Opened 8 years ago

Closed 7 years ago

#3323 closed defect (fixed)

Revisit WebGL

Reported by: mikeperry Owned by: mikeperry
Priority: High Milestone: TorBrowserBundle 2.3.x-stable
Component: TorBrowserButton Version:
Severity: Keywords: tbb-fingerprinting, MikePerry201206
Cc: g.koppen@…, ioerror Actual Points: 3
Parent ID: Points: 3
Reviewer: Sponsor:

Description

We disabled WebGL because adoption is probably pretty low, and it seems ill-advised: http://www.contextis.com/resources/blog/webgl/

After the trial by fire is over, we should consider re-enabling it and dealing with the fingerprinting issues.

Child Tickets

Change History (12)

comment:1 Changed 8 years ago by mikeperry

The API calls that concern me for fingerprinting issues are:

getParameter() specifically RENDERER, VENDOR, VERSION, and VIEWPORT.
getSupportedExtensions() and getExtension()
getContextAttributes() mostly for the display depth..

comment:2 Changed 8 years ago by gk

Cc: g.koppen@… added

comment:3 Changed 8 years ago by mikeperry

FYI, noscript has click-to-play placeholders for webgl. Not sure if those will conflict with the anti-fingerprinting hooks for those functions or not, but the click-to-play placeholders make it so enabling webgl will be less of a vulnerability surface for exploits.

comment:4 Changed 8 years ago by mikeperry

Cc: ioerror added

comment:5 Changed 7 years ago by mikeperry

Milestone: TorBrowserBundle 2.3.x-stable

WebGL now has a "minimal mode": https://developer.mozilla.org/en/WebGL#WebGL_debugging_and_testing

Might also be good for fingerprinting resistance?

comment:6 Changed 7 years ago by mikeperry

Keywords: tbb-fingerprinting added

comment:8 Changed 7 years ago by mikeperry

Keywords: MikePerry201206 added

comment:9 in reply to:  1 Changed 7 years ago by mikeperry

Replying to mikeperry:

The API calls that concern me for fingerprinting issues are:

getParameter() specifically RENDERER, VENDOR, VERSION, and VIEWPORT.

This is implemented in WebGLContext::GetParameter(). It appears that RENDERER, VENDOR, and VERSION are all actually Mozilla strings. I should double-check these things aren't available elsewhere, too.

"Minimal mode" appears to apply to this GetParameter() function (specifically the parameters surrounding texture, buffer, vector and vertex attribute sizes), and is exported as WebGLContext::MinCapabilityMode(). It looks like it in fact can serve to defend against normalizing some fingerprintable attributes. It is also used in WebGLContext::InitAndValidateGL() for the setting same values as member variables there.

The VIEWPORT is not governed by minimal mode.

getSupportedExtensions() and getExtension()

These two are in fact fully disabled by webgl.disable_extensions, which has no other effect atm.

getContextAttributes() mostly for the display depth..

Not governed by minimal mode.

comment:10 Changed 7 years ago by mikeperry

For reference, the source code to the paper gk mentioned above is at https://github.com/kmowery/canvas-fingerprinting. We've also discussed it briefly in #6041, as it also uses the canvas for font fingerprinting.

I'm going to have a look at it now and try to guess if minimal mode would make any difference to the rendering-based approach they do to extract pixel differences.

comment:11 Changed 7 years ago by mikeperry

Points: 2

Ok, I got that code working thanks to some help from Keaton, and Minimal Mode makes no difference for rendering the teapot.

However, I also just noticed webgl.osmesalib and webgl.force_osmesa in about:config.. It seems like the osmesalib needs to specify a path to the library, I guess? I wonder if it's worth it for us to ship a mesa library for software rendering, or if click-to-play + #6253 is good enough...

My current estimation is those two will be enough for now. I think we should also enable Minimal Mode and disable the extensions for API-level fingerprinting resistance, but obviously they're not a cure-all :/.

comment:12 Changed 7 years ago by mikeperry

Actual Points: 3
Points: 23
Resolution: fixed
Status: newclosed

I opened #6370 for the work of actually enabling WebGL.

Note: See TracTickets for help on using tickets.