For LibreWolf and its fans - INFORMATION

[diabolicbg]

I've liked LibreWolf for a long time, but I put it through security testing a month ago. Although it is based on Firefox, LibreWolf proved to be many times better in terms of security and covering your tracks on the web. You can check it out here: https://coveryourtracks.eff.org/

So much for the recommendations. Now the information:
I decided to take the risk and install LibreWolf on LM21.2 now 21.3 with the commands given on his site: https://librewolf.net/installation/debian/
The installation was smooth and seamless and the browser has been working beautifully for a month now. Yesterday it updated to the latest version via the Update Manager and even outperformed Firefox by a whopping 12 hours. Firefox just updated this morning.

For those worried about installations and commands in Terminal, I can recommend downloading AppImage from here: https://www.appimagehub.com/p/1716496
AppImage size is about 80MB vs 1.4/3.4GB Flatpak. If you download AppImageUpdate-x86_64, the updates are installed in seconds and at the same time as the browser update is installed - I mean, the authors update AppImage along with the new install version. https://appimage.github.io/AppImageUpdate/
Of course AppImageUpdate is run manually, but it takes 2-3 clicks and you're all set.

From here on you decide!

[xenopeek]

Although it is based on Firefox, LibreWolf proved to be many times better in terms of security and covering your tracks on the web. You can check it out here: https://coveryourtracks.eff.org/

That's a bold statement Cotton, let's see how it plays out.

Stock Firefox 122 on the left vs LibreWolf 122 on the right shows LibreWolf has better tracker protection:


There is no difference however in fingerprinting protection, how much information the browsers leak to the website:


LibreWolf 122 sets Enhanced Tracking Protection to Strict mode while stock Firefox 122 has it in Standard mode. After changing it to Strict mode in Firefox 122 it shows the same results as LibreWolf 122 except for WebGL, also further down in the report - and again fingerprinting protection was already the same before this change:


Adding the uBlock Origin extension, which LibreWolf installs by default, makes no difference for the test results.

I'm not disputing LibreWolf's changed settings and the added extension, as detailed on https://librewolf.net/docs/features/, are useful for privacy conscious users (I do many of these on Firefox) but I am disputing that such a user would see a difference with https://coveryourtracks.eff.org/ because as shown changing 1 single setting in Firefox - which any privacy conscious user would have done - makes it score the same as LibreWolf and the only difference in the test result then is Firefox has WebGL enabled and LibreWolf not. If you want to pump up LibreWolf, you need a better test website

[diabolicbg]

Thanks for testing xenopeek!
I don't generally like to delve much into browser config because not everything is clear to me. I approached it like a regular user. The only significant thing that differs in your test and mine is that I use additional security add-ons that are the same on both browsers, but I tested each one one by one to see the result of its action.

[Turtletronic]

That may all well be, but how does Librefox fare against Firefox when it comes to the one big biggy that keeps me WELL away from Firefox ... the constant reverting of user-made settings with each and every minor "update" ???

I mean, come on, the FF122 update not only reset my config yet again but at the same time dropped the keyboard short for clearing cache ... not that clearing the cache per settings does any good (as that is also bugged, again). Still, all settings (suggest this, suggest that, typing check, default browser, cache settings, homepage, yada yada) is all reset to Firefox's "pro-dataleech" defaults ...

They can say what they want, they are geared to indirectly scrape - or allow others to scrape - your data. If I set up a browser, I expect that it respects my defaults. Stick Librefox up your jumper if it does the same, no matter what some artsy-fartsy test suite says (as such things are obviously not tested).

[diabolicbg]

That may all well be, but how does Librefox fare against Firefox when it comes to the one big biggy that keeps me WELL away from Firefox ... the constant reverting of user-made settings with each and every minor "update" ???

Quite often I see people here complaining about this setting change, but it only happened to me once, maybe a year ago. Now all updates keep my original settings.
My guess is that you're using lower level security settings, and Firefox has recently raised them to the max, and is therefore changing yours to protect you.

