Hardening Zen

Privacy by Default?

I really like the Zen Browser. It’s the first Firefox fork in a long time that actually feels modern without being bloated or meh like LibreWolf. The tiling... the vertical tabs... the shortcuts.. And the performance is so snappy.

Where Zen shines is when you search for some specific settings in about:config, you might notice some of them have a little lock icon next to them. This means the Zen developers have integrated Betterfox into Zen already. However, being based on Firefox means it still inherits some of Mozilla’s questionable defaults. Here is how I clean it up:

Easy Settings

Before diving into everything else, go to the standard settings page. Under Privacy & Security, set Enhanced Tracking Protection to 'Strict'. This is the most basic thing you can do.

And then, scroll down and do the rest of the obvious things, such as DNS over HTTPS and others. Zen is better than vanilla Firefox about this but it’s good to make sure the doors are locked.

Deep Dive Into about:config

Type about:config in your URL bar. You’ll get a warning. Click 'Accept the Risk and Continue'.

Search for these specifically. Some might be set already, but double-checking is free.

• privacy.resistFingerprinting -> true
  This is the core of Firefox hardening. It forces your browser to report a generic version, generic time zone, and generic hardware specs. Note that this will force your browser into Light Mode on some sites to prevent them from knowing your OS theme.

  Zen is also gradually moving toward Firefox's newer privacy.fingerprintingProtection, which is a more web-compatible alternative, just in case this is outdated by the time you read this.

• privacy.resistFingerprinting.letterboxing -> true
  If you don't see this in the list, you'll need to add it. Select Boolean, click the + button, and set it to true. Have you used the Tor Browser before? This is what adds the gray bars (letterboxing) around your window. It prevents websites from knowing your exact monitor resolution or window size. It looks weird for five minutes, then you stop noticing.
• privacy.resistFingerprinting.block_mozAddonManager -> true
  Prevents Mozilla's official addon store from seeing which extensions you have installed. But regular websites have no access to this API anyway, and enabling this will make installing or updating extensions from the official site more manual by breaking the one-click "Install" button.
• network.http.referer.XOriginPolicy -> 2
  Only send the "Referer" header when the hostname matches. This stops your browser from telling site-b.com exactly which page on site-a.com you just came from.
• webgl.disabled -> true
  WebGL is a massive fingerprinting vector. Unless you're playing 3D games in your browser (why?), just kill it.
• dom.event.clipboardevents.enabled -> false
  Stops websites from knowing when you copy, cut, or paste something from their pages. Useful for those annoying sites that try to block you from pasting passwords or copying text. But be aware it may break complex clipboard tasks like pasting screenshots in web apps like Google Docs (which I hope you aren't using), Discord, or photo editors like Photopea.
• media.navigator.enabled -> false (Legacy)
  An older preference to block camera/microphone device queries. It is largely legacy today as Firefox uses modern, per-site permission prompts by default, but it completely disables camera and mic hardware access.
• browser.cache.disk.enable -> false
  Forces the browser to only use RAM for caching. This ensures that when you close the browser, no trace of your session remains on the physical drive.
• privacy.partition.serviceWorkers -> true
  If this isn't in your list, add it as a Boolean. Click the + button, and set it to true. Service workers are background scripts used for push notifications and offline features. This partitions them so a script from site-a.com can't be used to identify you when you visit site-b.com.
• browser.search.serpEventTelemetryCategorization.enabled -> false
  Stops the browser from analyzing how you interact with search results. Your search habits should stay between you and the search engine (or better yet, just you).
• nimbus.telemetry.targetingContextEnabled -> false
  Stops the browser from snooping on how you click through search engine results.
• browser.urlbar.suggest.searches -> false
  services.sync.prefs.sync.browser.urlbar.suggest.searches -> false
  Stops the browser from blabbing every keystroke to your search engine before you even hit enter. If I wanted to share my typos and half-baked thoughts with a server, I’d post them on social media.
• network.captive-portal-service.enabled -> false
  Stops the browser from constantly pinging Mozilla just to see if you're trapped behind a hotel or airport login page.
• beacon.enabled -> false
  This stops websites from sending pings to their servers the second you close a tab or leave a page. It’s the digital equivalent of a stalker watching you walk away from a conversation just to see where you go next.
• browser.safebrowsing.malware.enabled -> false
  services.sync.prefs.sync.browser.safebrowsing.malware.enabled -> false
  This stops the browser from constantly pinging Google's servers to check "malicious" URLs. If you're not clicking on bomb-israel-botnet.exe then you don't need this.
• network.prefetch-next -> false
  Stops the browser from pre-loading links it thinks you might click. This prevents your IP from hitting servers you never actually intended to visit.
• network.dns.disablePrefetch -> true
  Same as above, but for DNS lookups.
• media.eme.enabled -> false
  services.sync.prefs.sync.media.eme.enabled -> false
  This disables Digital Rights Management (DRM). Turning this off means Netflix or Spotify Web won't work, but it keeps proprietary blobs out of your browser. Why would you care about using services like those anyways?
• network.IDN_show_punycode -> true
  This prevents "homograph" attacks where a malicious site uses look-alike characters (like a Cyrillic 'а' instead of a Latin 'a') to trick you into thinking you're on a real site. It makes the URL look ugly, but I'd rather see the truth than a pretty lie.

