Fingerprinting 2.0: Plugins (word replacement) #10597

pes10k · 2020-07-07T22:29:51Z

Continuing from #9435

brave/brave-core#5989 completed the bulk of the original issue. This issue is to track the remaining, word-replacement parts of #9435.

Specifically these parts of the previous issue:

word replacements

Chrome: ["Chrome", "Chromium", "Brave", "Web", "Browser", "" (empty string), "OpenSource", "Online", "JavaScript"]
PDF: ["PDF", "Portable Document Format", "portable-document-format", "document", "doc", "PDF and PS", "com.adobe.pdf"]
Plugin: ["Viewer", "Renderer", "Display", "Plugin", "plug-in", "plug in", "extension", "" (empty string)]
Viewer: ["Viewer", "Renderer", "Display", "Plugin", "plug-in", "plug in", "extension", "" (empty string)]

default protection:

Randomize both descriptions of plugins, under eTLD+1 seed, using random selections from the above word replacements
Include two randomly generated plugins, using the above schema

max protection:

Include two randomly generated plugins, using the above schema

Due to the removal of flash, navigator.plugins will always report an empty array from now on, so there's no need for Brave to implement a farbling mechanism for such array any more. Thus, we can now remove all the code added to implement that and drop a couple of patches to upstream's Chromium in the way too. Main related issues in Brave's GitHub: * Fingerprinting 2.0: Plugins brave/brave-browser#9435 * Fingerprinting 2.0: Plugins (word replacement) brave/brave-browser#10597 Chromium change: https://chromium.googlesource.com/chromium/src.git/+/f8fe422e0e8a026f73f9d74d26f75c3c93102030 commit f8fe422e0e8a026f73f9d74d26f75c3c93102030 Author: Mason Freed <masonfreed@chromium.org> Date: Wed Jan 20 18:50:56 2021 +0000 Empty out navigator.plugins and navigator.mimeTypes With this CL, navigator.plugins and navigator.mimeTypes will both return empty arrays. With the removal of Flash, there is no longer the need to return anything for navigator.plugins and navigator.mimeTypes. These APIs were used primarily for a) probing for Flash player support, or b) fingerprinting. As such, we'd like to return empty for these two properties. Gecko already switched to returning *only* Flash starting with Firefox 52, and returning empty as of Firefox 85. I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/bbxAGu90LgM Fixed: 1164635

Due to the removal of flash, navigator.plugins will always report an empty array from now on, so Brave needs to adapt its farbling mechanism to work like this depending on the selected behavior: * "off": return the real navigators.plugins, that is, an empty array. * "balanced" or "maximum": return 2 additional fake plugins. Additionally, we need to adapt the browser tests to account for this new scenario, and test that indeed the expectation of navigator.plugins returning an empty array stays true. Issues in Brave's GitHub related to the implementation of this feature: * Fingerprinting 2.0: Plugins brave/brave-browser#9435 * Fingerprinting 2.0: Plugins (word replacement) brave/brave-browser#10597 Chromium change: https://chromium.googlesource.com/chromium/src.git/+/f8fe422e0e8a026f73f9d74d26f75c3c93102030 commit f8fe422e0e8a026f73f9d74d26f75c3c93102030 Author: Mason Freed <masonfreed@chromium.org> Date: Wed Jan 20 18:50:56 2021 +0000 Empty out navigator.plugins and navigator.mimeTypes With this CL, navigator.plugins and navigator.mimeTypes will both return empty arrays. With the removal of Flash, there is no longer the need to return anything for navigator.plugins and navigator.mimeTypes. These APIs were used primarily for a) probing for Flash player support, or b) fingerprinting. As such, we'd like to return empty for these two properties. Gecko already switched to returning *only* Flash starting with Firefox 52, and returning empty as of Firefox 85. I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/bbxAGu90LgM Fixed: 1164635 GOOD

Due to the removal of flash, navigator.plugins will always report an empty array from now on, so Brave needs to adapt its farbling mechanism to work like this depending on the selected behavior: * "off": return the real navigators.plugins, that is, an empty array. * "balanced" or "maximum": return 2 randomly generated fake plugins. Additionally, we need to adapt the browser tests to account for this new scenario, and test that indeed the expectation of navigator.plugins returning an empty array stays true. Issues in Brave's GitHub related to the implementation of this feature: * Fingerprinting 2.0: Plugins brave/brave-browser#9435 * Fingerprinting 2.0: Plugins (word replacement) brave/brave-browser#10597 Chromium change: https://chromium.googlesource.com/chromium/src.git/+/f8fe422e0e8a026f73f9d74d26f75c3c93102030 commit f8fe422e0e8a026f73f9d74d26f75c3c93102030 Author: Mason Freed <masonfreed@chromium.org> Date: Wed Jan 20 18:50:56 2021 +0000 Empty out navigator.plugins and navigator.mimeTypes With this CL, navigator.plugins and navigator.mimeTypes will both return empty arrays. With the removal of Flash, there is no longer the need to return anything for navigator.plugins and navigator.mimeTypes. These APIs were used primarily for a) probing for Flash player support, or b) fingerprinting. As such, we'd like to return empty for these two properties. Gecko already switched to returning *only* Flash starting with Firefox 52, and returning empty as of Firefox 85. I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/bbxAGu90LgM Fixed: 1164635

pes10k added the OS/Desktop label Jul 7, 2020

pes10k assigned pilgrim-brave Jul 7, 2020

pes10k added feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields privacy privacy-pod Feature work for the Privacy & Web Compatibility pod and removed OS/Desktop labels Jul 7, 2020

pes10k mentioned this issue Jul 7, 2020

Fingerprinting Protections v2: Farbling and cross-origin #8787

Closed

10 tasks

pilgrim-brave mentioned this issue Jul 8, 2020

Implement navigator.plugins name replacement farbling brave/brave-core#6041

Merged

32 tasks

pilgrim-brave closed this as completed in brave/brave-core#6041 Jul 15, 2020

pes10k added QA/No release-notes/exclude labels Jul 16, 2020

pes10k added this to the 1.13.x - Nightly milestone Jul 16, 2020

bbondy added OS/Android Fixes related to Android browser functionality OS/Desktop labels Aug 7, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fingerprinting 2.0: Plugins (word replacement) #10597

Fingerprinting 2.0: Plugins (word replacement) #10597

pes10k commented Jul 7, 2020

Fingerprinting 2.0: Plugins (word replacement) #10597

Fingerprinting 2.0: Plugins (word replacement) #10597

Comments

pes10k commented Jul 7, 2020