2050515 - Enable WebGL Vendor and Renderer protection in Nightly PBM

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, enhancement)

Description

[Tom Ritter [:tjr]]

Now that we have Remote Settings overrides for the known concerns, let's enable this.

Comment 1

[Tom Ritter [:tjr]]

Attachment: Bug 2050515: Enable WebGL Vendor and Renderer protection in Nightly PBM r?timhuang

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/70391e085a6e
https://hg.mozilla.org/integration/autoland/rev/6f1b623ac062
Enable WebGL Vendor and Renderer protection in Nightly PBM r=timhuang

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/47ef212881bf
https://hg.mozilla.org/integration/autoland/rev/e035a4dd4d4d
Revert "Bug 2050515: Enable WebGL Vendor and Renderer protection in Nightly PBM r=timhuang" for causing gl1c failures at test_webgl_constant_vendor_fpp.html

Comment 4

[rperta]

Backed out for causing gl1c failures at test_webgl_constant_vendor_fpp.html
Backout link
Push with failures
Failure log(s)

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b202b435a03f
https://hg.mozilla.org/integration/autoland/rev/25e5ef0e1c59
Enable WebGL Vendor and Renderer protection in Nightly PBM r=timhuang

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/9b76a2f882af
https://hg.mozilla.org/integration/autoland/rev/cd8b93a107ef
Revert "Bug 2050515: Enable WebGL Vendor and Renderer protection in Nightly PBM r=timhuang" for causing mochitest failures @test_webgl_constant_vendor_fpp.html.

Comment 7

[agoloman]

Backed out for causing mochitest failures @test_webgl_constant_vendor_fpp.html.

• Backout link
• Push with failures
• Failure Log

Comment 8

[Tom Ritter [:tjr]]

So I sent it to try but not phab; uhg.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/542208dcdb89
https://hg.mozilla.org/integration/autoland/rev/03d7b739171d
Enable WebGL Vendor and Renderer protection in Nightly PBM r=timhuang

Comment 10

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/03d7b739171d

Comment 11

[Thorin [:thorin]]

Attachment: test.png

unmasked vendor is random per execution making it inconsistent even between contexts. This is a red flag for anti-bot, fraud-detection scripts and is only going to end in tears. Mismatched values (think conflicting useragent in navigator/header or iframe vs document results ) seen numerous times in RFP over the years, is never good.

personally I think the randomizing here is (ultimately) a waste of time, as it can always be detected (and the pattern here is trivial) - and is not strictly needed - you could just as easily always return Mozilla or some consistent result per platform. I will refer to [1] and [2]. Do read them - [1] you were part of and [2] I wrote in parallel to [1] without knowing it's existence and it only reinforces it with real world knowledge and experience including from other FP researchers such as Antoine Vastel.

If you are going to randomize at least make it persistent (per session/eTLD+1 etc) which could at least help mitigate mismatched values - but again, I think this is the wrong approach to take - randomizing should be a last resort (e.g. canvas) - everywhere randomizing has been used (including brave), it has been either bypassed (complexity, too subtle etc), the poisoned-data effect rendered useless (advanced scripts, backend analysis such as fpjspro can/could do), or weaponized against the user

Sorry, I don't want to come across as all preachy, but I would like a reply - otherwise I feel like I am wasting my time

[1] https://w3c.github.io/fingerprinting-guidance/#a_standardized_profile
[2] https://arkenfox.github.io/thorin/items/02browserfingerprinting.html#random

Comment 12

[Tom Ritter [:tjr]]

It's possible we're seeing this effect in CAPTCHA rates, I'm going to back out the randomization in Bug 2056780 while we run an experiment to measure.