1414989 - Flag when privacy.resistFingerprinting is enabled

Status: RESOLVED DUPLICATE of bug 1429519

(Core :: Graphics: Canvas2D, defect)

Description

[Gary]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.36

Steps to reproduce:

Immediately on page load, WordPress uses a canvas render and the image data to detect if the current browser/OS is able to render emoji correctly.


Actual results:

When privacy.resistFingerprinting is enabled, WordPress' behaviour causes a canvas image data warning to pop up.


Expected results:

WordPress should be able to avoid triggering this popup.

Comment 1

[Gary]

A few notes on previous discussions on this topic:

- This has come up in relation to Tor browser in the past (https://core.trac.wordpress.org/ticket/32138, https://trac.torproject.org/projects/tor/ticket/18195), but unfortunately never progressed.
- A suggestion that has come up a few times is for WordPress to use font metrics to detect emoji support, but I don't believe this option is viable (https://core.trac.wordpress.org/ticket/42428#comment:3).
- Due to the regular additions to the Emoji spec, it's unlikely that WordPress will ever be able to deprecate this check.


I have no personal preference what the solution here is - a few options that come to mind include:

- The browser detects what emoji support the current OS has, and exposes that information. WordPress currently tests if the browser/OS supports Emoji 5, country flags, and other flags.
- The browser exposes a flag for whether privacy.resistFingerprinting is enable, so WordPress can check that, and skip the tests. I don't know if it's a privacy issue to expose that the browser has stronger privacy settings enabled. :-)
- The browser exposes a flag for whether the canvas element will allow exporting image data, so WordPress can skip the tests.

WordPress ticket reference: https://core.trac.wordpress.org/ticket/42428

Comment 2

[Tom Ritter [:tjr]]

Our plan is to use a permission. I should have made that bug this one; but that one now has all the followers and flags.