Open Bug 1233846 Opened 4 years ago Updated Last month

WebSpeech Synthesis API mustn't allow fingerprinting

Categories

(Core :: Web Speech, defect, P3)

46 Branch
defect

Tracking

()

People

(Reporter: kolan_n, Unassigned)

References

Details

(Keywords: privacy, Whiteboard: [fingerprinting][tor 10283][fp-triaged])

User Agent: Mozilla/5.0 (Windows NT 6.3; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20151218030232

Steps to reproduce:

speechSynthesis.getVoices()


Actual results:

It exposes info about TTS engines installed in the system


Expected results:

This can be used for fingerprinting. I suggest to redesign the API
1 speechSynthesis.getVoices() must be allowed only to addons with enough priveleges
2 Add speechSynthesis.getVoiceSelectorWidget() which should return a DOM node allowing the user to select speech engine but disallowing the webpage to see its internals.
3 events timing must be obfuscated by adding a random value from some range to them.
Component: Untriaged → Web Speech
Product: Firefox → Core
4 There should be a generalized TTS engine which will select and use another engines based on SSML tags.
(In reply to Olli Pettay [:smaug] from comment #2)
Done.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: privacy
Whiteboard: [fingerprinting]
See Also: → 1333641
Priority: -- → P5
Whiteboard: [fingerprinting] → [fingerprinting][fp-triaged]
Whiteboard: [fingerprinting][fp-triaged] → [fingerprinting][fp-triaged][tor 10283]
See Also: → 1485280
Summary: WebSpeech API mustn't allow fingerprinting → WebSpeech Synthesis API mustn't allow fingerprinting
Whiteboard: [fingerprinting][fp-triaged][tor 10283] → [fingerprinting][tor 10283]
No longer blocks: uplift_tor_fingerprinting
Priority: P5 → P3
Whiteboard: [fingerprinting][tor 10283] → [fingerprinting][tor 10283][fp-triaged]
Duplicate of this bug: 1566415
You need to log in before you can comment on or make changes to this bug.