User.js: Network info fingerprinting

[Thorin-Oakenpants]

I could find any reference to this in the repository, and noticed it wasn't already included in the user.js. Excuse my sloppy pastes with my numbering system in them :)

// 2503: disable giving away network info
// eg bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, none
// https://developer.mozilla.org/en-US/docs/Web/API/Network_Information_API
// https://wicg.github.io/netinfo/
user_pref("dom.netinfo.enabled", false);

[Thorin-Oakenpants]

Totally agree that it is harmless. Its not a security issue at all (AFAIK). It's fingerprinting issue - hence the title :) It's just a suggestion.

Maybe I'm confused. I know this user.js is about "hardening" Firefox. You clearly look at security issues. You also have some tracking and privacy settings, and I bet if I look, there are fingerprinting ones. I do realize there can be overlap between these things.

OK, I just had a quick check. Yes, you have lots of fingerprinting settings - such as Battery API, graphics hardware ( gfx.direct2d.disabled etc), media device enumeration ( media.navigator.enabled ), gamepad API which leaks USB device IDs, Virtual Reality settings, media JS performance fingerprinting ( media.video_stats.enabled ) ... to name a few.

PS: There's also two harmless geo* settings.

PPS: Not sure what you mean that it "requires other services installed + activated which directly using it". Its an API which any script can call - right?

[Thorin-Oakenpants]

Look, I'm just suggesting it. It's a fingerprinting attack vector. TBB saw fit to disable it. I could probably dig up some tor ticket links. I am talking about this one setting, not the whole DOM. The fingerprinting information is not compromised locally, its not "leaking", it's a built in function - its a value passed back - those values are
bluetooth, cellular, ethernet, wifi, wimax, other, mixed, unknown, or none

From the link given in the first post (emphasis mine)

Interfaces
NetworkInformation
Provides information about the connection a device is using to communicate with the network and provides a means for scripts to be notified if the connection type changes. The NetworkInformation interfaces cannot be instantiated. It is instead accessed through the Navigator interface.

Detection of Keyboard layout is also possible via native JS + within HTML5 itself

That may be so, but does that stop us blocking most JS when we can, or disabling HTML5 (or making it click on demand). If we can harden, then we should.

[Thorin-Oakenpants]

Awesome .. what's a widget_gonk? Good link btw .. hope it doesn't break google (see comment 79)

[fmarier]

what's a widget_gonk?

It's a part of Firefox OS: https://developer.mozilla.org/en-US/docs/Glossary/Gonk

[Thorin-Oakenpants]

@fmarier On a side note: Is security.ssl.disable_session_identifiers still used (46+)

[pyllyukko]

Maybe I'm confused. I know this user.js is about "hardening" Firefox. You clearly look at security issues. You also have some tracking and privacy settings, and I bet if I look, there are fingerprinting ones. I do realize there can be overlap between these things.

Yes, this project is about security and privacy. One thing I also worry about is the attack surface that is the amount of code running at any given time. To make the attack surface smaller, it makes sense to disable unneeded components/entities in Firefox.

Also:

None of the dom.* settings can compromise any security aspect.

As one single line of code can compromise all security, it's naive to think that things are black and white like that.

[pyllyukko]

Thanks @Roman-Nopantski! And @CHEF-KOCH for the PR.

[Thorin-Oakenpants]

One thing I also worry about is the attack surface that is the amount of code running at any given time. To make the attack surface smaller, it makes sense to disable unneeded components/entities in Firefox.

@pyllyukko FYI: http://www.theregister.co.uk/2016/05/24/pointless_features_add_to_browser_bloat_and_insecurity/

[licaon-kter]

@Roman-Nopantski Retry your linking the link :)

[Thorin-Oakenpants]

@licaon-kter no idea what happened there - fixed it :)

[fmarier]

On a side note: Is security.ssl.disable_session_identifiers still used (46+)

@Roman-Nopantski I'm not familiar with what that does, but it looks like it's still in there:

• http://searchfox.org/mozilla-central/source/security/manager/ssl/nsNSSComponent.cpp#1407
• http://searchfox.org/mozilla-central/source/security/manager/ssl/nsNSSComponent.cpp#1999

[Thorin-Oakenpants]

Not sure if to continue in here in this closed issue or start a new one.

@fmarier
SSL session IDs speed up HTTPS connections (no need to renegotiate) and last for 48hrs. The ID is unique, web servers can (and do) use it for tracking - virtually undetectable because it is fully implemented by the web server and leaves no traces in the browser. IBM WebSphere, Apache and others offer an API for accessing the SSL session ID. And it is certainly used in commercial software packages.

https://tools.ietf.org/html/rfc5077

FF 36 introduced the above hidden pref. In FF46 I had to actually manually add it, since it wouldn't add itself via user.js (weird). I realize it was in the code, but I have no idea if its still effective or was discontinued - hence I asked you :)

[Gitoffthelawn]

Are there any web-based tests that are _already_ online that show the value returned by netinfo?

[Atavic]

Here is an example for determining the connection type, that's the user's connection type/speed.