ToDo: diffs FF119-FF120 #1772
Comments
some bugzilla tickets
|
|
Will we see the other new features in 120 enabled by ArkenFox? Namely Copy Link Without Site Tracking Global Privacy Control The cookie banner and URL protection |
not adding things that are in the midst of being rolled out or still being worked on - less items to maintain, answer questions about, cause breakage, etc |
|
What CVEs? This is a threat level that doesn't seem justified, even if there is a threat. FWIW, it is fingerprintable, but not exactly friendly so super unlikely to be used: when disabled it will instantly return otherwise it only returns when the print dialog is closed (or never, e.g. you close the tab) - the unfriendly scare-away-users part is the print dialog opening. This is a bit like DRM enabled testing, when disabled it will cause an install prompt in FF |
Hi, please allow a secondary question: How can one discern if a setting is fingerprintable or not? Thanks in advance. |
I wrote a big ass long reply and then decided it was way too long. The short answer is you test it Depending on what it is, you test in different ways, but the first thing you check are properties (and their typeof or value): e.g. window properties, HTMLElement, SVG etc e.g. here is how I test you are at least v117 if (CanvasRenderingContext2D.prototype.hasOwnProperty("fontStretch")) return 117now that doesn't have any prefs to turn it on or off, but if it did, that's how you would detect it. After that it you dig a little deeper You also need to be careful of running things in console vs a page script, and check the scheme (e.g some things require secure context), and often it pays to always close all existing tabs and open a new one between tests, or even restart the session |
|
Thank you very much!
Maybe you want consider this to become an Appendix to the wiki some day?! |
|
I will be writing some docs/parts-of-docs/blogs for Tor Browser on a bunch of FPing issues - sort of an intro and over-arching viewpoint, how we analyze it, how we mitigate it (strategies), and how to not fucking use online tests to check entropy I had planned for ages to setup an arkenfox/blog where I could post things - e.g. how you can't hide your engine etc and FPing basics, so I wouldn't have to keep repeating myself - and in the last big wiki revamp about 2 years ago https://github.com/arkenfox/user.js/wiki/Appendix-B-Test-Sites-[Fingerprinting]#-foreword was going to point to that if I got around to it - but at the time I just settled for "not interested in discussing it" note in the wiki and I try to avoid the topic like the plague here but now I'm part of Tor Project core .. and the last two meetups (april, oct) not only has FPing documentation been brought up, but also revamping the entire TB document (it's so out of date, e.g. flash, ftp, etc) so that's getting done. Also with Mullvad Browser now on board, we feel there is a need for some articles/docs/lesarn_mores (even a built in interface for FP checks) etc - dumbed down for lack of better words, simple etc to explain some things - in fact, much bigger than that - a guide with expandable sections if you wish to dive a little deeper and I've been designated - so as much as I've been putting it off for 3 or more years, I'll have to start doing it - and peer reviewed of course |
FF120 release date: Nov. 21st 2023
FF120 release notes
FF120 for developers
FF120 security advisories
93 diffs ( 53 new, 26 gone, 14 different )
new in v120.0:
ignore
click me for details
==NEW
==REMOVED, RENAMED or HIDDEN
==CHANGED
The text was updated successfully, but these errors were encountered: