1450561 - Resist screen elements dimensions fingerprinting

Status: RESOLVED WONTFIX

(Core :: DOM: Security, enhancement, P5)

Description

[KOLANICH]

Hello. Some webpages now use screen elements dimensions for determining other elements dimensions. This API in its current state allows fingerprinting. And we cannot remove that API because some webdevs may put the message "Chrom(?:e|ium)(?:-like)? or GT\*O" and will be right. So we need another way.

I wonder if it is possible to render webpages on a virtual screen of fake static resolution (for example even if the whole screen is 1 virtual pixel wide and 1 v. px. high, the websites normalizing sizes on resolutiom should work fine, but surely we need just to take the most widespread not to break the sites expecting integers and making the browsers less unique), making web browser to translate the sizes to the correct ones itself and why such an obvious idea have not been implemented yet. Of course there will be some distortions when rendering raster content, but I guess they are tolerable.

Comment 1

[François Marier [:francois]]

This would be related to our anti-fingerprinting effort (see privacy.resistFingerprinting in about:config).

Comment 2

[Ethan Tseng [:ethan]]

Thanks for the interesting idea. But right now, we propose to mitigate the window dimension fingerprinting vector by the "letterboxing" approach, which will be implemented in bug 1407366.

Comment 3

[Tom Ritter [:tjr]]

As letterboxing is implemented, we don't intend to experiment with this.