Setting `general.useragent.override` does not spoof the platform part anymore in ESR 60 which is confusing

Despite updating general.useragent.override to match ESR 60 (done according to comment:16:ticket:25543) the platform part is not spoofed to Windows on my Linux box.

Now, that is intentional, see: https://bugzilla.mozilla.org/show_bug.cgi?id=1404608.

So, we probably should not set general.useragent.override at all anymore and just rely on the settings we get with privacy.resistFingerprinting? Because if we explicitly set it to the Windows UA but then don't get that, this is weird.

added TorBrowserTeam201809R component::applications/tor browser ff60-esr owner::mcs priority::high resolution::fixed severity::normal status::closed tbb-8.0-issues tbb-8.0.1-can tbb-fingerprinting-os type::defect labels

Type 'navigator' in developer console. Tor Browser is a 'browser' so why not change navigator.* code to match Windows OS?

(make the website owner believe the TorBrowser user is using Windows 10 and Firefox 60(ESR))

'privacy.resistFingerprinting' is severly broken. They - Mozilla - implemented it wrong.

Firefox with 'privacy.resistFingerprinting:true' (60 and above) Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0 (before 60) Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0

Tor Browser Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0

Expecting Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0

Replying to cypherpunks:

Expecting Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0

If Firefox with RFP or Tor Browser used this format it would not match Firefox's (non-RFP) format and would be easily identifiable.

This is also bad for anonymity. With Tor Browser 8.0a9 the results on panopticlick.eff.org look as expected, except for "Platform" and "User Agent" which reveal the OS (Linux in my case).

There is also this Mozilla bug which is about not spoofing the platform because TCP/IP fingerprinting reveals the OS either way: https://bugzilla.mozilla.org/show_bug.cgi?id=1409269

But this should not be relevant for Tor Browser, as I understand it.

I think this has to be fixed before Tor Browser 8.0 is released (hopefully even before that although it only affects the alpha channel at the moment).

Trac:
Username: viktorj
Cc: N/A to viktor_jaegerskuepper@freenet.de

Replying to viktorj:

This is also bad for anonymity. With Tor Browser 8.0a9 the results on panopticlick.eff.org look as expected, except for "Platform" and "User Agent" which reveal the OS (Linux in my case).

The platform/OS on which Tor Browser is running can be detected multiple ways, spoofing the user agent is simply a low-hanging fruit for obscuring it. The usefulness of this is debatable, but we should minimize the differences between platforms when it is possible.

Replying to sysrqb:

The platform/OS on which Tor Browser is running can be detected multiple ways, spoofing the user agent is simply a low-hanging fruit for obscuring it. The usefulness of this is debatable, but we should minimize the differences between platforms when it is possible.

I understand. Ideally the user agent should be the same for all platforms, but I see that the platform can be identified at least via the fonts at the moment.

Trac:
Username: viktorj

Replying to viktorj:

Replying to sysrqb:

The platform/OS on which Tor Browser is running can be detected multiple ways, spoofing the user agent is simply a low-hanging fruit for obscuring it. The usefulness of this is debatable, but we should minimize the differences between platforms when it is possible.

I understand. Ideally the user agent should be the same for all platforms, but I see that the platform can be identified at least via the fonts at the moment. Not everyone does OS detection through installed fonts though everyone collects user-agents. Also with JS disabled OS detection is MUCH harder. Giving away free entropy like that is intolerable.

Trac:
Cc: viktor_jaegerskuepper@freenet.de to viktor_jaegerskuepper@freenet.de, dmr

Trac:
Cc: viktor_jaegerskuepper@freenet.de, dmr to viktor_jaegerskuepper@freenet.de, dmr, gamma@fooledbyrandomness.com

Trac:
Cc: viktor_jaegerskuepper@freenet.de, dmr, gamma@fooledbyrandomness.com to viktor_jaegerskuepper@freenet.de, dmr, gamma@fooledbyrandomness.com, arlolra

Replying to cypherpunks: WTF are you doing?

Replying to tom:

Replying to cypherpunks:

Expecting Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0

If Firefox with RFP or Tor Browser used this format it would not match Firefox's (non-RFP) format and would be easily identifiable. Don't mix FF w/RFP with TBB! RTFM of TBB ;) Actually, Mozilla/5.0 (Unknown; rv:60.0) Gecko/20100101 Firefox/60.0 is everything TBB should expose until we can delete it altogether.

By the way let's smash this type of thinking once and for all, "X can be found using Y anyway in Z circumstances, so let's expose X directly". Ok, Tor Browser can be identified using exit IP, fingerprint and other stuff, so let's expose that information directly, how about Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 TorBrowser/8.0 as UA?

Tor Browser 8.0a10 reveals Linux, x86_64 and X11.

This is unacceptable.

Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0

7.47 bits of identifying information 1 in 177.02 browsers

Trac:
Username: nez

Replying to nez:

This is unacceptable. I can't stress this enough, as I said on the blog comments the original Mozilla bugzilla report makes no sense since with a proxy (such as Tor) network OS fingerprinting is moot so why fall for it? And it's such a let down to see great privacy people on the Mozilla side (that I won't mention out of respect) fall for such a cheap trap. (PS: As mentioned earlier, the argument ("X can be found using Y anyway in Z circumstances, so let's expose X directly") itself is false)

Anyone willing to make a followup bugzilla report to get this fixed on the Mozilla side as well?

Replying to nez:

Tor Browser 8.0a10 reveals Linux, x86_64 and X11.

x86_64 is always x86_64 (even for i686 users), and X11 is always X11 on Linux, so it doesn't really reveal more than Linux.

Comment 18 on the bugzilla was unaddressed https://bugzilla.mozilla.org/show_bug.cgi?id=1404608#c18 This is just sad.

Closed #27495 (moved) as a dup.

(I am not the previous cyberpunks. I am just using the public account to comment.) Does the 'perfect is the enemy of good' argument apply here?

Surely, there are many fingerprinting tactics available if you look hard enough, since most web technology are not designed with privacy in mind. (I would even argue that it is exactly the opposite.) However, this doesn't mean we should give away identifying information ourselves! I consider this being a regression.

By the way, #27520 (moved) is a possible duplicate of this.

Trac:
Username: cyberpunks

Trac:
Keywords: N/A deleted, tbb-fingerprinting-os added