1397611 - Allow Web Extensions to control privacy.resistFingerprinting

Status: RESOLVED FIXED

(WebExtensions :: General, enhancement, P3)

Description

[Tom Ritter [:tjr]]

We would like to expose the privacy.resistFingerprinting preference we are working on (https://wiki.mozilla.org/Security/Fingerprinting) to Web Extensions so privacy tools can toggle it on and take advantage of the work we've been doing.

Comment 1

[Tom Ritter [:tjr]]

Attachment: Bug 1397611 Expose a websites.resistFingerprinting pref that Web Extensions can toggle

Review commit: https://reviewboard.mozilla.org/r/177158/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/177158/

Comment 2

[Bob Silverberg [:bsilverberg]]

Comment on attachment 8905364 [details]
Bug 1397611 Expose a websites.resistFingerprinting pref that Web Extensions can toggle

https://reviewboard.mozilla.org/r/177158/#review182304

Thanks for taking the time to write this patch, Tom. It looks good but for a few minor issues. I figured I'd do an initial review when I saw it, but aswan will need to give it a final r? before it can land. r+ from me, with issues addressed.

::: toolkit/components/extensions/ext-privacy.js:242
(Diff revision 1)
>                return Preferences.get("network.http.sendRefererHeader") !== 0;
>              }),
> +          resistFingerprinting: getPrivacyAPI(extension,
> +            "websites.resistFingerprinting",
> +            () => {
> +              return Preferences.get("privacy.resistFingerprinting") !== 0;

This should just be `return Preferences.get("privacy.resistFingerprinting");` because it's a boolean pref, not a numeric pref. 

Note that this module will likely be updated to use Services.prefs rather than Preferences.jsm in the future, but for now it's fine to use Preferences to keep the file consistent.

::: toolkit/components/extensions/test/xpcshell/test_ext_privacy.js:239
(Diff revision 1)
>      },
>      "websites.referrersEnabled": {
>        "network.http.sendRefererHeader": 2,
>      },
> +    "websites.resistFingerprinting": {
> +      "privacy.resistFingerprinting": 1,

This should be  `"privacy.resistFingerprinting": true,` because it is a boolean pref.

::: toolkit/components/extensions/test/xpcshell/test_ext_privacy.js:347
(Diff revision 1)
>        "network.http.sendRefererHeader": 2,
>      });
>  
> +  await testSetting("websites.resistFingerprinting", false,
> +    {
> +      "privacy.resistFingerprinting": 0,

This should check for `false`, rather than `0`, once the change is made to ext-privacy.js.

::: toolkit/components/extensions/test/xpcshell/test_ext_privacy.js:351
(Diff revision 1)
> +    {
> +      "privacy.resistFingerprinting": 0,
> +    });
> +  await testSetting("websites.resistFingerprinting", true,
> +    {
> +      "privacy.resistFingerprinting": 1,

As above, this should check for `true` rather than `1`.

Comment 3

[Tom Ritter [:tjr]]

Comment on attachment 8905364 [details]
Bug 1397611 Expose a websites.resistFingerprinting pref that Web Extensions can toggle

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/177158/diff/1-2/

Comment 4

[Andrew Swan [:aswan]]

Comment on attachment 8905364 [details]
Bug 1397611 Expose a websites.resistFingerprinting pref that Web Extensions can toggle

https://reviewboard.mozilla.org/r/177158/#review190810

thanks!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3bf4a8d9d126
Expose a websites.resistFingerprinting pref that Web Extensions can toggle r=aswan,bsilverberg

Comment 6

[Bob Silverberg [:bsilverberg]]

Nice work, thanks Tom!

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/3bf4a8d9d126

Comment 8

[Ethan Tseng [:ethan]]

Tom, thanks for making this happen!

Comment 9

[marius.santa]

Is manual testing required on this bug? If Yes, please provide some STR and the proper webextension(if required), if No set the “qe-verify-“ flag.

Comment 10

[Will Bamberg [:wbamberg]]

I've updated https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/privacy/websites for this, please let me know if this covers it.

Note that the compat data is updated, but not deployed to MDN at the time I write this.

Comment 11

[Tom Ritter [:tjr]]

LGTM