fidzu : thunderbird

Firefox is strengthening protection against trackers that recognize you across websites, even when they don't use cookies. The latest fingerprinting protections shipped in Firefox reduce the extractable distinguishing details, making more Firefox users look alike to tracking scripts and strengthening individuals' privacy in everyday browsing.

These protections build on our research into browser and device fingerprinting, a technique that combines details about your browser and device to identify you across websites. We investigated which details contribute most to make users uniquely identifiable, turned those findings into practical protections for Firefox users, and shared our results openly so the wider web security and privacy community can build stronger defenses.

Our findings are documented in the research paper Large-Scale Measurement and Real-World Mitigation of Web Browser Fingerprinting in the Wild, which has been accepted for publication at Computer and Communications Security (CCS) 2026, a leading international conference on computer security and privacy. We've also created an easier-to-digest website and browser test suite to help explore the findings in the paper.

Cookie-less Tracking

Browser fingerprinting combines details about your browser and device, such as available fonts, screen dimensions, and graphics hardware, to build a uniquely recognizable profile. Each piece may seem ordinary, but together, they can enable trackers to single you out across websites, even without storing a cookie.

Effective fingerprinting protection starts with understanding which browser details trackers rely on most. Our research found that protecting just a handful of browser features can significantly weaken popular fingerprinting techniques. That finding enabled us to focus on Firefox's protections where they can make the biggest difference and bring those benefits to all Firefox users.

To evaluate these techniques, we simulated the browser measurements collected by fingerprinting scripts from Fingerprint Pro, Signifyd, and Akamai and examined how their combinations distinguish users. The study used measurements collected from nearly 25 million Firefox users, with additional privacy safeguards beyond Mozilla's existing data collection policies.

Those safeguards included OHTTP, which routed encrypted requests through a relay. The relay sees the user's IP address but not the request contents, while Mozilla receives the contents without the user's IP address. We also tightly limited data access and retention: individual telemetry records were deleted several months ago and only aggregate results were retained and published for open science. Our research paper explains the method, safeguards and ethical considerations in detail.

Less distinctive, more private

Our approach reduces unnecessary differences in the information Firefox exposes to websites. For example, Firefox limits the information exposed through screen resolution APIs to hide the size and position of the system taskbar or dock, preventing that desktop layout detail from contributing to a fingerprint. As another example, it can report processor counts as either 4 or 8 instead of exposing the exact count, which can make a browser more distinctive.

Our goal is to make more users' browsers look similar to fingerprinting scripts while preserving the information websites need to function correctly, like language and timezone settings. Firefox also uses randomization to make other fingerprinting signals less useful to trackers, though the benefits of these techniques are harder to quantify and fall outside the measurements reported here.

In our evaluation, these protections (the most recent of which shipped in Firefox 145) substantially degraded the precision of fingerprinting in Firefox both by reducing the number of users with unique fingerprints and increasing the size of the groups of users that share a fingerprint.

The research also enabled us to identify why certain measurements differed between users. Addressing these differences produced more consistent outputs for image rendering, Web Audio, and mathematical operations on Android, reducing the distinguishing details available to fingerprinters.

These results show that substantial reductions in browser fingerprint uniqueness are achievable and provide meaningful progress toward stronger online privacy. These do not make fingerprinting impossible as trackers can surely adapt. But our research provides a concrete, measurable improvement in browser defenses against online tracking.

The built-in privacy protections in Firefox are complemented with capabilities and options to further strengthen the protection against online fingerprinters. Built-in and always-on Total Cookie Protection in Firefox segments stateful identifiers and prevents trackers from following you across your browsing using cookies. Firefox Relay provides you with unique email masks, preventing websites from linking your subscriptions to other sites via data brokers. And Firefox now integrates a free VPN that masks your IP address to protect against tracking and fingerprinting. Together with Firefox's enhanced fingerprinting protections, these capabilities provide everyone a very strong foundation to take back control of their privacy online.

Research that improves everyday browsing

Privacy protections need to work on the websites people use every day. These findings allow us to prioritize changes that deliver measurable privacy benefits while keeping those websites working.

Some of Firefox's fingerprinting protections, such as hiding the size of your taskbar or dock, are on by default in all browsing modes. Others are introduced first in Private Browsing and Strict Enhanced Tracking Protection (ETP) mode, while we work toward enabling them by default, following the same strategy we've used for years. To enable these additional protections in all your Firefox windows, select Strict in the Enhanced Tracking Protection settings. Follow the steps here if the "Strict" protections get in the way of any website functionality.

Want to explore browser fingerprinting yourself? Visit the research project page to try the fingerprinting test and learn more about our findings. For a closer look at what we measured and how we turned those insights into Firefox protections, explore our paper: Large-Scale Measurement and Real-World Mitigation of Web Browser Fingerprinting in the Wild.

We'll keep strengthening Firefox's privacy protections while continuing to work in the open. By sharing our research, our code, and what we learn, we're shaping the web we envision: free, private, secure, and accessible to all.

The post Open research, stronger privacy: Making Firefox users harder to fingerprint appeared first on Mozilla Security Blog.

10 Nov 2026 6:36pm GMT

In the last update, the team shared ongoing work around removing technical jargon and adopting plain language so everyone can navigate settings with ease. Those initial content refinements have rolled out into Thunderbird already (v160).

Following those copy updates, the team ran research to evaluate how settings information is structured. Below is a breakdown of what the data revealed, how those findings shaped an interactive prototype, and the plan for incremental rollout.

If you don't have time to read the full research summary, here are the key points. We had an overwhelming response to the research study, so we have feedback from many different perspectives and use cases. Some of the new organization of categories weren't as easy to find because of the language or because it was too hidden, so we've updated those and it's reflected in the new prototype linked below.

