevitable part of it is collecting IP addresses, but not only that. It is tracking additional user information via download, browsing activities or subscription service etc. Understandably, we should be concerned about this enough to opt this out in the browser settings like this:

media.eme.enabled false

It disables the playback of DRM-controlled HTML5 content and there are some sites where content playback isn’t possible without enabled DRM. So while this setting contributes to your privacy, it once again undermines usability.

My suggestion here would be to have one browser which is DRM-enabled to allow using Netflix, Prime Video, Audible and other DRM protected services and in your other browsers to disable DRM plugins.

Lastly, WebRTC is a feature that provides browsers and apps with real-time communication via API, so it allows audio and video communication to work inside web pages. Cool function, indeed, but it also costs you some privacy, since it leaks your real IP address even when you are using VPN or TOR. Once again, based on your preference, usability vs privacy, you can either opt it out or not:

media.peerconnection.enabled

WebRTC is less of an issue if you are chatting with people whom you already know. It’s not a big deal if your mother, your friends or even your work colleagues know your home IP. Not true, just by having WebRTC enabled, any website you visit can obtain your true physical IP regardless of VPN. Was WebRTC the secret sauce in the Netflix crackdown on VPN post-2015? Recommendation: WebRTC should be toggled on when needed or again, enabled only in the known-sources browser.

Other than that, you can disable telemetry by setting these values false, so Firefox will not collect usage statistics and performance reports:

toolkit.telemetry.unified toolkit.telemetry.enabled datareporting.healthreport.service.enabled datareporting.healthreport.uploadEnabled

IceCat

Is Mozilla too big and commercial for you to trust them? For the ones like you GNU has developed IceCat, a Firefox fork that’s unlike the original, free (or libre) software, philosophically and legaly speaking, as defined by Richard M. Stallman, a head of GNU Project.

Developing and maintaining a modern web browser is a large and expensive project. GNU doesn’t have as big development team as its competitors, which results in slower updates and sometimes a lack of feature parity. On the other hand, GNU really respects your privacy and follows the strict philosophical rules which were set up by their founder Richard M. Stallmanin in his GNU manifesto.

Let me show you how to configure the advanced settings through the address bar, even though it can cause problems on some sites. Well, privacy first.

To start with, type about:config in the address bar and promise to be careful.

Since IceCat is based on Firefox, the following steps in advanced configuration can be applied the same way – just scroll up to Firefox advanced config. After all, IceCat is designed to be more or less privacy respecting “out of the box”.

Another popular alternative to Firefox used to be Waterfox, once again, developed by a small team so don’t count on as frequent updates. No more. The main reason for Waterfox’s existence used to be an ethical principles based on privacy and transparency. Optimized for privacy by default it has telemetry, data collection, and startup profiling along with sponsored tiles removed without tweaking it manually. Waterfox’s relevance has vanished into a thin air, since it was sold to advertising company System1. Thus, despite the frequent suggestions on the internet in favour of Waterfox, if you’re looking for suitable alternative to Firefox, IceCat is more reasonable option, since GNU’s values have not yet been compromised. Moreover, it’s free software, not just standard open source, hence it’s possible to inspect and modify all elements of its code and this way it will be also in future due to general public licence.

Brave

Among the major web browsers, Brave has quickly acquired cachet among privacy minded users. Unlike aforementioned Google, Microsoft or even Apple tailored nightmares, Brave’s business model isn’t based on heavy data collection.¹ But is it enough for a complacent browsing? Even Brave calls for a few tweaks here and there.

To start with, go to browser settings.

Once there, choose shields area on the left side to block all cookies, scripts, trackers & ads as well as fingerprinting. Same as in case of Firefox, you can also choose strict blocking over standard, but once again it will cost you usability, since strict options may break some sites.

Note that blocking all scripts, on the other hand, can break functionality of some websites like those well-known and much visited like Facebook or Youtube among others.

Next step leads to Social media blocking area. Facebook, Goolge, Twitter, oh, how infamous for privacy violations they are. Don’t feed them. It might require to step out of your comfort zone, but privacy, especially these days, is only for the brave (no pun intended).

After scrolling down we can find default search engine options. Once again, choosing your trusted search engine takes at least as much time and effort as choosing your web browser. One thing is certain, though, Google is not a choice under any circumstances. From the ones offered only DuckDuckGo represents something privacy minded individual could live with, in spite of having serious doubts nonetheless. Considerable alternative might be Qwant, since its servers are based in Europe not in USA, but less relevant search results are what you pay in return.

Brave Search provides much better results. My boss doesn’t like the layout of the Brave Search results and has made a much more readable and scannable theme available to users of the popular Stylus and Stylish CSS customise plugins: Wide Brave Search.

In privacy and security area after scrolling down, there are also several things to be done to enhance your browsing privacy set up. Along with disabling telemetry it’s also useful to disable WebRTC to non-proxied UTP, since WebRTC protocol can leak your IP address.

In Clear browsing data section I recommend to allow Brave clearing it on exit, thus, after closing the browser.

Finally, Brave’s business model is unique. Unlike Google, they don’t rely on usual way of selling data to advertising companies, although they still need some income from ads, since considerable money’s involved in digital marketing. Brave solved this issue by creating the advertising ecosystem of their own, pocketing 15% of revenue generated by advertising. To follow their privacy first formula, Brave ads are in opt in regime, however, the users who enable these ads are rewarded so called BAT tokens. Needless to say, if you really value your privacy, any kind of online advertising should be a red flag for you, rewards or not. So from the privacy point of view, I advice you to let these Brave ads settings untouched.

Ungoogled Chromium

Ungoogled Chromium is an open source chromium-based browser, stripped of the dependencies on Google services such as Google Safe Browsing or Google location service. This fact means that Ungoogled Chromium actively avoids phoning home to Google servers or integrating with Google API’s. While “out of the box” Ungoogled Chromium can be considered more or less private, at least in comparison with some other chromium projects, that does not mean it can’t be tweaked as well.

To begin with, unlike the most of the browsers, Ungoogled Chromium has no default search engine, which disables searching the web by just typing the query into the address bar. Obviously, this default increases the privacy aspect of the Ungoogled Chromium, many users might find it annoying, so setting up a default search engine is the first logical step. You can do that easily in browser settings after choosing search engine section.

When it comes to blocking cookies, Ungoogled Chromium blocks all third party cookies by default. To do so, go to general settings and choose privacy and security section, as displayed below.

In the same section you can also enable “Do Not Track” requests which is not enabled by default. This is not recommended (see above) in practice:

In Site Settings section you can manage permissions like you location, access to camera and microphone or receiving notifications – all of them are pre-set to ask first. After scrolling down to additional permissions you can disable JavaScript, which is not recommended by browser, although many privacy enthusiasts are particular about having it blocked. Disabling JavaScript is indeed a harsh interference with common usability, as it breaks some sites like much used Facebook or Youtube among others.

Unlike in case of Google Chrome or even Brave Browser, Ungoogled Chromium has disabled autofills like your passwords, payment methods or address. This is a relief.

Final set of tweaks requires advanced setting, accessible through chrome//:flags/ entered into the search bar. Here you can set anonymize local IPs exposed by WebRTC to enabled, disable search engine collection to enabled, and fingerprint deception to enabled.

In conclusion, sometimes it can be difficult to decide between strict options and day to day usability. After all, web browser should serve us, not vice versa. Even the most strict set up doesn’t cover our fingerprints absolutely. Fingerprinting is a very complex issue and it’s impossible to be completely free of it. Even the popular method of using multiple browsers is not completely private, as arises from the respective study.

Still by following the steps above, advertising companies, governments, other malicious actors will have much less information about you. It’s the social duty of the responsible citizen to make spying on oneself more difficult. The harder and more expensive it is for bad actors to spy on us, the lower the temptation for them to try.