spoof history.length - browser.sessionhistory.max_entries

ip-check.info demonstrated, history.length can be read.

They recommend:

The number of visited pages should be reset to 2 whenever you change to a new domain.

Open about:config and set browser.sessionhistory.max_entries to 2.

What about doing this with TorButton?

added component::applications/tor browser owner::tbb-team priority::low severity::normal status::new tbb-linkability tbb-torbutton type::defect labels

Setting "browser.sessionhistory.max_entries" to "2" is not worth the usability issues, I think (wearing a user hat). There should be a smarter approach.

Trac:
Cc: N/A to g.koppen@jondos.de

At best this is a minor cross-origin linkability issue.

Trac:
Priority: normal to minor
Keywords: N/A deleted, tbb-linkability added

Trac:
Keywords: N/A deleted, tbb-torbutton added
Owner: mikeperry to tbb-team
Component: TorBrowserButton to Tor Browser

Set all open tickets without a severity to "Normal"

Trac:
Severity: N/A to Normal

@gk

FWIW, browser.sessionhistory.max_entries has been broken since FF61, and I will probably never get fixed - see https://bugzilla.mozilla.org/show_bug.cgi?id=1511813

As for cross-origin linkability / privacy concerns: there shouldn't be any: see

• https://developer.mozilla.org/en-US/docs/Web/API/History
• https://html.spec.whatwg.org/multipage/history.html

I think we can close this.

Edit: Note: there may be other underlying issues with History API (which the pref has nothing to do with) such as history.pushState, where an attcker can find it useful to hide reflected XSS in the URL by dynamically changing the path to something less suspicious - e.g. http://samuli.hakoniemi.net/tag/history-pushstate/ - but that's out of scope for this ticket

Trac:
Reviewer: N/A to N/A
Sponsor: N/A to N/A

We could think about keeping this ticket for further History API investigations and there is no need for pages knowing my session history length, really.

Trac:
Cc: g.koppen@jondos.de to N/A

#32983 (moved) is a duplicate.

Trac:
Cc: N/A to pf.team

mentioned in issue #32983 (moved)

moved to tpo/applications/tor-browser#8213 (closed)