Canvasblocker: WebExtensions are the future

[rugk]

The current plan is that Firefox 57 will only support web extensions. Your add-on is not a web extension yet as far as I can see, so you should consider remaking your add-on. The Firefox 57 release is planned for 28th November 2017.
Already for Firefox 53 (planned release: 18th April 2017) it is planned to no longer accept other new add-on submissions than web extensions on AMO (addons.mozilla.org). Old extensions can however still be updated.
The good message is that one should be able to use your web extensions add-on in all mayor browsers. That's the idea behind web extensions.
Note that you can use so-called hybrid extensions for switching to WebExtensions.

Note that all dates are estimates and may be changed.

German source: https://www.soeren-hentzschel.at/firefox/firefox-57-mit-exklusiver-webextension-unterstuetzung/
Original source: https://blog.mozilla.org/addons/2016/11/23/add-ons-in-2017/

[rugk]

Oh, just saw this might already be a WebExtension as you have a package.json, but on AMO no permissions are shown…

[kkapsner]

No CB is not a WebExtension yet. But I'm already working on a hybrid. Not sure if this add-on can be realized with a WebExtension. For sure not one that will be useable in all mayor browsers since the WebExtension API is just too limited (exportFunction is only available in Firefox).

[ghost]

Not sure if this add-on can be realized with a WebExtension

@kkapsner ScriptSafe - which is a Chrome extension (web-extension) has the ability to block/spoof the canvas readout. So, I would assume you will have these capabilities.

See the screenshot below:

[lawl]

@DrunkenSasquatch I haven't looked at ScriptSafe recently, but when I did a few years ago they simply injected code into every website. That's not safe. It's fairly trivial to get around that.

[neroux]

@DrunkenSasquatch In addition to the extension you mentioned, there are also two other extensions with the direct purpose of blocking canvas fingerprinting, so it should be possible to port it over

https://chrome.google.com/webstore/detail/canvas-defender/obdbgnebcljmgkoljcdddaopadkifnpm
https://chrome.google.com/webstore/detail/canvasfingerprintblock/ipmjngkmngdcdpmgmiebdmfbkcecdndc

[EchoDev]

Mozilla will be addding loads of anti-fingerprinting features to Firefox 54/55

https://bugzilla.mozilla.org/show_bug.cgi?id=1329996
https://bugzilla.mozilla.org/show_bug.cgi?id=1041818 (I'm not sure if this exactly covers what this addon does)

This addon might become obsolete? Maybe it is better to wait for FF54/55 before rewriting for nothing.

[kkapsner]

Version 0.3.8 is out which includes an embedded webExtension to allow the transition.

[kkapsner]

@EchoDev: I think they will add something like the "ask for permission". So my favourite - the fake option - will not be available.

[kkapsner]

I see a way to make the basics work. One main issue is that I currently see no good way to make anything configurable by the user: https://bugzilla.mozilla.org/show_bug.cgi?id=1332273

[davidhedlund]

@kkapsner Is CanvasBlocker a hybrid WebExtension yet?

[kkapsner]

Yes - version 0.3.8 included a part to store the settings for later use in the WebExtension: a6e1b05045b857b3ebdf992503fee801e07da61f

[davidhedlund]

@kkapsner An add-on is a hybrid WE if it has a "hasEmbeddedWebExtension" key available in the install.rdf, its found in the current version of CanvasBlocker as you pointed out.

I didn't know that was the standard procedure when I asked, sorry.

[kkapsner]

No reason to apologize.

[ghost]

Great to hear it will be ported! One small request - would be great if the icon was refreshed with something better and higher res. Keep up the good work.

[kkapsner]

If you have something better in higher res - you are welcome to contribute to the project. I'm no artist and have no time to search for something that could be used (in terms of licence, aestetics and symbolism).

