1816189 - Introduce random noises to canvas data when resist fingerprinting is enabled.

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, task)

Description

[Tim Huang[:timhuang]]

Adding random noises when extracting canvas data to prevent browsing fingerprinting. We should address the following canvas types

• Canvas Element
• Offscreen Canvas
• CanvasRendering2dContext

Comment 1

[Tim Huang[:timhuang]]

Attachment: Bug 1816189 - Part 1: Implementing methods in nsRFPService for canvas randomization. r?tjr!

This patch adds nsRFPService::RandomizePixels() and
nsRFPService::GetPointInRandomizedPixels(). These two function will be
used to randomize the canvas data.

Comment 2

[Tim Huang[:timhuang]]

Attachment: Bug 1816189 - Part 2: Add RFPTargets for the canvas fingerprinting protections. r?tjr!

Adding a pref to control canvas randomization. When canvas randomization
is enabled, we will allow the canvas image data extraction without
the canvas prompt when fingerprinting protection is on.

Depends on D175496

Comment 3

[Tim Huang[:timhuang]]

Attachment: Bug 1816189 - Part 4: Add random noise when extracting data from canvas element when canvas randomization is enabled. r?tjr!,#gfx-reviewers!

This patch introduces random noises to data extraction functions of
canvas element and offscreen canvas. The random noise is based on the
random key of the cookieJarSettings and the image data itself.

The random noises would interfere the ability of fingerprinters that
use canvas data to fingerprint users. The random noise will make unique
canvas finerprint to for every browsing session. Therefore, fingerprinter
cannot use canvas fingerprint to tracker individuals across browsing
sessions.

Depends on D175497

Comment 4

[Tim Huang[:timhuang]]

Attachment: Bug 1816189 - Part 5: Perturb the CanvasRenderingContext2D::IsPointInPath() and IsPointInStroke(). r?tjr!,#gfx-reviewers!

This patch changes the return value of these two function if the canvas
randomization is enabled. We would alter the return valuse if the test
position is in the place where affected by the canvas noise data.

Depends on D175499

Comment 5

[Tim Huang[:timhuang]]

Attachment: Bug 1816189 - Part 5: Add tests for canvas randomization on image extraction. r?tjr!

Adding tests to ensure we add random noise when extracting canvas data
if canvas randomization is enabled.

Depends on D175500

Comment 6

[Tim Huang[:timhuang]]

Attachment: Bug 1816189 - Part 7: Add a test for canvas randomization on CanvasRenderingContext2D.isPointInPath() and isPointInStroke(). r?tjr!

Adding a test to verfy the canvas randomization on
CanvasRenderingContext2D.isPointInPath() and isPointInStroke().

Depends on D175501

Comment 7

[Tim Huang[:timhuang]]

Attachment: Bug 1816189 - Part 3: Moving ShouldResistFingerprinting() to nsICanvasRenderingContextInternal from ClientWebCLContext and add a RFPTarget as an input argument. r?tjr,#gfx-reviewers

Depends on D175497

Comment 8

[Jeff Muizelaar [:jrmuizel]]

Is there a design doc that outlines the threat model and mitigations? For example, I don't understand the purpose of introducing randomization into isPointInPath() and isPointInStroke()

Comment 9

[Tim Huang[:timhuang]]

Hi Jeff,

This is the overview document that describes the canvas randomization.

For isPointInPath() and isPointInStroke() specifically, the fingerprinter could use these two functions to extract the canvas image data by testing every possible position on the canvas. So, we introduce the random noises using a similar approach as we do for image data extraction functions.

Comment 10

[Jeff Muizelaar [:jrmuizel]]

(In reply to Tim Huang[:timhuang] from comment #9)

For isPointInPath() and isPointInStroke() specifically, the fingerprinter could use these two functions to extract the canvas image data by testing every possible position on the canvas. So, we introduce the random noises using a similar approach as we do for image data extraction functions.

Can you elaborate on how that would work? The return value of isPointInPath shouldn't be affected by the contents of the canvas.

Comment 11

[Tim Huang[:timhuang]]

Per discussion with Jeff, the isPointInPath() and isPointInStorke() shouldn't reveal browser fingerprints because the result of these two functions is solely based on the Path/Stroke settings on the canvas. The function doesn't render the Path/Stroke to check the point so we can rule out the hardware fingerprints here. It's the same for software settings; no software setting would affect the Path/Stroke settings on Canvas.

Therefore, we don't need to add random noises to them because no browser fingerprints leaked from them. I will update the patches.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a17d7d650aec
Part 1: Implementing  methods in nsRFPService for canvas randomization. r=tjr
https://hg.mozilla.org/integration/autoland/rev/c118df0f5b8c
Part 2: Add RFPTargets for the canvas fingerprinting protections. r=tjr
https://hg.mozilla.org/integration/autoland/rev/c7dcc4328876
Part 3: Moving ShouldResistFingerprinting() to nsICanvasRenderingContextInternal from ClientWebCLContext and add a RFPTarget as an input argument. r=tjr,lsalzman
https://hg.mozilla.org/integration/autoland/rev/b640578b7534
Part 4: Add random noise when extracting data from canvas element when canvas randomization is enabled. r=tjr,lsalzman
https://hg.mozilla.org/integration/autoland/rev/7dfc345ccf21
Part 5: Add tests for canvas randomization on image extraction. r=tjr

Comment 13

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/a17d7d650aec
https://hg.mozilla.org/mozilla-central/rev/c118df0f5b8c
https://hg.mozilla.org/mozilla-central/rev/c7dcc4328876
https://hg.mozilla.org/mozilla-central/rev/b640578b7534
https://hg.mozilla.org/mozilla-central/rev/7dfc345ccf21