50/61 deliveries completed by the 20th : TBK | Torhoo darknet markets

Thank you so much for this!

For everyone else, I typed this up so you can just copy and paste it into a text editor and save it as user.js for yourself. Edit: Fixed the last line, thx /u/jake0126 <3

user_pref("privacy.sanitize.sanitizeOnShutdown", true);
user_pref("javascript.enabled", false);
user_pref("network.cookie.lifetimePolicy", 2);
user_pref("dom.storage_access.enabled", false);
user_pref("dom.event.clipboardevents.enabled", false);
user_pref("geo.enabled", false);
user_pref("privacy.firstparty.isolate.block_post_message", true);
user_pref("privacy.resistFingerprinting.letterboxing", true);
user_pref("webgl.disabled", true);
user_pref("webgl.enable-webgl2", false);
user_pref("media.peerconnection.enabled", false);
user_pref("dom.enable_performance", false);
user_pref("gfx.webrender.all", false);
user_pref("privacy.resistFingerprinting.block_mozAddonManager", true);
user_pref("network.cookie.lifetimePolicy", 2);
user_pref("network.cookie.thirdparty.sessionOnly", true);
user_pref("browser.sessionstore.privacy_level", 2);
user_pref("network.http.referer.spoofSource", true);
user_pref("network.http.sendSecureXSiteReferrer", false);
user_pref("network.dns.disablePrefetch", true);
user_pref("network.predictor.enabled", false);
user_pref("network.http.referer.hideOnionSource", true);
user_pref("gfx.font_rendering.graphite.enabled", false);
user_pref("layout.css.font-visibility.level", 3);
user_pref("network.http.referer.trimmingPolicy", 2);
user_pref("network.http.referer.XOriginPolicy", 2);
user_pref("network.http.referer.XOriginTrimmingPolicy", 2);
user_pref("privacy.resistFingerprinting.reduceTimerPrecision", true);
user_pref("privacy.resistFingerprinting.reduceTimerPrecision.microseconds", 10000);
user_pref("fission.autostart", true);
user_pref("privacy.firstparty.isolate", true);
user_pref("privacy.trackingprotection.fingerprinting.enabled", true);
user_pref("privacy.trackingprotection.cryptomining.enabled", true);
user_pref("dom.webaudio.enabled", false);
user_pref("media.eme.enabled", false);
user_pref("media.video_stats.enabled", false);
user_pref("browser.startup.blankWindow", true);
user_pref("browser.download.start_downloads_in_tmp_dir", true);
user_pref("browser.helperApps.deleteTempFileOnExit", true);
user_pref("network.dns.blockDotOnion", false);
user_pref("network.proxy.socks_remote_dns", true);
user_pref("network.http.http3.enabled", false);
user_pref("dom.push.enabled", false);
user_pref("privacy.trackingprotection.enabled", true);
user_pref("privacy.trackingprotection.socialtracking.enabled", true);
user_pref("privacy.annotate_channels.strict_list.enabled", true);
user_pref("browser.send_pings", false);
user_pref("browser.display.use_document_fonts", 0);
user_pref("pdfjs.enabled", true);
user_pref("extensions.pocket.enabled", false);
user_pref("browser.safebrowsing.malware.enabled", false);
user_pref("browser.safebrowsing.phishing.enabled", false);
user_pref("webgl.enable-debug-renderer-info", false);
user_pref("media.navigator.enabled", false);
user_pref("dom.battery.enabled", false);
user_pref("device.sensors.enabled", false);
user_pref("accessibility.force_disabled", 1);
user_pref("browser.cache.offline.enable", false);
user_pref("beacon.enabled", false);
user_pref("clipboard.plainTextOnly", true);
user_pref("extensions.torbutton.use_nontor_proxy", false);
user_pref("extensions.torbutton.block_disk", true);
user_pref("dom.security.https_only_mode", true);
user_pref("dom.security.https_only_mode.upgrade_local", true);
user_pref("security.mixed_content.block_active_content", true);
user_pref("webspeech.recognition.enable", false);
user_pref("webspeech.synth.enabled", false);
user_pref("media.hardwaremediakeys.enabled", false);
user_pref("device.sensors.motion.enabled", false);
user_pref("device.sensors.orientation.enabled", false);
user_pref("dom.gamepad.enabled", false);
user_pref("browser.urlbar.suggest.searches", false);
user_pref("media.gmp-gmpopenh264.enabled", false);
user_pref("media.gmp-widevinecdm.enabled", false);
user_pref("browser.helperApps.neverAsk.saveToDisk", "application/pdf,application/octet-stream,application/zip");

Should I save the file as (title).user.js or (title)user.js?

Thank you so much! If it was just the three entries it would almost be faster to just open about:config and do it manually, but with the list /u/BlazinTits put together its very much worth the time it takes to navigate to the correct folders (on my system it wouldn't show amnesia from the Home folder, had to go to Other Locations>Tails>Home>amnesia

Earlier, you said you would add this to the comments later and you did exactly that. Thank you very much. We need more like you.

Where do I put the user.js file?
In the program files for tor?

i was just following the dnm bible and thought setting the security settings to safest was adequate. when i double checked in about:config it was a shock to see javascript.enabled was still set to true.

thats why i added it to MOST IMPORTANT!! lol

Security Settings to Safest is not enough

EXACTLY!!!

thank you! :)

everything under the bullet points are a explanation for what that setting does. so turning Javascript.enabled = False will Disables all JavaScript, blocking most modern browser exploits and fingerprinting scripts.

so only Javascript.enabled set to false, that completely turns off javascript.

same questions :)

Funny seeing you here!