[Thorin-Oakenpants]

What sizes do you need and in what format? png? I've been p*ssing around in PS for 20 years, and just did a google image search for icon fingerprint block - lots of padlocks (sigh), but the fingerprint designs themselves are simplistic and very clean (the current one is too busy/noisy). I could easily use something similar to the below and add a block type symbol

https://www.iconexperience.com/_img/i_collection_png/256x256/plain/fingerprint.png
http://www.psdgraphics.com/file/fingerprint-icon.jpg << simple/clean basis

https://cdn3.iconfinder.com/data/icons/law-and-justice-icons/512/Fingerprint_Search-512.png
https://freemobileapk.com/wp-content/uploads/2014/09/com_lab_fingerprint_lock.png
^^ examples of offsetting the overlaid "block" symbol (trust me, it looks better especially of you're trying to overlay a circle on a circle'ish print)

What symbol would you want? a fat X, the current circle+stroke, a padlock

Colors: I suggest 2 - dark grey print, red-tone symbol, however this creates a problem with transparency (dark themes), so I suggest a colored background as well, maybe rounded corners. I can have a play, just give me some ideas

[rugk]

Only use free licenses (for copyright reasons): CC0 e.g. on https://openclipart.org/search/?query=fingerprint.

[Thorin-Oakenpants]

For sure - that was just examples to show what I meant. Am using own vectors, and will get a free fingerprint vector. I only dabble in this stuff very occasionally, so here's a quick sample. I would make the black FP lighter shade, and you could use red or green. Use any symbol. Placement of symbol as you like, etc. If you want me to take it further @ me in a new topic so we don't pollute this one ;)

[kkapsner]

Yay... Mozila decided not to provide my needed API for FF 57... let's see if I can provide something where the user can use their settings.

[rugk]

Which APIs? Don't you basically just modify the website (code/etc.) somehow, which you should be able to do freely, without any APIs needed?

[kkapsner]

It's the API in https://bugzilla.mozilla.org/show_bug.cgi?id=1332273 - the changes in the canvas-API have to be dependent on the users settings. And these informations have to be in place before the website has a chance to perform a fingerprinting. And this is not guarateed with the asynchronous storage API. But I think the first WebExtension version has to take this risk...

[kkapsner]

I created a beta version: https://github.com/kkapsner/CanvasBlocker/releases/tag/0.4.0-Beta.1
Can you all please test (you have to deactivate the regular version since they use different ids and would interfere otherwise)?

[kkapsner]

I already found a bug when using the migrated settings... so do not test that yet.

[spodermenpls]

@kkapsner Is the setting migration supposed to happen immediately after the first install? Because I didn't notice that anything was transferred.. otherwise it seems to work fine, I really like the small icon in the adress bar.

[rugk]

I really like the small icon in the adress bar.

Hopefully that is optional…

[wbedard]

I installed 0.4.0 Beta RC2 and had the following observations:

• The primary functionality seems to work, as tested at https://browserleaks.com/canvas.
• The drop-down menus on the options page appear offset from their origin. Actually, each menu seems to appear much closer to the next drop-down menu item on the options page.

[spodermenpls]

@kkapsner Replacing the storage.js broke the extension's functionality (no notifications, no canvas faking on browserleaks.com), after a re-install (without migrated settings) everything works again.

[kkapsner]

It worked for me - can you give me your storage.js?

[spodermenpls]

I uploaded the storage.js of CB 0.3.8: https://workupload.com/file/xGKsJ6X

[kkapsner]

Hm... your storage.js works for me. Did you update to RC2?

[spodermenpls]

I followed your instructions from above, and used RC2. I will try again..

[spodermenpls]

And I tried again, with the same result. The old settings are migrated, but Browserleaks displays the same signature with every refresh. Could this be a specific problem of 55.0.3, that is solved in 56/57?

[wbedard]

@kkapsner - I confirmed that you're likely correct about the drop-down issue being a bug in Firefox DevEd 57.0beta2. I just went through the rest of my extensions that have option pages w/ drop-down menus and they all behave in the same (buggy) way.

[kkapsner]

@spodermenpls: I'm currently also testing on 55.0.3 - this is weird. Can you open the the addon debugger (https://developer.mozilla.org/en-US/Add-ons/Add-on_Debugger) and check if there are any error messages?

@wbedard: good to know - thanks for checking.

[spodermenpls]

@kkapsner The migration of storage.js didn't break CB on the 3rd try now, it works fine. I also checked the debugging console, it is filled with a lot of errors and warnings, but those are most likely not related to CB, especially now that it works normally again. CB's storage section in the debugger is completely empty.

[kkapsner]

OK - good that it works now.

[spodermenpls]

@kkapsner When do you plan to release the WebExtension version for everyone?

[kkapsner]

At the moment I'm tweaking the page action display and I have to clean up some bits. After that I will release it.

[skyerjoe]

seems to work so far
thnks

[kkapsner]

0.4.0 is out and at Mozilla for review.