User.js: [Meta] privacy.resistFingerprinting : track changes

[Thorin-Oakenpants]

Tor Uplift: https://wiki.mozilla.org/Security/Tor_Uplift/Tracking

Part of the Tor Uplift Project has been the creation of a privacy.resistFingerprinting preference, to which more and more code solutions are being tied to. This issue is so we can discuss, track and implement these are they come up rather than creating numerous issues or constantly going back to old ones

DONE

• screen/window and orientation spoofing
  // https://bugzilla.mozilla.org/show_bug.cgi?id=418986
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1281949
• bock enumeration of plugins and mime-types
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1281963 )

COMING

• [Active]: resource://URIs leak
  // https://trac.torproject.org/projects/tor/ticket/8725
  // https://bugzilla.mozilla.org/show_bug.cgi?id=863246
  // test: https://www.browserleaks.com/firefox
• [Assigned]: enable fingerprinting resistence to WebGL
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1217290
• [Assigned]: checkbox in about#preferences#privacy for privacy.resistFingerprinting
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1308340
• [Backlog]: disable keyboard fingerprinting
  // Test: https://w3c.github.io/uievents/tools/key-event-viewer.html
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1222285
• [Not on Tor Uplift Page Yet]: use UTC timezone (spoof as UTC 0)
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1330890
• [Not on Tor Uplift Page Yet]: new window sizes to round to hundreds
  // Note: override values, future may enforce a select set of (inner) window measurements
  // if override values are too big, the code falls back and determins it for you
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1330882
  // user_pref("privacy.window.maxInnerWidth", 1366);
  // user_pref("privacy.window.maxInnerHeight" 768);
• [Backlog]: disable WebSpeech API
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1333641
• [Backlog]: spoof Navigator API
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1333651
• [Backlog]: set and enforce various prefs with privacy.resistFingerprinting
  // https://bugzilla.mozilla.org/show_bug.cgi?id=1333933

[pyllyukko]

user.js issues that are related:

• #38
• #101
• #159
• #163
• #166

[Thorin-Oakenpants]

New tor ticket on keyboard fingerprinting (this one is about keypress leaking) - https://trac.torproject.org/projects/tor/ticket/21390 . Ticket links to a very nice test page: https://w3c.github.io/uievents/tools/key-event-viewer.html with lots of options for output.

[Atavic]

@Roman-Nopantski By enabling the Proposed Field in the key-event-viewer page, it shows a %LOCALE% column.

I found this page from _W3 Consortium_: https://w3c.github.io/fingerprinting-guidance/#detectability

[uBlock-user]

Is Canvas Fingerprinting going to be included ?

[Thorin-Oakenpants]

@uBlock-user If you go to the Tor Uplift page linked in the first comment, it is listed. It's been there for over 7 months (on Tor Uplift), and may or may not be added. Hopefully it will be. Currently still unassigned. https://bugzilla.mozilla.org/show_bug.cgi?id=1041818 , "take steps to mitigate canvas fingerprinting" (2.5 years old) - what that solution eventually is, who knows (they mention making it "click to play" and a site permission), but mention nothing about faking a random. I think you're best off with the extension TBH.

Edit: I should add that the above list is items that are going to be tied to the privacy.resistFingerpinting preference. It may well be that in time canvas is tied to that as well.

[uBlock-user]

Yes you're right, it appears so. ScriptSafe covers it all. Also I don't suppose Chromium devs would be interested in adding this ?

[Atavic]

There's an ungoogled-chromium discussion.

[pyllyukko]

I guess this issue is continued at https://github.com/ghacksuserjs/ghacks-user.js/issues/7, so I'll close it here.

[polymeer]

Hello folks,
privacy.resistFingerprinting prevent log into ff accounts...

[pyllyukko]

privacy.resistFingerprinting prevent log into ff accounts...

I don't have a Firefox account myself. Can someone confirm this? If the problem persist, maybe you should open a new issue about it.

[Thorin-Oakenpants]

^^ https://bugzilla.mozilla.org/show_bug.cgi?id=1443701