Re: [tor-bugs] #19417 [Applications/Tor Browser]: asm.js files should be no linkability risk (was: asm.js files should not be cached to disk in Tor Browser and no linkability risk)

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#19417: asm.js files should be no linkability risk
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:
                                                 |  assigned
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tbb-linkability, GeorgKoppen201609,  |  Actual Points:
  TorBrowserTeam201609, ff52-esr                 |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by gk):

 * status:  needs_revision => assigned
 * keywords:
     tbb-disk-leak, tbb-linkability, GeorgKoppen201609,
     TorBrowserTeam201609, ff52-esr
     => tbb-linkability, GeorgKoppen201609, TorBrowserTeam201609, ff52-esr


Old description:

> #19400 revealed that asm.js files are cached to disk which violates at
> least our no-disk-leaks requirement. The upstream bug is
> https://bugzilla.mozilla.org/show_bug.cgi?id=1047105.

New description:

 #19400 revealed that asm.js files are cached to disk which violates at
 least our no-disk-leaks requirement. The upstream bug is
 https://bugzilla.mozilla.org/show_bug.cgi?id=1047105 which got fixed in
 Firefox 51. However, there are linkability risks as well we might want to
 address.

--

Comment:

 Replying to [comment:30 legind]:
 > Here's a friendly ping to revisit this issue, now that the transition to
 52 is complete.

 So, the disk leak is gone but there is still the problem of asmjs not
 adhering to our URL bar domain isolation. This part still needs to be
 investigated. I am adjusting the title and description of the ticket.

 > WebAssembly is a related upcoming standard in development at W3C, we
 should also keep an eye on this as well.

 That's true. FWIW wasm got disabled by Mozilla in the ESR 52 series,
 though. We have #21549 for the investigation task.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19417#comment:31>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs