Privacy & Anonymity

The Hardened Browser

Your browser is the single most revealing thing on your machine. It remembers where you’ve been, stays logged into who you are, hoards cookies that track you across the web, and broadcasts a user-agent string that helps fingerprint you. Oniomarchy ships a hardened Firefox configured to give as little of that away as possible — the browser you’d have set up by hand anyway, done for you the moment the install finishes.

It sits alongside your normal browser, not on top of it. Omarchy’s default browser (Chromium) is left exactly as it is; this hardened Firefox is the security browser you reach for when you want the machine to forget what you did. The whole configuration is applied through Firefox’s supported enterprise-policy mechanism, so it’s consistent and survives updates.

What’s hardened

Everything below is set out of the box:

• Permanent private browsing. Firefox starts in private mode every time and keeps no history — nothing about your session is written to disk.
• Clears cookies and site data on exit, so even within a session nothing lingers after you close the browser.
• Global Privacy Control turned on — the standardized “do not sell or share my data” signal sent to every site.
• No saved passwords. Firefox won’t offer to store logins — that’s KeePassXC’s job, not the browser’s.
• DuckDuckGo as the default search engine, so your queries aren’t feeding a profile.
• Prompt before every download, so files land where you choose, not silently in a Downloads folder you forget about.

The extensions

Five extensions come pre-installed (and stay removable, so you can drop one mid-engagement if you need to):

A consequence worth stating plainly: because the browser forgets everything on exit, you won’t stay logged into a target application across a restart. That’s usually exactly what you want on an engagement; occasionally it’s mildly annoying. The private-browsing setting is left toggleable in the UI for the rare session where you need persistence.

Ready to intercept

The hardened browser is also pre-wired for web app testing. FoxyProxy ships with proxy entries already defined for Burp and Caido, so switching your traffic into an intercepting proxy is one click instead of a settings dive:

The two collide on port 8080 by default, so the setup pins Caido to 8081 — set Caido’s listener to match in its own settings.

The last piece is trusting the proxy’s certificate, so HTTPS pages don’t throw errors when you intercept them. Start the proxy, then pick Trigger → Pentest → Trust Proxy CA — it trusts the certificate system-wide, so Firefox, Chromium, and curl are all covered at once. See Quick Attack Actions.

A bookmarks folder

All of the Webapps — CyberChef, Shodan, revshells.com, GTFOBins, and the rest — are also dropped into an “Oniomarchy” bookmarks folder, so they’re reachable from inside the browser as well as from the menu.