Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Going to I can see that that Firefox and Chrome expose more about 'System Fonts' and 'Browser Plugin Details' than I prefer.

How can the permission of a web page to access these settings be disabled in Firefox and Chrome?

share|improve this question
For System Fonts you have to disable Flash. Still looking for Plugins. – pkario Jun 5 '11 at 5:35
Actually, disabling Flash doesn’t cut it; it can still enumerate them another way. – Synetech Mar 13 at 8:08

There are two questions but I am answering the font list question:

It is possible to disable Flash font enumeration using mms.cfg system wide configuration file. This file should be located in /etc/adobe/ directory if you are using Linux. Basically you just need to put the following line in the file:

DisableDeviceFontEnumeration = 1

See the Adobe Flash Player Administration Guide for more details.

With this setting Panopticlick and other sites can not get your font list via Flash.

Note that the font list is still available through Java if you have it installed. It is a good idea to get rid of Java anyway. If you use a couple of sites that require Java, use a different browser instance with a different user profile with Java enabled just for those sites.

share|improve this answer
On my Windows 7 machine, the file is located at C:\Windows\SysWOW64\Macromed\Flash\mms.cfg – MikeFHay Mar 27 '13 at 20:17
You could simply disable Java and Flash in your browser extensions. This worked for me. – 5chdn May 9 '13 at 10:55
Thank you so much! This works on my PC (Windows XP). Panopiclick still recognises me as a unique visitor, though. through my list of plug-ins... – Cerberus Sep 11 '13 at 0:28
Works for me on XP, too. FWIW, the file location was C:\WINDOWS\system32\Macromed\Flash\mms.cfg. – martineau Sep 25 '13 at 8:59
Did not work for Chrome on OS X. Turns out, Chrome uses its own Flash plugin, which has a separate configuration file. Its path is ~/Library/Application Support/Google/Chrome/Default/Pepper Data/Shockwave Flash/System/mms.cfg (create System/mms.cfg if it doesn't exist.) – Dan Dec 29 '13 at 19:19

The free Chrome extension RubberGlove blocks plugin and mime-type enumeration by cloaking the array entries in roughly the same way Firefox and Internet Explorer can/do natively.

You still need to set chrome to "Click to play" plugins and disable 3rd-party cookies in Chrome's privacy settings yourself. Also, as was mentioned in the study, you'll still probably show up as unique until enough people start using plugins like this.

Full disclosure: I'm the author.

This functionality may (or may not) be integrated into the Electronic Frontier Foundation's Privacy Badger extension in future. They seemed interested, anyway.

share|improve this answer

In Firefox 28:

Type about:config the location bar

Find plugins.enumerable_names

Set the entry to nothing.

Visit to verify plugins are no longer listed.

share|improve this answer
To white list use this format plugins.enumerable_names: Java,QuickTime,Shockwave – Tilo Oct 21 '14 at 16:42
To revert this method, change the entry back to * – ᴉʞuǝ Mar 28 '15 at 18:13
I don't see this setting in FireFox 41. Anyone know where it is now? – Kelly Thomas Oct 18 '15 at 10:13

Javascript has ability to check what plugins are installed, this is generally used to give a "install missing plugin" message if needed. If you want, you could disable plugins in the settings, and disable Javascript using an addon like Javascript Blacklist for Chrome, or Quick Java statusbar for Firefox.

share|improve this answer
Where can you disable plugins in the settings? – martineau Sep 27 '13 at 22:34
from tools-addons menu. – NoBugs Sep 28 '13 at 5:21

Absolutely possible with Proxomitron.

Prox is like NoScript, HTTP LiveHeaders, RequestPolicy, CookieSafeguard, BetterPrivacy, and whatnot, all put into one program. It's not developed further, but still guarantees me privacy no other tool can do.

The Proxomitron is a universal web filter. Info from their site:

The Program

For those who have not yet been introduced, meet the Proxomitron: a free, highly flexible, user-configurable, small but very powerful, local HTTP web-filtering proxy. To become better acquainted, please see our online version of the Proxomitron Help files for a more comprehensive overview.

The current (and last) version of Proxomitron is Naoko 4.5, of which there were two releases, one in May of 2003 followed by one in June. Although very similar, there are distinct differences between the two which are not mentioned in either program's documentation. Both releases are available in the Files section. P.I's focus will be on the latest version -- the June release.

The Author

Scott R. Lemmon originally developed the Proxomitron for his own use. He then decided to release it to the public and made himself available to users via email and in several Proxomitron user-discussion groups. His support, like his program, was always free.

With the release of Naoko 4.5, Scott discontinued all further development and support of his program and pulled the official home of Proxomitron off the Web. We respected his decision to move on and wished him all the best -- which is, after all, what he consistently gave to us.

Sadly, one year later, Scott died -- but his brilliance of mind and spirit lives on. Simply put, Proxomitron is a reflection of its creator: To know Scott's program . . . is to know Scott Lemmon.

Check it out! There's a (somewhat) active community.

share|improve this answer
Wow, people are still using Proxomitron, even with Windows 7, Chrome, etc.‽ ಠ_๏ I guess Scott really did a great job with it. I haven’t used it in a long time; I guess I should get it out. – Synetech Jan 29 '13 at 2:54

As of Firefox 17 you can enable 'click to play' which stops Java and Flash loading automatically. This in turn stops a lot (not all) info being discovered. For example, stopping Flash plugin prevents most fonts being discovered.

To enable 'click_to_play' in Firefox:

  • got to 'about:config' in your address bar
  • search for 'click_to_play'
  • double click on the entry to toggle the value from 'false' to 'true'
  • close the tab
  • next time the plugin is required, you will get a prompt giving you the option to enable it
share|improve this answer
Isn't this essentially what the Flashblock add-on accomplishes in many other versions of Firefox? – martineau Sep 25 '13 at 9:23
This did not work for me. – mlibby Apr 17 '14 at 17:08

Solution for latest firefox browsers is to:

  • Use Random Agent Spoofer. It recently added options to turn off plugin enumeration:

  • Or use a user script as shown in Mechazawa's comment in the above link. You can use his Greasemonkey or Tampermonkey script (both firefox and chrome) to take care of this without any extension.

I can confirm that this shows plugins as "undefined" in the panopticlick test.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .