#10286: Touch events leak absolute screen coordinates -------------------------------------------------+------------------------- Reporter: mikeperry | Owner: | arthuredelstein Type: defect | Status: | needs_review Priority: High | Milestone: Component: Applications/Tor Browser | Version: Severity: Normal | Resolution: Keywords: tbb-fingerprinting-resolution, | Actual Points: ff52-esr, tbb-testcase, tbb-firefox-patch, | TorBrowserTeam201704R, tbb-7.0-must-alpha | Parent ID: | Points: Reviewer: | Sponsor: | Sponsor4 -------------------------------------------------+-------------------------
Comment (by arthuredelstein): I have thought some more and I now think my reasoning in comment:24 is wrong. Some laptop/desktop users will be using a touch screen or stylus frequently, which means that two such sessions can be positively correlated. That means we have allowed some fingerprinting, even if a third session where the Touch API is not used cannot be positively linked to the first two. So now I am inclined to disable the Touch API altogether. Here's a new branch with 3 patches. The first simply disables the pref. The next two patches are the same as before (censoring the true screenX, etc.); the latter two are included as a possible defense in depth, in case the Touch API gets activated by the user or by us in the future, but those patches are not absolutely necessary. https://github.com/arthuredelstein/tor-browser/commits/10286+2 -- Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10286#comment:25> Tor Bug Tracker & Wiki <https://trac.torproject.org/> The Tor Project: anonymity online _______________________________________________ tor-bugs mailing list tor-bugs@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs