[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #6370 [Tor bundles/installation]: Enable WebGL
#6370: Enable WebGL
--------------------------------------+-------------------------------------
Reporter: mikeperry | Owner: mikeperry
Type: enhancement | Status: new
Priority: major | Milestone: TorBrowserBundle 2.3.x-stable
Component: Tor bundles/installation | Version:
Keywords: MikePerry201207 | Parent:
Points: 1 | Actualpoints:
--------------------------------------+-------------------------------------
In #3323, we reviewed WebGL for API-based fingerprinting issues. The
conclusion is that if we set webgl.min_capability_mode and webgl.disable-
extensions, our primary API-level fingerprinting concerns are addressed.
Additionally, #6253 lists another related fingerprinting defense to
rendering vectors (#6041), but so long as WebGL remains click-to-play, I
think #6253 is not a blocker to enabling WebGL in a click-to-play limited
sense.
However, I am still terrified by the vulnerability surface represented by
WebGL on the graphics driver end. Because much of that code lives in
kernel or at least at UID 0 priv level, it will prove very difficult to
actually properly sandbox.. Worse, many drivers are very likely not
network-hardened or designed to handle untrusted input. See also:
http://www.contextis.com/resources/blog/webgl/
Hence, I think WebGL will probably have to remain a second-class click-to-
play tech for the foreseeable future, even if "enabled".
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6370>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs