[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[or-cvs] [torbutton/master 1/3] Update design doc with new firefox bugs.
Author: Mike Perry <mikeperry-git@xxxxxxxxxx>
Date: Mon, 28 Jun 2010 06:02:28 -0700
Subject: Update design doc with new firefox bugs.
Commit: cef2d7e67d8a014a8b1850510252eba8c1ab2418
Bugs came from ideas generated at a meeting with pde (panopticlick author) and
mozilla.
---
website/design/design.xml | 114 ++++++++++++++++++++++++++++++---------------
1 files changed, 77 insertions(+), 37 deletions(-)
diff --git a/website/design/design.xml b/website/design/design.xml
index 18c1d69..d16f7fb 100644
--- a/website/design/design.xml
+++ b/website/design/design.xml
@@ -11,7 +11,7 @@
<address><email>mikeperry.fscked/org</email></address>
</affiliation>
</author>
- <pubdate>Apr 10 2010</pubdate>
+ <pubdate>Jun 28 2010</pubdate>
</articleinfo>
<sect1>
@@ -1981,7 +1981,7 @@ Google Captcha</title>
<para>
-Google's earch engine has rate limiting features that cause it to
+Google's search engine has rate limiting features that cause it to
<ulink
url="http://googleonlinesecurity.blogspot.com/2007/07/reason-behind-were-sorry-message.html";>present
captchas</ulink> and sometimes even outright ban IPs that issue large numbers
@@ -2065,13 +2065,16 @@ is currently not exposed via the preferences UI.
Torbutton has to work around a number of Firefox bugs that impact its
security. Most of these are mentioned elsewhere in this document, but they
-have also been gathered here for reference. Several of these have fixes in
-Firefox3.0/trunk, but are listed because they still have not been backported
-to FF2.0. In order of decreasing severity, they are:
+have also been gathered here for reference. In order of decreasing severity,
+they are:
</para>
<orderedlist>
+<!--
+
+XXX: We should just consider this one fixed. FF3.0 is pretty much at EOL.
+
<listitem><ulink
url="https://bugzilla.mozilla.org/show_bug.cgi?id=392274";>Bug 392274 - Timezone
config/chrome API</ulink>
@@ -2094,28 +2097,52 @@ fulfill its <link linkend="location">Location Neutrality</link> requirement.
</para>
</listitem>
-<!--
-FIXME: This one is fixed, but we need to make use of the new API in FF3.5
+-->
+ <listitem><ulink
+url="https://bugzilla.mozilla.org/show_bug.cgi?id=429070";>Bug 429070 - exposing
+Components.interfaces to untrusted content leaks information about installed
+extensions</ulink>
+ <para>
+<ulink url="http://pseudo-flaw.net/";>Gregory Fleischer</ulink> demonstrated at Defcon 17 that these interfaces can
+also be used to <ulink
+url="http://pseudo-flaw.net/tor/torbutton/fingerprint-firefox.html";>fingerprint
+Firefox down the to the minor version</ulink>. Note that his test has not been
+updated since 3.5.3, hence it reports 3.5.3 for more recent Firefoxes. This
+bug interferes with Torbutton's ability to satisfy its <link
+linkend="setpreservation">Anonymity Set Preservation</link> requirement.
+ </para>
+ </listitem>
- <listitem><ulink
-url="https://bugzilla.mozilla.org/show_bug.cgi?id=436250";>Bug 436250 - Livemarks can't be
-disabled at runtime</ulink>
- <para>
+ <listitem><ulink
+url="https://bugzilla.mozilla.org/show_bug.cgi?id=280661";>Bug 280661 - SOCKS proxy server
+connection timeout hard-coded</ulink>
+ <para>
-The RSS Feed based "Livemarks"/"Live Bookmarks" update frequency is controlled
-by the pref <command>browser.bookmarks.livemark_refresh_seconds</command>.
-However, changing this preference does not cancel any pending timers, which
-means that at least one livemarks pref fetch will happen over Tor, and once
-this pref is set to disable livemarks for Tor, changing it back will never
-cause the service to start back up again. The
-leakage of Livemarks interferes with Torbutton's ability to fulfill
-the <link linkend="isolation">Network Isolation</link> requirement.