Research overview

Who took part in the study

• 381 community members
• 42 countries represented
• 88% use Thunderbird on a daily basis

About the structure of the study

To evaluate the proposed information architecture, the team conducted a tree test.

A tree test evaluates a text-only hierarchy with no visual styling. It isolates structure from visual design, reveals the exact navigation paths taken to complete a task, and saves development effort by validating organization before code is written. The scenarios that we tested alongside the tree test focused on key areas users have been bringing up as things they change often or have been confused about in the past.

However, there are trade-offs: without visual cues (icons, layout, color), success rates in tree tests are often artificially lower than in a functional app. Crucially, a tree test cannot simulate an active search bar, a primary navigation method for many participants. That is why testing an interactive prototype is the next step.

What worked well

• Appearance: Locating appearance-level preferences was straightforward for roughly 60% of respondents (though some initially checked Themes, expecting menu and button colors there).

• App updates: Update controls were well understood within the test, with most participants noting they typically check version details via Help > About.

• Set up mobile: Located successfully by most participants. However, those looking for account sync preferences frequently navigated to Synchronization & Storage.

What needs improvement

• Global vs. Account settings: Participants voiced frustration with a rigid divide between Global Preferences and Account Settings. Switching back and forth depending on whether an option applies to one account or the whole app feels disjointed.
  • "My only concern is that you seem to be keeping 'Settings' and 'Accounts' separate… they should be merged or use a separator on the same page."
  • "I continue to be bemused by the strong separation of settings and account settings."

• Category naming misalignment: Having dedicated top-level categories for Calendar and Chat, while categorizing core email behavior under Composition, created confusion. High confusion also surfaced with the difference between Appearance, Themes, and Add-ons & Themes as there is overlap.
  • "Calendar setting seems a bit odd, as there isn't 'Mail', 'Contacts', or 'News' sections. Where are their settings?"

• Ambiguous Labels: Labeling a section "New Features" left participants unsure whether it contained release notes or experimental settings. Suggestions strongly favored clearer, purpose-driven labels like Thunderbird Labs or Experimental Features.

• Search dependency: A significant group, particularly power users and Linux desktop users, noted that manual category browsing is a secondary option. The primary workflow is jumping straight to the search bar. While search cannot be tested within a tree test framework, this reinforces search as a first-class feature in modern settings.

Feedback from participants who provided detailed qualitative comments:

• ~35% shared positive reactions, citing intuitive grouping and clearer organization.
• ~20% expressed resistance to change, emphasizing the need for stability, preservation of traditional menu workflows, reliable dark mode support, and caution against redesigning elements without functional improvement.

Turning feedback into design decisions

We've taken all that feedback into consideration and designed a lightweight prototype that uses a new way to structure the information. Some folks might not notice the new changes, but we hope this makes discovery easy for new users while maintaining the flexibility our user base values.

You'll also notice the prototype doesn't have all the functionality built in so some things might not work, nor does it adapt to your operating system so it displays specific language appropriate for macOS, Windows or Linux.

Test the prototype

What's next

One area deliberately not tackled in this prototype is the split between Account Settings and Global Settings. Bridging that gap requires deeper architectural changes. To avoid over-complicating this iteration, changes are being kept incremental.

Overhauling settings across a mature application cannot happen in a single, disruptive release. Each functional piece will include direct avenues for testing and feedback before graduating to beta and stable channels.

Thank you to everyone who took part and contributed such thoughtful feedback.

The post From Research to Prototype: Testing the New Desktop Settings appeared first on The Thunderbird Blog.

10 Nov 2026 3:10pm GMT

Whether you're heading home to see family this winter or taking a well-earned break before the year wraps up, we want you to browse with a little more peace of mind. That's why, as our gift to you, everyone using Firefox's free built-in VPN gets unlimited data starting today, November 10, through January 31, 2027. Sign in with a Mozilla account and unlock extra privacy for all that shopping, travel planning, and everyday browsing, no gift receipt required.

Using Firefox's free built-in VPN makes it harder for websites to use your IP address to determine where you are, or connect your visits across the web. Most importantly, you're not trading your browsing data for that protection: Firefox doesn't sell your browsing data, interrupt you with ads, or keep a record of the websites you visit.

You can use VPN to:

• Keep the sites you visit private on shared Wi-Fi. You might use café Wi-Fi to check your itinerary, or look up something you'd prefer to keep to yourself while at a relative's house. Turning on VPN helps hide the sites you're visiting from whoever runs those Wi-Fi networks so your browsing habits stay your own.
• Change your browsing location. Firefox's built-in VPN lets you change where your connection appears to come from, making it easy to check news from home while abroad.

Two things to remember:

1. VPN doesn't make you anonymous online or hide browsing history on your device. Websites can recognize you through cookies or when you sign into an account. Use Private Window to browse without logging new visits in your Firefox history.
2. Firefox's built-in VPN only covers browsing within Firefox. For protection across other apps on your device, check out Mozilla VPN (a separate, paid subscription service).

Firefox's free built-in VPN is available to people using Firefox on desktop and Android (iOS is coming soon!). To start using the service:

• Sign up for a Mozilla account if you don't yet have one.
• Select the VPN icon in Firefox's toolbar on desktop or open the three-dot menu and go to Settings > VPN on your Android device.
• Follow the setup prompts, turn on VPN, and start browsing.

You can check for availability in your region and review full instructions for using VPN on desktop and Android in our Help Center.

Download Firefox to try it out today.

The post Firefox's free built-in VPN uncaps data limit through January 2027 appeared first on The Mozilla Blog.

10 Nov 2026 2:00pm GMT