[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #18545 [Applications/Tor Browser]: Review Firefox Developer Docs and Undocumented bugs since FF38esr
#18545: Review Firefox Developer Docs and Undocumented bugs since FF38esr
--------------------------------------------+--------------------------
Reporter: gk | Owner: tbb-team
Type: task | Status: new
Priority: Very High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Critical | Resolution:
Keywords: ff45-esr, TorBrowserTeam201604 | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor: SponsorU
--------------------------------------------+--------------------------
Comment (by gk):
Replying to [comment:20 brade]:
> Kathy and I reviewed all of the release notes and developer docs for
Firefox 39-45. We have not yet looked at the complete bug lists
(comment:17).
That's fine. I am halfway through and think having just one doing that is
okay.
> Here are some things that might be worth another look (some of these may
have been looked at in more detail by gk already):
Thanks for looking at it!
> CacheStorage. It seems that this can be used by Web Workers and regular
JS code (not just by Service Workers).
> https://developer.mozilla.org/en-US/docs/Web/API/CacheStorage
Do you have a bug indicating that? CacheStorage is part of the Service
Workers spec and that whole MDN page indicates that, too.
> Server logging. This is kind of a strange feature: server applications
can return an X- HTTP header to cause items to be logged to the developer
console. Maybe it is only done when the console is open and the user is
monitoring network requests (I am not sure). Kathy and I do not like the
idea that this is enabled, but it may be harmless.
> https://developer.mozilla.org/en-
US/docs/Tools/Web_Console/Console_messages#Server
Hm. This is https://bugzilla.mozilla.org/show_bug.cgi?id=1168872. So what
if we put that feature behind a pref? Disabling it by default in Tor
Browser?
> window.screen.orientation. This is possibly a fingerprinting vector
unless it always returns "landscape-primary" on desktop Firefox (it may
still be an issue for Orfox). Or did we decide that applications can
derive this kind of info from the window size/aspect ratio anyway?
> https://developer.mozilla.org/en-US/docs/Web/API/Screen/orientation
#13025 did not solve this?
> Navigator.onLine. This can be used to monitor the connected state of a
user's computer. We can disable it by setting network.manage-offline-
status = false.
> https://developer.mozilla.org/en-US/docs/Web/API/NavigatorOnLine/onLine
I definitely came across this one and was thinking about it but I am not
sure anymore why I did not put it up in my review notes. I think flipping
that pref back is a good option, #18945
> Enable H.264 if system decoder is available (Linux). Kathy and I do not
know enough about the world of video decoders to know if this could be a
significant fingerprinting vector.
> https://bugzilla.mozilla.org/show_bug.cgi?id=1213499
We could investigate which Linux systems would be affected by this:
#18946.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18545#comment:21>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs