[tor-commits] [webwml/staging] More fingerprinting clarifications.

Sun, 09 Nov 2014 17:10:18 -0800 

commit 8cf46843a14d29175e2b2e0cf599447c1396d8ba
Author: Mike Perry <mikeperry-...@torproject.org>
Date:   Thu Nov 6 17:33:32 2014 -0800

    More fingerprinting clarifications.
---
 projects/torbrowser/design/index.html.en |   30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/projects/torbrowser/design/index.html.en 
b/projects/torbrowser/design/index.html.en
index 8624b4a..1bd9530 100644
--- a/projects/torbrowser/design/index.html.en
+++ b/projects/torbrowser/design/index.html.en
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";><html 
xmlns="http://www.w3.org/1999/xhtml";><head><meta http-equiv="Content-Type" 
content="text/html; charset=UTF-8" /><title>The Design and Implementation of 
the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL 
Stylesheets V1.78.1" /></head><body><div class="article"><div 
class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and 
Implementation of the Tor Browser [DRAFT]</h2></div><div><div 
class="author"><h3 class="author"><span class="firstname">Mike</span> <span 
class="surname">Perry</span></h3><div class="affiliation"><div 
class="address"><p><code class="email">&lt;<a class="email" 
href="mailto:mikeperry#torproject org">mikeperry#torproject 
org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 
class="author"><span class="firstname">Erinn</span> <span 
class="surname">Clark</span></h3><div class="a
 ffiliation"><div class="address"><p><code class="email">&lt;<a class="email" 
href="mailto:erinn#torproject org">erinn#torproject 
org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 
class="author"><span class="firstname">Steven</span> <span 
class="surname">Murdoch</span></h3><div class="affiliation"><div 
class="address"><p><code class="email">&lt;<a class="email" 
href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject 
org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">November 
6th, 2014</p></div></div><hr /></div><div class="toc"><p><strong>Table of 
Contents</strong></p><dl class="toc"><dt><span class="sect1"><a 
href="#idp65114112">1. Introduction</a></span></dt><dd><dl><dt><span 
class="sect2"><a href="#components">1.1. Browser Component 
Overview</a></span></dt></dl></dd><dt><span class="sect1"><a 
href="#DesignRequirements">2. Design Requirements and 
Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a 
href="#security">2.1. Secu
 rity Requirements</a></span></dt><dt><span class="sect2"><a 
href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span 
class="sect2"><a href="#philosophy">2.3. 
Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a 
href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span 
class="sect2"><a href="#adversary-goals">3.1. Adversary 
Goals</a></span></dt><dt><span class="sect2"><a 
href="#adversary-positioning">3.2. Adversary Capabilities - 
Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. 
Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span 
class="sect1"><a href="#Implementation">4. 
Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a 
href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span 
class="sect2"><a href="#state-separation">4.2. State 
Separation</a></span></dt><dt><span class="sect2"><a 
href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span 
class="sect2"><a href="#app-data-isol
 ation">4.4. Application Data Isolation</a></span></dt><dt><span 
class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier 
Unlinkability</a></span></dt><dt><span class="sect2"><a 
href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting 
Unlinkability</a></span></dt><dt><span class="sect2"><a 
href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" 
button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. 
Other Security Measures</a></span></dt></dl></dd><dt><span class="sect1"><a 
href="#BuildSecurity">5. Build Security and Package 
Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a 
href="#idp67866160">5.1. Achieving Binary 
Reproducibility</a></span></dt><dt><span class="sect2"><a 
href="#idp67901104">5.2. Package Signatures and 
Verification</a></span></dt><dt><span class="sect2"><a href="#idp67905040">5.3. 
Anonymous Verification</a></span></dt></dl></dd><dt><span class="appendix"><a 
href="#Transparency">A. Towards Tran
 sparency in Navigation Tracking</a></span></dt><dd><dl><dt><span 
class="sect1"><a href="#deprecate">A.1. Deprecation 
Wishlist</a></span></dt><dt><span class="sect1"><a href="#idp67937488">A.2. 
Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1"><div 
class="titlepage"><div><div><h2 class="title" style="clear: both"><a 
id="idp65114112"></a>1. Introduction</h2></div></div></div><p>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd";><html 
xmlns="http://www.w3.org/1999/xhtml";><head><meta http-equiv="Content-Type" 
content="text/html; charset=UTF-8" /><title>The Design and Implementation of 
the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL 
Stylesheets V1.78.1" /></head><body><div class="article"><div 
class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and 
Implementation of the Tor Browser [DRAFT]</h2></div><div><div 
class="author"><h3 class="author"><span class="firstname">Mike</span> <span 
class="surname">Perry</span></h3><div class="affiliation"><div 
class="address"><p><code class="email">&lt;<a class="email" 
href="mailto:mikeperry#torproject org">mikeperry#torproject 
org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 
class="author"><span class="firstname">Erinn</span> <span 
class="surname">Clark</span></h3><div class="a
 ffiliation"><div class="address"><p><code class="email">&lt;<a class="email" 
href="mailto:erinn#torproject org">erinn#torproject 
org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 
class="author"><span class="firstname">Steven</span> <span 
class="surname">Murdoch</span></h3><div class="affiliation"><div 
class="address"><p><code class="email">&lt;<a class="email" 
href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject 
org</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">November 
6th, 2014</p></div></div><hr /></div><div class="toc"><p><strong>Table of 
Contents</strong></p><dl class="toc"><dt><span class="sect1"><a 
href="#idp59720528">1. Introduction</a></span></dt><dd><dl><dt><span 
class="sect2"><a href="#components">1.1. Browser Component 
Overview</a></span></dt></dl></dd><dt><span class="sect1"><a 
href="#DesignRequirements">2. Design Requirements and 
Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a 
href="#security">2.1. Secu
 rity Requirements</a></span></dt><dt><span class="sect2"><a 
href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span 
class="sect2"><a href="#philosophy">2.3. 
Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a 
href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span 
class="sect2"><a href="#adversary-goals">3.1. Adversary 
Goals</a></span></dt><dt><span class="sect2"><a 
href="#adversary-positioning">3.2. Adversary Capabilities - 
Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. 
Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span 
class="sect1"><a href="#Implementation">4. 
Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a 
href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span 
class="sect2"><a href="#state-separation">4.2. State 
Separation</a></span></dt><dt><span class="sect2"><a 
href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span 
class="sect2"><a href="#app-data-isol
 ation">4.4. Application Data Isolation</a></span></dt><dt><span 
class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier 
Unlinkability</a></span></dt><dt><span class="sect2"><a 
href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting 
Unlinkability</a></span></dt><dt><span class="sect2"><a 
href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" 
button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. 
Other Security Measures</a></span></dt></dl></dd><dt><span class="sect1"><a 
href="#BuildSecurity">5. Build Security and Package 
Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a 
href="#idp60597904">5.1. Achieving Binary 
Reproducibility</a></span></dt><dt><span class="sect2"><a 
href="#idp60632800">5.2. Package Signatures and 
Verification</a></span></dt><dt><span class="sect2"><a href="#idp60636736">5.3. 
Anonymous Verification</a></span></dt></dl></dd><dt><span class="appendix"><a 
href="#Transparency">A. Towards Tran
 sparency in Navigation Tracking</a></span></dt><dd><dl><dt><span 
class="sect1"><a href="#deprecate">A.1. Deprecation 
Wishlist</a></span></dt><dt><span class="sect1"><a href="#idp60669376">A.2. 
Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1"><div 
class="titlepage"><div><div><h2 class="title" style="clear: both"><a 
id="idp59720528"></a>1. Introduction</h2></div></div></div><p>
 
