Tor Browser default screen resolution different between Qubes Debian & Whonix templates vs plain Debian

[adrelanos]

expected behavior

There should be no difference in Qubes Debian template vs plain (non-Qubes) Debian.

---

test environment

• Debian jessie vs Qubes Debian jessie template
• Whonix not involved at all (to prevent mixing this up with eventual Whonix specific issues)
• same screen
• same desktop resolution
• tested with same version, _6.0a4_ _hardened_ [ tor-browser-linux64-6.0a4-hardened_ALL.tar.xz (gpg verification passed) ]

---

actual behavior - test results - plain (non-Qubes) Debian jessie

• small white border on the left and right
• no white border on the bottom
• ip-check.info screen resolution result A
• looking acceptable

---

actual behavior - test results - Qubes Debian jessie template

• no white border on the left
• big white border on the right and the bottom
• different ip-check.info screen resolution result B
• looking strange

---

Whonix forum discussion
http://forums.whonix.org/t/tor-browser-auto-resize-feature-functional-in-qubes

---

Impact

Anonymity / Whonix is affected by this bug. Fingerprinting issue. Puts Qubes(-Whonix) users in a different anonymity set than other users.

[andrewdavidwong]

@marmarek: What do you think about creating a "privacy" label for issues such as this one?

[andrewdavidwong]

@marmarek: What do you think about creating a "privacy" label for issues such as this one?

[andrewdavidwong]

@marmarek: I just realized that I can create new labels, so I created one. If you think it's a bad idea or simply unnecessary, please feel free to delete it. :)

[andrewdavidwong]

@marmarek: I just realized that I can create new labels, so I created one. If you think it's a bad idea or simply unnecessary, please feel free to delete it. :)

[mfc]

sorry does this include Tor Browser in Whonix workstation? Or does it have the proper fingerprint (non-Qubes Debian jessie TB)?

This should be the whole point of Whonix workstation, so theoretically that should be the gold standard and we should tell folks that's the place to run the Tor Browser rather than doing so in a Debian template.

[mfc]

sorry does this include Tor Browser in Whonix workstation? Or does it have the proper fingerprint (non-Qubes Debian jessie TB)?

This should be the whole point of Whonix workstation, so theoretically that should be the gold standard and we should tell folks that's the place to run the Tor Browser rather than doing so in a Debian template.

[adrelanos]

Any Tor Browser in any VM template (Debian, Fedora, Whonix, ...) is affected by this bug since it is derived on how Qubes GUI protocol is implemented. No way to fix this on the template level.

[adrelanos]

Any Tor Browser in any VM template (Debian, Fedora, Whonix, ...) is affected by this bug since it is derived on how Qubes GUI protocol is implemented. No way to fix this on the template level.

[mfc]

great, thanks for the clarification. so specifically, the issues are that the auto-resizing and fullscreen-warning functionality don't work?

I was unable to confirm any of the UX issues about borders or looking strange, running 6.0 on whonix-workstation.

[mfc]

great, thanks for the clarification. so specifically, the issues are that the auto-resizing and fullscreen-warning functionality don't work?

I was unable to confirm any of the UX issues about borders or looking strange, running 6.0 on whonix-workstation.

[adrelanos]

TBB no longer has a full screen warning anywhere, no issue there.

The original bug report of a fingerpriting (screen resolution) issue is still valid as of TBB 6.0. test results - plain (non-Qubes) Debian jessie vs test results - Qubes Debian jessie template.

You won't be able to tell any difference in TBB looks without comparing to a plain (non-Qubes) Debian jessie.

[adrelanos]

TBB no longer has a full screen warning anywhere, no issue there.

The original bug report of a fingerpriting (screen resolution) issue is still valid as of TBB 6.0. test results - plain (non-Qubes) Debian jessie vs test results - Qubes Debian jessie template.

You won't be able to tell any difference in TBB looks without comparing to a plain (non-Qubes) Debian jessie.

[mfc]

okay, do we have a ticket about the Qubes GUI protocol bug? let's focus on the fingerprinting issue rather than the UX/UI.

vanilla Tor Browser 6.0 in Debian template opens to a default 1000x877 pixels, while whonix-ws Tor Browser opens to a default 1000x900 pixels (according to ip-check.info). neither of those are common resolutions. so it sounds like there may be an issue between the Debian and Whonix templates as well (or being affected by the GUI bug as well).

[mfc]

okay, do we have a ticket about the Qubes GUI protocol bug? let's focus on the fingerprinting issue rather than the UX/UI.

vanilla Tor Browser 6.0 in Debian template opens to a default 1000x877 pixels, while whonix-ws Tor Browser opens to a default 1000x900 pixels (according to ip-check.info). neither of those are common resolutions. so it sounds like there may be an issue between the Debian and Whonix templates as well (or being affected by the GUI bug as well).

[marmarek]

okay, do we have a ticket about the Qubes GUI protocol bug?

Yes, this one.

vanilla Tor Browser 6.0 in Debian template

This isn't about Debian template vs Whonix workstation. This is about TBB on baremetal Debian/Tails/whatever vs TBB in Qubes VM (in Debian/Whonix/whatever).

[marmarek]

okay, do we have a ticket about the Qubes GUI protocol bug?

Yes, this one.

vanilla Tor Browser 6.0 in Debian template

This isn't about Debian template vs Whonix workstation. This is about TBB on baremetal Debian/Tails/whatever vs TBB in Qubes VM (in Debian/Whonix/whatever).

[mfc]

vanilla TBB on Ubuntu opens to a default 1000x700 pixels according to ip-check.info.

I'll let you guys figure out this ticket. I'm just trying to emphasize that the privacy-impacting issues should be focused on, not UX/GUI stuff.

and obviously debian template TBB and whonix template TBB should have same default screen resolution, which should equal the default debian/etc TBB screen resolution.

[mfc]

vanilla TBB on Ubuntu opens to a default 1000x700 pixels according to ip-check.info.

I'll let you guys figure out this ticket. I'm just trying to emphasize that the privacy-impacting issues should be focused on, not UX/GUI stuff.

and obviously debian template TBB and whonix template TBB should have same default screen resolution, which should equal the default debian/etc TBB screen resolution.

[andrewdavidwong]

entr0py:

As long as #1856 still produces multiples of 200x100 screens, then it's more of an annoyance rather than a catastrophic bug. Instead of being lumped together with the Tor Browser users you were expecting, you're be grouped with other Tor Browser users instead. (Still useful to know why it happens though.)

Just wanted to add that it's very easy to play with your Tor Browser screen size by using KDE's Window Rules.

Need to add 8 pixels of width to accomodate Qubes' borders.
And 100 pixels of height for Window Title, Tabs, etc.
Panopticlick measures the Interior Browser window.

This can also be a temporary workaround for Issue 1856.

[andrewdavidwong]

entr0py:

As long as #1856 still produces multiples of 200x100 screens, then it's more of an annoyance rather than a catastrophic bug. Instead of being lumped together with the Tor Browser users you were expecting, you're be grouped with other Tor Browser users instead. (Still useful to know why it happens though.)

Just wanted to add that it's very easy to play with your Tor Browser screen size by using KDE's Window Rules.

Need to add 8 pixels of width to accomodate Qubes' borders.
And 100 pixels of height for Window Title, Tabs, etc.
Panopticlick measures the Interior Browser window.

This can also be a temporary workaround for Issue 1856.