#18545: Review Firefox Developer Docs and Undocumented bugs since FF38esr
--------------------------------------------+--------------------------
Reporter: gk | Owner: tbb-team
Type: task | Status: new
Priority: Very High | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Critical | Resolution:
Keywords: ff45-esr, TorBrowserTeam201604 | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor: SponsorU
--------------------------------------------+--------------------------
Comment (by brade):
Kathy and I reviewed all of the release notes and developer docs for
Firefox 39-45. We have not yet looked at the complete bug lists
(comment:17). Here are some things that might be worth another look (some
of these may have been looked at in more detail by gk already):
CacheStorage. It seems that this can be used by Web Workers and regular JS
code (not just by Service Workers).
https://developer.mozilla.org/en-US/docs/Web/API/CacheStorage
Server logging. This is kind of a strange feature: server applications can
return an X- HTTP header to cause items to be logged to the developer
console. Maybe it is only done when the console is open and the user is
monitoring network requests (I am not sure). Kathy and I do not like the
idea that this is enabled, but it may be harmless.
https://developer.mozilla.org/en-
US/docs/Tools/Web_Console/Console_messages#Server
window.screen.orientation. This is possibly a fingerprinting vector unless
it always returns "landscape-primary" on desktop Firefox (it may still be
an issue for Orfox). Or did we decide that applications can derive this
kind of info from the window size/aspect ratio anyway?
https://developer.mozilla.org/en-US/docs/Web/API/Screen/orientation
Navigator.onLine. This can be used to monitor the connected state of a
user's computer. We can disable it by setting network.manage-offline-
status = false.
https://developer.mozilla.org/en-US/docs/Web/API/NavigatorOnLine/onLine
Enable H.264 if system decoder is available (Linux). Kathy and I do not
know enough about the world of video decoders to know if this could be a
significant fingerprinting vector.
https://bugzilla.mozilla.org/show_bug.cgi?id=1213499
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18545#comment:20>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs
