1896175 - With RFP, a granted Canvas Permission still applies FPP's randomization

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[Tom Ritter [:tjr]]

As noted on the tor bugtracker - if you have RFP enabled, and grant a site canvas permission - it will still apply FPP's randomization. It should not.

Comment 1

[Fatih Kilic [:fkilic]]

Attachment: Bug 1896175: Check canvas extraction permission before returning ImageExtraction::Randomize. r?timhuang

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9a03d91857c7
Check canvas extraction permission before returning ImageExtraction::Randomize. r=timhuang

Comment 3

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/9a03d91857c7

Comment 4

[Fatih Kilic [:fkilic]]

Attachment: Bug 1896175: Check canvas extraction permission before returning ImageExtraction::Randomize. r?timhuang

Original Revision: https://phabricator.services.mozilla.com/D218882

Comment 5

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: This patch improves the fingerprinting prevention/privacy of the users. We want to uplift this patch so that the privacy targeted browsers (e.g. Tor, Mullvad) can receive the updates. No big impact if declined.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: Enable privacy.resistFingerprinting, visit https://arkenfox.github.io/TZP/tests/canvasnoise.html, grant canvas reading permissions, and verify 1st and 2nd read hashes match with the control hash
• Risk associated with taking this patch: I can't think of anything really. It has been a while since we landed this patch and we haven't seen any crashes.
• Explanation of risk level: Possibly none
• String changes made/needed: No
• Is Android affected?: yes

Comment 6

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/20d1491f8bea

Comment 7

[Thorin [:thorin]]

Attachment: test.png

This also doesn't work as expected - I am only testing getImageData, toBlob, and toDataURL - so not sure about offscreenCanvas etc

see image of FF132 nightly

• https://arkenfox.github.io/TZP/tzp.html#canvas
• top FPP - all good
• middle RFP - all good
• bottom RFP with a RFP canvas exception - toBlob and toDataURL (non solid) are still FPP'd

Comment 8

[Fatih Kilic [:fkilic]]

just to make sure that I understand it correctly, toDataURL and toBlob is applying randomization right? I'm going to assume that those functions are not checking for the permission.

Comment 9

[Fatih Kilic [:fkilic]]

so not sure about offscreenCanvas etc

Also about offscreen canvas, we no nothing, there's no permission check, it always returns placeholder

Comment 10

[Thorin [:thorin]]

long story short - if the notation is green, it's protected (randomized), if it's red it isn't (expected known value)

In a nutshell ... TZP is using known pixel tests. getImageData is randomized per section run (and the data stored for comparison), the others are hardcoded (and their hashes known). The tests (getImageData, isPoint*, toDataURL, toBlob etc) do a first pass (reading). For each one, if it returns the expected result then it displays that otherwise it will do a second pass (read) to determine if the change is persistent (like FPP) or per execution (like RFP). There are more checks for RFP compliance and some extra entropy is added about getImageData (at this point just the channels changed - I also display the % of pixels altered for each but do not record it in the fingerprint - this is called fingerprinting the fingerprint protection!)

offscreen canvas

My understanding is the FPP and RFP do protect this. If not then it's a gaping hole in FPP canvas protection. Check with tjr. I think there are also some other areas where canvas things are FPP protected - ? GetImageBuffer and GetInputStream ?

IDK what placeholder means

Comment 11

[Fatih Kilic [:fkilic]]

Hmm my testing shows that permission granting works. I created bug 1918690, we can continue there.