arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
MIT License
9.43k stars 507 forks source link

add privacy.spoof_english #1827

Closed Thorin-Oakenpants closed 2 months ago

Thorin-Oakenpants commented 2 months ago

first some backstory

also see #1747 where this was somewhat discussed

So back in the day independent of RFP .. we could

So, the languages is a nothing really - it's just what you would like to request pages in. It's the locale (resolvedOptions) in Intl (Collator, DateTimeFormat, DisplayNames, ListFormat, NumberFormat, PluralRules, RelativeTimeFormat, Segmenter and any future ones) that matters. Of course it makes sense to have a somewhat similar language to locale, but it is not a requirement.

javascript.use_us_english_locale also had the benefit of making sure to*String didn't leak back in the day. RFP only ever created a single language spoof (we're not really spoofing, we're actually using it) and that was en-US. But nowadays, everything is covered by Intl, even to*String (99% sure it just piggybacks on Intl)

One drawback though is that spoof_english is also used to mask your app language (i.e the language used in menus, chrome etc). So we should really be using it. And spoof_english auto-magically handled those two prefs we used to have (kinda, it gets messy). For example resetting it (0) would enable prompts again (if RFP is on), and changing from 2 to 1 or 0 doesn't reset your languages. So at the end of the day all we did was those two prefs and we ignored spoof_english

Now in FF117 I think it was, the pref javascript.use_us_english_locale was deprecated. And that left us with just settings languages, which makes no sense (#1759) so I dropped it.


Now spoof_english requires RFP (I hadn't really clicked to this), and I thought it was broken in FF since the use_us_english pref was deprecated, and I suspected something would break in Tor Browser come ESR128. And I'm right, kinda :) TB breaks, but we don't. Not if RFP is enabled. I was so used to testing it independently of RFP, and I have an english browser install and an english OS, that it was basically the same thing. But ... spoof english is/was flawed, it doesn't check if you're en-US, it only checks if you're en* (the code has moved, I need to find it again) ...

... so even if your browser is en-US,en and RFP is on, but your OS is e.g en-GB (great britain) or en-CA (canada), then uses en-GB or en-CA etc as your locale (I am in this boat, I am en-SOMETHING) .. so I assumed that it was still broken, and I swear I tested it

But now it seems that's just the prompt, and in fact if we set it ourselves, it works. So we're OK, but TB isn't (see linked TB issues - you wouldn't expect to have to "spoof" as english if you're already en-US and TB doesn't and currently doesn't need to, not even the use_us_english pref)

Anyway, we can add this back in, but inactive. I don't feel we should be changing people's languages on them, and non en* users would have seen a prompt

Thorin-Oakenpants commented 2 months ago

bit of a mess edited: less of a mess

/* 4506: disable RFP spoof english prompt [FF59+]
 * 0=prompt, 1=disabled, 2=enabled (requires RFP)
 * [NOTE] When changing from value 2, preferred languages ('intl.accept_languages') is not reset.
 * [SETUP-WEB] when enabled, sets 'en-US, en' for displaying pages and 'en-US' as locale.
 * [SETTING] General>Language>Choose your preferred language for displaying pages>Choose>Request English... ***/
user_pref("privacy.spoof_english", 1);

I would also like someone to test configs on a system that is not english

Thorin-Oakenpants commented 2 months ago

actually we would want it active but at 1 so anyone not using it won't be affected by prefsCleaner and not need an override

Thorin-Oakenpants commented 2 months ago

done - https://github.com/arkenfox/user.js/pull/1816/commits/1c50fdeb8bd0c6cb9f972f735fe71a8cf9ff7429

feel free to bring up any issues - but now I've typed thru the issues (there are more), I'm happy. I feel that anyone already spoofing will have this in there overrides, so I ok with the pref being active and the value 1. I've added an override to mine already

Thorin-Oakenpants commented 2 months ago

FYI: if you want to see where additional spoof english code lives .. look at GetMaybeLocalizedString

this covers things like input fields, input validation messages, xml errors, xslt errors .. etc