Browser-laptop: Fingerprinting methods not properly blocked

[srirambv]

Test plan

1. Visit https://audiofingerprint.openwpm.com/, Click on fingerprint,  audiofingerprint graph should not contain blue line representing user fingerprint
2. Visit https://jsfiddle.net/bkf50r8v/13/, output shows got webgl and canvas fingerprint but with values as 0

Description

Fingerprinting methods not properly blocked

Steps to Reproduce

1. Clean install 0.19.98, Enable block fingerprint from shields
2. Visit https://audiofingerprint.openwpm.com/, Click on fingerprint, shows the audiofingerprint graph
3. Visit https://jsfiddle.net/bkf50r8v/13/, output shows got webgl and canvas fingerprint

Actual result:

Expected result:
Should properly block all fingerprinting methods

Reproduces how often:
100%

Brave Version

about:brave info:

Brave | 0.19.98
-- | --
rev | 1909179
Muon | 4.5.16
libchromiumcontent | 62.0.3202.94
V8 | 6.2.414.42
Node.js | 7.9.0
Update Channel | Release
OS Platform | Microsoft Windows
OS Release | 10.0.15063
OS Architecture | x64

Reproducible on current live release:
No, All fingerprinting methods are blocked on 0.19.95

Additional Information

cc: @kjozwiak @LaurenWags

[diracdeltas]

may be due to https://github.com/brave/browser-laptop/pull/11784. @snyderp do you have time to take a look?

[pes10k]

Yep, I can see if these are related. Will get back by the EOD at the latest

[pes10k]

@diracdeltas @srirambv Apologies, but after digging into this, I'm not sure I understand the issue. I'm able to recreate the steps in the issue, but I don't understand which aspect is the bug / error.

For the audio fingerprinting, I'm getting the below:

Fingerprint using OscillatorNode:

0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
...
Fingerprint using hybrid of OscillatorNode/DynamicsCompressor method:

0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0

Which seems correct and also whats in the image in the issue.

For the JS fiddle, I'm getting

fingerprinting test
got canvas fingerprint 0
got webgl fingerprint 00

which also seems like the expected value if shields are working correctly, and whats in the Actual result images.

W/o blocking, for example, I get:

fingerprinting test
got canvas fingerprint data:image/png;base64,… (truncated)
got webgl fingerprint ANGLE_instanced_arrays;… (truncated)
got webrtc fingerprint

Apologies if I'm missing something, but whats the success condition here?

[diracdeltas]

i think this is the success condition (nothing shown under 'fingerprinting test'):

@snyderp i agree this seems like probably not an actual bug but instead a situation where the success condition needs to be updated

[srirambv]

@snyderp For jsfiddle, it should only show fingerprint test in the output window. the output should be like this

For audiofingerprint.openwpm.com, once the test is successful with thankyou message, it should not show the audio graph

This is the current behaviour on 0.19.95.

[diracdeltas]

@srirambv

for the jsfiddle, the manual test should actually be updated. if fingerprinting is working correctly, it will report 0's now instead of nothing in the jsfiddle output.

for the audiocontext fingerprinting test, i think the red line is some kind of calibration line, not the user fingerprint. the legend says that the blue line is the user fingerprint. so IIUC, fingerprinting protection is working as long as there is no blue line.

[diracdeltas]

^ confirming the above - the red line in the princeton test is a sample fingerprint.

so i think this can be closed but the manual test plans need to be updated

[srirambv]

Thanks @diracdeltas @snyderp for confirming. Will close the issue and update the manual test plans.

[pes10k]

@diracdeltas I think the "blocks fingerprinting including WebGL" test might need to be updated too. If that seems right to you too, I can give up looksie

[diracdeltas]

@snyderp can't remember if that needs an update since i thought it checks the number of FP stats, not the page content. also note that WebGL doesn't work in the Travis environment so the test condition in Travis is different. feel free to poke at it.