1908470 - Privacy-Preserving Attribution API enabled/disabled detectable

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Sertonix]

As far as I know it should not be detectable by a webpage if Privacy-Preserving Attribution is enabled or not (https://github.com/mozilla/explainers/issues/11#issuecomment-2228913120).

It is currently possible to detect that in js though. When PPA is disabled the argument checking is skipped. This can be used to detect whenever PPA is enabled or not by providing an invalid argument (eg. target: "~") and checking if the function errors.

try {
  navigator.privateAttribution.saveImpression({ type: "view", index: 6, ad: "shoes", target: "~" });
} catch (e) {
  if (e instanceof DOMException)
    console.log("PPA enabled!")
}

It would be better to check if PPA is enabled after the arguments were checked.

Comment 1

[Brian Grinstead [:bgrins]]

Thanks for filing, I can confirm the bug

Comment 2

[Emilio Cobos Álvarez [:emilio]]

Yeah that's an oversight on my end, nice catch! Should be a matter of moving the StaticPrefs checks added in https://hg.mozilla.org/mozilla-central/rev/75c2741fec927132a09d1b380e5bf1680069daa2 further below (just before the XRE_IsParentProcess() checks).

Comment 3

[Brian Grinstead [:bgrins]]

Don't think the fix will need uplifting since the API is only exposed through an OT

Comment 4

[Simon Friedberger [:simonf]]

Make sure to watch out for a timing side-channel as well when fixing this!

Comment 5

[cbguder]

Attachment: Bug 1908470 - Make it harder to detect when PPA is disabled r=bgrins

The privateAttribution API returns early when the user has disabled
Privacy Preserving Attribution. This makes it possible to detect this
condition by passing in an invalid target domain and observing whether
the API raises an exception.

This moves the user preference checks to happen after input validation,
so that input validation happens (and an exception is thrown) even when
PPA is disabled.

Note that it might still be possible to detect whether PPA is enabled by
observing the timing of calls.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e8ca6c27ae5b
Make it harder to detect when PPA is disabled r=emilio

Comment 7

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/e8ca6c27ae5b