[Hoser Rob]

That may all well be, but how does Librefox fare against Firefox when it comes to the one big biggy that keeps me WELL away from Firefox ... the constant reverting of user-made settings with each and every minor "update" ???...

Have you tried firefox esr?

[sylvain1_]

I am having a problem with the Librewolf source not showing up in my software sources GUI. If you installed Librewolf with the terminal, do you see the same issue?

viewtopic.php?t=412464

[Turtletronic]

... and Firefox has recently raised them to the max, and is therefore changing yours to protect you.

Nope, strict. And since when is a revert which allows to (insecurely!) SAVE PASSWORDS / ALLOW SINGLE SIGN IN as well as ACTIVATE AUTOFILL and STORE COOKIES an effort to protect me? That's poppycock a.k.a. a whole lot of bull if you ask me.

It's not like I'm mucking around with the damn thing all the time. Out of the box, into settings, set up as I liked, done. Now it resets every minor update ... and it's not restricted to one desktop or OS. Hence my thought that it is pure intent. Note: it's not a carry-over profile or such muck, and I don't sync, either.

@Hoser Rob:

I was tempted to; however my GF had similar problems on her WIndows rig which used FF ESR for some legacy stuff she needed for work until they got stuff updated. So I made a huge step away from FF ... I have a spare desktop here at the mo, perhaps I'll give it a shot (I'll use it as music player for a few days).

[diabolicbg]

I am having a problem with the Librewolf source not showing up in my software sources GUI. If you installed Librewolf with the terminal, do you see the same issue?

viewtopic.php?t=412464

Yes, it's the same for me. LibreWolf's PPA is visible in the system report, but not in the Software Manager. I have no idea why. It's important to me that it does its job with regular updates.

[diabolicbg]

I was thinking about the tests done by xenopeek and why we see different results with it. And in this regard I paid attention to some details:
- in both browsers I use English interface and Bulgarian regional settings. My entire OS is in Bulgarian, so the browsers took these settings from the system. This includes time, currency units, location (?), etc.
- The settings I made on both browsers are the same, without messing deep into about:config.
I use user-ageht switcher, set to Chrome 120 Windows. Both browsers display as I have set.
The differences:
- Firefox shows the time used as UTC+2 and my actual location in Bulgaria.
- LibreWolf shows the used time as UTC and the location as Los Angeles.
For me it is +1 for LibreWolf.

If I think of anything else, I'll write again.

[xenopeek]

That's this:

Always display user language as en-US to websites, in order to protect the language used in the browser and in the OS.

You can use https://myhttpheader.com/ to check what "Accept-Language" your browser sends.

You can change this in Firefox Settings -> General -> Language -> Choose your preferred language for displaying pages

[diabolicbg]

That's this:

Always display user language as en-US to websites, in order to protect the language used in the browser and in the OS.

You can use https://myhttpheader.com/ to check what "Accept-Language" your browser sends.

You can change this in Firefox Settings -> General -> Language -> Choose your preferred language for displaying pages

Thank you! I know that, but I've set English on purpose. I don't have much practice besides reading and writing, and I try to keep fit.
I rather don't understand how my time and location changes, but that's fine with me. I do want to hide...

[sylvain1_]

That's this:

Always display user language as en-US to websites, in order to protect the language used in the browser and in the OS.

You can use https://myhttpheader.com/ to check what "Accept-Language" your browser sends.

You can change this in Firefox Settings -> General -> Language -> Choose your preferred language for displaying pages

If I click on this link in Librewolf, one of the results is "Referer: https://forums.linuxmint.com/"

How do I change settings so that my referer is never told to the website? I do not want whatever website I visit to know whatever previous website I visited.

I can copy the link without site tracking to avoid this, and I can paste it into a Librewolf tab. But this does not apply if I click on the hyperlink. How do I do this? Alternatively, how do I make it so that if I click on a hyperlink, instead of opening up the website, it copies the website to my clipboard without site tracking, so I can paste it in another tab?

