Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:  closed
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  ff68-esr, tbb-9.0,   |  Actual Points:  1.5
  TorBrowserTeam201910R, BugSmashFund, tbb-  |
  backport   |
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  ff68-esr, tbb-9.0, TorBrowserTeam201910R, tbb-backport,
 BugSmashFund => ff68-esr, tbb-9.0, TorBrowserTeam201910R,
 BugSmashFund, tbb-backport


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:  closed
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  ff68-esr, tbb-9.0,   |  Actual Points:  1.5
  TorBrowserTeam201910R, tbb-backport|
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
 |  Sponsor44-can
-+-
Changes (by sysrqb):

 * actualpoints:   => 1.5


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:  closed
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  ff68-esr, tbb-9.0,   |  Actual Points:
  TorBrowserTeam201910R, tbb-backport|
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
 |  Sponsor44-can
-+-
Changes (by gk):

 * keywords:  ff68-esr, tbb-9.0, TorBrowserTeam201910R => ff68-esr, tbb-9.0,
 TorBrowserTeam201910R, tbb-backport


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:  closed
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  ff68-esr, tbb-9.0,   |  Actual Points:
  TorBrowserTeam201910R  |
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
 |  Sponsor44-can
-+-
Changes (by gk):

 * status:  needs_review => closed
 * resolution:   => fixed


Comment:

 Replying to [comment:33 sysrqb]:
 > I have two branches - one for tor-browser (deleting the override) and
 the other for torbutton (adding as a pref controlled by the security
 slider).
 >
 > Both branches are named `bug21549_00`.
 >
 > https://github.com/sysrqb/torbutton/

 Looks good. Merged to `master` (Torbutton) as commit
 324e8fd7f73c7f97f8174713c6a112ec75669e56 and `tor-browser-68.2.0-9.5-1`
 (`tor-browser`) as commit 80134f6a3d2026ff95943e806cb424bf9eff2c2f.

 Nice review work!

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  ff68-esr, tbb-9.0,   |  Actual Points:
  TorBrowserTeam201910R  |
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
 |  Sponsor44-can
-+-
Changes (by sysrqb):

 * status:  new => needs_review
 * keywords:  ff68-esr, tbb-9.0, TorBrowserTeam201910 => ff68-esr, tbb-9.0,
 TorBrowserTeam201910R


Comment:

 I have two branches - one for tor-browser (deleting the override) and the
 other for torbutton (adding as a pref controlled by the security slider).

 Both branches are named `bug21549_00`.

 https://github.com/sysrqb/torbutton/

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:  new
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  ff68-esr, tbb-9.0,   |  Actual Points:
  TorBrowserTeam201910   |
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
 |  Sponsor44-can
-+-

Comment (by sysrqb):

 I don't see any significant fingerprinting or linkability issues in the
 wasm implementation. I don't see any caching across principals. There is a
 minor fingerprinting risk due to timing leaks (how quickly the wasm byte
 code is returned as a Module), and how quickly a wasm function is
 executed. There is the additional risk of malicious byte code exploiting a
 compiler bug. However, these seem no worse than the existing javascript
 attack surface - wasm simply adds more options.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:  new
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  ff68-esr, tbb-9.0,   |  Actual Points:
  TorBrowserTeam201910   |
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
 |  Sponsor44-can
-+-

Comment (by sysrqb):

 The WebAssembly API [https://developer.mozilla.org/en-US/docs/WebAssembly
 consists] of:
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly WebAssembly]
 Object:
- [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/compile
 WebAssembly.compile()]
- [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/compileStreaming
 WebAssembly.compileStreaming()]
- [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/instantiate
 WebAssembly.instantiate()]
- [https://developer.mozilla.org/en-
 
US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/instantiateStreaming
 WebAssembly.instantiateStreaming()]
- [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/validate
 WebAssembly.validate()]
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Global
 WebAssembly.Global] Object:
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Module
 WebAssembly.Module] Object:
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Instance
 WebAssembly.Instance] Object:
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Memory
 WebAssembly.Memory] Object:
- [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Memory/buffer
 WebAssembly.Memory().buffer()]
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/Table
 WebAssembly.Table] Object:
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/CompileError
 WebAssembly.CompileError] Object:
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/LinkError
 WebAssembly.LinkError] Object:
  - The [https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/WebAssembly/RuntimeError
 WebAssembly.RuntimeError] Object:

