User.js: meta: tor uplift: privacy.resistFingerprinting

[Thorin-Oakenpants]

Locked sticky issue for tracking privacy.resistFingerprinting

• Tor Uplift
• MVP Tracking
• Bugzilla META RFP ticket
• Tor Uplift Dependency Tree
• Mozilla Support: Firefox's protection against fingerprinting

Last updated: see changelog at foot (regularly cleaned out)

RESOLVED & ADDED TO USER.JS ^{if applicable}

:small_red_triangle_down: FF41

• 418986 enable privacy.resistFingerprinting (limit window.screen & CSS media etc)
  // user_pref("privacy.resistFingerprinting", true);

:small_red_triangle_down: FF50

• 1281949 spoof screen orientation
• 1281963 hide the contents of navigator.plugins and navigator.mimeTypes
  
  
  
  • FF53: 1324044 fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray
  
  

:small_red_triangle_down: FF55

• 1330890 spoof timezone as UTC 0
  
  
  
  • FF58: 818634 deprecates Date.toLocaleFormat
  
  
  • FF60: 1409973 fixes Date.toLocaleDateString and Intl.DateTimeFormat
  
  
• 1330882 new window sizes to round to hundreds & override prefs
  // user_pref("privacy.window.maxInnerWidth", 1600);
  // user_pref("privacy.window.maxInnerHeight", 900);
• 1360039 spoof navigator.hardwareConcurrency as 2
• 1217238 reduce precision of time exposed by javascript

:small_red_triangle_down: FF56

• 1369303 spoof/disable performance API
• 1333651 & 1383495 & 1396468 spoof navigator API
  
  
  
  • FF57: 1393283 spoof as ESR instead of 10s
  
  
  • FF59: 1415488 UA leaks over HTTP CONNECT method - fixed as a result of 1419771
  
  
  • FF59: 1404608 do not lie about OS (limit to Windows, OSX, Android, or Linux)
  
  
  • FF59: 1418672 due to ESR being out of whack and Aurora/Nightly sometimes being ahead of ESR releases, the value is now temporally hardcoded to 52
  
  
  • FF60: 1418162 ESR algorithm fixed for 60+7's
  
  
  • FF63: 1472618 navigator.platform returns "Win32" (but JS UA still shows 64bit)
  
  
  • FF66: 1509829 upstream Tor 26146 reduce UA HTTP headers to two OSes (Windows, Android)
  
  
  • FF67: 1511763 ESR cadence fixed to 60+8's
  
  
  • FF68: 1511434 UA Spoof -> Windows 10, OS 10.14, Android 8.1
  
  
  • FF78: 1599188 version algorithm hardcoded in 78+ to cadence 13
  
  
  • FF78: 1635011 UA Spoof -> OS 10.15, Android 9.0
  
  
• 1369319 disable device sensors
• 1369357 disable site specific zoom
• 1337161 hide gamepads from content
• 1372072 spoof network information API as "unknown"
• 1372069 block geolocation requests
  
  
  
  • FF63: 1441295 reverted: RFP no longer blocks geo
  
  
• 1333641 disable WebSpeech API

:small_red_triangle_down: FF57

• 1369309 spoof media statistics
• 1382499 reduce screen co-ordinate fingerprinting in Touch API
• 1217290 enable fingerprinting resistance for WebGL
  
  
  
  • FF58: 1409677 WebGL issues
  
  
• 1382545 reduce fingerprinting in Animation API
• 1354633 limit MediaError.message to a whitelist
• 1382533 enable fingerprinting resistance for Presentation API
• 1384330 disable mozAddonManager Web API
  // user_pref("privacy.resistFingerprinting.block_mozAddonManager", true);

:small_red_triangle_down: FF58

• 967895 prompt (site permission) before allowing canvas data extraction
  
  
  
  • FF59: 1413780 when RFP=true include canvas in site permissions panel
  
  
  • FF59: 1376865 reduce canvas prompt fatigue by only prompting when user initiated (controlled by a temp pref privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts )
  
  
  • FF61: 1412961 RFP breaks extensions using canvas eg Screenshots:
  
  
  • > until then, you can open about:debugging>Add-ons, click the extension's manifest.url and on that page, right click >View Page Info>Permissions and set a canvas exception
  
  
  • FF62: 1453916 Fixes more extension + canvas issues
  
  
• 1397611 extensions can control privacy.resistFingerprinting
  
  
  
  • 1424341 FYI ONLY: Timing: not added to user.js: RFP timing & timer precision
    
    // privacy.reduceTimerPrecision
    
    // privacy.resistFingerprinting.reduceTimerPrecision.microseconds
  
  

:small_red_triangle_down: FF59

• 1372073 spoof/block fingerprinting in MediaDevices API
• 1039069 warn when language prefs are set to non en-US
  
  
  
  • privacy.spoof_english (pref is used internally AFAICT, we should not meddle with it)
  
  
  • at this stage the pref has not been added to the user.js, but the bugzilla has
  
  
  • 1222285 spoof keyboard events and suppress keyboard modifier events
  
  
  • FF59.0.2: 1433592 don't spoof/suppress CTRL key
  
  
  • FF60: 1438795 fixes keydown/keyup events
  
  
  • Test: https://w3c.github.io/uievents/tools/key-event-viewer.html
  
  

:small_red_triangle_down: FF60

• 1337157 disable WebGL debug renderer info (see 2011)
  
  
  
  • 1425462 FYI ONLY: Timing: not added to user.js: RFP timing precision jitter
    
    // privacy.resistFingerprinting.reduceTimerPrecision.jitter
  
  

:small_red_triangle_down: FF62

• 1459089 [Firefox for Android] HTTP Accept-Language header no longer leaks OS locale

:small_red_triangle_down: FF63

• 1479239 return no-preference with prefers-reduced-motion

:small_red_triangle_down: FF64

• 1363508 spoof/suppress Pointer Events

:small_red_triangle_down: FF65

• 1492766 pointerEvent.pointerid

:small_red_triangle_down: FF67

• 1485266 enforce ui.use_standins_for_native_colors=true (2618)
• 1407366 RFP letterboxing
  // user_pref("privacy.resistFingerprinting.letterboxing", true);
  // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", "");
  
  
  
  • FF68: 1548634 stepped ranges
  
  
• 1485264 FYI: remove dom.event.highrestimestamp.enabled
• 1494034 enforce light with prefers-color-scheme - see MDN for this standard added in FF67

:small_red_triangle_down: FF68

• 1492587 possible date picker locale leak fix

:small_red_triangle_down: FF70

• 1564422 spoof audioContext outputLatency per OS

:small_red_triangle_down: FF72

• 1595823 spoof audioContext sampleRate

:small_red_triangle_down: FF74

• 1607316 spoof pointer as coarse and hover as none on android

:small_red_triangle_down: FF78

• 1621433 randomize canvas
  
  
  
  • note: as of writing, isPointInPath and isPointInStroke still use the white-canvas
  
  

:small_red_triangle_down: FF80

• 1653987 font visibility is restricted to BaseFonts (non Android)
  
  
  
  • click here
  
  
  • the lists are hardcoded lists with two parts kBaseFonts and kLangPackFonts
  
  
  • note: this is the same as setting layout.css.font-visibility.level = 1
  
  

:small_red_triangle_down: FF82

• 1461454 spoof smooth=true and powerEfficient=false for Supported Media in MediaCapabilities

CHANGELOG

2020

• May 6: cleaned out changelog
• May 6: 1635011 (rfp os spoof changes) → FF78+ (under FF56 section)
• May 15: added entries for FF74 and FF78
• Jul 29: 1653987 (font visibility) → FF80+
• Nov 11: 1461454 (mediaCapabilities) → FF82+
• Dec 26: removed followups, pending, and invalid/wontfix sections since I'm not maintaining them and they're out of date

...

[Atavic]

MediaDevices is a different API but a tool like WebRTC JavaScript library implements the Mediadevices API into WebRTC.

[jawz101]

One thing that prevents me from using fingerprinting on Firefox for Android is the screen resolution thing. It makes no sense to blow a webpage up to full resolution when there's no way my mobile phone will display it properly. If the pref would disable that particular identifier if it's a mobile version of Firefox it would make so much more sense.

[aesthicc]

Would it be possible to include a version of the user.js that has privacy.resistFingerprinting set to false? I did the setup in my user-overrides.js, I just think i might miss changes made in the future. Just an idea for ease of use.
Edit: or another idea that might be a bit over the top: Developing an application that generates a user.js file. With preset loading/saving

[overdodactyl]

Thanks Pants! Just passed along the info :)

[overdodactyl]

Hmm ya, I either wasn't clear with what I said or it was misinterpreted a bit.

After linking the ctrl bug I proposed possibly using a different profile for google apps if the bug was preventing them from keeping RFP on. The mention of the privacy API being able to use it was more of a suggestion towards, in the future, uBO and other extensions might be able to quickly turn it on/off.

I agree it's not a solution, but if someone's not willing to keep RFP on because of a bug like this, it's a reasonable alternative in an isolated profile to be able to quickly toggle it on/off as needed.

[overdodactyl]

Just did, thanks :)

[earthlng]

not sure what you mean by "affect" but I just tested with a japanese FF63 and the string in the brackets is in japanese characters even with RFP enabled.
They have a test for this but that test most likely only ever runs on en-US versions and therefore they didn't notice the problem.

[earthlng]

correction!
during testing a prompt came up at one point asking me this:

言語設定を英語に変更すると、個人情報の特定がより難しくなりプライバシーが強化されます。英語版のウェブページを表示しますか？

Obviously I had no idea what that means and clicked the button which I assumed would be "cancel" because I thought it's something Activity-Stream or telemetry related.

Turns out this translates to

Changing the language setting to English will make it more difficult to identify your personal information and enhance your privacy. Do you want to view the English version of the webpage?

and was triggered by me enabling RFP. Clicking the other non-cancel button and testing again shows that RFP then spoofs the timezone string correctly in english as (Coordinated Universal Time)

[Mikaela]

I am not sure if this is relevant here, but i have heard suspicion that enabling privacy.resistFingerprinting leads to higher amount of Google Captchas with them being more difficult. For me this only had the result that I started closing pages whenever they prompted me to fill a Google Captcha.