20 KiB
I previously wrote about enforcing HTTPS for all users/profiles through browser policy receiving some positive feedback and I felt like continuing on the subject by instructing with extension installation. This barely scratches the surface of what browser policy can do for you either though.
I recommend reading the browser policy part Ⅰ on enforcing HTTPS only mode as especially the Firefox part will continue building on it and I will try to not repeat myself, although that is unavoidable.
Automaattinen sisällysluettelo / Automatically generated Table of Contents
- Chromium
- Firefox
- Answers to potential questions
- Where can I see what policies extensions can take?
- What do you think about this blog post?
- Will there be browser policies part Ⅲ?
Chromium
I
previously instructed with the directory creation and permissions in the
part Ⅰ and there I also mentioned loving how I can create separate
files there as opposed to messing everything together. I tend to use the
filename aminda-extensions.json for all extension related
as Chromium isn’t perfect either and only lets the options appear
once.
So the file may look a bit scary, but it’s actually quite simple (and
the difficulty comes from getting json formatted correctly, which I am
leaving for pretty-format-json pre-commit hook), so I am
going to explain everything before the actual json:
The 3rdparty and extensions let us
configure extensions in advance.
cjpalhdlnbpafiamejdnhcphjbkeiagm is the ID of uBlock
Origin from Chrome Web store which can be seen from its URL:
https://chromewebstore.google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm
and everything specified here will become a part of it’s
configuration.trustedSiteDirective means the sites it will
be disabld on, the extension pages are recommended in the documentation
and I don’t mind Ecosia displaying ads since they go to planting trees.
Note that the user can add their own sites or remove these from the
extension settings.
toOverwrite says clearly it will overwrite user
settings, so the lists everyone on your system wishes to use should be
specified here. In this case, this contains the default lists, the
Finnish adblocking list and the quick fixes list, which updates more
rapidly in cases such as the cat-and-mouse with YouTube and
adblockers.
There is also the EFF DNT allowlist which was introduced to me by AdNauseam. You have most likely heard of how ads let content to be free and supports content creators and all that, I don’t want to take away their revenue, but I don’t want to risk targeted malvertising or manipulation either, so this is my compromise. Respect my privacy, and I will see your ads, or be blocked.
Onwards to PrivacyBadger, the
ID again comes from Chrome Web Store URL
https://chromewebstore.google.com/detail/privacy-badger/pkehgijcmpdhfbdbbnkijodmdjhbjlgp
and the settings are clear on what they do. If they are removed, it’s up
to the default value or user configuration what will happen.
This PrivacyBadger configuration will simply always set these options on browser start:
"checkForDNTPolicy": truecheck if the domain has a.well-known/dnt-policy.txtand if so, won’t block it."disabledSites": []configures the domains that are allowed to perform tracking/disrespect DNT. While here it’s the same as with uBlock Origin, in my actual policies I allowlist domains more freely in uBlock Origin than PrivacyBadger."learnInIncognito": trueWARNING! May make you more trackable Same as below, but in incognito mode."learnLocally": trueWARNING! May make you more trackable PrivacyBadger has rare ability to learn who tracks you without having to ask anywhere else, so with this enabled, it may block something before it gets added to either the premade list or something uBlock Origin has."sendDNTSignal": trueWhether or not to configure the web browser to send Do Not Track and Global Privacy Control signals."showCounter": trueWhether to display the number of blocked trackers in the PrivacyBadger icon."showIntroPage": falseWhether or not to display the welcome to PrivacyBadger screen on start. In general having less displayed automatically on browser start is a good thing, and if you set this totrue, PrivacyBadger would greet you every browser start and I bet you would get annoyed quickly."socialWidgetReplacementEnabled": trueWhether to display social media embeds directly or replace them with a notice on how PrivacyBadger has blocked them from tracking you with the menu options on what to do.
Now the only thing to do remains actually installing the extension.
BONUS! "ExtensionManifestV2Availability": 2
will extend the time how long until ManifestV3 gets forced (and Google
kills content filters).
Anyway there is the same extension ID as before and four new options:
installation_modehas optionsnormal_installed,force_installedandblocked. The first means it’s installed by default, but the user can choose to unload it, the second used here will prevent unloading the extension and the third prevents installing and loading it entirely.- Typing this I am not sure if
override_update_urlis actually required. force_pinnedwill pin the extension to Chromium toolbar by default and not allow unpinning and moving it to the extension menu. I strongly recommend it with content blockers, especially when there is site breakage as it makes it so much easier to see at a glance when something is blocked. The other option would bedefault_unpinned.update_urlis required for automatically installed extensions and while here it’s the Chrome Web Store, it could as well behttps://edge.microsoft.com/extensionwebstorebase/v1/crxand although the IDs are different there, they are again visible in the URL bar.
/etc/opt/chromium/policies/managed/aminda-extensions.json
I hope I didn’t scare you too badly by saying this isn’t scary, but it’s all explained above.
