Opened 9 years ago

Closed 8 years ago

#2907 closed defect (duplicate)

Torbutton doesn't correctly adjust screen size and HTTP_ACCEPT

Reported by: OsamaK Owned by: mikeperry
Priority: Medium Milestone:
Component: TorBrowserButton Version: Torbutton: 1.3.0-alpha
Severity: Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

EFF's Panopticlick test shows that Torbutton 1.3.2-alpha results in rare browser settings because of two configurations:

1) the screen size which is adjusted to "1300x650x24" instead of "1300x600x24", and
2) HTTP_ACCEPT which didn't have a space between ',' and 'deflate' but now it does. ('gzip, deflate en-us,en;q=0.5' instead of 'gzip,deflate en-us,en;q=0.5'

This resulted in 'one in 300,346 browsers have the same fingerprint as yours' instead of the stable version's 'one in 9,689 browsers'.

Child Tickets

Change History (5)

comment:1 Changed 9 years ago by OsamaK

Component: - Select a componentTorbutton
Owner: set to mikeperry

comment:2 Changed 9 years ago by mikeperry

The space thing is super weird.. We don't touch that at all. Are you sure that isn't due to a different addon or Firefox upgrade?

As for the screen thing, as long it reports your desktop is a multiple of 50px, Torbutton is doing it's job. The EFF people didn't do this aspect of the test right and it's ruining my day. Sometimes I wonder if I should just give up and make torbutton report a bogus desktop resolution (which would actually be more fingerprintable, but would make us look better on their test).

comment:3 Changed 9 years ago by OsamaK

It seems that the space was added by Firefox 4.0 but having the User Agent set to Firefox 3.6 makes Tor users more fingerprintable.

What has changed in the alpha release of Torbutton that changed my screen resolutions from "1300x600x24" to "1300x650x24"? Is "1300x650x24" common enough that it's safe to have it?

comment:4 Changed 9 years ago by mikeperry

Component: TorbuttonTorBrowserButton

Hrmm. It should be automatically rounding up to the next largest 50px above your browser window. It is possible the FF3 vs FF4 window decorations are slightly smaller, yielding a larger internal window size, hence the extra 50px.

It is debatable what is optimal here. We may want to have an option to try to fix all windows at 800x600. See #1282 for that.

The key property is that your desktop resolution is not directly revealed, nor is the size of your browser widgets. I believe these to be the more entropy-dense pieces of your resolution information. More so than just your desktop size alone... However, desktop resolution is all EFF tested, hence you look bad in their result set when you have weird values there..

comment:5 Changed 8 years ago by mikeperry

Resolution: duplicate
Status: newclosed

Dupping this to #4810.

Note: See TracTickets for help on using tickets.