1913639 - Scrollbar existance leaks external mouse presence on OSX even with RFP

Status: RESOLVED DUPLICATE of bug 1397996

(Core :: Privacy: Anti-Tracking, defect, P3)

Description

[Fatih Kilic [:fkilic]]

On OSX, Settings > Appearance > Show scroll bars controls if a window should have a scrollbar or not when an external mouse is present. Websites can check to see if a scrollbar is present to check an external mouse's presence.

Comment 1

[Fatih Kilic [:fkilic]]

It seems on Windows this also leaks user preference. Tor is affected as well.

Comment 2

[Fatih Kilic [:fkilic]]

Attachment: Bug 1913639: Force scrollbar to be overlay if RFPTargets::ScrollPresence is on. r?timhuang

Comment 3

[Henry Wilkes (they/them) [:henry-x]]

Note, downstream in Tor Browser, we have been discussing this in one of our issues plus in bug 1397996.

What I would like to summarise is that overlay scrollbars cause usability/accessibility problems:

1. Overlay scrollbars are generally more difficult to operate.
2. The difficulties would be hard to address and still would fall short of non-overlay scrollbars.

Also, under the normal resist fingerprinting pattern, chrome and content pages are exempt from restrictions. I'm not sure it would be a good user experience for content pages to use a different scrollbar style than web pages.

I would personally advocate for RFP to use non-overlay on desktop myself because I'm an accessibility person, so that's the default I would push for.

However, if you look in our downstream issue, other people would like overlay scrollbars. One reason is that non-overlay scrollbars can reveal (fractional) scaling factors for the window display. Note there are many more sources that reveal this same information, although it is unknown whether non-overlay scrollbars are equivalent to these other methods.

Comment 4

[Thorin [:thorin]]

This is a duplicate of Bug 1690038 which was closed as a duplicate of Bug 1397996 - we only need 1397996 TBH

• see https://bugzilla.mozilla.org/show_bug.cgi?id=1690038#c6

Unless you want to use this as a starting point to create a RFPTarget that ignores all possible prefs (all OSes), ignores the OS setting on mac, and enforces a set size (per OS) for auto, thin and hover .. which is basically 1397996

closing, but feel free to disagree and reopen