kkapsner / CanvasBlocker

A Firefox extension to protect from being fingerprinted.
https://canvasblocker.kkapsner.de
Mozilla Public License 2.0
1.15k stars 86 forks source link

Bug on google image #272

Closed grysor closed 5 years ago

grysor commented 6 years ago

Hello, I have canvasblocker version 0.5.4 i have a pc desktop with windows10 pro up to date -I am under firefox quantum 62.0

There is a bug : On google image for example here : https://www.google.fr/search?biw=1450&bih=744&tbm=isch&sa=1&ei=UMOqW5_YLoTMrgTRpICgAg&q=fleurs&oq=fleurs&gs_l=img.3..0l10.179788.181940.0.182218.6.5.0.1.1.0.99.487.5.5.0....0...1c.1.64.img..0.6.490...0i67k1.0.q-qybWHb8Dc when I click on images, very often nothing happens! While normally the thumbnail of the image should appear with next write: consult - share And when I disable canvasblocker, then reload the page, this time all the images are again clickable and thumbnails with consult-share are re-displayed.

can you fix this problem please?thank you

kkapsner commented 6 years ago

I'm not able to reproduce the problem. Is there something visible in the browser console (Ctrl+Shift+K)?

Can you please retest on a fresh Firefox profile?

grysor commented 5 years ago

hello when I press (Ctrl+Shift+K) here is what appears :
http://zupimages.net/viewer.php?id=18/39/a4nf.png

for reinitinialize firefox, i'm sorry i do not prefer, because I'm afraid of losing my tabs and bookmarks...but otherwise my firefox works very well has no bugs,it is certain that it is canvas blocker which causes this bug, i made the test several times...

kkapsner commented 5 years ago

Hm... please give me you CanvasBlocker Settings (you may want to delete the persistent storage and some private informations: grafik

I did not mean you should reset your Firefox but to create a new profile (open the command line prompt and start Firefox with the --no-remote and -p flag: {path to firefox}\firefox.exe --no-remote -p)

Reeywhaar commented 5 years ago

Hello! Same for me on images.google.com. I have attached settings (github doesn't allow .json uploads so I changed extension to .txt) CanvasBlocker-settings.txt

I see in console, that every time I click on any image message "TypeError: a is undefined, can't access property "nextElementSibling" of it" shows up.

Also in the console there is an error message somehow related to content security policy error-msg.txt. So it maybe that extension denies execution of some inline scripts which breaks service.

Thank you!

kkapsner commented 5 years ago

Weird... still not able to reproduce the problem. Even with your settings.

Please try with disabled "Block data URL pages": grafik

Which other addons do you have installed? Still a test with a fresh profile could help.

Reeywhaar commented 5 years ago

No luck. By the way, I forgot the browser version I use: FF63b.5 (64bit) @ osx 10.13.6

kkapsner commented 5 years ago

I had a closer look at the csr message. "d2630e41-b004-4080-9716-5724fdbcdc2b" looks like an extension internal uuid. Please check which this is (on about:debugging#addons you can see the Internal UUIDs).

Reeywhaar commented 5 years ago

I found that problem caused by Protect DomRectApi being on.

kkapsner commented 5 years ago

Yes.. but why? I have no problems with it. There has to be something else which breaks in combination with that.

Reeywhaar commented 5 years ago

But that narrowed the problem.

As for uuid they are random on every load, and no extension with such uuid exists, I don't think they related. Also, I tried to disable every other extension to check is there any interference.

kkapsner commented 5 years ago

Yes it narrows the problem down. But actually I already had it in mind as it's the big change for 0.5.4

Any luck finding the interfering extension?

PS: the uuid should be random but should stay constant across browser restarts. At least they are on my limited tests.

Reeywhaar commented 5 years ago

I meant that uuid in error-msg.txt you said is random on every google images page reload.

There is no interfering exception as long as I can see. With only Canvas Blocked being enabled problem still present.

