5 Android - Willie169/combinedfox GitHub Wiki

combinedfox user.js currently doesn't support Android. However, you can apply your preferences manually in about:config and UI in forks that don't disable access to about:config, such as Fennec F-Droid and IronFox. Note that not all preferences can be effectively changed in about:config. Read IronFox Documentation Why are certain preferences locked? before using about:config on Android. Read Fennec F-Droid and IronFox sections for more information.

To enable Debug menu in Firefox for Android and its forks, go to Settings > About Firefox (or fork's name), and click Firefox's (or fork's) logo five times. Entries such as Install extension from file and Secret Settings will be shown in Settings.

The following stores can be used to install and update browsers on Android:

• FFUpdater (de.marmaro.krt.ffupdater) from F-Droid: Install and update browsers.
• F-Droid from F-Droid, F-Droid Basic from F-Droid, Droid-fy (com.looker.droidify) from F-Droid: Install and update apps from F-Droid repositories.
• Obtainium (dev.imranr.obtainium): Install and update apps from multiple sources such as GitHub and GitLab releases.
• Google Play Store: Requiring a Google account.
• Aurora Store (com.aurora.store) from F-Droid: Unofficial, FOSS client to Google Play Store without requiring login to a Google account.

Since Firefox profiles and containers currently don't support Android. You can use multiple browsers to achieve similar functionality. Besides different apps, work profile (in contrast to Personal Profile) can provide a second instance for each app. I recommend using Insular (com.oasisfeng.island.fdroid) from F-Droid or Shelter (net.typeblog.shelter) from F-Droid to manage work profile.

Fennec F-Droid browser is based on the latest Mozilla Firefox release. It has proprietary bits and telemetry removed, but still connects to various Mozilla services that can track users.

Refer to Fennec F-Droid on F-Droid, its build metadata, and repo of scripts and patches for the F-Droid flavor of Mozilla Fennec for more information.

IronFox is a fork of Divested Computing Group's Mull Browser, based on Mozilla Firefox. Our goal is to continue the legacy of Mull by providing a free and open source, privacy and security-oriented web browser for daily use.

All users are HIGHLY recommended to take a look at our documentation, ESPECIALLY the Limitations and Frequently Asked Questions pages!

IronFox uses configs from Phoenix as well as IronFox-specific changes to harden and configure Gecko’s preferences. For more information on Phoenix’s features, please see the documentation here.

Refer to IronFox documentation and repo for more information.

Phoenix and IronFox set the following preferences about WebExtension Content Security Policy (CSP):

defaultPref("extensions.webextensions.base-content-security-policy", "script-src 'self' 'wasm-unsafe-eval' 'unsafe-inline'; upgrade-insecure-requests;"); // [ANDROID]
defaultPref("extensions.webextensions.base-content-security-policy", "script-src 'self' 'unsafe-inline'; upgrade-insecure-requests;"); // [NO-ANDROID]
defaultPref("extensions.webextensions.base-content-security-policy.v3", "script-src 'self'; upgrade-insecure-requests;");
defaultPref("extensions.webextensions.base-content-security-policy.v3-with-localhost", "script-src 'self'; upgrade-insecure-requests;");

To let Manifest V2 extensions work as normal, go to about:config and set

extensions.webextensions.base-content-security-policy

to

script-src 'self' https://* http://localhost:* http://127.0.0.1:* moz-extension: blob: filesystem: 'unsafe-eval' 'wasm-unsafe-eval' 'unsafe-inline';

To let Manifest V3 extensions on non-localhost work as normal, go to about:config and set

extensions.webextensions.base-content-security-policy.v3

to

script-src 'self' 'wasm-unsafe-eval';

To let Manifest V3 extensions on localhost work as normal, go to about:config and set

extensions.webextensions.base-content-security-policy.v3-with-localhost

to

script-src 'self' 'wasm-unsafe-eval' http://localhost:* http://127.0.0.1:*;

Beware to only add extensions you trust. Refer to Extensions - Security section for more information.

For example, in Header Editor full/Manifest V2 version, you need to add back unsafe-eval to extensions.webextensions.base-content-security-policy to unblock functionalities such as custom function, which will show a rule blocked by CSP pop-up when blocked. Refer to Extensions - Optional section for more information.

I've reported this to the maintainer, and they say

we generally do document web compat issues like this, so i will ensure i add this specific case, appreciate you letting us know!

i agree it’s probably worth documenting the csp policies more broadly as well though, so will definitely look into that too. ideally for ironfox i’d like to add a way to control it per-extension at some point, via ui or otherwise.

IronFox sends DNT, and you can go to about:config and toggle privacy.donottrackheader.enabled to false to remove it if you want. Refer to Do Not Track (DNT) and Global Privacy Control (GPC) section for more information.

Next: 6. Explanations