Having your puppy firewall is a good start, but the browser can be a SIGNIFICANT problem. about:config is your friend.
1.) autocomplete and typeaheadfind need to be FALSE.
2.) Telemetry needs to be FALSE except for addons and certs, urls to 127.0.0.1 ditto for send
3.) Fingerprint needs to be TRUE except 'block_mozAddonManager', logs to Warn.
4.) geo.enabled false
geo.prompt.open_system_prefs false
geo.provider.geoclue.always_high_accuracy false
geo.provider.network.url 127.0.0.1
geo.provider.use_geoclue false
5.) 'webgl.enable-debug-renderer-info' to FALSE (search-term DEBUG makes this the LAST ENTRY)
*** EDIT: add #6 ***
6.) TOSS Google
Search term safebrowse
false all, https = 127.0.0.1, empty the lists.
repeat for goog
https://browserleaks.com can help with ssl/tls... in FF the minimum is 4, but 3 is also acceptable if Forward Secrecy enabled
Regards N97