Closed arthuredelstein closed 10 months ago
It would be nice to have Dark Mode protection as an option in the shields settings
What's the plan for the other settings? Is there no possibility that we can keep them in default mode, but disable them for sites that break?
Also it doesn't seem like User Agent farbling should break that many sites for a regular user
I can't wait for the blog post to see how these are resolved, I'm quite curious
Hi @arthuredelstein ! Mind adding a testplan here, when you get a chance? Thanks! Adding QA/Blocked and QA/Test-Plan-Required just until we've got that, and then we'll be fully unblocked 👍
PASSED
usingBrave | 1.62.73 Chromium: 119.0.6045.163 (Official Build) nightly (x86_64)
-- | --
Revision | 522e9147d931744b1641084046c197caf7b341f0
OS | macOS Version 11.7.10 (Build 20G1427)
PASSED
PASSED
1.60.x
- PASSED
Verification PASSED
using
Brave | 1.62.105 Chromium: 120.0.6099.71 (Official Build) beta (64-bit)
-- | --
Revision | f72c783bcd52110d026061575b4bef28ccb547f7
OS | Windows 11 Version 22H2 (Build 22621.2715)
1.62.105
brave://flags
in a new tab#brave-show-strict-fingerprinting-mode
flagBlock fingerprinting
toggle is enabled as a defaultBlock fingerprinting
toggle is enabled as a default in Per site Shields settingstep 4 | step 5 | step 6 |
---|---|---|
PASSED
1.61.x
- PASSED
Verified with
Brave | 1.62.122 Chromium: 120.0.6099.144 (Official Build) beta (64-bit) |
---|---|
Revision | cfddebe77d394064c472fda64afcd9fbed34ceb4 |
OS | Linux |
PASSED
PASSED
1.61.x
- PASSED
Verification PASSED on Vivo X70 Pro version 12
running Bravemonoarm64.apk_1.62.121
1.62.x
brave://flags
in a new tab#brave-show-strict-fingerprinting-mode
flagBlock fingerprinting
toggle is enabled as a defaultBlock fingerprinting
toggle is enabled as a default in Per site Shields settingstep 4 | step 5 | step 6 |
---|---|---|
PASSED
1.61.x
- PASSED
Verified on Samsung Galaxy Tab S7
using version:
Brave 1.62.147 Chromium: 120.0.6099.234 (Official Build) (32-bit)
Revision 3b25c3743150a54485dea24f0ceb1e69d6db51bc
OS Android 13; Build/TP1A.220624.014; 33; REL
Brave Shields & privacy
settingsBlock Fingerprinting
is enabled by default in Shields panel and in global settings.Block Fingerprinting
is enabled for Standard and Strict mode on upgraded profile.Block Fingerprinting
is disabled for Disabled mode on upgraded profile. Feature Flag
Example | Example | Example |
---|---|---|
Farbling Test
First Test | After restart |
---|---|
Upgraded Profile - Standard Mode
1.61.x | Set Flag - 1.62.x | Flag set - 1.62.x | 1.62.x |
---|---|---|---|
Upgraded Profile - Strict Mode
Example | Example | Example | Example |
---|---|---|---|
Upgraded Profile - Disabled
Example | Example | Example | Example |
---|---|---|---|
@arthuredelstein Note that without aggressive fingerprinting protection, UNMASKED_RENDERER_WEBGL
and UNMASKED_VENDOR_WEBGL
from the WebGL WEBGL_debug_renderer_info
extension will always return the true GPU info with no option to enable randomization of these values (see #10214). This is a pretty high-entropy source of fingerprintable information—shouldn't the current aggressive behavior (replacing the values with random gibberish) be folded into default fingerprinting mode? The entire canvas farbling is much less effective if websites can read the GPU type anyway.
@arthuredelstein Note that without aggressive fingerprinting protection,
UNMASKED_RENDERER_WEBGL
andUNMASKED_VENDOR_WEBGL
from the WebGLWEBGL_debug_renderer_info
extension will always return the true GPU info with no option to enable randomization of these values (see #10214). This is a pretty high-entropy source of fingerprintable information—shouldn't the current aggressive behavior (replacing the values with random gibberish) be folded into default fingerprinting mode? The entire canvas farbling is much less effective if websites can read the GPU type anyway.
If it's not put into default protections, this could potentially be a permission prompt that asks users if they want to let the website read their GPU info
@BenjaminAster @davidcollini Thank you for these comments. We definitely want to have GPU protections in standard mode.
@arthuredelstein Thanks for the quick response! While I'm at it, I just opened https://github.com/brave/brave-browser/issues/35646 where I have even more suggestions about anti-fingerprinting measures that I think Brave could still take.
Thank you @BenjaminAster !
We are considering removing aggressive fingerprinting mode, to reduce unneeded complexity in browser code and in the UI. To do this, we would need to work out which protections from aggressive mode to drop, and which ones to fold into default fingerprinting mode. Current protections in aggressive mode include: