search

arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.43k stars 506 forks source link

FPP canvas can fail in service workers [1878716] #1813

Open Thorin-Oakenpants opened 4 months ago

Thorin-Oakenpants commented 4 months ago

Originally posted by @mik0l in https://github.com/arkenfox/user.js/issues/1716#issuecomment-1963013656

Not always, but sometimes there is a leak in "Service".

  1. Start browser and paste into the address bar https://abrahamjuliot.github.io/creepjs/tests/workers.html
  2. If there is no leak, close browser and return to step 1.

Originally posted by @Thorin-Oakenpants in https://github.com/arkenfox/user.js/issues/1716#issuecomment-1963033751

OK, so I can confirm (nightly 125) - the result in SWers sometimes (I get it almost every time) is not randomized

@tomrittervg see STR ~~in previous comment

this is without FPP noFPP

some FPP examples

diff1

diff2

Thorin-Oakenpants commented 4 months ago

spinning this off to a separate issue so I can track it

Thorin-Oakenpants commented 4 months ago

^ ping! @tomrittervg reminder .. next reminder in 3 more days :)

tomrittervg commented 4 months ago

I have it in my list, I'm in training the next couple days, so I'm not sure if I'll get to it before next reminder ;)

Thorin-Oakenpants commented 4 months ago

no worries, I'll stop pinging you now :) But this is a blocker for #1804 and unlocking the hundreds of millions of arkenfox users into FPP for testing and reporting 👀

Thorin-Oakenpants commented 3 months ago

https://bugzilla.mozilla.org/show_bug.cgi?id=1885471

tomrittervg commented 2 months ago

It looks like the window.open patches in https://bugzilla.mozilla.org/show_bug.cgi?id=1878716 will resolve this also

Thorin-Oakenpants commented 2 months ago

don't forget https://bugzilla.mozilla.org/show_bug.cgi?id=1889762 😃

Thorin-Oakenpants commented 2 months ago

@tomrittervg did you know (at least FF125+) that if you have RFP enabled and you have ETP Strict enabled - that when you relax RFP canvas extraction, FPP kicks in

here's an example showing RFP is on with RFP values for speech engines, media devices, audio context keys + values, etc .. with said conditions above (canvas exception, ETP blue shield .. it's strict)

tada

I wonder if this would happen in TB next ESR since it's already in PB mode (hence FPP by default) - cc @pospeselr

edit: so RFP overrides FPP where RFP is used. But if FPP adds protections not covered by RFP then there's nothing to stop them from being applied - e.g. when RFP canvas is excepted. This is probably fine, since anything FPP adds can only be a net gain

tomrittervg commented 2 months ago

Yeah... I think we should have a bug on file for this. Canvas is just unusual because there's 4 behaviors to account for across the 2 different modes and then 2 ways of exempting a site that affect the modes differently.

Thorin-Oakenpants commented 1 month ago

gah .. still failing: STR

It's not applying any FPP on canvas

Thorin-Oakenpants commented 1 month ago

weird - TZP shows FPP is used .. but that creepy test is showing no changes - it always shows 0e8c9761 which is my real value

edit: even weirder : PB mode is not showing FPP canvas - i,e we are returning the expected values as per TZP test I'm an idiot, accidentally opened file:// instead of https

Thorin-Oakenpants commented 1 month ago

Yeah... I think we should have a bug on file for this. Canvas is just unusual because there's 4 behaviors to account for across the 2 different modes and then 2 ways of exempting a site that affect the modes differently.

https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42556

Thorin-Oakenpants commented 1 month ago

AFAICT this issue is not resolved @tomrittervg