HTML5 fullscreen API makes TB fingerprintable, disable it!

added component::applications/tor browser owner::mikeperry priority::high resolution::wontfix severity::normal status::closed tbb-fingerprinting-resolution tbb-linkability type::defect labels

Trac:
Cc: N/A to gk

Is there a better channel for reporting these kind of bugs? Where the "other side" isn't reading along...

I feel kind of uncomfortable now about having reported it here.

Proof of concept screen size fingerprinter: https://rawgit.com/anonymous/11543371dbc4052c1b1a/raw/e253cd0bafb2844bcd3ec971528fc67c72c66d36/jsbin.cicediwe.html

Trac:
Summary: HTML5 fullscreen API makes TB fingerprintable? Disable it? to HTML5 fullscreen API makes TB screen size fingerprintable, disable it!
Priority: major to critical

More bad news: It's not only the screen size that is fingerprintable here, but also very probably the OS. Because what the attacker gets is the innerHeight/innerWidth - of a full screen window!

Trac:
Summary: HTML5 fullscreen API makes TB screen size fingerprintable, disable it! to HTML5 fullscreen API makes TB fingerprintable, disable it!

It's not only way to get fingerprints today. Look at #9881 (moved) Many desktops in the world shares 640x480 (that reveals by this bug for example), but not so much browsers shares limitations for avail window size (that reveals by #9881 (moved)).

Proof of concept screen size fingerprinter Can it fingerprint automatically without click on page visit?

Trac:
Summary: HTML5 fullscreen API makes TB fingerprintable, disable it! to HTML5 fullscreen API makes TB screen size fingerprintable, disable it!

Trac:
Summary: HTML5 fullscreen API makes TB screen size fingerprintable, disable it! to HTML5 fullscreen API makes TB fingerprintable, disable it!

Because what the attacker gets is the innerHeight/innerWidth - of a full screen window! Why do you think it's inner size? My test reports real_desktop_width x (real_desktop_height - 1px).

Replying to cypherpunks:

Can it fingerprint automatically without click on page visit?

User interaction (clicks, hover, keyboard, etc.) is supposed to be necessary. Not a very high bar, though.

Replying to cypherpunks:

Because what the attacker gets is the innerHeight/innerWidth - of a full screen window! Why do you think it's inner size? My test reports real_desktop_width x (real_desktop_height - 1px).

Me too (Linux)... I assumed that's some weird GUI toolkit leftover pixel. Maybe I'm wrong and it's the same on every platform.

Replying to cypherpunks:

It's not only way to get fingerprints today. Look at #9881 (moved)

TB should really really set dom.disable_window_move_resize = true and browser.link.open_newwindow.restriction = 0. The current situation is horrific.

Trac:
screen-size-anti-fp.patch

screen size anti-fingerprinting patch

Please let me know if screen-size-anti-fp.patch is a good approach.

Trac:
Component: Firefox Patch Issues to TorBrowserButton
Status: new to needs_review

Trac:
Cc: gk to gk, lunar

This bug is about the fullscreen API. The other preferences the patch manipulates do not have anything to do with that.

Trac:
Priority: critical to major
Status: needs_review to needs_revision

The other two prefs fix #9881 (moved) (which is closely related) and are listed in ticket:9881#comment:22 for discussion. Should I split them up? But then you'd have to merge the lines manually anyway.

Proof of concept screen size fingerprinter Site expired, it doesn't works properly now.

<html>

<head>
<title>HTML5 fullscreen API fingerprinter</title>
<script>
function fingerprint() {
  document.getElementById('x').mozRequestFullScreen();
  setTimeout(function(){ window.alert(screen.width + "x" + screen.height); }, 1000);
}
</script>
</head>

<body onclick="fingerprint()">
<h1 id="x">click anywhere and wait a second</h1>

<p>1
<p>2
<p>3

</body>
</html>

Hello other [comment:16 cypherpunks],

{{{

1

2

3

Personally, I would rather fix the root Firefox bug here to actually prompt before making the widget full screen. Disabling full screen for everyone is bad UX. In terms of the number of people who will complain about either property, I think more will complain if we fully remove their ability to watch full screen videos.

