Re: Intent to Implement: canvas-imagedata permission

2018-01-12 Thread Tom Ritter
On Thu, Jan 11, 2018 at 10:26 AM, Gervase Markham wrote: > On 10/01/18 18:40, Tom Ritter wrote: >> This proposal is that. Add a permission 'canvas-imagedata' that will >> return 'granted' when Resist Fingerprinting mode is disabled, and >> 'prompt' when RP is enabled and

Re: Intent to Implement: canvas-imagedata permission

2018-01-11 Thread Gervase Markham
On 10/01/18 18:40, Tom Ritter wrote: > This proposal is that. Add a permission 'canvas-imagedata' that will > return 'granted' when Resist Fingerprinting mode is disabled, and > 'prompt' when RP is enabled and appropriate. As this is basically a "is RF turned on?" flag, why not just call it that?

Re: Intent to Implement: canvas-imagedata permission

2018-01-10 Thread Tom Ritter
> In Resist Fingerprinting mode, could it sometimes return all 3 > states (granted, prompt, denied) depending on whether the user had > chosen to remember the decision from a prior prompt? Or is there no > such memory? Yes, it can return all three, it will behave like a normal permission (and

Re: Intent to Implement: canvas-imagedata permission

2018-01-10 Thread Daniel Veditz
On Wed, Jan 10, 2018 at 12:32 PM, L. David Baron wrote: > Is stopping canvas fingerprinting actually a substantial reduction > in available entropy, or is it just removing a convenient source > that happens to combine a bunch of sources of entropy that are also > available

Re: Intent to Implement: canvas-imagedata permission

2018-01-10 Thread L. David Baron
On Wednesday 2018-01-10 12:40 -0600, Tom Ritter wrote: > When Resist Fingerprinting is enabled, we display a permission prompt > when a website tries to access the rendered canvas data. This is > because canvas rendering is a popular fingerprinting and tracking > vector on the web. Is stopping

Intent to Implement: canvas-imagedata permission

2018-01-10 Thread Tom Ritter
Summary: When Resist Fingerprinting is enabled, we display a permission prompt when a website tries to access the rendered canvas data. This is because canvas rendering is a popular fingerprinting and tracking vector on the web. However, some uses of this technique are not actually malicious -