Opened 5 years ago

Last modified 4 years ago

#18559 new defect

Number of logical processors is detectable from web content

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-fingerprinting, ff52-esr
Cc: mcs Actual Points:
Parent ID: Points:
Reviewer: Sponsor: Sponsor4


The number of logical processors is detectable from web content. Currently, this can be done using

The total number of cores available to the user agent can already be approximated with high accuracy given enough time using the polyfill in the appendix on a system with low to moderate system load.


But soon this is getting exposed directly:

Child Tickets

Change History (4)

comment:1 Changed 5 years ago by bugzilla

As web browsers are going to be more and more OS-like, the need of a lite VM / sandbox / hw emulation layer is becoming more obvious.

comment:2 Changed 5 years ago by mcs

Cc: mcs added

comment:3 Changed 4 years ago by gk

Keywords: ff52-esr added
Sponsor: NoneSponsor4

comment:4 Changed 4 years ago by gk

We have #21675 for window.navigator.hardwareConcurrency now. While it would be neat to deal with "leaking the number of cores" once and for all. Defending against the probabilistic approach mentioned in this ticket might be harder than dealing with the low hanging fruit in #21675. Hence two tickets.

Note: See TracTickets for help on using tickets.