+This bug prevents us from using the Firefox SOCKS layer directly, and
+currently requires us to ship an auxiliary HTTP proxy called <ulink
+url="http://www.pps.jussieu.fr/~jch/software/polipo/";>Polipo</ulink>. If this
+patch were landed, we would no longer need to ship Polipo, which has a number
+of privacy and security issues of its own (in addition to being unmaintained).
- </para>
- </listitem>
--->
+ </para>
+ </listitem>
+ <listitem><ulink
+url="https://bugzilla.mozilla.org/show_bug.cgi?id=418986";>Bug 418986 - window.screen
+provides a large amount of identifiable information</ulink>
+ <para>
- <listitem><ulink
+As <link linkend="fingerprinting">mentioned above</link>, a large amount of
+information is available from <ulink
+url="http://developer.mozilla.org/en/docs/DOM:window.screen";>window.screen</ulink>.
+Currently, there is no way to obscure this information without Javascript
+hooking. This bug is a feature request to provide some other method to change
+these values. This bug interferes with Torbutton's ability to fulfill its
+<link linkend="setpreservation">Anonymity Set Preservation</link>
+requirement.
+
+ </para>
+ </listitem>
+ <listitem><ulink
url="https://bugzilla.mozilla.org/show_bug.cgi?id=435159";>Bug 435159 -
nsNSSCertificateDB::DeleteCertificate has race conditions</ulink>
<para>
@@ -2135,6 +2162,26 @@ feature.
</listitem>
<listitem><ulink
+url="https://bugzilla.mozilla.org/show_bug.cgi?id=575230";>Bug 575230 - Provide option to
+reduce precision of Date()</ulink>
+ <para>
+
+Currently it is possible to <ulink
+url="http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-finger-unauthorized-users.ars";>fingerprint
+users based on their typing cadence</ulink> using the high precision timer
+available to javascript. Using this same precision, it is possible to compute
+an identifier based upon the clock drift of the client from some nominal
+source. The latter is not much of a concern for Tor users, as the variable
+delay to load and run a page is measured on the order of seconds, but the high
+precision timer can still be used to fingerprint aspects of a browser's
+javascript engine and processor, and apparently also a user's typing cadence.
+This bug hinders Torbutton's ability to satisfy its <link
+linkend="setpreservation">Anonymity Set Preservation</link> requirement.
+
+ </para>
+ </listitem>
+
+ <listitem><ulink
url="https://bugzilla.mozilla.org/show_bug.cgi?id=409737";>Bug 409737 -
javascript.enabled and docShell.allowJavascript do not disable all event
handlers</ulink>
@@ -2179,6 +2226,8 @@ The following bugs impact Torbutton and similar extensions' functionality.
</para>
<orderedlist>
+
+
<listitem><ulink
url="https://bugzilla.mozilla.org/show_bug.cgi?id=445696";>Bug 445696 -
Extensions cannot determine if firefox is fullScreen</ulink>
@@ -2350,20 +2399,6 @@ livemarks fetches.
</para>
</listitem>
-->
- <listitem><ulink
-url="https://bugzilla.mozilla.org/show_bug.cgi?id=418986";>Bug 418986 - window.screen
-provides a large amount of identifiable information</ulink>
- <para>
-
-As <link linkend="fingerprinting">mentioned above</link>, a large amount of
-information is available from <ulink
-url="http://developer.mozilla.org/en/docs/DOM:window.screen";>window.screen</ulink>.
-Currently, there is no way to obscure this information without Javascript
-hooking. This bug is a feature request to provide some other method to change
-these values.
-
- </para>
- </listitem>
<listitem><ulink
url="https://bugzilla.mozilla.org/show_bug.cgi?id=309524";>Bug 309524</ulink>
@@ -2399,6 +2434,10 @@ Williams.
</para>
</listitem>
+<!--
+
+XXX: This is likely fixed with nsICrypto.logout()
+
<listitem><ulink
url="https://bugzilla.mozilla.org/show_bug.cgi?id=448747";>Bug 448747 -
Provide Mechanism to clear TLS Session IDs</ulink>
@@ -2414,6 +2453,7 @@ thing.
</para>
</listitem>
+-->
<listitem><ulink
url="https://bugzilla.mozilla.org/show_bug.cgi?id=419598";>Bug 419598 - 'var
--
1.7.1