1900828 - Collect test canvas software renderings

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, task)

Description

[Fatih Kilic [:fkilic]]

Can be landed after 1899874. We can actually land it even now as the extra argument on getContext don't break anything.

Comment 1

[Fatih Kilic [:fkilic]]

Attachment: Bug 1900828: Collect test canvas software renderings. r?timhuang

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The following patch is waiting for review from an inactive reviewer:

ID	Title	Author	Reviewer Status
D212714	Bug 1900828: Collect test canvas software renderings. r?tjr	fkilic	tjr: Back Aug 20, 2024

:fkilic, could you please find another reviewer?

For more information, please visit BugBot documentation.

Comment 3

[Fatih Kilic [:fkilic]]

Changed it

Comment 4

[Fatih Kilic [:fkilic]]

DATA REVIEW REQUEST

1. What questions will you answer with this data?

How unique is the result of software rendered canvases.

More generally: What is the most productive use of engineering time to make fingerprinting an ineffective method of tracking users? As detailed in https://bugzilla.mozilla.org/show_bug.cgi?id=1879151

2. Why does Mozilla need to answer these questions? Are there benefits for users?
   Do we need this information to address product or business requirements?

We want to improve our fingerprinting defenses. We don't want to guess at what will make an improvement, so we want to make a decision based on data. We also want to know how much of an improvement we have made, so we can state it and know how much further we have to go.

3. What alternative methods did you consider to answer these questions?
   Why were they not sufficient?

We considered privacy preserving metric collection (DAP), collecting it indirectly (e.g. via hashes of the data), using exisiting (lmited) data we currently collect, not collecting the data at all and using academic literature. These options are detailed in https://docs.google.com/document/d/1m_j0BQEprQleRHZ7tVT7mG-krc8UA171GD5Vl6gZbL0/edit

4. Can current instrumentation answer these questions?

As detailed in https://docs.google.com/document/d/1m_j0BQEprQleRHZ7tVT7mG-krc8UA171GD5Vl6gZbL0/edit - some attributes are collected by current instrumentation. However, using this data (and not using the other data we don't collect) will give an incomplete picture that may mislead us into choosing a task that does not make an appreciable change for users. We will also be unable to accurately state the improvement we have made.

5. List all proposed measurements and indicate the category of data collection for each
   measurement, using the Firefox data collection categories found on the Mozilla wiki.

Measurement Name	Measurement Description	Data Collection Category	Tracking Bug
characteristics.canvasdata1software	The sha1 hash of an image rendered on a canvas. The image is a simple organge box and used as a control image	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata2software	The sha1 hash of an image rendered on a canvas. The image is a bordered triage, and used to test point interpolation	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata3software	The sha1 hash of an image rendered on a canvas. The image is a stretched photographic image, used to test image operations.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata4software	The sha1 hash of an image rendered on a canvas. The image is two rotated, semi-transparenct overlapping squares, used to test transparency and point interpolation.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata5software	The sha1 hash of an image rendered on a canvas. The image is a local font rendered normally.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata6software	The sha1 hash of an image rendered on a canvas. The image is a local font rendered with italics, rotation, and shadow-blur.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata7software	The sha1 hash of an image rendered on a canvas. The image is a system-ui font rendered normally.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata8software	The sha1 hash of an image rendered on a canvas. The image is a system-ui font rendered with italics, rotation, and shadow-blur.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata9software	The sha1 hash of an image rendered on a canvas. The image is a font shipped with Firefox rendered normally.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata10software	The sha1 hash of an image rendered on a canvas. The image is a font shipped with Firefox rendered with italics, rotation, and shadow-blur.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata11_webglsoftware	The sha1 hash of an image rendered on a WebGL canvas (instead of Canvas2D). IT is a RGB gradient cube.	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata12_fingerprintjs1software	The sha1 hash of an image rendered on a canvas, it is a copy of fingerprintjs' text canvas	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828
characteristics.canvasdata13_fingerprintjs2software	The sha1 hash of an image rendered on a canvas, it is a copy of fingerprintjs' geometry canvas	technical	https://bugzilla.mozilla.org/show_bug.cgi?id=1900828

6. Please provide a link to the documentation for this data collection which
   describes the ultimate data set in a public, complete, and accurate way.

This collection is Glean so is documented in the Glean Dictionary.

7. How long will this data be collected?

This collection will be collected permanently.
[e-mail] will be responsible for the permanent collections.

8. What populations will you measure?

All channels, countries, and locales. No filters.

9. If this data collection is default on, what is the opt-out mechanism for users?

These collections are Glean. The opt-out can be found in the product's preferences.

10. Please provide a general description of how you will analyze this data.

The general question is "What engineering tasks should we do". To determine that, we will answer sub-questions like:

• How many users are uniquely identifiable via fingerprinting?
• For the users who are not, how large a cohort are they bucketed into?
• What attributes contribute the most to making users unique, or placing them in small buckets
• What attributes correlate with each other, such that we would need to address them in tandem

11. Where do you intend to share the results of your analysis?

We hope to publish an academic paper, actually, as this is a significant contribution to the topic of browser fingerprinting. We can also expect to do a blog post. The decisions about what engineering tasks we choose to do to decrease the uniqueness of our users will be filed as Bugzilla Bugs that will contain descriptions of why this is the engineering task to do.

12. Is there a third-party tool (i.e. not Glean or Telemetry) that you
    are proposing to use for this data collection?

No.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/93cd1edda657
Collect test canvas software renderings. r=timhuang

Comment 6

[Serban Stanca [:SerbanS]]

Backed out for causing multiple failures.

• Backout link

---

• Push with failures - build bustages
• Failure Log
• Failure line: /builds/worker/checkouts/gecko/gfx/gl/GLContextProviderWGL.cpp(475,8): error: no viable conversion from 'mozilla::CastableTypedEnumResult<CreateContextFlags>' to 'bool'

---

• Push with failures - leak failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | leakcheck | tab 232 bytes leaked (Mutex, StringBuffer, nsJSPrincipals, nsSimpleURI)

---

• Push with failures - reftests failures
• Failure Log
• Failure line: Assertion failure: NS_IsMainThread(), at /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:3616

Comment 7

[Fatih Kilic [:fkilic]]

Working on a fix right now, thank you!

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/25267209c88c
Collect test canvas software renderings. r=timhuang

Comment 9

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/25267209c88c

Comment 10

[Cristian Tuns]

Backed out for causing conflicts with the backout of Bug 1899874

• Backout link

Comment 11

[Serban Stanca [:SerbanS]]

Backout merged in central: https://hg.mozilla.org/mozilla-central/rev/43e913554c8344a5dca863ea27ebcc0166581fef

Comment 12

[Fatih Kilic [:fkilic]]

Updated revisions to fix the crashing issue. Thank you!

Comment 13

[Donal Meehan [:dmeehan]]

Backout uplift to beta: https://hg.mozilla.org/releases/mozilla-beta/rev/9904907868810c2b7e1ec8089d37121fe51087dd

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6852b185bce5
Collect test canvas software renderings. r=timhuang

Comment 15

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/6852b185bce5