What I can't understand is that message in error-msg.txt is just that some script saw reported for csp violation, not blocked. But it obvious that some scripts were blocked in fact :-/

kkapsner commented 5 years ago

That's very weird. Does the error-msg also appear when CB is disabled?

Have you tried with a fresh Firefox profile?

Reeywhaar commented 5 years ago

No, there is no message with addon disabled. Yes, problem is present with fresh FF profile with only canvas blocked installed. Really weird.

Reeywhaar commented 5 years ago

As a workaround for now adding "google.com" disabled to site specific values helps. screen

kkapsner commented 5 years ago

So the scenario is:

Correct?

Reeywhaar commented 5 years ago

Yes, my test link

kkapsner commented 5 years ago

Seems simple enough... but still no luck on my site... I will try on Windows...

Reeywhaar commented 5 years ago

I narrowed down even more. While in expert mode, disabling "getBoundingClientRect" in DomRect api removes bug.

kkapsner commented 5 years ago

Good to know. But as I'm still not able to reproduce the problem I still do not know how to fix this.

Also on Windows 10 no luck. Everything works for me.

Reeywhaar commented 5 years ago

Oh, about the error msg that I told earlier, it appears that it doesn't correlate with addon in any way, it just sometimes appears, and sometimes not, sometimes immediately, sometimes after delay. So don't bother with it. Sorry for misinformation.

Reeywhaar commented 5 years ago

I'm on Mac myself. Did you try with Firefox Beta?

kkapsner commented 5 years ago

No - I try with 62.0.2 and the nightly. I will try beta.

kkapsner commented 5 years ago

Regarding the error msg: it might be an ad...

grysor commented 5 years ago

Hm... please give me you CanvasBlocker Settings (you may want to delete the persistent storage and some private informations: grafik

Hello :) here are my canvasblocker settings, but I have not changed much because I'm a novice ... : CanvasBlocker-settings.txt

I did not mean you should reset your Firefox but to create a new profile (open the command line prompt and start Firefox with the --no-remote and -p flag: {path to firefox}\firefox.exe --no-remote -p)

for this, I will not know how to do it I'm a novice, sorry :(

kkapsner commented 5 years ago

@Reeywhaar also no luck with Beta @grysor no problem

To be honest. I'm at a point where I do not know what to do next. Yes you can disable the DOMRect protection (either globally or just for google.com) but I find that quite a hack.

Reeywhaar commented 5 years ago

I'm digging it. Replacing registerDOMRect in modifiedDOMRectAPI.js with noop solves the problem, I think at least I could found the problem myself, maybe it will give you a hint later. I understand that it's hard to find the problem on site such as Google, there may be tons of regional specific settings.

Reeywhaar commented 5 years ago

So, I have found where the problem is, and for sure, the best solution is just to add google.com to exceptions.

The problem starts in getFakeDomRect in lib/modifiedDOMRectAPI.js on line 66 https://github.com/kkapsner/CanvasBlocker/blob/ab344294d72d6f0ecd7ddf8956af4e87d2633b22/lib/modifiedDOMRectAPI.js#L65-L67

Google relies on that images on the same row must have identical y value to find where to place spot with image description (my theory). Canvas Blocker changes every block y position by less than 0.1, so Google can't find images on same row and fails.

The following screenshot shows domRect.y and cached.y outputs: screen shot 2018-09-28 at 00 10 26

For example if we change the lines to

    getFakeValue(domRect.x, 0), 
    domRect.y 
    getFakeValue(domRect.width, 2),

... everything works. Even if we floor the y:

    getFakeValue(domRect.x, 0), 
    Math.floor(domRect.y) 
    getFakeValue(domRect.width, 2),

... everything works.

So possible solutions is to ignore said website or to make getFakeValue(value, i) generate determined or memoized output. @kkapsner Maybe you can't replicate the problem because of the way how RNG works on your system? ¯_(ツ)_/¯

grysor commented 5 years ago

So, I have found where the problem is, and for sure, the best solution is just to add google.com to exceptions.

Hello that is true? if i put google.com to exceptions, this will fix the problem and the pics on google images will be clickable again? :) I will try, thanks to you if it works I will make a return then :)

grysor commented 5 years ago

I have whitelisted google.com and it still does not work, just the first 3 pics in google image are clickable. For all the others, nothing happens when I click on it :(

Reeywhaar commented 5 years ago

@grysor there are many solutions. see my comment for first solution. The second is to change random number generator to persistent

screen shot 2018-09-28 at 00 40 47

Adding google.com to exclusions will not work if you use google.de or google.fr etc...

grysor commented 5 years ago

@Reeywhaar this solution that you posted? :

As a workaround for now adding "google.com" disabled to site specific values helps. screen

Reeywhaar commented 5 years ago

Yeah, doesn't it work?

grysor commented 5 years ago

Or does your other solution seem the best? :) thank you in any case for your help and your solutions :)

screen shot 2018-09-28 at 00 40 47

Reeywhaar commented 5 years ago

I think persistent solution more fail proof because, I'm not sure, but I think I saw the same problem on other websites.

grysor commented 5 years ago

Thank you for your answer I'm going to add google.com in "protect DOMRect API" so, great, thank you :)

grysor commented 5 years ago

I'm disgusted, after doing it, I tried again and it still does not work for me, I can not click on any pic :(

Reeywhaar commented 5 years ago

Sorry to hear, did you try to uncheck mark near protect DOMRect Api completely?

grysor commented 5 years ago

by contrariwise, your second solution works like a charm, she ! :) all the pics are again clickable in google image!

screen shot 2018-09-28 at 00 40 47

Reeywhaar commented 5 years ago

Well, that's great! As I said, maybe you're using regional google domain so adding just google.com will not work, that's why solution above is more concrete.

grysor commented 5 years ago

Sorry to hear, did you try to uncheck mark near protect DOMRect Api completely?

indeed ! :) i unchecked as you told me the mark near "protect DOMRect Api" completely, then I put as original "random number generator" on : "no-persistence of data" and I tried again on google image and it works this time you were right, great :) but by unchecking the mark near "DOMRect Api" the problem is that next, all the terms checked below disappear, if you see what I mean?

kkapsner commented 5 years ago

@Reeywhaar thanks for the great analysis. I could change the cache to work on a property/value basis and not on the entire DOMRect. This would provide the same value for the rows. I will make an alpha version that you can test.

@grysor If you disable the DOMRect protection entirely the other settings are useless. That's why they disappear.

kkapsner commented 5 years ago

Please try https://github.com/kkapsner/CanvasBlocker/releases/tag/0.5.5-Alpha1 (disable normal CB before).

grysor commented 5 years ago

Please try https://github.com/kkapsner/CanvasBlocker/releases/tag/0.5.5-Alpha1 (disable normal CB before).

Hello ,thank you for your message I installed your new beta version by your link, and i confirm that the photos on google image are again all clickable! great, thank you :)

grysor commented 5 years ago

i use google translate in french because I live in France :) thank you

Reeywhaar commented 5 years ago

Works great for me! Thank you very much for openness. Hope it also resolves other similar bugs!

spodermenpls commented 5 years ago

Thumbs up from me too, the new faking method also seems to have sped up some DOMRect-heavy websites a little bit (e.g. Youtube, the synonym for "DOMRect-heavy"). I used to have similar "non-reactive thumbnails" on Google Images, but not for the longest time, so I wouldn't have been able to provide intel on that one. Thanks to @Reeywhaar for dropping some of his expertise. 👍

kkapsner commented 5 years ago

Please test https://github.com/kkapsner/CanvasBlocker/releases/tag/0.5.5-RC1

Reeywhaar commented 5 years ago

It works for me. Clean firefox, default settings, CanvaBlocker's icon shows that it protects domRect. Google images works fine if you asking me.

kkapsner commented 5 years ago

Version 0.5.5 is out and ready to use. @grysor consider updating your review on AMO