search

mullvad / mullvad-browser

Privacy-focused browser for Linux, macOS and Windows. Made in collaboration between @torproject and @mullvad
https://mullvad.net/browser
1.28k stars 25 forks source link

[Windows] Missing WebGL 2.0 support? #17

Closed CostcoFanboy closed 1 year ago

CostcoFanboy commented 1 year ago

This browser doesn't support WebGL 2.0, is there a reason for this considering it's an extremely commonly supported library and also present in Firefox.

Source: https://tsherif.github.io/webgl2examples/ssao.html
WebGL2RenderingContext

Thorin-Oakenpants commented 1 year ago

this is part of RFP's protection

actually, it's a Tor Browser and base browser pref flip - webgl.enable-webgl2 = false. Do not change prefs, or you will alter your fingerprint

CostcoFanboy commented 1 year ago

actually, it's a Tor Browser and base browser pref flip - webgl.enable-webgl2 = false. Do not change prefs, or you will alter your fingerprint

I'm sorry I'm not very educated in regards to browser security but why would I not want webgl2 and why would that change my fingerprint? Because I'd be "one of few Mullvad users with webgl2" so now I can be traced back?

Waterfox and Libre have it on by default.

Thorin-Oakenpants commented 1 year ago

Because I'd be "one of few Mullvad users with webgl2" so now I can be traced back?

it would make you stand out in an already small set of users (if you were being fingerprinting by a universal script - i.e the same test on multiple sites). Webgl is behind click-to-play and this eliminates sites just grabbing the very high entropy webgl rendering of images/text/shaders etc. But it doesn't cover all the parameters and extensions and experimantal and their values. So when Tor Browser did this, five+ years ago, webgl was new'ish and while RFP does protect some of them, they just decided to block the new webgl2 part. Today of course this is standard fare and fully supported. Webgl protection needs an overall - but it'll happen upstream, not here.

That said, don't let any of this scare you off. Webgl is still not that widespread, and certainly wasn't at the time Tor Browser did this - just use those few sites that you really need webgl in another browser.