Just about the only thing that would convince me otherwise is if this fingerprinting could be done invisibly, without the user becoming aware of it via a full screen video suddenly playing.

Replying to mikeperry:

Just about the only thing that would convince me otherwise is if this fingerprinting could be done invisibly, without the user becoming aware of it via a full screen video suddenly playing.

It can. The element does not have to be a video (or even be visible), and we can exit fullscreen mode right away (without user interaction) after the screen dimensions have been extracted.

Here's a v2 proof of concept that leaves fullscreen after 500 ms. Obviously this flicker could be reduced much further (100 ms worked fine, 10 ms didn't), but I'm not familiar enough with JavaScript and FS API race conditions to try.

https://rawgit.com/anonymous/eceb468086375f942c2f/raw/36ea4683bdba6315e828026a9a97f23fba775320/fs-v2.html

It's true that the proper fix would be to open the permission dialog before entering fullscreen mode, but I hope we can use this pref as a temporary bugfix until then.

Trac:
Username: faether

It's possible to set a video to fullscreen automatically (with javascript). I'd say to either prompt user when they try to enable full-screen that doing so reduces their anonymity slightly, or go with mikeperry's proposed solution below.

Per mikeperry's mention in #tor-dev, limiting full-screen mode to the size of the browser window still allows someone to make an educated guess at resolution. Which is still a big improvement over the default.

Uh oh, there's onresize events firing all over the place when you go to fullscreen. See below in the log, that number 1000x689? That's my actual browser window size, without the X11 border, +5px in height. Same strange 5px increase for the screen height, 1055.

[17:13:11.255] "1409245991255 pre-fs   1000x600"
[17:13:11.308] "1409245991287 onresize 1000x689"
[17:13:11.360] "1409245991360 onresize 1000x689"
[17:13:11.370] "1409245991370 onresize 1680x1055"
[17:13:12.256] "1409245992256 1000ms   1680x1055"
[17:13:12.257] Exited full-screen because full-screen element was removed from document. 
[17:13:12.273] "1409245992272 onresize 1680x966"
[17:13:12.317] "1409245992317 onresize 1000x600"
[17:13:13.256] "1409245993256 2000ms   1000x600"

generated using fingerprinter v3: https://rawgit.com/anonymous/f63b0650637fef3dcdf1/raw/a4199acc17e23ca301a4b71bbe916143b9b5f89b/fs-v3.html (try running it multiple times if it doesn't get your browser window size)

Trac:
Username: faether

I thought finding out the actual window size (incl. chrome), in a addition to the screen size, seemed pretty serious. Has nobody else been able to reproduce this using the v3 fingerprinter?

Trac:
Username: faether

FWIW, I think that #12977 (moved) is the right way to deal with this issue.

Trac:
Keywords: tbb-fingerprinting deleted, tbb-fingerprinting-resolution added

Trackers now send back every change of resolution, so that in conjunction with timers it can be used to defeat FPI.

Trac:
Keywords: N/A deleted, tbb-linkability added
Sponsor: N/A to N/A
Reviewer: N/A to N/A
Component: TorBrowserButton to Applications/Tor Browser
Severity: N/A to Normal

Trac:
Username: tokotoko
Cc: gk, lunar to gk, lunar, fdsfgs@krutt.org

We should ensure the prompt works properly, not disable fullscreen.

Trac:
Resolution: N/A to wontfix
Status: needs_revision to closed

closed

mentioned in issue #32713 (moved)

mentioned in issue #33479 (moved)

moved to tpo/applications/tor-browser#12609 (closed)

mentioned in issue tpo/applications/tor-browser#33479

HTML5 fullscreen API makes TB fingerprintable, disable it!

Child items ...

Activity