1727981 - Canvas extraction permission prompt does not have an 'always remember' prompt

Status: UNCONFIRMED

(Core :: Graphics: CanvasWebGL, enhancement)

Description

[alceryes]

Attachment: Canvas data block.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0

Steps to reproduce:

Be in permanent privacy mode, with strict privacy and security level setting, and have resist fingerprinting set to true. Go to a site that requests HTML5 canvas data.

Actual results:

When clicking on the canvas data extraction prompt in the address bar, I only see an allow or block for that particular website. Mozilla Firefox's own support pages show an 'always remember my decision' setting. https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting?as=u&utm_source=inproduct

Expected results:

I expect to be able to always block HTML5 canvas data extraction instead of having to block each website I visit, every time I open a new browser window.
If the canvas data extraction is blocked by default I expect the wording to be better in the prompt. Currently, it leads me to believe that extraction is allowed until I select block (as show by the little icon).

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Canvas: WebGL' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[alceryes]

I wanted to check in on this bug.

Do you need anything else from me to verify? I believe the allow/block canvas data still prompts on every website and doesn't allow a 'always block' option, regardless of the security setting and strict privacy more.

There should be an 'always block' option available.

Comment 3

[Kelsey Gilbert [:jgilbert]]

This is a good idea.

Comment 4

[alceryes]

I wanted to check in on this again and also give my findings.

It appears that in the advanced preferences, privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts is already set to true. However, I still see the extract canvas notification prompt appearing in the address bar when a site tries to extract canvas data.

So the question is -
Is canvas data extraction truly blocked and that little icon that pops up appearing in error OR is canvas data extraction being allowed even though privacy.resistFingerprinting and privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts are both set to TRUE?

Since I can actively go up to the prompt and select block canvas extraction data, at which time the icon adds a line through it showing it's blocked, I want to say that your resistFingerprinting settings aren't working. Either that or there's a complete disconnect between these advanced settings and the icons appearing in the address bar.

Comment 5

[alceryes]

Just checking in on this. It only takes 2 minutes to confirm this bug/issue.

Can we get a permanent 'block HTML5 canvas data extraction' in Firefox?

Comment 6

[alceryes]

Just checking on this again.

Can we get a toggle to permanently 'block HTML5 canvas data extraction' in Firefox?