Thanks!

That mean's a lot!

save this to the confs file so you don't have to repeat it over and over if you are using a disposable system

Yes! i'll add that to the post!

How do you go about saving it to the confs file? Would that allow these settings to load automatically every time I restart Tails?

Thanks! :)

If they doesn't exist, you make them, so if it calls true/false then pick boolean and set it to true/false. If its a number click number, then click the add/+ button on the far right as add it. once ypu add it you can then change it from true/false, or change the number if you picked number before you pressed add.

I said it in my post at the top in the last paragraph, right before "MOST IMPORTANT!!!"

network.http.referer.trimmingPolicy = 2
network.http.referer.XOriginPolicy = 2
network.http.referer.XOriginTrimmingPolicy = 2

I double checked everything to make sure they are spelled right before i posted.

referer isn't the real way to spell it but that's how the setting spells it lol. and i'm posting a guide in the comments here about that tomorrow. ill tag everyone who asked about it

I haven't been online much today besides this post and a few reply's.

thanks man! :)

even when you type something into the search bar?

start typing javascript.enabled into the search bar and see if it pops up.

thank you!

oh damn that suck's

of course man! :)

leave it at custom.

That's normal and doesn't reduce your security. as long as you added all those features

yeah you can DM me.

if you want you're anonymity to be better then yes. i wrote a guide down in the comments how to add it to tails automatically :)

just scroll down/up. another guy also wrote out all the configs so you can just copy and paste.

of course! glad to help :)

Yeah, that’s right. This guide is similar to arkenfox.js, but it’s focused specifically on hardening Tor Browser for anonymity and darknet use. arkenfox is great for regular Firefox privacy, but Tor Browser has different defaults and needs, so these settings are tailored for Tor’s threat model. Both use the same user.js method for customizing browser privacy and security, so you can use all these configs for arkenfox.js if you want to harden Firefox the same way.

Thank you! :)

yes exactly!

That’s a good question, and I get why it looks confusing. In Tor Browser, network.dns.blockDotOnion = false does NOT mean your .onion addresses get sent to your regular DNS server. By default, Tor Browser is already set up to handle all .onion addresses through the Tor network only, never your normal DNS.

This setting just tells Firefox/Tor Browser whether to block .onion addresses entirely or allow them to work. Setting it to false allows .onion sites to resolve through Tor, which is what you want. If you set it to true, the browser will block all access to .onion domains completely.

no problem! happy to help :)

love the name BTW

yeah i'd be glad too

Yes, that’s completely normal. Tor Browser shows that message whenever it detects you’ve changed its default security settings with a user.js file or by making manual tweaks in about:config. All it means is that your browser is now using “Custom” settings instead of one of the built-in security levels like Standard, Safer, or Safest.

Your changes are working, and you can safely ignore that warning as long as you know which settings you changed and why. If you want to use your own hardening tweaks, just leave it on Custom, there’s no problem.

If you change it back to Safest, Tor Browser will remove all the custom configs you added from this post. If you had Safest turned on before you added your own tweaks, those Safest settings will stay active. Only the settings you changed yourself will be affected by switching between Safest and Custom.

a ton of people in the comments has said they've changed there setting to it. either in the comments or messaged me.

read the comments. you won't notice anything different. it won't effect usability.

keep it as custom, don't put it back to safer or it will erase all the configs you just put up.

and i'm going to write a Script for it to automatically move to the tor folder on startup. ill post it later tonight.

Thanks for sharing your perspective. You’re right that changing Tor Browser’s default settings can potentially make you more unique if you go overboard or don’t know exactly what each setting does.

It’s true that settings like privacy.trackingprotection.enabled and others can change your fingerprint, and The goal is to avoid creating a “rare” browser fingerprint while still closing real privacy holes. That’s why the best approach is to stick close to default Tor Browser behavior, only disabling things that really leak info or open you up to known attacks, and not to apply every Firefox privacy setting blindly.

No browser can guarantee zero fingerprint, and yes, there’s always risk when trusting big projects. But not hardening at all, or only disabling JavaScript, leaves you open to a ton of other fingerprinting vectors and exploits. The key is understanding your threat model and using OPSEC that matches it, not just following any guide or default.

Anyone who’s serious about privacy should test their own setup, stay current, and know exactly what each config tweak does. Blanket statements like “admins are dumb or compromised” don’t really move the conversation forward. Constructive critiques and actual fingerprint test results help everyone, though. If you have more info or see a setting that causes real issues, it’s good to share your findings and let others test and discuss.

The guide I posted isn’t about blindly flipping every switch, but about making informed decisions to reduce real-world leaks and attacks that have actually been seen in the wild. Every setting is there for a reason, with an explanation of what it does and how it impacts both privacy and usability. I always recommend testing your own fingerprint before and after any changes and adjusting based on your own threat model. No OPSEC setup is one-size-fits-all, but simply sticking to defaults or disabling JavaScript only gives a false sense of security for most users. A smart balance of hardening and blending in with other Tor users is the best approach, and that’s exactly what this guide is meant to help people achieve.

yes as far a i know, there's no Tor Mobile app that lets you edit in about:config.