This probably isn't the whole list. But anyways, WebRTC is great for video calls, and notorious for leaking your real IP address even if you're using a VPN. If you don't use your browser for Discord calls or something, disable this:

• media.peerconnection.enabled -> false

If you absolutely need WebRTC but want to stay safe, toggle media.peerconnection.ice.default_address_only to true instead. It forces WebRTC to only route through your default active connection (which will be your VPN tunnel when active), preventing it from probing your physical adapters for your real IP.

Note about extensions

One of the biggest mistakes people make when "hardening" a browser is installing twenty different privacy extensions. This actually makes you more unique because your specific combination of extensions creates a unique fingerprint. Even if a website can't see the list of your extensions directly (since standard sites never had access to your addon lists), they can easily detect them via a concept called Extension Fingerprinting via Behavior. Even if a site can't see what extensions you have installed, it can see what they do to the page.

uBlock Origin is non-negotiable doe. It's not just for ads, the rest of what this extension can do is so overlooked. It treats trackers, malware-distributing domains, and "pop-under" scripts with the same hostility. You can also disable JavaScript (Satan) globally or for individual sites, and unlike other blockers, it's highly optimized. It can also automatically clean up those ugly tracking strings at the end of URLs. AND, it's open source. Get it, and go over to the settings dashboard and enable "I am an advanced user" and start configuring it. Because you definitely are an advanced user.

Actually, it is negotiable if you just use nextdns.io instead or something. DNS-level adblocking and trackerblocking is still slept on. However they can't block stuff like ads on YouTube videos because they're basically embedded into the video itself. And if that's a dealbreaker just degoogle already and use Invidious or Piped.

However PLEASE do NOT use ublockdns.com. It is NOT affiliated with the extension we all know and love which is uBlock Origin. It's just a company that bought the domain name and is trying to scam you. They're like someone selling fake Rolex watches out of a trench coat and the ublockorigin.com site literally has big red text saying This is not the official uBlock Origin site. and proceeds to lead you to their bullshit DNS. Though the backend stack on NextDNS is also closed-source, which is normal, they're still more transparent and are trusted by the community. But if you REALLY want a fully open-source DNS stack then NextDNS will not fit your needs and your best bet is to self-host Pi-hole or AdGuard Home on a local device like a Raspberry Pi.

Note about other user.js templates

Aside from all of that, I hope some Arkenfox chud has not thought to themselves that this is stupid and people should just use Arkenfox. Arkenfox is bound to break websites beyond usability and can actually interfere with Zen's unique interface and features. And because of that, using Arkenfox may actually make you more unique, not less. Zen already integrates Betterfox.

After all of this, some sites MIGHT break. Some sites hate when they can't fingerprint you. When that happens, don't lower your security. Find a better way to access the service, or don't use it at all.

Close the tab, restart the browser, and you're good to go.