Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Desktop] consider removing list of fingerprint attempts blocked from shields #10544

Closed
LaurenWags opened this issue Jul 2, 2020 · 6 comments
Labels
closed/not-actionable feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields feature/shields/panel Front-end design and functionality of the Shields panel. OS/Desktop priority/P3 The next thing for us to work on. It'll ride the trains. QA/Yes
Projects

Comments

@LaurenWags
Copy link
Member

Description

While testing #10000 I noticed that using 1.11.x I could not get any FP attempts listed as blocked in shields (it was always 0), even when expected and the setting was set to the highest level of "strict".

Comparatively, using the highest FP setting on 1.10.x did show a number for FP attempts listed as blocked (2 in my example below).

I asked @pes10k about this and he mentioned that this list was not all that useful and often resulted in a a lot of false positives. He recommended removing this list since it's not all that useful.

Steps to Reproduce

  1. Using 1.10.x, set default shields setting for FP to block fingerprinting.
  2. Visit https://dev-pages.bravesoftware.com/farbling.html and generate fingerprints. Note shields lists 2 blocked and you can view them.
  3. Using 1.11.x, set default shields setting for FP to strict.
  4. Visit https://dev-pages.bravesoftware.com/farbling.html and generate fingerprints. Note shields lists 0 blocked.

Actual result:

1.11.x on the left, 1.10.x on the right
Screen Shot 2020-07-02 at 9 25 45 AM

Expected result:

Remove list of blocked items per recommendation from @pes10k

Reproduces how often:

Brave version (brave://version info)

Brave 1.11.85 Chromium: 83.0.4103.116 (Official Build) dev (64-bit)
Revision 8f0c18b4dca9b6699eb629be0f51810c24fb6428-refs/branch-heads/4103@{#716}
OS macOS Version 10.14.6 (Build 18G3020)

Version/Channel Information:

  • Can you reproduce this issue with the current release? no
  • Can you reproduce this issue with the beta channel? yes
  • Can you reproduce this issue with the dev channel? yes
  • Can you reproduce this issue with the nightly channel? yes

Other Additional Information:

  • Does the issue resolve itself when disabling Brave Shields?
  • Does the issue resolve itself when disabling Brave Rewards?
  • Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

cc @rebron

@LaurenWags LaurenWags added feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields QA/Yes feature/shields/panel Front-end design and functionality of the Shields panel. OS/Desktop labels Jul 2, 2020
@LaurenWags LaurenWags added this to Untriaged / Incoming in Shields via automation Jul 2, 2020
@pes10k
Copy link
Contributor

pes10k commented Jul 2, 2020

Just seconding @LaurenWags above. The "FP attempts" list was never very useful, bc of the high number of false positives. And now that we deploy protections in all frames by default, and cover even more APIs, it'll be even worse noise-to-signal. My vote is to remove the dropdown for fingerprinting attempts all together

@ryanbr
Copy link
Collaborator

ryanbr commented Jul 9, 2020

Could it be useful for debugging purposes?

@pes10k
Copy link
Contributor

pes10k commented Jul 10, 2020

I think if we'd like to add it for debugging purposes we could think about integrating it with the devtools, but right now, its not doing anything (i.e. that field will always be empty), and if we reported all touches to those APIs there, we'd have an enormous number of false positives. I still vote for removing, but would be a-ok with another follow up issue adding debugging information to the console

@cjwijtmans
Copy link

cjwijtmans commented Jul 12, 2020

I like to keep it. Especially if there are "false-positives", more reason to.

@pes10k
Copy link
Contributor

pes10k commented Jul 20, 2020

@cjwijtmans it will always be empty currently. We don't think we can confidently distinguish FP from actual fingerprinting, which is part of the reason we moved to the farbling / randomization approach for defenses too

@rebron rebron added the priority/P3 The next thing for us to work on. It'll ride the trains. label Aug 21, 2020
@rebron rebron added this to P3 Backlog in General Aug 24, 2020
@pes10k
Copy link
Contributor

pes10k commented Apr 2, 2021

Closing bc we not longer report any fingerprinting information in shields (since the false positive rate is too high to be useful)

@pes10k pes10k closed this as completed Apr 2, 2021
General automation moved this from P3 Backlog to Completed Apr 2, 2021
Shields automation moved this from Untriaged / Incoming to Completed Apr 2, 2021
@rebron rebron removed this from Completed in General Apr 6, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
closed/not-actionable feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields feature/shields/panel Front-end design and functionality of the Shields panel. OS/Desktop priority/P3 The next thing for us to work on. It'll ride the trains. QA/Yes
Projects
Shields
  
Completed
Development

No branches or pull requests

5 participants