Tutorial - How to Prevent Data Leaks in your Firefox

Although Firefox is considered safe and reliable browser, it has separate modules that track users behavior and send statistics to remote servers. Bad news is that year by year there are more modules like that appearing and they are activated by default. Good news is they can be turned off in about:config.

This repo https://github.com/amq/firefox-debloat maintains an up-to-date list of options that should be disabled in about:config to prevent data leakage :

Google "Safe" Browsing

Sends every URL you visit to Google, this means if you hacked a site and use an unprotected web-shell to manage it, Google will know the web-shell's URL and what IP you visited it from.

browser.safebrowsing.enabled 

browser.safebrowsing.downloads.enabled 

browser.safebrowsing.malware.enabled

Firefox Statistics

Sends data reports to Firefox about your browser performance and stability

datareporting.healthreport.service.enabled 

datareporting.healthreport.upload.enabled

toolkit.telemetry.enabled

WebRTC

Leaks a real IP of your internet connection even when you use Tor/VPN

media.peerconnection.enabled

Encrypted Media Extensions (DRM)

A binary plugin with unknown source code that comes with Firefox since version 38. Allows you to play encrypted media content and use Netflix and others without Microsoft Silverlight. It uses Intel chipset and CPU hardware instructions to invoke communications, thus can affect your hardware maliciously without your consent.

To completely uninstall the plugin, you need to use the version of the EME-free Firefox browser: download.cdn.mozilla.net/pub/firefox/releases/latest/win32-EME-free/ or use Firefox ESR builds provided by Debian/Ubuntu and other Linux distributions.

media.eme.enabled 

media.gmp-eme-adobe.enabled

Firefox Hello

Firefox connects to third-party services ("Telefonica") without user consent

loop.enabled

Pocket

A third-party service for manipulating "read later" articles/publications.

browser.pocket.enabled

Geolocation

geo.enabled

Search suggestions

Everything you write in a browser search or URL box is instantly sent to remote servers

browser.search.suggest.enabled