User.js: [Fingerprint] Fix Firefox resource URI leak

[ghost]

Any website can access a selection of Firefox resource files to find out more about the web browser that is used to connect to the site.

Firefox and add-ons use the resource:// scheme to load resources internally, but some of the information are available to sites the browser connects to as well.

It is unclear why websites would need access to resource:// resources.

See Fix Firefox resource URI leak

Addon: no-resource-uri-leak

[pyllyukko]

Thanks! I kinda hope Mozilla would come up with a fix to this.

Direct links:

• Bug 863246 - resource:// URIs leak information
• Bug 903959 - custom resource://foo/ allows fingerprinting addons
• Firefox Resources Reader — BrowserLeaks.com

I'll add this to the README.

[pyllyukko]

I think there's not much we can do to fix this besides recommending to use the add-on, so I'll close this issue.

[Thorin-Oakenpants]

FYI: plugging the resource://URI leak but allowing functionality for addons etc is part of the tor uplift and will be tied to the privacy.resistFingerprinting preference (actually a lot of stuff will be tied to that pref)

Rather than create new issues - I'll list em here, an you can decide what to do with the info

• you already know about the screen/window and orientation spoofing ( https://bugzilla.mozilla.org/show_bug.cgi?id=418986 , https://bugzilla.mozilla.org/show_bug.cgi?id=1281949 )
• you already know about the enumeration of plugins and mime-types blocking ( https://bugzilla.mozilla.org/show_bug.cgi?id=1281963 )

Coming

• [Active]: resource://URIs leak - now part of tor uplift project
  // https://trac.torproject.org/projects/tor/ticket/8725
  // https://bugzilla.mozilla.org/show_bug.cgi?id=863246
  // test: https://www.browserleaks.com/firefox
• [Assigned]: enable fingerprinting resistence to WebGL
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1217290
• [Backlog]: disable keyboard fingerprinting
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1222285

[Thorin-Oakenpants]

I was wondering if it would be a good idea to create an open issue for tracking the tor uplift items bound to resistFingerprinting, because we're now well past just resource://URIs

additional to the above last post

• Checkbox in about#preferences#privacy for privacy.resistFingerprinting
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1308340
  I think they are talking about enforcing Tracking Protection in order to use resistFingerprinting- I hope not

And, I'll just add this here: spoof timezone as UTC

• Use UTC timezone (spoof as UTC 0)
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1330890
  It's not actually on the Tor Uplift page (yet), but is linked by meta tickets

[pyllyukko]

Indeed the privacy.resistFingerprinting seems to be a promising switch that'll enable all kinds of privacy goodies.

Sure. Sounds like a good idea. I take it that you volunteered to create the issue? :)

[Thorin-Oakenpants]

Done. Feel free to add labels and fix the title :)

[pyllyukko]

Thanks!