1377744 - privacy.resistfingerprinting's UTC timezone should not affect extensions

Status: RESOLVED DUPLICATE of bug 1709867

(WebExtensions :: General, defect, P3)

Description

[Kestrel]

Installed Grandfather Fox WebExtension and noticed it had the wrong time and was using UTC.

https://addons.mozilla.org/en-US/firefox/addon/grandfather-fox/

This particular extension gets the time in a background script.

Extensions should not be affected by anti-fingerprinting measures.

Comment 1

[Ethan Tseng [:ethan]]

(In reply to Kestrel from comment #0)
> Installed Grandfather Fox WebExtension and noticed it had the wrong time and
> was using UTC.
> https://addons.mozilla.org/en-US/firefox/addon/grandfather-fox/
> This particular extension gets the time in a background script.
> Extensions should not be affected by anti-fingerprinting measures.

Hi Kestrel,

The pref privacy.resistfingerprinting is off by default.
Did you turn on this pref manually?

Add Tim to CC.  He did the timezone fingerprinting patch in bug 1330890.

Comment 2

[Kestrel]

Yes I enabled privacy.resistfingerprinting manually and I expected it to break websites but not extensions. Another more notable example is the Snooze Tabs Test Pilot Experiment which fails to restore tabs at the expected time.

Comment 3

[Ethan Tseng [:ethan]]

Thanks for the confirmation.

We plan to fix this issue by two steps:
1. Write a test case to make sure every timezone value has been spoofed correctly.
2. Move the implementation from TZ value to JavaScript level.

We could file a new bug for step 1, or do it in this bug.
I'll let Tim make the decision.

Comment 4

[Matthew Elvey]

Have folks thought about how this interacts with extensions such as 
Change Timezone (Time Shift)
and Spoof Timezone?

(I'm thinking about trade-offs, as being on UCT time certainly was very confusing before I figured out (by googling) why webmail and such were showing confusing times, but I understand the benefit, and maybe it'll be far less confusing now that I can expect it!)

Comment 5

[Thorin [:thorin]]

(In reply to Matthew Elvey from comment #4)
> Have folks thought about how this interacts with extensions such as 
> Change Timezone (Time Shift)
> and Spoof Timezone?

Good question. I think, just like UA spoofing extensions can be used to override RFP, Time Spoofing extensions do the same, because they are the last to modify the data going out? Maybe you could do a test? If this was the case, then an extension with whitelisting would allow users to not get confused with various sites such as venue/concert/show times, gmail timestamps etc. Or maybe at some stage RFP will build in a site permission same as they did with Canvas, see Bug 1426232

But that's all to do with websites. This ticket is about RFP features not impacting extensions themselves, see Bug 1450398

Comment 6

[Tom Schuster (MoCo)]

After bug 1709867 lands timezone spoofing can be disabled by disabling resist fingerprinting completely for extensions. With the pref privacy.resistFingerprinting.testGranularityMask set to 1. https://searchfox.org/mozilla-central/rev/af78418c4b5f2c8721d1a06486cf4cf0b33e1e8d/modules/libpref/init/StaticPrefList.yaml#12936-12941

Comment 8

[Tom Ritter [:tjr]]

(In reply to Tom Schuster (MoCo) from comment #6)

After bug 1709867 lands timezone spoofing can be disabled by disabling resist fingerprinting completely for extensions. With the pref privacy.resistFingerprinting.testGranularityMask set to 1. https://searchfox.org/mozilla-central/rev/af78418c4b5f2c8721d1a06486cf4cf0b33e1e8d/modules/libpref/init/StaticPrefList.yaml#12936-12941

Just FYI for anyone who finds this - as the name implies - that is a testing pref. Setting it now can result in undefined behavior. We will be rolling it out under the regular RFP pref when we feel it is ready.