While Firefox is A) slower than Chrome and B) making some poor security decisions recently (ie. non-optional Pocket integration - with its recent security meltdown - and the recent unveiling of the Speculative Connect API), I think they're still the best browser choice because of their openness and the excellent selection of plug-ins. It continues to be my browser of choice. Most settings are done through the "Options" or "Preferences" menu (the name has varied between platforms and releases and I don't think it's ever stabilised), although if you're dealing with Add-ons (installing, disabling, etc.) there's a specific "Add-ons" menu.
Options or Preferences
- Search: set the "Default Search Engine" to DuckDuckGo: I admit the results aren't quite as good as Google, but that's because they're not slurping up your history and preferences and storing all of it to improve future searches. I prefer the privacy.
- Content: check "Block pop-up windows" - this has been a default for a while, but it's generally preferable. There's a button for allowing exceptions.
- Privacy: I usually click "Tell sites that I do not want to be tracked," but it's pretty much laughably useless these days
- Privacy: I recommend, but admit that I do not use, "Always use private browsing mode." I find my history too useful to give it up.
- Privacy: under Cookies, set "Keep until:" to "ask me every time." This is fantastically annoying, but it acts as a constant reminder of the invasiveness of modern websites.
- Advanced -> Data Choices: turn off "Enable Firefox Health Report" and "Enable Crash Reporter"
- Advanced -> Network: reduce the size of the "Cached Web Content" - I usually use 20-30MB, but if you're very privacy-oriented, 0 would be good.
- Advanced -> Network: check "Tell me when a website asks to store data for offline use"
- Advanced -> Update: turn off automatic update of Search Engines
- Adblock Plus: blocks ads (which are occasionally carrying malware)
I consider these two utterly essential.
- Cookie Monster: a more polite and less intrusive method than the "always ask" mentioned above
- Nuke Anything Enhanced: "Allows you to hide almost anything via context menu 'Remove Object.'"
- Privacy Badger: "Protects privacy by blocking spying ads and invisible trackers" (a product of the EFF, which is good enough for me)
- Remove It Permanently: "Permanently hide content from web pages using the Context Menu."
More obscure settings - and sometimes settings that Mozilla is possibly deliberately trying to hide - go into "about:config". This massive clump of interesting (and occasionally scary) settings is accessed by typing "about:config" (without the quotes) into the URL bar. If this is your first time accessing it, you may get a warning about "voiding your warranty." Since you didn't really have one anyway, you probably want to proceed (although they're not kidding: you can break your browser if you're not careful).
- browser.pocket.enabled = false - disable Pocket entirely: we can't remove it, but this is more secure than just not using it (I got the impression it phones home even if you don't use it)
- network.http.speculative-parallel-limit = 0 - disable prefetching of links that are hovered over
- network.prefetch-next = false - disable prefetch: prefetching of links can be requested by a site, this disables it even if it's requested
- network.dns.disablePrefetch = true - disable speculative prefetching of DNS information for the page you're looking at
UPDATE: the EFF offers Panopticlick to test your browser's security.
These are extensions I find useful that aren't related to privacy:
- Extended Statusbar: "A Statusbar with speed, percentage, time and loaded size" (useful for a web developer)
- FaviconizeTab: minimize the size of a tab to just the size of the favicon
- Firebug: a superb page inspector (HTML, CSS, JS) for developers
- Firepath: requires Firebug, shows XML path of a particular element: hugely useful if you're working with certain things, in my case Selenium ... otherwise incredibly obscure and unnecessary
- Tab Mix Plus
- Greasemonkey: allows you to include user-written JS scripts on any page. The value ranges from "brilliant" to "flat out dangerous," and it could also be filed under "Privacy Extensions" above ... but I don't use it most of the time because I don't trust the scripts
- Theme Font & Size Changer: 2016-01-10 with an extremely high res screen this may be useful for bumping up the size of UI elements and fonts
- TiddlyFox: for TiddlyWiki, has no use if you don't have that
- Tilt 3D: silly, wonderful, and actually quite useful: it provides a 3D rendering of the DOM to show you which elements are inside which other elements
- Web Developer: used to use this a lot, not sure it hasn't been completely superseded at this point ...