[sylvain1_]

That's this:

Always display user language as en-US to websites, in order to protect the language used in the browser and in the OS.

You can use https://myhttpheader.com/ to check what "Accept-Language" your browser sends.

You can change this in Firefox Settings -> General -> Language -> Choose your preferred language for displaying pages

Thank you! I know that, but I've set English on purpose. I don't have much practice besides reading and writing, and I try to keep fit.
I rather don't understand how my time and location changes, but that's fine with me. I do want to hide...

There used to be a good website to explain this, https://locatejs.com/.

However, it seems to no longer be functioning.

The readme is still educational. You can see it at https://github.com/z0ccc/LocateJS.

This website is also useful, but luckily since you are using a Firebox-based browser, you are resistant to this type of tracking. https://github.com/z0ccc/extension-detector

https://privacytests.org/ is a website that directly compares the privacy of several browsers. These include Firefox and Librewolf.

Other useful tools include https://browserleaks.com/ and https://www.privacytools.io/private-browser.

More discussion of online privacy can be found at https://anonymousplanet.org/.

[diabolicbg]

Thanks for the info sylvain1!

[xenopeek]

If I click on this link in Librewolf, one of the results is "Referer: https://forums.linuxmint.com/"

How do I change settings so that my referer is never told to the website? I do not want whatever website I visit to know whatever previous website I visited.

With the setting network.http.sendRefererHeader. Search for it for an explanation. I assume LibreWolf can use Firefox extensions. If you search for "referrer" in the extensions there are several that offer some button to control this as well.

This can break some websites. It's common to use the referer header to block hotlinking to images (bandwidth theft). And I don't know but maybe it's also used when doing a transaction in an online store. Just saying there will be some side-effects.

[diabolicbg]

Another confirmation of my statement.

[Tramp 116]

I have been using these same versions of both browsers for about 6 - 8 months now. And I find from a security point of view they both are very similar. My definition is total security is complete privacy, total security and complete anonymity. Which is currently unachievable. But a lot of the security depends on what you're doing. You can tweak Firefox to provide a greater degree of security but it ends up breaking a lot of websites that I want to access. LibreWolf provides access to those websites with a slightly lower degree of security. So it's a trade-off.

A lot of the results is based on how you have each set up. Out of the box, I think Librewolf is better as it comes with Ublock Origin built in. This is pretty much the way I use it as it is highly recommended not to add extensions and add-ons to LibreWolf. My Firefox, on the other hand, has a number of add-ons that tighten it up considerably. One of the biggies here is NoScripts. This addon allows me to look as the javascript tags that are attached to a web site and to use the Blacklight privacy inspector. There are other tools that come with the NoScripts add-on that make it very handle. LibreWolf recommends against installation of NoScripts. Ublock has a lot of similar functions to NoScripts but not all of them. And the additional tools are simply too good not to have.

But either one is greatly enhanced by use of a good VPN. I almost never work on a server located in the U.S. And I've found a lot of the data collection drops off when you're located in some obscure server in who-knows-whereistan. Unless you're using a server located where either China or Russia has an interest. And rotating your server regularly (several times a day) helps as well.

[diabolicbg]

I am having a problem with the Librewolf source not showing up in my software sources GUI. If you installed Librewolf with the terminal, do you see the same issue?

I just noticed that Wine's PPA is also not showing up in Software Manager. I've installed it via a terminal from winehq.org too.
So what if it's not visible? It works flawlessly.

[xenopeek]

LibreWolf is using the new DEB822 format. The giveaway is it creates a file /etc/apt/sources.list.d/librewolf.sources instead of librewolf.list. This is not yet supported in Software Sources. You can use the command inxi -r to show your entire APT repositories configuration, including those in DEB822 format.

DEB822 format support is planned for Linux Mint 22: https://trello.com/b/dBxsEOyF/linux-mint-22