{
"3rdparty": {
"extensions": {
"cjpalhdlnbpafiamejdnhcphjbkeiagm": {
"toAdd": {
"trustedSiteDirectives": [
"chrome-extension-scheme",
"ecosia.org",
"moz-extension-scheme"
]
},
"toOverwrite": {
"filterLists": [
"user-filters",
"ublock-filters",
"ublock-badware",
"ublock-privacy",
"ublock-abuse",
"ublock-unbreak",
"easylist",
"easyprivacy",
"urlhaus-1",
"plowe-0",
"https://www.eff.org/files/effdntlist.txt",
"FIN-0",
"ublock-quick-fixes"
]
}
},
"ddkjiahejlhfcafbddmgiahcphecmpfh": {
"disableFirstRunPage": true
},
"pkehgijcmpdhfbdbbnkijodmdjhbjlgp": {
"checkForDNTPolicy": true,
"disabledSites": [
"chrome-extension-scheme",
"ecosia.org",
"moz-extension-scheme"
],
"learnInIncognito": true,
"learnLocally": true,
"sendDNTSignal": true,
"showCounter": true,
"showIntroPage": false,
"socialWidgetReplacementEnabled": true
}
}
},
"ExtensionManifestV2Availability": 2,
"cjpalhdlnbpafiamejdnhcphjbkeiagm": {
"installation_mode": "normal_installed",
"override_update_url": true,
"toolbar_pin": "force_pinned",
"update_url": "https://clients2.google.com/service/update2/crx"
},
"ddkjiahejlhfcafbddmgiahcphecmpfh": {
"installation_mode": "normal_installed",
"override_update_url": true,
"toolbar_pin": "force_pinned",
"update_url": "https://clients2.google.com/service/update2/crx"
},
"pkehgijcmpdhfbdbbnkijodmdjhbjlgp": {
"installation_mode": "force_installed",
"override_update_url": true,
"toolbar_pin": "force_pinned",
"update_url": "https://clients2.google.com/service/update2/crx"
}
}2024-06-04: I added uBlock Origin Lite here, see the questions and answers.
Firefox
If you haven’t read the previous blog post yet, please do that now as
Firefox forces everything to be in
/etc/firefox/policies.json and thus this file will begin by
expanding the end result from there. And to not repeat myself, please
also read the Chromium section above as due to everything being
webextensions, the new part within extension configuration is the
same.
Let’s begin by what differs from Chromium:
- The extension ID is most easily readable from
about:supportinstead of addon URL. - We can sideload the extension, although that won’t affect Firefox sync.
- It’s a lot easier to figure out what extension a block belongs to as the names appear here.
- While there is no
ExtensionManifestV2Availability, there are domains protected by default (extensions.webextensions.restrictedDomains) that we could unset.
Oh meow, no more json! I am sorry.
{
"policies": {
"3rdparty": {
"Extensions": {
"jid1-MnnxcxisBPnSXQ@jetpack": {
"checkForDNTPolicy": true,
"disabledSites": [
"challenges.cloudflare.com",
"chrome-extension-scheme",
"ecosia.org",
"moz-extension-scheme"
],
"learnInIncognito": true,
"learnLocally": true,
"sendDNTSignal": true,
"showCounter": true,
"showIntroPage": false,
"socialWidgetReplacementEnabled": true
},
"uBOLite@raymondhill.net": {
"disableFirstRunPage": true
},
"uBlock0@raymondhill.net": {
"toAdd": {
"trustedSiteDirectives": [
"chrome-extension-scheme",
"ecosia.org",
"firefox.com",
"mozilla.net",
"mozilla.org",
"moz-extension-scheme"
]
},
"toOverwrite": {
"filterLists": [
"user-filters",
"ublock-filters",
"ublock-badware",
"ublock-privacy",
"ublock-abuse",
"ublock-unbreak",
"easylist",
"easyprivacy",
"urlhaus-1",
"plowe-0",
"https://www.eff.org/files/effdntlist.txt",
"FIN-0",
"ublock-quick-fixes"
]
}
}
}
},
"DNSOverHTTPS": {
"Enabled": true,
"Fallback": false,
"Locked": true,
"ProviderURL": "https://dns.quad9.net/dns-query"
},
"DisableEncryptedClientHello": false,
"ExtensionSettings": {
"jid1-MnnxcxisBPnSXQ@jetpack": {
"install_url": "https://addons.mozilla.org/firefox/downloads/latest/privacy-badger17/latest.xpi",
"installation_mode": "force_installed"
},
"uBOLite@raymondhill.net": {
"install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin-lite/latest.xpi",
"installation_mode": "normal_installed"
},
"uBlock0@raymondhill.net": {
"install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi",
"installation_mode": "normal_installed"
}
},
"Preferences": {
"dom.block_download_insecure": {
"Status": "locked",
"Type": "boolean",
"Value": true
},
"dom.security.https_only_mode": {
"Status": "locked",
"Type": "boolean",
"Value": true
},
"extensions.webextensions.restrictedDomains": {
"Status": "user",
"Type": "string",
"Value": ""
}
}
}
}Doesn’t that look familiar? Yes, it’s practically the same file from part Ⅰ and the extensions took the exact same values as Chromium, only the IDs and download locations changed and some Chromium extras disappeared.
Well, in uBlock Origin I did add the Mozilla/Firefox domains to avoid breakage and in the end I removed the extra protection those sites would have from extensions which would permit tracking by Mozilla. However, PrivacyBadger would still protect from that while being less likely to break.
Would you like to restore the protection for Mozilla pages?
Replace the user in status of
extensions.webextensions.restrictedDomains {} with
clear so it will be restored to default value while
user persists even if the lines are removed as they appear
as if the user had changed them in about:config.
2024-06-04: I added uBlock Origin Lite here, see the questions and answers.
Answers to potential questions
As I sometimes tend to be a bit controversial when balancing security, privacy, digital carbon footprint and all, there are going to be questions and I keep answering them otherwise too.
Where can I see what policies extensions can take?
In Chromium about:policies has a checkbox “show unset
policies” which will bring a long list including the extensions. It also
has a lovely search box.
Why both PrivacyBadger and uBlock Origin?
I admit they have some overlap, but uBlock Origin relies on human made lists instead of an algorhitm to block trackers (note that PrivacyBadger doesn’t even try to block ads, it happens by accident).
Additionally uBlock Origin does nothing about Instagram, Disqus, etc. widgets. I could block JavaScript (which I do), but sometimes I will allow it to a website anyway and then the widget learns I am there even if I had no interest in seeing comments in that case. And if I wanted to allow them somewhere, I could click “always allow this widget on this site”.
I also love its ability to self-learn trackers, even if that may make
me more trackable. I think there are easier methods to track me (like my
HTTP user-agent saying I am on Windows, while my
navigator.useragent ornavigator.platform` say something
different) and Firefox Nightly is newer than most people use and there
are a countless of small things in browser fingerprinting, which could
be it’s own blog post.
Why EFF DNT allowlist?
I think I already answered this in the Chromium section, but I don’t hate ads. They may be important source of money to creators and I wouldn’t mind some financial support as well (if that wasn’t practically illegal in Finland).
What I mind is targeted advertising, tracking, the potential for targeted malvertising without it affecting anyone else and how they are used for manipulation especially politically and with elections on discouraging some people from voting.
Where did uBlock Origin Lite come from?
I added it here on 2024-06-04 and set uBlock Origin to
normal_installed instead of force_installed,
because I am worried about ManifestV2 extensions not syncing as the
majority probably won’t have the policy to allow it configured.
This gives the users the choice to use either of the two, both (which may be discouraged) or neither, while PrivacyBadger is forced on and I think it may perform better with ManifestV3 anyway considering the local learning feature, which I consider essential for non-English content anyway.
Speaking of PrivacyBadger, other concerns I have with uBlock Origin Lite are:
- I cannot allow non-tracking ads as I cannot add the EFF DNT allowlist. I would need to convince the developer to add it, which I am not even going to try, as it would go against the principle of the extension.
I didn’t get uBlock Origin Lite’s. A day later I got"noFiltering": [""]policy working, so I cannot pre-emptively handle broken captchas or allow Ecosia to show me tracking ads in exchange of them planting trees."noFiltering": [""]working, but it works liketoOverwritefrom uBlock Origin, so any edits outside of the policy will reset upon restart. Then again that may also be a feature, please do send your best regards to Google…
Google only has themselves to blame for not thinking of the scenario where their users might be ok with non-tracking ads and now have no option to allow them due to being more concerned about malvertising than how advertising businesses are doing, since they they ruined the compromise solution that tried to account both.
I may trust myself to avoid malicious content online or that DNS filtering will catch it, but I don’t have such trust on my less technical family members.
I should also say that ManifestV3 and uBlock Origin Lite have good sides as well, considering it not needing or requesting access to all pages visited out of the box, so it may be more likely to pass organizational criterias and actually get installed through policy.
How do I enable more default lists in uBlock Origin?
As you saw, external blocklists are just matter of entering the URL
into the policy, but integrated ones are a bit more challenging. See the
eye icon in uBlock Origin dashboard? I have been pointing it and looking
at the URL which ends
e.g. /asset-viewer.html?url=fanboy-social where
fanboy-social would be the list name.
More technical solution would be looking into the assets/assets.json
file in uBlock Origin’s GitHub repository where the same names
appear.
Remember that more filter lists make you more identifiable and do as I say, not as I do.
What do you think about this blog post?
I feel a bit disappointed with it, I felt the previous one was more meaningful and did everything better, but I hope this will be some benefit to someone regardless or be something I can link to when I inevitably get asked these questions again.
Will there be browser policies part Ⅲ?
Honestly, I don’t know. I was surprised part Ⅱ happened, although this is also just scratching the tip of the iceberg and there is really a lot you can do with browser policies.
Where is all the futher reading?
If you have read both blog posts carefully, this one didn’t actually say anything new, it’s all linked from part Ⅰ.