1888894 - Remove DOMHighResTimeStamp privacy.reduceTimerPrecision value for localhost / 127.0.0.1 hosts

Status: UNCONFIRMED

(Core :: Privacy: Anti-Tracking, enhancement)

Description

[esprigde]

Steps to reproduce:

Remove rounding policy for DOMHighResTimeStamp for privacy.reduceTimerPrecision value for localhost / 127.0.0.1 hosts, so every call to performance.now / Date.now will get real values

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Privacy: Anti-Tracking' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Benjamin VanderSloot [:bvandersloot]]

Thoughts?

Comment 3

[Tim Huang[:timhuang]]

I think exempting the protection from the localhost page can cause a potential loophole. If a user loads a page that contains fingerprinting scripts on localhost, the fingerprint can be sent to attackers via fetch.

I suggest adding a separate pref to control the behavior on the localhost page instead of disabling it from localhost pages.

Comment 4

[esprigde]

If a user loads a page that contains fingerprinting scripts on localhost, the fingerprint can be sent to attackers via fetch.

Not for file:// protocols, for that still be restrictions. Only for localhost domain names, as it is for devs only, so they will know what they do, casual users will not be able to run anything locally, downloaded pages will be opened via file:// schema

Comment 5

[esprigde]

As here pointed localhost is trusted and secure
https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts

Comment 6

[esprigde]

Any ideas?