 These are [https://searchfox.org/mozilla-
 esr68/source/js/src/wasm/WasmJS.cpp#3670 exported] and implemented:
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#2997
 WebAssembly.compile()]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#3618
 WebAssembly.compileStreaming()]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#3046
 WebAssembly.instantiate()]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#3641
 WebAssembly.instantiateStreaming()]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#3091
 WebAssembly.validate()]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#2342
 WebAssembly.Global]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#1587
 WebAssembly.Memory]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#657
 WebAssembly.Module]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#1169
 WebAssembly.Instance]
 [https://searchfox.org/mozilla-esr68/source/js/src/wasm/WasmJS.cpp#1926
 WebAssembly.Table]

 - `WebAssembly.compile` is for ahead-of-time compiling a WASM module. It
 takes in a buffer of WASM and returns a Promise of a `WebAssembly.Module`.
 - `WebAssembly.compileStreaming` is similar to `compile()` except it takes
 in a Response object or Promise for a wasm module (compared with a buffer
 containing the module).
 - `WebAssembly.instantiate` has two prototypes.
   - The first takes in a buffer of WASM and returns a Promise of a tuple:
 (`WebAssembly.Module`, `WebAssembly.Instance`). The `Module` is the
 compiled WASM, and the `Instance` is an instantiation of that `Module`.
   - The second takes in an existing `WebAssembly.Module` (already compiled
 WASM) and r

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:  new
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  ff68-esr, tbb-9.0,   |  Actual Points:
  TorBrowserTeam201910   |
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
 |  Sponsor44-can
-+-

Comment (by sysrqb):

 Okay, I started from the beginning, and then worked backwards :)

 This was tedious because most of the initial patches were simply
 refactoring asmjs compiler code such that the code could be shared with
 wasm. Reading these patches was helpful except the code has significantly
 changed since four years ago (and wasm has mostly replaced asmjs in the
 codebase now). As an example, the compiler cached asmjs code until earlier
 this year. I'm taking a different approach now, but I'll post this anyway.
 The next comments will be based on the current implementation.

 https://bugzilla.mozilla.org/show_bug.cgi?id=1188259
   - Meta ticket of implementing wasm
 https://bugzilla.mozilla.org/show_bug.cgi?id=1224389
   - Odin: refactor in preparation for WebAssembly decoder
   Commits:
 - f7c5ebaa664b0dc07836fe06d3609e239ba7e71a - okay
   - Mostly refactoring
 - 4ef42db6e3cad192ccefaacc823aab012a57c6e5 - okay
   - Mostly code simplification
 - 28f2c8f11d211e30e1f0fb77902c9ba4d2a7d1c5 -
 - Check JS::AsmJSCache_QuotaExceeded, LookupAsmJSModuleInCache
   - https://bugzilla.mozilla.org/show_bug.cgi?id=1516697 - Remove
 the implementation of the asm.js caching mechanism.
 - masm.loadAsmJSHeapRegisterFromGlobalData is isolated?
 https://bugzilla.mozilla.org/show_bug.cgi?id=1232205
   - wasm:Baseline JIT
   Commits:
 - 9e9fafcd38f7e3ec3db1d4508bf4230a2d4b3678 - okay
 - 8938a215ec16a20f9fa4f4156d9bd611e8fa8562 - okay
 - 5f37b8277391842f5e56c211c3ca4acd86237d72 - okay
 - 8ec23c07dd09da1e46bf17f05ecad83f8aa12e4e - okay
 - 9af7246a474bb824f39562b68e5f7fae0921a8d9 - okay
   - All refactoring and JIT impl, no caching
 - 136c1d78af1bf603c4bcd2fc2488d3c3f9661569 - okay
   - Adds mechanism for running baseline wasm tests
 - 65b0869d9e684d486c1ac4cf90c60bf3dfc22c82 - okay
   - Adds test directive
 - 2a5c7f48c92c2163b9f69ebc9f287c7ae8db7c7c -
   - Baseline JIT impl.
   - Pushes code onto masm stack? Is this masm stack isolated?
   - ffiCall? WasmTableCallPtrReg?
 - bd9aa07076b543051bcfbd8937c32a9ad2bec883 - okay
   - Add pref and jsshell runtime arg

