UUID exposure

[tartpvule]

Saw this on ghacks.net, so thought I'd give this a try. I am using Firefox ESR 68.

In /src/content.js, line 5 script.src = chrome.runtime.getURL('src/nc.js'); is dangerous.

It exposes the extension's UUID that can be used as a unique fingerprint to track the user. (https://bugzilla.mozilla.org/show_bug.cgi?id=1372288)

Array.from(document.getElementsByTagName('script'))
  .map((elem) => elem.getAttribute('src'))
  .filter((src) => src && src.startsWith('moz-extension:'))
  .join('\n')
;

[MathRobin]

Sadly, extensions are indeed in the list of the items which can help you to create a fingerprint... Like when you use adblock, uBlock, etc. Sadly. I don't know what to do to escape from this problem. And without nc.js,this extension will never work.

[TontonSancho]

I'm not to fully understanding the following "without nc.js,this extension will never work". The content script 'content.js' (as registered by manifest) is there to just append nc.js scripts to head content ... but the way web extensions works is exactly the purpose of declaring a script at 'content_scripts' entry in manifest.

Is there something tricky I'm missing ?

[MathRobin]

i will try

[TontonSancho]

I already have a branch with the refactor ready. Could you given me some urls samples to tests existing consent to discard ?

[MathRobin]

I updated the README with a section "test" giving some URLs to tests each platform. Will try to make the UUID disappear today

[MathRobin]

i didn't succeed to make it disappear, i'm interested about your PR if you still have it

[MathRobin]

Sadly I haven't time anymore to maintain. I decided to remove this extension from stores and archieve this repo. Many thanks to having try to help me. Many thanks again :heart: