[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #10286 [Applications/Tor Browser]: Touch events leak absolute screen coordinates
#10286: Touch events leak absolute screen coordinates
-------------------------------------------------+-------------------------
Reporter: mikeperry | Owner:
| arthuredelstein
Type: defect | Status:
| needs_review
Priority: High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: tbb-fingerprinting-resolution, | Actual Points:
ff52-esr, tbb-testcase, tbb-firefox-patch, |
TorBrowserTeam201704R, tbb-7.0-must-alpha |
Parent ID: | Points:
Reviewer: | Sponsor:
| Sponsor4
-------------------------------------------------+-------------------------
Comment (by arthuredelstein):
I have thought some more and I now think my reasoning in comment:24 is
wrong. Some laptop/desktop users will be using a touch screen or stylus
frequently, which means that two such sessions can be positively
correlated. That means we have allowed some fingerprinting, even if a
third session where the Touch API is not used cannot be positively linked
to the first two.
So now I am inclined to disable the Touch API altogether. Here's a new
branch with 3 patches. The first simply disables the pref. The next two
patches are the same as before (censoring the true screenX, etc.); the
latter two are included as a possible defense in depth, in case the Touch
API gets activated by the user or by us in the future, but those patches
are not absolutely necessary.
https://github.com/arthuredelstein/tor-browser/commits/10286+2
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10286#comment:25>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs