kkapsner / CanvasBlocker

A Firefox extension to protect from being fingerprinted.
https://canvasblocker.kkapsner.de
Mozilla Public License 2.0
1.16k stars 87 forks source link

one site only - a problem with recaptcha #581

Closed ajay-gh closed 2 years ago

ajay-gh commented 3 years ago

Description

while I am quite familiar how to use CanBlocker (CB) with a large number of websites, there is one website (www.leboncoin.fr) which got recently broken by CB no matter which API one turns on or of. It uses a recaptcha at start, AND following the advice in the FAQ about window.name does not make any difference.

I know a developer cannot trouble-shoot a million websites on behalf of users ... but I would really appreciate your help

Expected Behavior

there should be a way to tweak CB with any website, but this time I cannot find it, the log entries are inconclusive

Current Behavior

CB works fine, but the website simply doesn't load as long as the CB extension is enabled in F.F. Just disabling CB by clicking on the icon inside the CB popup window does not do the trick either.

Possible Solution

absolutely no idea, I tried many combinations of API on and off, without luck.

Steps to Reproduce (for bugs)

enable CB, try to load www.leboncoin.fr in FF

Context

n/a

Your Environment

Your Settings

irrelevant as I tried many combinations, see above

kkapsner commented 3 years ago

I'm not able to reproduce your problem. The page loads without problem for me with CB enabled - even in my MacOSX VM. But it's 10.15.3 not 10.14.6 - maybe that's the problem...

ajay-gh commented 2 years ago

I come to believe that it doesn't have to do with the version of osx. Could it be that you simply opened the site (thank you for thrying !) without "using it" ? With Canvasblocker at it's defaults, the site's main page (depending on your location or VPN server) will work for a while (top page, may be start of search etc.) But as soon as you stay on for a while, search, try to sign up or sign-in, it will stop working - stating a Captcha verification is coming / needed, but this Captcha will never show.

kkapsner commented 2 years ago

Yes - I only tried to load it.

But it works for me when I browse it a little bit - I had no Captcha popping up. I will not give them my phone number to register...

Did you read the section about reCaptch in the FAQ? Are there any error messages regarding CanvasBlocker in the browser console?

ajay-gh commented 2 years ago

Yes, I did read that section. Interesting in this context, the problem does not go away when you turn off CB (while keeping the add-on enabled). Only when CB is disabled, and a different VPN server is selected, and the browser gets restarted, the site comes back. About the browser console, I find the following: GEThttps://www.leboncoin.fr/ [HTTP/2 403 Forbidden 125ms] AND sendRemoveListener on closed conduit CanvasBlocker@kkapsner.de.274877906981 ConduitsChild.jsm:108 _send resource://gre/modules/ConduitsChild.jsm:108 _send self-hosted:1279 removeListener resource://gre/modules/ExtensionChild.jsm:654 removeListener resource://gre/modules/ExtensionChild.jsm:882 onChanged chrome://extensions/content/child/ext-storage.js:332 removeListener resource://gre/modules/ExtensionCommon.jsm:2499 revoke resource://gre/modules/ExtensionCommon.jsm:2521 close resource://gre/modules/ExtensionCommon.jsm:2526 unload resource://gre/modules/ExtensionCommon.jsm:887 close resource://gre/modules/ExtensionContent.jsm:935 destroyed resource://gre/modules/ExtensionContent.jsm:1011 observe resource://gre/modules/ExtensionContent.jsm:1029

ajay-gh commented 2 years ago

I think I do finally have some idea where this is going wrong. I noticed that adding websites to the exclusion list of the navigator api is not flawless. Sometimes it works (clicking + adds it), sometimes it doesn't (+ has no function), sometimes you have to close firefox and re-open it, and then a value (like *.leboncoin.fr) is accepted. Wildcards seem a problem too. Of course I cannot be sure, but it seems to trigger the captcha denial. There also seems a problem with how values are interpreted once they are accepted in the mask. Hovering the mouse over the CB icon shows a description not in line with settings visible in the settings dialog. Finally, it appears that removing a value (~ website) from the list is not always successful. The website is no longer visible (after clicking the cross), but it is still excluded.

Please let me know if more information is needed.

kkapsner commented 2 years ago

Clicking the + should add an URL specific value when something is entered in the input field. Do you have a reproducible scenario when it doesn't? I always works for me. I also never had the problem that I had to restart Firefox.

CanvasBlocker does not use wildcards. They are implicit. So if you enter "leboncoin.fr" also "www.leboncoin.fr" will use that value.

There also seems a problem with how values are interpreted once they are accepted in the mask. Hovering the mouse over the CB icon shows a description not in line with settings visible in the settings dialog.

I do not quite understand what you mean. Can make some screenshots that illustrate the problem?

Finally, it appears that removing a value (~ website) from the list is not always successful. The website is no longer visible (after clicking the cross), but it is still excluded.

What do you exactly mean with "excluded"?

ajay-gh commented 2 years ago

Sorry, it took me a while. First question: I tried many times and scenarios, and first I couldn't reproduce it at all. Then I used as a wildcard (now I know I shouldn't) and the problem started immediately. And when I remove the the problem remains. So using a wildcard by accident seem to cause a problem which doesn't go away Please see if this could be (part of) the problem. Second question: this may be related to the first observation. Probably not worth pursuing. Third question: once the problem starts (q1) this also re-appears.

Here is the most simple example I could find / reproduce: Enter exclusion for yahoo.com (or other), click +, this works as expected, now enter exclusion for .yahoo.com, click +, nothing happens now try to replace . from the last step with www. resulting in www.yahoo.com, click +, still nothing happens enter exclusion web.de, click +, nothing happens

This cannot be fixed be disabling, followed by enabling the extension, or by simply restarting FF. I hope this helps.

kkapsner commented 2 years ago

Sorry for the delay.

Your scenario is very helpful and I now know exactly what is wrong.