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-
 |  team
 Type:  task | Status:  new
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  ff68-esr, TorBrowserTeam201909,  |  Actual Points:
  tbb-9.0|
Parent ID:   | Points:  1
 Reviewer:   |Sponsor:
 |  Sponsor44-can
-+-
Changes (by gk):

 * keywords:  ff68-esr, TorBrowserTeam201909 => ff68-esr,
 TorBrowserTeam201909, tbb-9.0


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff68-esr, TorBrowserTeam201909  |  Actual Points:
Parent ID:  | Points:  1
 Reviewer:  |Sponsor:
|  Sponsor44-can
+--
Changes (by pili):

 * points:   => 1


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff68-esr, TorBrowserTeam201907  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by gk):

 * keywords:  ff60-esr, TorBrowserTeam201809 => ff68-esr,
   TorBrowserTeam201907


Comment:

 We have #23719 for the slider related things and this bug for the general
 enabling. Talking to Luke I think we are in good shape (surprise!) and
 nothing stood out. One thing that remains to test is whether New Identity
 is actually blowing away WASM related cache in case someone used Tor
 Browser outside of Private Browsing Mode (there are no WASM cache entries
 written to disk in that mode).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201809  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by tom):

 the flag for enabling wasm is on the JSContext

 https://searchfox.org/mozilla-
 
central/rev/c0ca77697c6868482f30af873ec8069f2c080a34/js/public/ContextOptions.h#24

 We would need to push it down to CompartmentOptions. And then we can
 enable it per-Compartment, and enable it for Chrome but not Content.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201809  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by legind):

 Update: in https://github.com/EFForg/https-everywhere/pull/18093, HTTPS
 Everywhere includes WASM optimizations.  So Tor Browser would see an OOTB
 performance increase and memory overhead decrease by enabling WASM in
 extension-land.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201809  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by gk):

 Oh, and  one additional point: we might want to have some WebExtensions
 exceptions on the higher levels of the security slider for things like JIT
 (see: #23719) which is kind of related.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201809  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by gk):

 Replying to [comment:18 legind]:
 > @gk I'm concerned that extensions are a single-click install in most
 cases, and privileging them in general will open identifiable
 characteristics to possibly irresponsible third parties.  Can we whitelist
 WASM by extension ID?

 Maybe. However, the current policy is that users are responsible
 themselves for possible fallout if they are installing other extensions
 into their Tor Browser. This is not recommended for all sorts of reasons.

 Webextensions got already "privileged" by allowing JavaScript to run in
 general if it is disabled in the browser (you might remember
 https://bugzilla.mozilla.org/show_bug.cgi?id=1329731). I think it is more
 straightforward to follow the reasoning dveditz outlined in
 https://bugzilla.mozilla.org/show_bug.cgi?id=1329731#c7 arguing that
 disabling WASM for extensions (while allowing it for the remaining parts
 of the privileged browser) is not the right solution.

 FWIW: that Mozilla bug might be a good start for investigating how to
 enable WASM for extensions only but not content (by checking the principal
 accordingly).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201809  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by legind):

 @gk I'm concerned that extensions are a single-click install in most
 cases, and privileging them in general will open identifiable
 characteristics to possibly irresponsible third parties.  Can we whitelist
 WASM by extension ID?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201809  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by gk):

 Replying to [comment:16 legind]:
 > Relevant to HTTPS Everywhere, which would like to rewrite portions of
 the code in WASM for better performance: https://github.com/EFForg/https-
 everywhere/issues/17143.

 I think we could bypass the investigation for HTTPS Everywhere (and
 extensions in general) at least by assuming it belongs to privileged code
 (which it does) and that the linkability etc. concerns only applies to
 content (which I think is not unreasonable). The idea then could be to
 implement a switch to being able to disable WASM and similar things
 (ASM.js comes to mind) for content only while leaving chrome like code
 untouched.

 Or maybe the chrome/content separation already exists and WebExtensions
 are just not properly added to the chrome bucket?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201809  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by legind):

 Relevant to HTTPS Everywhere, which would like to rewrite portions of the
 code in WASM for better performance: https://github.com/EFForg/https-
 everywhere/issues/17143.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201809  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by legind):

 * cc: legind (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by reportUrl):

 Is this enough after tiering was enabled?
 https://bugzilla.mozilla.org/show_bug.cgi?id=1277562

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by gk):

 * keywords:  ff60-esr, TorBrowserTeam201808R => ff60-esr,
 TorBrowserTeam201808
 * status:  needs_review => new


Comment:

 Thanks. Cherry-picked to `tor-browser-60.1.0esr-8.0-1` (commit
 3c6862f6cc8a7dc59b9eba41638100638ecb33b0). Setting back to `new` for the
 investigation part.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-team
 Type:  task | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808R  |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by mcs):

 r=mcs, r=brade
 Looks good to us.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
-+-
 Reporter:  gk   |  Owner:  tbb-team
 Type:  task | Status:
 |  needs_review
 Priority:  Very High|  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808R  |  Actual Points:
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  ff60-esr, TorBrowserTeam201808 => ff60-esr,
 TorBrowserTeam201808R
 * status:  new => needs_review
 * cc: mcs, brade (added)


Comment:

 Let's disable it for now until we are confident we can enable it and let
 it govern by the security slider. See: `bug_21549`
 (https://gitweb.torproject.org/user/gk/tor-
 browser.git/commit/?h=bug_21549&id=19ad2e4d07a06e529920f082eb7d5fdd87e380d4)
 in my public `tor-browser` repository.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Old description:

> In order to avoid the asm.js disaster we should investigate whether wasm
> complies with our design requirements. It got enabled in Firefox 52 (and
> presumably in ESR 52 as well):
> https://bugzilla.mozilla.org/show_bug.cgi?id=1342060.

New description:

 In order to avoid the asm.js disaster we should investigate whether wasm
 complies with our design requirements. It got
 [[https://bugzilla.mozilla.org/show_bug.cgi?id=1342060|enabled in Firefox
 52]] but [[https://bugzilla.mozilla.org/show_bug.cgi?id=1342440|re-
 disabled in ESR 52]].

--

Comment (by dmr):

 Replying to [comment:1 cypherpunks]:
 > {{{status-firefox-esr52:  disabled}}}
 > https://bugzilla.mozilla.org/show_bug.cgi?id=1342060#c23
 > But, please, don't postpone such tasks to the next esr.

 Indeed disabled in esr52.
 pref `javascript.options.wasm`

 More details (beyond the comment):
 https://bugzilla.mozilla.org/show_bug.cgi?id=1342440
 https://hg.mozilla.org/releases/mozilla-esr52/rev/e07850f191a0

 Changing the description so that others don't need to read comments to
 know about this.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by dmr):

 * cc: dmr (added)


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--

Comment (by gk):

 I think we can disable WASM for 8.0 until we are sure we are good here. If
 we happen to do the analysis and proper patches earlier, great.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  Very High   |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201808  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by gk):

 * priority:  High => Very High


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
+--
 Reporter:  gk  |  Owner:  tbb-team
 Type:  task| Status:  new
 Priority:  High|  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  ff60-esr, TorBrowserTeam201807  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by gk):

 * priority:  Medium => High
 * keywords:  ff60-esr => ff60-esr, TorBrowserTeam201807


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
--+--
 Reporter:  gk|  Owner:  tbb-team
 Type:  task  | Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  ff59-esr  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by gk):

 * keywords:   => ff59-esr
 * sponsor:  Sponsor4 =>


Comment:

 If we get earlier to it fine with me. But that needs to get addressed
 latest with the switch to esr59. Addjusting the key words and sponsor
 field.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #21549 [Applications/Tor Browser]: Investigate wasm for linkability/fingerprintability/disk avoidance issues

[Tor Bug Tracker & Wiki]

#21549: Investigate wasm for linkability/fingerprintability/disk avoidance 
issues
--+--
 Reporter:  gk|  Owner:  tbb-team
 Type:  task  | Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:  Sponsor4
--+--
Changes (by cypherpunks):

 * keywords:  ff52-esr =>


Comment:

 {{{status-firefox-esr52:disabled}}}
 https://bugzilla.mozilla.org/show_bug.cgi?id=1342060#c23
 But, please, don't postpone such tasks to the next esr.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs