Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Farbled HTTP Accept-Language header does not have a q value #24126

Closed
pilgrim-brave opened this issue Jul 19, 2022 · 6 comments · Fixed by brave/brave-core#14235
Closed

Farbled HTTP Accept-Language header does not have a q value #24126

pilgrim-brave opened this issue Jul 19, 2022 · 6 comments · Fixed by brave/brave-core#14235
Assignees
@pilgrim-brave
Labels
feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields OS/Android Fixes related to Android browser functionality OS/Desktop QA Pass - Android ARM QA Pass - Android Tab QA Pass-Linux QA Pass-macOS QA Pass-Win64 QA/Test-All-Platforms QA/Yes release-notes/include
Milestone
1.42.x - Release

Comments

@pilgrim-brave
Copy link

The initial design of Accept-Language farbling specified that, in aggressive anti-fingerprinting mode, the value should always be "en-US,en". However, webcompat testing has since revealed that some frameworks react poorly to the lack of a q value.

Suggest we change the aggressive value to "en-US,en;q=0.9" which matches a Chromium's default behavior for en-US users.
@pilgrim-brave pilgrim-brave self-assigned this Jul 19, 2022
@pilgrim-brave pilgrim-brave added QA/Yes release-notes/include OS/Android Fixes related to Android browser functionality OS/Desktop labels Jul 19, 2022
@pilgrim-brave pilgrim-brave mentioned this issue Jul 19, 2022
Merged
25 tasks
@brave-builds brave-builds added this to the 1.43.x - Nightly milestone Jul 19, 2022
This was referenced Jul 19, 2022
Merged
Closed
@kjozwiak kjozwiak added QA/Test-All-Platforms feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields labels Jul 27, 2022
@kjozwiak
Copy link
Member

The above requires 1.42.81 or higher for 1.42.x verification 👍

@GeetaSarvadnya
Copy link
Collaborator

GeetaSarvadnya commented Jul 28, 2022 •
edited

Verification PASSED on


Brave | 1.42.81 Chromium: 104.0.5112.69 (Official Build) (64-bit)
-- | --
Revision | 7ce2902023c722af8564068e6b26e934b83fd774-refs/branch-heads/5112@{#1213}
OS | Windows 10 Version 21H2 (Build 19044.1826)

Verified test plan from brave/brave-core#14235 (comment). See this comment for note re: Navigation and Sub-resource columns not matching.

Went through the STR/Cases outlined via brave/brave-core#14235 (comment) and ensured that all the cases via https://dev-pages.brave.software/fingerprinting/headers.html were working as per the following:

Before running through the cases, ensured that Brave was restarted so it pulls/starts using the studies from Griffin. Ensured that DisableReduceLanguage:Enabled via brave://version as per the following:

brave://version brave://settings
image image

Went through the following once DisableReduceLanguage:Enabled via brave://version:

Language FP enabled & Block fingerprinting (Default)

  • ensured that the value under Headers matches the first language set via brave://settings/languages

English

Example Example Example
image image image

Kannada

Example Example Example
image image image

Language FP enabled & Allow fingerprinting (Disabled)

English

  • ensured that the value under Headers displays all the languages listed via brave://settings/languages
Example Example Example
image image image

Hindi

  • ensured that the value under Headers displays all the languages listed via brave://settings/languages
Example Example Example
image image image

Language FP enabled & Aggressively block fingerprinting (Aggressive)

  • ensured that the value under Headers always displays en despite the languages listed under brave://settings/languages
Example Example Example
image image image

Also went through the following cases once Prevent sites from fingerprinting me based on my language preferences was disabled via brave://settings/shields

Language FP disabled & Block fingerprinting (Default)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
image image

Language FP disabled & Allow fingerprinting (Disabled)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
image image

Language FP disabled & Aggressively block fingerprinting (Aggressive)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
image image

@LaurenWags LaurenWags added the QA/In-Progress Indicates that QA is currently in progress for that particular issue label Jul 28, 2022
@LaurenWags
Copy link
Member

LaurenWags commented Jul 28, 2022 •
edited

Verified with

Brave | 1.42.81 Chromium: 104.0.5112.69 (Official Build) (x86_64)
-- | --
Revision | 7ce2902023c722af8564068e6b26e934b83fd774-refs/branch-heads/5112@{#1213}
OS | macOS Version 12.5 (Build 21G72)

Verified test plan from brave/brave-core#14235 (comment). See this comment for note re: Navigation and Sub-resource columns not matching.

Went through the STR/Cases outlined via brave/brave-core#14235 (comment) and ensured that all the cases via https://dev-pages.brave.software/fingerprinting/headers.html were working as per the following:

Before running through the cases, ensured that Brave was restarted so it pulls/starts using the studies from Griffin. Ensured that DisableReduceLanguage:Enabled via brave://version as per the following:

brave://version brave://settings
1 2

Went through the following once DisableReduceLanguage:Enabled via brave://version:

Language FP enabled & Block fingerprinting (Default)

  • ensured that the value under Headers matches the first language set via brave://settings/languages

English

Example Example Example
1 2 3

French

Example Example Example
4 5 6

Language FP enabled & Allow fingerprinting (Disabled)

  • ensured that the value under Headers displays all the languages listed via brave://settings/languages
Example Example Example
1 2 3

Language FP enabled & Aggressively block fingerprinting (Aggressive)

  • ensured that the value under Headers always displays en despite the languages listed under brave://settings/languages
Example Example Example
1 2 3

Also went through the following cases once Prevent sites from fingerprinting me based on my language preferences was manually disabled via brave://settings/shields:

Screen Shot 2022-07-28 at 12 15 05 PM

Language FP disabled & Block fingerprinting (Default)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
Capture d’écran 2022-07-28 à 12 30 57 PM Capture d’écran 2022-07-28 à 12 31 10 PM

Language FP disabled & Allow fingerprinting (Disabled)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
Capture d’écran 2022-07-28 à 12 33 34 PM Capture d’écran 2022-07-28 à 12 33 43 PM

Language FP disabled & Aggressively block fingerprinting (Aggressive)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
Capture d’écran 2022-07-28 à 12 35 02 PM Capture d’écran 2022-07-28 à 12 35 12 PM

@LaurenWags LaurenWags added QA Pass-macOS and removed QA/In-Progress Indicates that QA is currently in progress for that particular issue labels Jul 28, 2022
@Uni-verse
Copy link
Collaborator

Uni-verse commented Jul 28, 2022 •
edited

Verification PASSED on Samsung Galaxy S21 using

Brave	1.42.81 Chromium: 104.0.5112.69 (Official Build) (64-bit) 
Revision	7ce2902023c722af8564068e6b26e934b83fd774-refs/branch-heads/5112@{#1213}
OS	Android 12; Build/SP1A.210812.016

Refered to Testing Plan in brave/brave-core#14235 (comment)

Quick Note: As per @pes10k, both of the Navigation and Sub-resource columns don't match which is a bug and expected. This will be fixed in a follow up issue via brave/brave-core#14338 as per @pes10k.

Went through the STR/Cases outlined via brave/brave-core#14235 (comment) and ensured that all the cases via https://dev-pages.brave.software/fingerprinting/headers.html were working as per the following:

brave://version

0

Language FP enabled & Block fingerprinting (Default)

ensured that the value under Headers matches the first language set via brave://settings/languages

Example Example Example
screenshot-1659045736072 screenshot-1659045847376 screenshot-1659045856036

Language FP enabled & Allow fingerprint (Disabled)

ensured that the value under Headers displays all the languages listed via brave://settings/languages

Example Example Example
screenshot-1659038603707 screenshot-1659038630527 screenshot-1659038158234

Language FP enabled & Block fingerprinting (Aggressive)

ensured that the value under Headers always displays en despite the languages listed under brave://settings/languages

Example Example Example
screenshot-1659044932644 screenshot-1659044978559 screenshot-1659043915820

Because Android doesn't have the Prevent sites from fingerprinting me based on my language preferences toggle implemented like desktop, went through the below after disabling brave://flags#brave-reduce-language.

0

Language FP disabled & Block fingerprinting (Default)

ensured that all the languages are being displayed via the Header as Accept-Language has been disabled

Example Example Example
screenshot-1659045974299 screenshot-1659045985033 screenshot-1659045736072

Language FP disabled & Allow fingerprint (Disabled)

ensured that all the languages are being displayed via the Header as Accept-Language has been disabled

Example Example Example
screenshot-1659043852344 screenshot-1659043857831 screenshot-1659038158234

Language FP disabled & Block fingerprinting (Aggressive)

ensured that all the languages are being displayed via the Header as Accept-Language has been disabled

Example Example Example
screenshot-1659045116709 screenshot-1659044978559 screenshot-1659043915820

@Uni-verse Uni-verse added the QA/In-Progress Indicates that QA is currently in progress for that particular issue label Jul 28, 2022
@Uni-verse
Copy link
Collaborator

Uni-verse commented Jul 28, 2022 •
edited

Verification PASSED on Samsung Galaxy Tab S7 using

Brave	1.42.81 Chromium: 104.0.5112.69 (Official Build) (64-bit) 
Revision	7ce2902023c722af8564068e6b26e934b83fd774-refs/branch-heads/5112@{#1213}
OS	Android 12; Build/SP1A.210812.016

Refered to Testing Plan in brave/brave-core#14235 (comment)

Went through the STR/Cases outlined via brave/brave-core#14235 (comment) and ensured that all the cases via https://dev-pages.brave.software/fingerprinting/headers.html were working as per the following:

brave://version

0

Language FP enabled & Block fingerprinting (Default)

ensured that the value under Headers matches the first language set via brave://settings/languages

Example Example Example
screenshot-1659046957085 screenshot-1659046963140 screenshot-1659047024908

Language FP enabled & Allow fingerprint (Disabled)

ensured that the value under Headers displays all the languages listed via brave://settings/languages

Example Example Example
screenshot-1659047418216 screenshot-1659047024908 screenshot-1659047570789

Language FP enabled & Block fingerprinting (Aggressive)

ensured that the value under Headers always displays en despite the languages listed under brave://settings/languages

Example Example Example
screenshot-1659047638966 screenshot-1659047648872 screenshot-1659047024908

Because Android doesn't have the Prevent sites from fingerprinting me based on my language preferences toggle implemented like desktop, went through the below after disabling brave://flags#brave-reduce-language.

0

Language FP disabled & Block fingerprinting (Default)

ensured that all the languages are being displayed via the Header as Accept-Language has been disabled

Example Example Example
screenshot-1659046957085 screenshot-1659047024908 screenshot-1659047301143

Language FP disabled & Allow fingerprint (Disabled)

ensured that all the languages are being displayed via the Header as Accept-Language has been disabled

Example Example Example
screenshot-1659047408367 screenshot-1659047418216 screenshot-1659047024908

Language FP disabled & Block fingerprinting (Aggressive)

ensured that all the languages are being displayed via the Header as Accept-Language has been disabled

Example Example Example
screenshot-1659047648872 screenshot-1659047024908 screenshot-1659048039721

@LaurenWags LaurenWags added QA/In-Progress Indicates that QA is currently in progress for that particular issue and removed QA/In-Progress Indicates that QA is currently in progress for that particular issue labels Aug 1, 2022
@LaurenWags
Copy link
Member

LaurenWags commented Aug 1, 2022 •
edited

Verified with

Brave	1.42.84 Chromium: 104.0.5112.69 (Official Build) (64-bit) 
Revision	7ce2902023c722af8564068e6b26e934b83fd774-refs/branch-heads/5112@{#1213}
OS	Linux

Verified test plan from brave/brave-core#14235 (comment). See this comment for note re: Navigation and Sub-resource columns not matching.

Went through the STR/Cases outlined via brave/brave-core#14235 (comment) and ensured that all the cases via https://dev-pages.brave.software/fingerprinting/headers.html were working as per the following:

Before running through the cases, ensured that Brave was restarted so it pulls/starts using the studies from Griffin. Ensured that DisableReduceLanguage:Enabled via brave://version as per the following:

brave://version brave://settings
Screen Shot 2022-08-01 at 4 00 51 PM Screen Shot 2022-08-01 at 4 13 35 PM

Went through the following once DisableReduceLanguage:Enabled via brave://version:

Language FP enabled & Block fingerprinting (Default)

  • ensured that the value under Headers matches the first language set via brave://settings/languages

English

Example Example Example
Screen Shot 2022-08-01 at 4 16 00 PM Screen Shot 2022-08-01 at 4 16 41 PM Screen Shot 2022-08-01 at 4 16 51 PM

Spanish

Example Example Example
Screen Shot 2022-08-01 at 4 23 34 PM Screen Shot 2022-08-01 at 4 23 43 PM Screen Shot 2022-08-01 at 4 24 00 PM

Language FP enabled & Allow fingerprinting (Disabled)

  • ensured that the value under Headers displays all the languages listed via brave://settings/languages
Example Example Example
Screen Shot 2022-08-01 at 4 27 24 PM Screen Shot 2022-08-01 at 4 29 15 PM Screen Shot 2022-08-01 at 4 29 25 PM

Language FP enabled & Aggressively block fingerprinting (Aggressive)

  • ensured that the value under Headers always displays en despite the languages listed under brave://settings/languages
Example Example Example
Screen Shot 2022-08-01 at 4 27 24 PM Screen Shot 2022-08-01 at 4 27 35 PM Screen Shot 2022-08-01 at 4 27 44 PM

Also went through the following cases once Prevent sites from fingerprinting me based on my language preferences was manually disabled via brave://settings/shields:

Screen Shot 2022-08-01 at 4 45 32 PM

Language FP disabled & Block fingerprinting (Default)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
Screen Shot 2022-08-01 at 4 46 22 PM Screen Shot 2022-08-01 at 4 46 32 PM

Language FP disabled & Allow fingerprinting (Disabled)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
Screen Shot 2022-08-01 at 4 48 07 PM Screen Shot 2022-08-01 at 4 48 14 PM

Language FP disabled & Aggressively block fingerprinting (Aggressive)

  • ensured that all the languages are being displayed via the Header as Accept-Language has been disabled
Example Example`
Screen Shot 2022-08-01 at 4 48 28 PM Screen Shot 2022-08-01 at 4 48 34 PM

@LaurenWags LaurenWags removed the QA/In-Progress Indicates that QA is currently in progress for that particular issue label Aug 1, 2022
@LaurenWags LaurenWags mentioned this issue Aug 2, 2022
Closed
@srirambv srirambv mentioned this issue Aug 3, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@pilgrim-brave pilgrim-brave

Labels
feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields OS/Android Fixes related to Android browser functionality OS/Desktop QA Pass - Android ARM QA Pass - Android Tab QA Pass-Linux QA Pass-macOS QA Pass-Win64 QA/Test-All-Platforms QA/Yes release-notes/include
Projects
None yet
Milestone
1.42.x - Release
Development

Successfully merging a pull request may close this issue.

Add q value to fake accept-language header in max anti-fingerprinting mode brave/brave-core
6 participants
@kjozwiak @Uni-verse @LaurenWags @GeetaSarvadnya @pilgrim-brave @brave-builds