[I've heard] it's better to configure TBB using about:config
There are potential reasons you might possibly want to do this but there are things that these direct changes do not take into account, especially with the TBB.
Regarding the listed settings specifically, the issues with them are either:
They are items that already have counterparts in TBB without about:config.
They are semi-permanent solutions that can potentially cause more problems than they solve (depending on website and browsing habits).
The security concerns they address are not invalid but should be approached with thought.
It seems [about:config] does not exist in recent [versions of the] TBB.
I cannot speak for other versions, but about:config is accessible in the current revision of the Windows Tor Browser Bundle (v7.0.2).
The entries for xxx.sendSecureXSiteReferrer do seem to be missing from the basic about:config settings and likely need to be manually added if you wish to work with them.
Are [changes to these settings] really necessary? Is setting the security slider to high insufficient?
It depends greatly on what you call "insufficient". For the majority of users, using the "High" security settings in TBB is perfectly acceptable. That said, however, it does not cover every possible anonymity issue.
Per this Mozilla Article, this disables all cookies ("No cookies are allowed").
The security slider, even set at "High", does not disable all cookies. But this same behavior is available in the TBB without about:config:
- Enable the Menu Bar (Along the top browser edge, right-click → Menu Bar)
- Select Tools → Options, then choose "Privacy"
- Uncheck "Accept cookies from sites"
Below is a screen shot of about:config after making these changes:
To be clear, this setting was not directly altered in about:config.
On a privacy note (pun intended), while you are in the Privacy settings, I personally would also:
- check that "Always use private browsing mode" is marked (it should be if the security slider is set to "High").
- empty any current cookies in the cookie cache.
- disable all three options for "Location Bar" (this helps prevent local snooping).
Note that cookies are something you may wish to turn back on later depending on site requirements. But using the TBB Privacy interface is (again) probably simpler than messing with about:config.
HTTP(S) Referer Headers
These two entries currently do not appear to be standard options available in about:config. But since at least one seems to be a valid option regarding HTTPS Referer headers, these apparently need to be manually added to about:config. Regarding the basic HTTP Referer setting:
per this Mozilla Article, this toggles HTTP headers off ("Never send the Referer header or set document.referrer").
There are no settings in the TBB for Referer headers. The following paragraph from the Tor Browser Design Document gives us some insight:
When leaving a .onion domain we set the Referer header to the destination to avoid leaking information which might be especially problematic in the case of transitioning from a .onion domain to one reached over clearnet. Apart from that we haven't disabled or restricted the Referer ourselves because of the non-trivial number of sites that rely on the Referer header to "authenticate" image requests and deep-link navigation on their sites. Furthermore, there seems to be no real privacy benefit to taking this action by itself in a vacuum, because many sites have begun encoding Referer URL information into GET parameters when they need it to cross HTTP to HTTPS scheme transitions. Google's +1 buttons are the best example of this activity.
The main takeaways are:
- TBB already takes some steps to obscure potentially delicate Referer information.
- Many (normal) sites break without HTTP Referer information.
- Referer information is not necessarily just in the HTTP Referer header.
So while these about:config options for HTTP(S) Referer headers can be set, the points above are things to consider.
Another thing to consider (and which is likely far more relevant for general browsing) is that sometimes Referer information can be blocked by simply not clicking links to sites but rather copying and pasting.
That is, when a link is copied and dropped into a new tab, the Referer header is generally blank. More broadly, many URLs come with tracking information that is not necessarily connected to actually displaying the page (and thus can safely be left off).
Leaking Referer information isn't necessarily trivial and I can't evaluate your situation. But strictly as a personal opinion, doing something like disabling Referer headers seems like a headache unless you have serious privacy concerns.
Checking Security Settings
Regardless of what settings you decide to use, I suggest you confirm that Tor is operating properly then periodically use services like JonDonym's IP Check and The EFF's Panopticlick to help verify your overall security.