1744439 - privacy.resistFingerprinting.letterboxing.dimensions doesn't work

Status: RESOLVED WORKSFORME

(Core :: DOM: Security, defect)

Description

[sedan-01-unset]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0

Steps to reproduce:

Set privacy.resistFingerprinting.letterboxing.dimensions to 1920x1080, or a popular resolution like 1600x900

Actual results:

Nothing, reopening Firefox opens a windows and the small default size

Expected results:

Firefox should open with a custom letterbox resolution.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Security' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Tom Ritter [:tjr]]

So this preference is really just for testing and not that supported. It should work but....

To be sure: this pref will only take effect if you've already set the main letterboxing pref and see it letterboxing windows. Additionally, no letterboxing will be applied if the window is smaller than the lowest letterboxing size. So try a smaller value like 400x400 and ensure your window is larger than that. The change will only take affect after you refresh a webpage (like mozilla.org). I just tested with 800x800 and it worked for me; but 8000x8000 make it appear as it letterboxing was disabled.

Comment 3

[sedan-01-unset]

To be sure: this pref will only take effect if you've already set the main letterboxing

By this you mean that letterboxing is turned on? It is turned on for me.

Additionally, no letterboxing will be applied if the window is smaller than the lowest letterboxing size. So try a smaller value like 400x400 and ensure your window is larger than that.

Not sure I follow. The default size seems to be 1000x1000. Which is unchanging no matter what the dimensions are set to privacy.resistFingerprinting.letterboxing.dimensions. Id like the window bigger not smaller.

The change will only take affect after you refresh a webpage (like mozilla.org). I just tested with 800x800 and it worked for me; but 8000x8000 make it appear as it letterboxing was disabled.

When you say appeared as if it was disabled, do you mean it appears as 1000x1000 or it appears full screen? I don't think refreshing a page changes the size of your window - restarting firefox should see the change take affect.

Comment 4

[Tom Ritter [:tjr]]

(In reply to sedan-01-unset from comment #3)

By this you mean that letterboxing is turned on? It is turned on for me.

Gotcha.

Additionally, no letterboxing will be applied if the window is smaller than the lowest letterboxing size. So try a smaller value like 400x400 and ensure your window is larger than that.

Not sure I follow. The default size seems to be 1000x1000. Which is unchanging no matter what the dimensions are set to privacy.resistFingerprinting.letterboxing.dimensions. Id like the window bigger not smaller.

So there are two window-size preferences. privacy.resistFingerprinting will make the outer size of new windows (i.e. popup windows) come up with specific dimensions. Letterboxing (privacy.resistFingerprinting.letterboxing) will make the content size of windows grow and shrink in 'steps' as you resize your window. When no value in privacy.resistFingerprinting.letterboxing.dimensions (or an invalid value) letterboxing will step in 50, 100, or 200 pixel ranges depending on the size of the window.

If you don't see the content window being letterboxing (the gray outline around the content in this image when the dimensions pref is empty; then letterboxing is not enabled or working for you.

The change will only take affect after you refresh a webpage (like mozilla.org). I just tested with 800x800 and it worked for me; but 8000x8000 make it appear as it letterboxing was disabled.

When you say appeared as if it was disabled, do you mean it appears as 1000x1000 or it appears full screen? I don't think refreshing a page changes the size of your window - restarting firefox should see the change take affect.

I mean it will appear as if there is no letterboxing - the content will fit the size of the window with no border.

The dimensions pref is intended to hold a list of values (and as I mentioned is really just for testing so it's real annoying to work with). Setting it to e.g. 400x400 (and making sure your window is larger than that) should show your content with giant borders around it.

Comment 5

[sedan-01-unset]

Right I see- this seems far less like a bug and more that i'm not knowledgeable on the topic, and this feature is still in progress. It was explained to me that turning on resistFingerprinting also turned on letterboxing, which doesn't seem to be the case. In my about:config there is only one entry that contains "letterboxing" and that's the one for dimensions. I don't see one for the feature itself.

The dimensions setting was also explained to me to be the one where you set the dimensions of the browser window, not the size of the steps for this internal window. Just a fundamental misunderstanding with the reddit community and this feature it seems.

privacy.resistFingerprinting will make the outer size of new windows (i.e. popup windows) come up with specific dimensions.

Do you know how to change this size? There seems to be a lot of conflicting information out there.

Comment 6

[Tom Ritter [:tjr]]

(In reply to sedan-01-unset from comment #5)

Just a fundamental misunderstanding with the reddit community and this feature it seems.

Can you point me to the thread; I'd like to go try to clear up confusion.

privacy.resistFingerprinting will make the outer size of new windows (i.e. popup windows) come up with specific dimensions.

Do you know how to change this size? There seems to be a lot of conflicting information out there.

I had expected to say "You can't" but it turns out that the code does actually consult these preferences. But, given that I didn't even know they existed; I can't give you much guidance on how to make it do what you want. But apparently you can fiddle the prefs that are involved!

Comment 7

[Thorin [:thorin]]

Do you know how to change this size

RFP when enabled controls new window sizes. You can override the max values to start rounding down from, and the final result will be the largest size that fits your screen. New window sizes are only used at creation: i.e they get altered if you resize, maximize, go full screen, or toggle chrome elements
[1] https://github.com/arkenfox/user.js/blob/b60a888da3c9df3862b9dbaff1b1ac2621e67db2/user.js#L1036-L1045

Letterboxing is independent of RFP, uses stepped ranges and is applied all the time: e.g. if you resize, maximize, go full screen, or toggle chrome elements. It was designed to eliminate bugs with new window sizes, and if users resize etc, to minimize the possible combinations of width and height from millions to a fraction of that
[2] https://github.com/arkenfox/user.js/blob/b60a888da3c9df3862b9dbaff1b1ac2621e67db2/user.js#L1050-L1060

this seems far less like a bug

Yes. This is not a bug. +1 for closing

or a popular resolution

Sets of protected users do not care about what is popular/common. The key is to not leak the real value and to reduce the number of possible results

Comment 8

[Thorin [:thorin]]

ninja'd by tom :-(

Comment 9

[sedan-01-unset]

(In reply to Tom Ritter [:tjr] (ni? for response to CVE/sec-approval/advisories/etc) from comment #6)

(In reply to sedan-01-unset from comment #5)

Just a fundamental misunderstanding with the reddit community and this feature it seems.

Can you point me to the thread; I'd like to go try to clear up confusion.

privacy.resistFingerprinting will make the outer size of new windows (i.e. popup windows) come up with specific dimensions.

Do you know how to change this size? There seems to be a lot of conflicting information out there.

I had expected to say "You can't" but it turns out that the code does actually consult these preferences. But, given that I didn't even know they existed; I can't give you much guidance on how to make it do what you want. But apparently you can fiddle the prefs that are involved!

This is the only thread i still had open: https://www.reddit.com/r/firefox/comments/loeida/any_way_to_set_privacyresistfingerprinting_window/go7mm0s/

But there are a lot of threads on /r/privacytools and /r/privacyguides that say slighter different things about firefox/fingerprinting in general.