BeZilla/Bon Echo security and privacy guide

BeZilla (referred to as Bon Echo in the program itself) is a port of Firefox 2 for BeOS and Haiku. It is old but still useful for casual Web browsing, particularly on computers with slower processors and/or a low amount of RAM. It also has a more complete user interface than WebPositive and NetSurf.

This page describes how to configure it for maximum security and privacy.

Recommended settings

Choose "Options…" from the Tools menu, then:

Under "Content"

• Check "Block pop-up windows" (it should be by default).
• Uncheck "Enable JavaScript". This is very important because the majority of security vulnerabilities discovered since this browser was released can be prevented by disabling JavaScript.
• Uncheck "Enable Java".

Under "Privacy"

Uncheck "Accept cookies from sites" and define exceptions if necessary.

Under "Advanced"

In the Encryption tab, uncheck "Use SSL 3.0" and check "Use TLS 1.0". This is also very important.

Note: TLS 1.0 is not the best anymore, but it is an improvement and most sites will not work otherwise. You may still want to use WebPositive for logging in to sites (as opposed to just reading) because it supports newer encryption protocols.

In about:config

Disabling obsolete encryption protocols

After you have disabled SSL 3.0 and enabled TLS 1.0, set the following to false:

• security.ssl3.ecdh_ecdsa_rc4_128_sha
• security.ssl3.ecdh_rsa_rc4_128_sha
• security.ssl3.ecdhe_ecdsa_rc4_128_sha
• security.ssl3.ecdhe_rsa_rc4_128_sha
• security.ssl3.rsa_fips_des_ede3_sha
• security.ssl3.rsa_rc4_128_md5
• security.ssl3.rsa_rc4_128_sha

Changing the user agent string

You may want to change your user agent string, since BeZilla (and any BeOS/Haiku browser) is sure to stick out among others.

The simplest way is to create a string setting called general.useragent.override and set it to the desired user agent string.

If you want to switch between multiple user agent strings, you can use the User Agent Switcher extension. This sets the above setting for you, but uses the default unless you change it manually for every session.

Disabling the Referer header

By default, the browser sends the Referer (not "Referrer"!) header, which tells Web sites where you came from (if you followed a link from another page). To disable it, set network.http.sendRefererHeader to 0.

Blocking advertisements

With AdBlock Plus

This is the simpler option.

1. Get AdBlock Plus from ToastyTech.
2. Install it by choosing "Open File…" from the File menu, then choose the AdBlock Plus XPI file (AdBlock without the Plus does not work).
3. The browser will restart.
4. Once installed, it will ask you to choose a filter list. Do not choose any; instead, open its Preferences window and import Easylist.txt manually. This will take a long time (2 hours or more, depending on the speed of your computer) during which the browser will not respond. Be patient.
5. After the list is imported, click "OK" to save it.
6. You can then delete the downloaded files.

With Privoxy

The other option is to run Privoxy on another computer (since it isn't available for BeOS/Haiku) and then configure the browser to use it as a proxy.

Firefox 3.0a1

There exists a Firefox 3.0a1 for BeOS and a port of SeaMonkey from about the same time, but neither works on Haiku; they crash when trying to open a page. If anyone has any solutions or knows where to get the source code, I would be grateful.