2021648 - Putting full screen mode behind a permission prompt

Status: UNCONFIRMED

(Core :: WebRTC: Audio/Video, enhancement)

Description

[sworddragon2]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0

Actual results:

In the past and especially quite recently I noticed websites putting you into full screen mode when you don't expect it (from the last 2 recent events it was triggered via 2 different webgames. One entered full screen mode upon starting it when you would have expected it to stay embedded within the website and the other one triggered it once I entered its game settings for the first time). When this happens it usually throws me off my workflow which is quite a bit of a problem here.

Expected results:

Entering full screen mode via a website could trigger a permission prompt like some other actions (camera, microphone, etc.) already do. This would stop websites (unintentionally) distracting you and additionally it might be a potential solution to bug #1450401 to prevent fingerprinting - but this ticket mainly targets the annoyances rather than the tracking part.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::WebRTC: Audio/Video' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Thorin [:thorin]]

quite recently I noticed websites putting you into full screen mode when you don't expect it

I asume you mean fullscreenElement -> https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_API -> Element.requestFullscreen() and not the user hitting F11

anyway, it does require user action - and the "leak" would only be on those sites, not universal - this is very low hanging fruit for fingerprinters as it's not guaranteed (and FPers don't want to trigger users because it hurts their customers traffic).

On android I have noticed this (i.e the "when you don't expect it" part) more frequently in the last 6+ months and it is a little jarring every time - but that's the website, not fingerprinters. Honestly, I only check about 2 dozen sites on my phone regularly and I think the guardian is the guilty party these days. Maybe it makes sense on android. Perhaps Android should not have any prompts? Your android screen size is practically already inferred

IMO, there's a lot of considerations and quite a bit of engineering - for (almost) no gain.

---

pinging @pierov FYI for linkage: https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/32713#note_2835556

Comment 3

[sworddragon2]

(In reply to Thorin [:thorin] from comment #2)

I asume you mean fullscreenElement -> https://developer.mozilla.org/en-US/docs/Web/API/Fullscreen_API -> Element.requestFullscreen() and not the user hitting F11

Yes, it was the website triggering the full screen mode once it had user input and not the user just hitting F11. Firefox also showed its info popup but it vanishes so fast that it is almost impossible to read (even when you're aware of its content).

(In reply to Thorin [:thorin] from comment #2)

anyway, it does require user action - and the "leak" would only be on those sites, not universal

I believe this is not strictly correct. Even when (d)FPI is enabled the website that triggered full screen mode could simply forward to an universal tracker and append the gathered full screen information via this GET request. The tracker would store this information in its first-party storage and then simply forward back to the original site. And every other future website like YouTube could simply do this double forward immediately when being opened to also gather this leaked information (the tracker would still have the leaked information in its isolated first-party storage but could still share it via the forwards GET request) and this would be fast/subtle enough at this stage that you won't notice it. This is why I think (d)FPI has just limited capabilities in isolating websites here as websites always could just force bypassing it. But correct me if I'm wrong here as I really would be very interested into knowing why this would not work then.

(In reply to Thorin [:thorin] from comment #2)

On android I have noticed this (i.e the "when you don't expect it" part) more frequently in the last 6+ months and it is a little jarring every time - but that's the website, not fingerprinters. Honestly, I only check about 2 dozen sites on my phone regularly and I think the guardian is the guilty party these days.

For me the last 2 recent examples (both on desktop) were itch.io and an external site hosting one of the games there. I also recall very vaguely that websites had elements to enable fullscreen in a bad spot where you could easily click on them by accident or they were not labeled obviously. But that is a bit longer ago (but not too much) so I don't remember the exact details anymore.

Anyways, similar as your experience I perceive this as a more and more common issue over time and wouldn't mind if this could be (even out of the potential anti-tracking improvements) be improved somehow.