1584715 - Canvas and WebGl Fingerprinting

Status: UNCONFIRMED

(Core :: Graphics: CanvasWebGL, enhancement, P2)

Description

[Luker]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0

Steps to reproduce:

First Open Site panopticlick.eff.org
this site is for testing Browser Fingerprints
then click test my browser wait to complete and click all details.

Actual results:

You Will See The Browser have a unique fingerprint with canvas and webgl that make browser unique.

Expected results:

The firefox must randomization webgl and canvas to avaid this, also extension do sames but for strict privacy please add an option in menu to users can able to use randomized web gl and canvas.

Comment 1

[BugBot [:suhaib / :marco]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Sjon Hortensius]

Why is this triaged as an enhancement? Imo this is a pretty high prio bug. Firefox implies it block canvas fingerprinting, see the related discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=967895

This issue can easily be reproduced - running firefox --profile /tmp/ 'https://browserleaks.com/canvas' will use a blank firefox profile without any extensions yet always yield the same Signature, also in the latest Ff 74

Comment 3

[Kelsey Gilbert [:jgilbert]]

Thanks for your concern!
Fortunately, our findings are that it's not a unique fingerprint, but rather your WebGL will be indistinguishable from everyone else with your same (OS, GPU) tuple.
We're actively investigating mitigations to improve on this relatively low bar, but these are considered enhancements.

Bug 967895 is predominately for TOR Browser, and I believe relates to privacy.resistFingerprinting, which still defaults to false in Firefox.
This bug is about what we can do for WebGL outside of privacy.resistFingerprinting, which we generally expect to break some benign content.

FWIW, randomization is not enough, but we do have ideas!

Expect to hear more from us about this soon!

Comment 4

[Sjon Hortensius]

(In reply to Jeff Gilbert [:jgilbert] from comment #3)

Thanks for your concern!
..
Expect to hear more from us about this soon!

thanks for your reply Jeff. I was simply surprised, just like the reporter of this bug, that panopticlick identifies my browser almost uniquely, despite my efforts to lock it down. The most bits of identifying information come from WebGL and canvas fingerprints. FIrefox's strict "Tracking Protection" implies it already blocks fingerprinting, but apparently it doesn't

Comment 5

[Kelsey Gilbert [:jgilbert]]

I have serious doubts about the accuracy of panopticlick's "bits of identifying information" measurements. In short, if I gave everyone the same 32-bit value, panopticlick may think that's leaking 32 bits of info, even though the number of unique bits between users is zero.
For instance, panopticlick will generally treat MAX_RENDERBUFFER_SIZE and MAX_TEXTURE_SIZE as orthogonal, but they're the same value on practically all systems.

It's hard to concretely evaluate the number of leaked bits, or the 1-in-N value for webgl as a whole, and it's not clear to me that panopticlick did this correctly.

Comment 6

[Sarah Bird]

The ETP (Enhanced Tracking Protection) method for blocking fingerprinting is to block identified fingerprinting domains from the disconnect list. More details here: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop

There is a pref privacy.resistFingerprinting which is on by default in TOR. I don't have full details, but here are some pages: https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Tor_Uplift/Tracking. The resistFingerprinting approach is one which tries to reduce the browser's entropy, which is different than how ETP operates.

Comment 7

[Arthur Edelstein [:arthur]]

(In reply to Sjon Hortensius from comment #2)

Why is this triaged as an enhancement? Imo this is a pretty high prio bug. Firefox implies it block canvas fingerprinting, see the related discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=967895

The feature implemented in bug 967895 to block canvas fingerprinting is off by default in Firefox; it is however currently enabled in Tor Browser.

Comment 8

[Luker]

(In reply to Sarah Bird from comment #6)

The ETP (Enhanced Tracking Protection) method for blocking fingerprinting is to block identified fingerprinting domains from the disconnect list. More details here: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop

There is a pref privacy.resistFingerprinting which is on by default in TOR. I don't have full details, but here are some pages: https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Tor_Uplift/Tracking. The resistFingerprinting approach is one which tries to reduce the browser's entropy, which is different than how ETP operates.

This is very bad The ETP (Enhanced Tracking Protection) method only support the disconnect list, i mean the self protection must be used to avoid these problems also privacy.resistFingerprinting break sites and need optimuze for better working and avoid tracking.

Comment 9

[Thorin [:thorin]]

https://www.usenix.org/conference/usenixsecurity19/presentation/wu - contains links to the paper [PDF] and github repo

redefines all the floating-point operations, either explicitly written in GLSL programs or implicitly invoked by WebGL, to mitigate the fingerprinting factors

Comment 10

[Kelsey Gilbert [:jgilbert]]

There was great work on GLSL precision guarantees, but it comes at severe performance cost, and still is not sufficient enough to fully address these issues. It could be worth re-investigating eventually, but this is not low-hanging fruit.