Opened 6 months ago

Last modified 3 months ago

#30862 new defect

10ms time precision via EXSLT date-time function

Reported by: gk Owned by: tbb-team
Priority: High Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-fingerprinting-time-highres
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

z3t reported at HackerOne that the EXSLT date-tme function is subverting our patches that set the timing granularity to 100ms. We get at least a 10ms precision that way. PoC is on https://people.torproject.org/~gk/tests/tor_xml_time.html. And see dom/xslt/xslt/txEXSLTFunctions.cpp for the date:date-time implementation.

Child Tickets

Change History (6)

comment:1 Changed 6 months ago by cypherpunks

How is this new to #16110 with ~5ms accuracy? Also isn't 100ms too much?

comment:2 Changed 6 months ago by gk

Keywords: tbb-fingerprinting-highres added; tbb-fingerprinting removed

comment:3 Changed 6 months ago by cypherpunks

It's a tbb-fingerprinting-time or tbb-fingerprinting-time-highres if sub-ms accuracy can be achieved.

comment:4 Changed 6 months ago by gk

Keywords: tbb-fingerprinting-time-highres added; tbb-fingerprinting-highres removed

comment:5 Changed 3 months ago by Thorin

Am I missing something here? I can already get 1ms timing via other means: see Fantastic Timers and Where to Find Them (gk: I sent you a copy a month ago)

Last edited 3 months ago by Thorin (previous) (diff)

comment:6 in reply to:  5 Changed 3 months ago by gk

Replying to Thorin:

Am I missing something here? I can already get 1ms timing via other means: see Fantastic Timers and Where to Find Them (gk: I sent you a copy a month ago)

Yes, there are ways to get around fingerprinting defenses. But that is not a reason to not implement defenses in the first place. You close hole by hole raising the bar for the attacker. Remeber: you don't win the fingerprinting game by closing _all_ the holes but by making it hard enough that trackers lose interest in this technique and/or don't get usable results out of it anymore.

Note: See TracTickets for help on using tickets.