 This document describes the <a class="link" href="#adversary" title="3. 
Adversary Model">adversary model</a>,
 <a class="link" href="#DesignRequirements" title="2. Design Requirements and 
Philosophy">design requirements</a>, and <a class="link" href="#Implementation" 
title="4. Implementation">implementation</a>  of the Tor Browser. It is 
current as of Tor Browser
@@ -654,13 +654,13 @@ system-wide extensions (through the use of
 disabled, which prevents Flash cookies from leaking from a pre-existing Flash
 directory.
 
-   </p></div><div class="sect2"><div class="titlepage"><div><div><h3 
class="title"><a id="disk-avoidance"></a>4.3. Disk 
Avoidance</h3></div></div></div><div class="sect3"><div 
class="titlepage"><div><div><h4 class="title"><a id="idp67642512"></a>Design 
Goal:</h4></div></div></div><div class="blockquote"><blockquote 
class="blockquote">
+   </p></div><div class="sect2"><div class="titlepage"><div><div><h3 
class="title"><a id="disk-avoidance"></a>4.3. Disk 
Avoidance</h3></div></div></div><div class="sect3"><div 
class="titlepage"><div><div><h4 class="title"><a id="idp60374176"></a>Design 
Goal:</h4></div></div></div><div class="blockquote"><blockquote 
class="blockquote">
 
 The User Agent MUST (at user option) prevent all disk records of browser 
activity.
 The user should be able to optionally enable URL history and other history
 features if they so desire. 
 
-    </blockquote></div></div><div class="sect3"><div 
class="titlepage"><div><div><h4 class="title"><a 
id="idp67643872"></a>Implementation Status:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote">
+    </blockquote></div></div><div class="sect3"><div 
class="titlepage"><div><div><h4 class="title"><a 
id="idp60375536"></a>Implementation Status:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote">
 
 We achieve this goal through several mechanisms. First, we set the Firefox
 Private Browsing preference
@@ -734,7 +734,7 @@ the url bar origin for which browser state exists, possibly 
with a
 context-menu option to drill down into specific types of state or permissions.
 An example of this simplification can be seen in Figure 1.
 
-   </p><div class="figure"><a id="idp67666576"></a><p 
class="title"><strong>Figure 1. Improving the Privacy UI</strong></p><div 
class="figure-contents"><div class="mediaobject" align="center"><img 
src="NewCookieManager.png" align="middle" alt="Improving the Privacy UI" 
/></div><div class="caption"><p></p>
+   </p><div class="figure"><a id="idp60398240"></a><p 
class="title"><strong>Figure 1. Improving the Privacy UI</strong></p><div 
class="figure-contents"><div class="mediaobject" align="center"><img 
src="NewCookieManager.png" align="middle" alt="Improving the Privacy UI" 
/></div><div class="caption"><p></p>
 
 This example UI is a mock-up of how isolating identifiers to the URL bar
 origin can simplify the privacy UI for all data - not just cookies. Once
@@ -1140,7 +1140,7 @@ To improve rendering, we exempt remote <a class="ulink" 
href="https://developer.
 fonts</a> from these counts, and if a font-family CSS rule lists a remote
 font (in any order), we use that font instead of any of the named local fonts.
 
-     </p></li><li class="listitem">Monitor and OS Desktop Resolution
+     </p></li><li class="listitem">Monitor, Widget, and OS Desktop Resolution
      <p>
 
 Both CSS and Javascript have access to a lot of information about the screen
@@ -1189,8 +1189,8 @@ to privacy in this mode.
 Beyond simple resolution information, a large amount of so-called "Media"
 information is also exported to content. Even without Javascript, CSS has
 access to a lot of information about the device orientation, system theme
-colors, and other desktop features that are not at all relevant to rendering
-and also user configurable. Most of this
+colors, and other desktop and display features that are not at all relevant to
+rendering and also user configurable. Most of this
 information comes from <a class="ulink" 
href="https://developer.mozilla.org/en-US/docs/Web/Guide/CSS/Media_queries"; 
target="_top">CSS
 Media Queries</a>, but Mozilla has exposed <a class="ulink" 
href="https://developer.mozilla.org/en-US/docs/Web/CSS/color_value#System_Colors";
 target="_top">several
 user and OS theme defined color values</a> to CSS as well.
@@ -1377,11 +1377,11 @@ In order to avoid long-term linkability, we provide a 
"New Identity" context
 menu option in Torbutton. This context menu option is active if Torbutton can
 read the environment variables $TOR_CONTROL_PASSWD and $TOR_CONTROL_PORT.
 
-   </p><div class="sect3"><div class="titlepage"><div><div><h4 
class="title"><a id="idp67813456"></a>Design Goal:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote">
+   </p><div class="sect3"><div class="titlepage"><div><div><h4 
class="title"><a id="idp60545136"></a>Design Goal:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote">
 
 All linkable identifiers and browser state MUST be cleared by this feature.
 
-    </blockquote></div></div><div class="sect3"><div 
class="titlepage"><div><div><h4 class="title"><a 
id="idp67814704"></a>Implementation Status:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote"><p>
+    </blockquote></div></div><div class="sect3"><div 
class="titlepage"><div><div><h4 class="title"><a 
id="idp60546384"></a>Implementation Status:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote"><p>
 
 First, Torbutton disables Javascript in all open tabs and windows by using
 both the <a class="ulink" 
href="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIDocShell#Attributes";
 target="_top">browser.docShell.allowJavascript</a>
@@ -1461,7 +1461,7 @@ all non-WebM HTML5 codecs (<span 
class="command"><strong>media.ogg.enabled</stro
 Fingerprinting</a> is a statistical attack to attempt to recognize specific
 encrypted website activity.
 
-     </p><div class="sect3"><div class="titlepage"><div><div><h4 
class="title"><a id="idp67843072"></a>Design Goal:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote"><p>
+     </p><div class="sect3"><div class="titlepage"><div><div><h4 
class="title"><a id="idp60574784"></a>Design Goal:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote"><p>
 
 We want to deploy a mechanism that reduces the accuracy of <a class="ulink" 
href="https://en.wikipedia.org/wiki/Feature_selection"; target="_top">useful 
features</a> available
 for classification. This mechanism would either impact the true and false
@@ -1483,7 +1483,7 @@ Congestion-Sensitive BUFLO</a>. It may be also possible 
to <a class="ulink" href
 defenses</a> such that they only use existing spare Guard bandwidth capacity 
in the Tor
 network, making them also effectively no-overhead.
 
-     </p></blockquote></div></div><div class="sect3"><div 
class="titlepage"><div><div><h4 class="title"><a 
id="idp67849968"></a>Implementation Status:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote"><p>
+     </p></blockquote></div></div><div class="sect3"><div 
class="titlepage"><div><div><h4 class="title"><a 
id="idp60581680"></a>Implementation Status:</h4></div></div></div><div 
class="blockquote"><blockquote class="blockquote"><p>
 Currently, we patch Firefox to <a class="ulink" 
href="https://gitweb.torproject.org/tor-browser.git/commitdiff/27ef32d509ed1c9eeb28f7affee0f9ba11773f72";
 target="_top">randomize
 pipeline order and depth</a>. Unfortunately, pipelining is very fragile.
 Many sites do not support it, and even sites that advertise support for
@@ -1548,7 +1548,7 @@ contend with. For this reason, we have deployed a build 
system
 that allows anyone to use our source code to reproduce byte-for-byte identical
 binary packages to the ones that we distribute.
 
-  </p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a 
id="idp67866160"></a>5.1. Achieving Binary 
Reproducibility</h3></div></div></div><p>
+  </p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a 
id="idp60597904"></a>5.1. Achieving Binary 
Reproducibility</h3></div></div></div><p>
 
 The GNU toolchain has been working on providing reproducible builds for some
 time, however a large software project such as Firefox typically ends up
@@ -1665,7 +1665,7 @@ unitialized memory</a> that only appear in LXC mode, as 
well as
 <a class="ulink" href="https://trac.torproject.org/projects/tor/ticket/12240"; 
target="_top">oddities related to
 time-based dependency tracking</a> that only appear in LXC containers.
 
-   </p></li></ol></div></div><div class="sect2"><div 
class="titlepage"><div><div><h3 class="title"><a id="idp67901104"></a>5.2. 
Package Signatures and Verification</h3></div></div></div><p>
+   </p></li></ol></div></div><div class="sect2"><div 
class="titlepage"><div><div><h3 class="title"><a id="idp60632800"></a>5.2. 
Package Signatures and Verification</h3></div></div></div><p>
 
 The build process produces a single sha256sums.txt file that contains a sorted
 list of the SHA-256 hashes of every package produced for that build version. 
Each
@@ -1699,7 +1699,7 @@ and by their nature are based on non-public key material, 
providing native
 code-signed packages while still preserving ease of reproducibility
 verification has not yet been achieved.
 
-    </p></div><div class="sect2"><div class="titlepage"><div><div><h3 
class="title"><a id="idp67905040"></a>5.3. Anonymous 
Verification</h3></div></div></div><p>
+    </p></div><div class="sect2"><div class="titlepage"><div><div><h3 
class="title"><a id="idp60636736"></a>5.3. Anonymous 
Verification</h3></div></div></div><p>
 
 Due to the fact that bit-identical packages can be produced by anyone, the
 security of this build system extends beyond the security of the official
@@ -1815,7 +1815,7 @@ possible for us to <a class="ulink" 
href="https://trac.torproject.org/projects/t
 ourselves</a>, as they are comparatively rare and can be handled with site
 permissions.
 
-   </p></li></ol></div></div><div class="sect1"><div 
class="titlepage"><div><div><h2 class="title" style="clear: both"><a 
id="idp67937488"></a>A.2. Promising Standards</h2></div></div></div><div 
class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a 
class="ulink" href="http://web-send.org"; target="_top">Web-Send 
Introducer</a><p>
+   </p></li></ol></div></div><div class="sect1"><div 
class="titlepage"><div><div><h2 class="title" style="clear: both"><a 
id="idp60669376"></a>A.2. Promising Standards</h2></div></div></div><div 
class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a 
class="ulink" href="http://web-send.org"; target="_top">Web-Send 
Introducer</a><p>
 
 Web-Send is a browser-based link sharing and federated login widget that is
 designed to operate without relying on third-party tracking or abusing other




_______________________________________________
tor-commits mailing list
tor-commits@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits

Reply via email to