Opened 3 years ago

Last modified 6 months ago

#23805 new defect

Disable dom.enable_performance_navigation_timing

Reported by: tom Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-fingerprinting-time
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

See https://groups.google.com/forum/#!topic/mozilla.dev.platform/1OZrP1hR_SE

It might be disabled by dom.enable_performance though.

Child Tickets

Change History (9)

comment:1 Changed 3 years ago by gk

Keywords: ff59-esr added

comment:2 Changed 3 years ago by gk

Keywords: ff60-esr added; ff59-esr removed

Firefox 60 is the new ESR.

comment:3 Changed 3 years ago by cypherpunks

Summary: Disable dom.enable_performance_navigation_timing in ESR 59Disable dom.enable_performance_navigation_timing in ESR 60

comment:4 Changed 2 years ago by mcs

I have not done any tests, but my reading of the code says that dom.enable_performance does not disable everything. Therefore, we should set dom.enable_performance_navigation_timing to false.

The same goes for dom.enable_performance_observer, although we may want a separate ticket for that one.

comment:5 Changed 2 years ago by mcs

There is also performance.timeOrigin. See:

https://developer.mozilla.org/en-US/docs/Web/API/Performance/timeOrigin

Based on reading the code, it appears to be rounded for reduced precision when privacy.resistFingerprinting = true. We will need to determine if that is sufficient and make sure the system time zone offset is not leaked by this feature.

comment:6 Changed 2 years ago by gk

Priority: MediumHigh

comment:7 Changed 6 months ago by tom

timeOrigin is unrelated to the system/user clock. See https://www.w3.org/TR/hr-time-2/#dfn-time-origin

comment:8 Changed 6 months ago by Thorin

AFAIK (all three are default true in TB alpha 9.5a11)

unless tom knows something we don't

comment:9 Changed 6 months ago by Thorin

Keywords: tbb-fingerprinting-time added; ff60-esr removed
Summary: Disable dom.enable_performance_navigation_timing in ESR 60Disable dom.enable_performance_navigation_timing
Note: See TracTickets for help on using tickets.