Hardening Pale Moon security protocols

[wlfit]

I read this article http://www.ush.it/2007/07/25/clientside ... a-firefox/ it's outdated but many settings there are still enabled by default
I was wondering if you here recommend changing:

Code: Select all

network.protocol-handler.external.afp		false
network.protocol-handler.external.data		false
network.protocol-handler.external.disk		false
network.protocol-handler.external.disks		false
network.protocol-handler.external.hcp		false
network.protocol-handler.external.javascript	false
network.protocol-handler.external.mailto	false	not default
network.protocol-handler.external.ms-help	false
network.protocol-handler.external.news		false	not default
network.protocol-handler.external.nntp		false	not default
network.protocol-handler.external.shell		false
network.protocol-handler.external.snews		false	not default
network.protocol-handler.external.vbscript	false
network.protocol-handler.external.vnd.ms.radio	false
network.protocol-handler.expose-all		false	not default

Also regarding ciphers, would you recommend this:

Code: Select all

:: 128 bits ::
security.ssl3.rsa_camellia_128_sha false
security.ssl3.ecdhe_rsa_aes_128_sha false
security.ssl3.ecdhe_ecdsa_aes_128_sha false
security.ssl3.dhe_rsa_camellia_128_sha false
security.ssl3.dhe_rsa_aes_128_sha false

:: 3DES < 128bits - http://www-archive.mozilla.org/projects ... uites.html
:: https://en.wikipedia.org/wiki/3des#Security + http://en.citizendium.org/wiki/Meet-in- ... dle_attack ::
fehlt security.ssl3.dhe_rsa_des_ede3_sha false
fehlt security.ssl3.ecdhe_rsa_des_ede3_sha false
security.ssl3.rsa_des_ede3_sha false

:: 256bits without PFS ::
security.ssl3.rsa_camellia_256_sha false

:: Susceptible to the logjam attack - https://weakdh.org ::
security.ssl3.dhe_rsa_camellia_256_sha false
security.ssl3.dhe_rsa_aes_256_sha false

:: DSA max 1024bits ::
fehlt security.ssl3.dhe_dss_aes_128_sha false
fehlt security.ssl3.dhe_dss_aes_256_sha false

:: don't found any problems but maybe let it on for compatibility ::
security.ssl3.rsa_aes_128_sha false

security.ssl3.ecdhe_ecdsa_camellia_128_gcm_sha256 false
security.ssl3.ecdhe_rsa_camellia_128_gcm_sha256 false 

The ciphers edits I got from here viewtopic.php?t=13486#p95629


Thank you, Merry Christmas!

[New Tobin Paradigm]

I would recommend you all stop trying to go against the defaults when it comes to security or network performance or any other garbage that is copypasta'd all over the internet after ghacks posts it.

Customization and choice is great but sometimes the best choice especially when none of you knows what you are doing with these preferences is to stick with the defaults.. They are setup for optimum security and stability. TRUST.

[Moonchild]

So, you read a 10 year old article about internet security, and assume it has ANYthing of value in it?

Please use our defaults. As people have found out after spinning their wheels and exchanging posts and running through the thought processes we already have that yes, those defaults in use are there for specific reasons (usually multiple).

[wlfit]

So, you read a 10 year old article about internet security, and assume it has ANYthing of value in it?

Please use our defaults. As people have found out after spinning their wheels and exchanging posts and running through the thought processes we already have that yes, those defaults in use are there for specific reasons (usually multiple).

At that time it was recommended to disable insecure protocols and dark_moon also recommended some of the features which made me think about it ... he was clear to say it was his personal preferences and not recommended for pale moon users overall but regardless I'm curious about it

For instance I don't know how valuable is

Code: Select all

javascript.options.asmjs

enabled and I couldn't find any information on the internet except a few security risks related to the asmjs but I was more interested in the ciphers and protocols

But anyway as recommended I'll leave default for protocols and ciphers

[dark_moon]

My post is older then 1 year and i doesnt use most of the stuff i posted.
I mainly use defaults with few changes and most of them comes from uBlock Origin