[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #26598 [Applications/Tor Browser]: disable User Timing API in ESR60
#26598: disable User Timing API in ESR60
-------------------------------------------------+-------------------------
Reporter: mcs | Owner: tbb-
| team
Type: defect | Status:
| needs_review
Priority: High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: tbb-fingerprinting-time-highres, | Actual Points:
ff60-esr, TorBrowserTeam201808 |
Parent ID: | Points:
Reviewer: | Sponsor:
-------------------------------------------------+-------------------------
Changes (by arthuredelstein):
* status: new => needs_review
Comment:
I examined the code for setResourceTimingBufferSize(...):
https://dxr.mozilla.org/mozilla-
esr60/rev/dd52b41d2b775e5c7261ce52795268b7670635fc/dom/performance/Performance.cpp#407
and for Performance::InsertResourceEntry(...):
https://dxr.mozilla.org/mozilla-
esr60/rev/dd52b41d2b775e5c7261ce52795268b7670635fc/dom/performance/Performance.cpp#413
When "privacy.resistFingerprinting" is true, InsertResourceEntry
shortcuts. Therefore no entries are added, and
performance.onresourcetimingbufferfull is never called, regardless of any
past calls to `setResourceTimingBufferSize(unsigned long maxSize)`. So I
am satisfied that there isn't a fingerprinting vector of supercookie
mechanism exposed by this API.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26598#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs