[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #13021 [Tor Browser]: Review Canvas APIs for fingerprintability
#13021: Review Canvas APIs for fingerprintability
-------------------------+-------------------------------------------------
Reporter: | Owner: brade
mikeperry | Status: assigned
Type: task | Milestone:
Priority: major | Version:
Component: Tor | Keywords: ff31-esr, tbb-fingerprinting,
Browser | TorBrowserTeam201409
Resolution: | Parent ID:
Actual Points: |
Points: |
-------------------------+-------------------------------------------------
Comment (by dcf):
Replying to [comment:6 gacar]:
> Replying to [comment:5 mcs]:
> > Kathy and I also reviewed the canvas APIs. Here are a few of our
observations:
>
> > * We have not done anything to block use of isPointInPath() and
isPointInStroke(). Do we need to block these?
> >
>
> I could not find any way to exploit those two for fingerprinting, but
better someone else give a shot too.
>
> Some canvas fingerprinting scripts found to use isPointInPath() with
"even-odd" winding rule, but I think this was just to check browser
support - will be same for all TBs. Unless someone says "the internal
representations of the paths may depend on the graphics stack too!"
It might be possible to get some mileage out of floating-point precision
issues. For example, attachment:path.html draws quarter-circles in
different ways (with `arc` and `bezierCurveTo` and `quadraticCurveTo`) and
with different transformation matrices, and then tests points right on the
perimeter of the circle.
I see different fingerprints in different versions of Firefox on the same
system, and the same version of Tor Browser on different operating
systems. I didn't get different fingerprints for the same Tor Browser on
the same OS, but I only tried three installations.
The fingerprint I get with Tor Browser 4.0-alpha-2 on Debian is:
{{{
arc
( T F F F T T ) ( T F F F T T ) ( T F F F T T )
arc prerotated
( F F F T T T ) ( F F F T T T ) ( F F F T T T )
bezierCurve
( T F F F T T ) ( T F F F T T ) ( T F F F T T )
bezierCurveTo prerotated
( F F F T T T ) ( F F F T T T ) ( F F F T T T )
quadraticCurve
( T T T T T T ) ( T T T T T T ) ( T T T T T T )
quadraticCurve prerotated
( F F F T T T ) ( F F F T T T ) ( F F F T T T )
}}}
We can guess that the underlying representation for `arc` is a cubic
Bezier, because the corresponding rows match. The one for Firefox 31 on
the same Debian is a little different:
{{{
arc
( T F F F T T ) ( T F F F T T ) ( T F F F T T )
arc prerotated
( F F F T T T ) ( F F F T T T ) ( F F F F T T )
bezierCurve
( T F F F T T ) ( T F F F T T ) ( T F F F T T )
bezierCurveTo prerotated
( F F F T T T ) ( F F F T T T ) ( F F F F T T )
quadraticCurve
( T T T T T T ) ( T T T T T T ) ( T F T F T T )
quadraticCurve prerotated
( F F F T T T ) ( F F F T T T ) ( F F F F T T )
}}}
Tor Browser 4.0-alpha-1 on Windows 8 is:
{{{
arc
( T T T T T T ) ( F T T T T T ) ( F T F F F T )
arc prerotated
( F F F T T T ) ( F F F T T T ) ( F F T T F T )
bezierCurve
( T T T T T T ) ( F T T T T T ) ( F T F F F T )
bezierCurveTo prerotated
( F F F T T T ) ( F F F T T T ) ( F F T T F T )
quadraticCurve
( T T T T T T ) ( F T T T T T ) ( F T F F F T )
quadraticCurve prerotated
( F F F T T T ) ( F F F T T T ) ( F F T T F T )
}}}
The fact that the result of isPointInPath can change just by applying a
different transformation matrix (even though the test point gets
multiplied by the same matrix) shows that there are probably some
measurable precision issues. Whether they could ever distinguish the same
Firefox on the same OS, I don't know.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13021#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs