1913421 - Track the amount of Captchas caused by fingerprinting protections

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, task)

Description

[Tom Schuster]

Enabling fingerprinting protections could cause more sites to show captchas before being allowed to access the page, because it makes our users look less unique. We know this happens when enabling RFP, e.g. bug 1909961 for cloudflare.

One idea for being able to track captchas would be to see how often specific canvas fingerprinters are being used, which often happen together.

Comment 1

[Tim Huang[:timhuang]]

Is the canvas fingerprinting only used after the captcha shows up? I would suspect it's before. So, maybe looking into canvas fingerprinting isn't efficient in detecting captchas. Maybe some info only gets read after showing a captcha. We should rely on those instead.

Comment 2

[Fatih Kilic [:fkilic]]

Attachment: WIP: Bug 1913421: Introduce captcha-detection extension

Comment 3

[Fatih Kilic [:fkilic]]

Attachment: WIP: Bug 1913421: Detect Google reCAPTCHA v2

Comment 4

[Fatih Kilic [:fkilic]]

Attachment: WIP: Bug 1913421: Introduce experimental API to record metrics using Glean.

Note that this patch doesn't create a metrics.yaml or ping.yaml file. It just provides the plumbing required to call Glean API.

Comment 5

[Fatih Kilic [:fkilic]]

Attachment: WIP: Bug 1913421: Detect Cloudflare turnstile completions

Comment 6

[Fatih Kilic [:fkilic]]

Attachment: WIP: Bug 1913421: Introduce metrics.yaml and pings.yaml

Comment 7

[Fatih Kilic [:fkilic]]

Attachment: WIP: Bug 1913421: Implement updateMetric function

Comment 8

[Fatih Kilic [:fkilic]]

Attachment: WIP: Bug 1913421: Actually update metrics

Comment 9

[Fatih Kilic [:fkilic]]

Attachment: WIP: Bug 1913421: Fix linter errors

Comment 10

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Introduce Captcha Detection Actor. r?mossop

Comment 11

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Create a mutation observer with the correct handler. r?mossop

Comment 12

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Detect Google Recaptcha V2. r?mossop

Comment 13

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Introduce tab state and log how a Google Recaptcha V2 was completed (manually or automatically). r?mossop

Comment 14

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Detect CF Turnstile results. r?mossop

Comment 15

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Introduce metrics.yaml and pings.yaml. r?mossop

Comment 16

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Actually update captcha metrics. r?mossop

Comment 17

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Submit ping with at least 24 hour delay since last submission or on pref changes. r?mossop

Comment 18

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Detect DataDome Captchas. r?mossop

Comment 19

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Refactor and optimize observer parameters. r?mossop

Comment 20

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Detect hCaptcha captchas. r?mossop

Comment 21

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Detect AWS WAF Captchas. r?mossop

Comment 22

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Detect Arkose Labs Captchas. r?mossop

Comment 23

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Add type definitions. r?mossop

Comment 24

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Minor typing change change nsresult to nsIXPCComponents_Values. r?mossop

Comment 25

[Dave Townsend [:mossop] (PTO until July 20)]

The way this patch stack is structured makes it difficult to review from an architectural standpoint because over halfway through the stack (in D226545) you completely change the architecture. This means that many of my comments on the earlier patches become irrelevant. Can you either restructure the stack so this doesn't happen or give me a clean patch to review in one go?

Comment 26

[Fatih Kilic [:fkilic]]

Sure, I will. The logic doesn't really change I just export stuff to their own classes but I can see how that changes validity of comments in the old patches (like lets say you wanted to say naming is not good here but then I changed naming and all in the new class implementation etc.), sorry. I'll fix it.

Comment 27

[Fatih Kilic [:fkilic]]

Alright I updated it. I removed 3 patches including the one with "refactor the whole thing" patch. Also see this document for implementation specifics and notes https://docs.google.com/document/d/1WVEJgYCWXJVhrXQlYWXWSBNumj_xS3dp49B2gZ0mh90/edit

Comment 28

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Test Google Recaptcha V2 mock. r?mossop

Comment 29

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Test CF Turnstile mock. r?mossop

Comment 30

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Test Datadome mock. r?mossop

Comment 31

[BugBot [:suhaib / :marco/ :calixte]]

The following patches are waiting for review from a reviewer who resigned from the review:

ID	Title	Author	Reviewer Status
D226922	Bug 1913421: Detect hCaptcha captchas. r?mossop	fkilic	mossop: Resigned from review
D227556	Bug 1913421: Detect Arkose Labs Captchas. r?mossop	fkilic	mossop: Resigned from review

:fkilic, could you please find another reviewer?

For more information, please visit BugBot documentation.

Comment 32

[Fatih Kilic [:fkilic]]

Sure I'll find someone. Thank you!

Comment 33

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Test hCaptcha mock. r?mossop

Comment 34

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Test hCaptcha mock. r?mossop

Comment 35

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Test hCaptcha mock. r?mossop

Comment 36

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Test AWS WAF mock. r?mossop

Comment 37

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913421: Test ArkoseLabs mock. r?mossop

Comment 38

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/849674119c65
Introduce Captcha Detection Actor. r=mossop
https://hg.mozilla.org/integration/autoland/rev/51f94cd7e9e5
Detect Google Recaptcha V2. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/cd2258c3f8e3
Detect CF Turnstile results. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/afd89f58cab0
Introduce metrics.yaml and pings.yaml. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/2459730a7e10
Actually update captcha metrics. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/7f54b1a2c565
Submit ping with at least 24 hour delay since last submission or on pref changes. r=mossop,geckoview-reviewers,tjr,tthibaud
https://hg.mozilla.org/integration/autoland/rev/f6850c74997a
Detect DataDome Captchas. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/b36e090e8715
Detect hCaptcha captchas. r=tjr
https://hg.mozilla.org/integration/autoland/rev/ba58924faee8
Detect AWS WAF Captchas. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/335767ea0138
Detect Arkose Labs Captchas. r=tjr
https://hg.mozilla.org/integration/autoland/rev/cc2acc1bd560
Add type definitions. r=mossop
https://hg.mozilla.org/integration/autoland/rev/8ca6f7399e31
Test Google Recaptcha V2 mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/2fbc4c09d4f0
Test CF Turnstile mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/d5f36da0c01f
Test Datadome mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/22084dc8fbb0
Test hCaptcha mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/5f1bb8cea1d5
Test AWS WAF mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/7eda60115372
Test ArkoseLabs mock. r=mossop

Comment 39

[Serban Stanca [:SerbanS]]

Backed out for causing mochitests-plain failures in test_arkose_labs.html.

• Backout link
• Push with failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | toolkit/components/captchadetection/tests/mochitest/test_arkose_labs.html | Test timed out. -

Comment 40

[Fatih Kilic [:fkilic]]

The issue was about xorigin tests running on .org instead of .com. Hopefully it should be fixed now.

Comment 41

[Serban Stanca [:SerbanS]]

Please also check these bustages.

• Failure Log

Comment 42

[Fatih Kilic [:fkilic]]

Hmm really interesting. Some sort of regex matching issue with the urls i listed in matches section of js window actor. I'll try to remove stuff one by one to see what's going on.

Comment 43

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b10761a94df6
Introduce Captcha Detection Actor. r=mossop
https://hg.mozilla.org/integration/autoland/rev/e8bb11c1c410
Detect Google Recaptcha V2. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/17af42850877
Detect CF Turnstile results. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/cab976b11ed5
Introduce metrics.yaml and pings.yaml. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/555ebf268c2b
Actually update captcha metrics. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/da2a230542bd
Submit ping with at least 24 hour delay since last submission or on pref changes. r=mossop,geckoview-reviewers,tjr,tthibaud
https://hg.mozilla.org/integration/autoland/rev/e2d6171d2fba
Detect DataDome Captchas. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/edd4c0b4d9ea
Detect hCaptcha captchas. r=tjr
https://hg.mozilla.org/integration/autoland/rev/4eb23fa7b448
Detect AWS WAF Captchas. r=mossop,tjr
https://hg.mozilla.org/integration/autoland/rev/3803cd174636
Detect Arkose Labs Captchas. r=tjr
https://hg.mozilla.org/integration/autoland/rev/ffd699eaacb9
Add type definitions. r=mossop
https://hg.mozilla.org/integration/autoland/rev/511986d815a6
Test Google Recaptcha V2 mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/dabe3c0f9387
Test CF Turnstile mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/10f9094f4107
Test Datadome mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/594f6790bc2d
Test hCaptcha mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/88ae4861a8ac
Test AWS WAF mock. r=mossop
https://hg.mozilla.org/integration/autoland/rev/ecdb537a3742
Test ArkoseLabs mock. r=mossop

Comment 44

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/b10761a94df6
https://hg.mozilla.org/mozilla-central/rev/e8bb11c1c410
https://hg.mozilla.org/mozilla-central/rev/17af42850877
https://hg.mozilla.org/mozilla-central/rev/cab976b11ed5
https://hg.mozilla.org/mozilla-central/rev/555ebf268c2b
https://hg.mozilla.org/mozilla-central/rev/da2a230542bd
https://hg.mozilla.org/mozilla-central/rev/e2d6171d2fba
https://hg.mozilla.org/mozilla-central/rev/edd4c0b4d9ea
https://hg.mozilla.org/mozilla-central/rev/4eb23fa7b448
https://hg.mozilla.org/mozilla-central/rev/3803cd174636
https://hg.mozilla.org/mozilla-central/rev/ffd699eaacb9
https://hg.mozilla.org/mozilla-central/rev/511986d815a6
https://hg.mozilla.org/mozilla-central/rev/dabe3c0f9387
https://hg.mozilla.org/mozilla-central/rev/10f9094f4107
https://hg.mozilla.org/mozilla-central/rev/594f6790bc2d
https://hg.mozilla.org/mozilla-central/rev/88ae4861a8ac
https://hg.mozilla.org/mozilla-central/rev/ecdb537a3742