New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

meta: tor uplift: privacy.resistFingerprinting #7

Open
Thorin-Oakenpants opened this Issue Feb 18, 2017 · 46 comments

Comments

Projects
None yet
@Thorin-Oakenpants
Member

Thorin-Oakenpants commented Feb 18, 2017

Use this ticket to discuss and track privacy.resistFingerprinting

Last updated: see changelog at foot (regularly cleaned out)

RESOLVED & ADDED TO USER.JS if applicable

🔻 FF41

  • 418986 enable privacy.resistFingerprinting (limit window.screen & CSS media etc)
    // user_pref("privacy.resistFingerprinting", true);

🔻 FF50

  • 1281949 spoof screen orientation
  • 1281963 hide the contents of navigator.plugins and navigator.mimeTypes
    • FF53: 1324044 fixes GetSupportedNames in nsMimeTypeArray and nsPluginArray

🔻 FF55

  • 1330890 spoof timezone as UTC 0
    • FF58: 818634 deprecates Date.toLocaleFormat
    • FF60: 1409973 fixes Date.toLocaleDateString and Intl.DateTimeFormat
  • 1330882 new window sizes to round to hundreds & override prefs
    // user_pref("privacy.window.maxInnerWidth", 1600);
    // user_pref("privacy.window.maxInnerHeight", 900);
  • 1360039 spoof navigator.hardwareConcurrency as 2
  • 1217238 reduce precision of time exposed by javascript

🔻 FF56

  • 1369303 spoof/disable performance API
  • 1333651 & 1383495 & 1396468 spoof navigator API
    • FF57: 1393283 spoof as ESR instead of 10s
    • FF59: 1415488 UA leaks over HTTP CONNECT method - fixed as a result of 1419771
    • FF59: 1404608 do not lie about OS (limit to Windows, OSX, Android, or Linux)
    • FF59: 1418672 due to ESR being out of whack and Aurora/Nightly sometimes being ahead of ESR releases, the value is now temporally hardcoded to 52
    • FF60: 1418162 ESR algorithm fixed for 60+7's
  • 1369319 disable device sensors
  • 1369357 disable site specific zoom
  • 1337161 hide gamepads from content
  • 1372072 spoof network information API as "unknown"
  • 1372069 block geolocation requests
    • FF63: 1441295 reverted: RFP no longer blocks geo
  • 1333641 disable WebSpeech API

🔻 FF57

  • 1369309 spoof media statistics
  • 1382499 reduce screen co-ordinate fingerprinting in Touch API
  • 1217290 enable fingerprinting resistance for WebGL
  • 1382545 reduce fingerprinting in Animation API
  • 1354633 limit MediaError.message to a whitelist
  • 1382533 enable fingerprinting resistance for Presentation API
  • 1384330 disable mozAddonManager Web API
    // user_pref("privacy.resistFingerprinting.block_mozAddonManager", true);

🔻 FF58

  • 967895 prompt (site permission) before allowing canvas data extraction
    • FF59: 1413780 when RFP=true include canvas in site permissions panel
    • FF59: 1376865 reduce canvas prompt fatigue by only prompting when user initiated (controlled by a temp pref privacy.resistFingerprinting.autoDeclineNoUserInputCanvasPrompts )
    • FF61: 1412961 RFP breaks extensions using canvas eg Screenshots:
    • until then, you can open about:debugging>Add-ons, click the extension's manifest.url and on that page, right click >View Page Info>Permissions and set a canvas exception

    • FF62: 1453916 Fixes more extension + canvas issues
  • 1397611 extensions can control privacy.resistFingerprinting
  • 1424341 Timing: meta ticket on RFP timing and prefs used for testing [not added to user.js]
    // privacy.reduceTimerPrecision
    // privacy.resistFingerprinting.reduceTimerPrecision.microseconds

🔻 FF59

  • 1372073 spoof/block fingerprinting in MediaDevices API
  • 1039069 warn when language prefs are set to non en-US
    • privacy.spoof_english (pref is used internally AFAICT, we should not meddle with it)
    • at this stage the pref has not been added to the user.js, but the bugzilla has
  • 1222285 spoof keyboard events and suppress keyboard modifier events

🔻 FF60

  • 1337157 disable WebGL debug renderer info (see 2011)

🔻 FF62

  • 1459089 [Firefox for Android] HTTP Accept-Language header no longer leaks OS locale

🔻 FF64

  • 1363508 spoof/suppress Pointer Events

FOLLOWUPS & BUGS to RFP patches

  • 1377744 UTC spoof: should not affect extensions
  • 1426232 UTC spoof: create timezone spoof site permission when RFP=true (similar to canvas, default deny, allow exceptions)
  • 1462115 UTC spoof affects native file picker
  • 1394448 UA spoof: breaks AMO 💡 you can still install extensions
    • drag the + Add to Firefox button to the urlbar
    • right click the + Add to Firefox button and open in a new tab
      • may fail with a message "Firefox prevented this site from asking you to install software on your computer" in which case just refresh the new tab
  • 1433676 UA spoof: sub document UA issues
  • 1422862 Canvas: OffscreenCanvas doesn't respect Canvas Permission Prompt
  • 1422890 Canvas: more tests needed
  • 1429865 Canvas: pref for canvas default permission
  • 1418537 Window: bookmark toolbar issues in FF57+
  • 1428331 Window: HiDPI & RFP
  • 1433815 Window: EnableOrientationChangeListener
  • 1450401 Window: mozFullScreen leaks real screen res
  • 1448423 Window: browser.startup.blankWindow reveals RFP maximizing step
  • 1450398 RFP should not affect Extensions

PENDING

  • 1233846 Webspeech API further anti-FP'ing (follow up to further harden 56+ patch 1333641)
  • 1336208 bundle & whitelist fonts
  • 1358149 Audio FP'ing
  • 1369299 disable GeoIP/RegionDefault searches
  • 1397994 CSS line-height reveals platform
  • 1397996 scrollbar thickness reveals platform
  • 1401440 split RFP into multiple options
  • 1403747 warn on maxmize
  • 1404017 option to restrict RFP to PB mode
  • 1407366 dynamically round viewpoint dimensions
  • 1409269 OS leaks over TCP/IP FP'ing
  • 1428033 mitigate fingerprinting with WebGL
  • 1428034 mitigate WebGL's readPixels (kind of a Canvas thing)
  • 1433350 disable windows user data collection
  • 1436226 hardcode VP8/VP9 algorithm choice
  • 1449732 WebRTC: do not expose local IP (media.peerconnection.ice.no_host)
  • 1461454 RFP -> canPlayType and Media Capabilities APIs
  • 1466025 RFP + DNT
  • 1466148 WebRTC leaks IP even when camera/mic permissions are not granted
  • NOTE: with 1472618 FF63+ navigator.platform returns "Win32", even on Win64 OS, so now RFP is at odds
    • this does not affect the entropy of the RFP set, but the UA may need to be revisted
  • 1472808 spoof Keyboard Layout according to content locale
  • 1485249 disable some WebGL stuff with RFP
  • 1485258 when privacy.spoof_english is true, don't reveal locale by charset fallback
  • 1485264 enforce dom.event.highrestimestamp.enabled=true
  • 1485266 enforce ui.use_standins_for_native_colors=true (2618)
  • 1485280 SpeechRecognition: enforce media.webspeech.recognition.enabled=false
  • 1492766 pointerEvent.pointerid

INVALID / WONTFIX / DUPLICATE

  • 1369327 disable reader view
    • After investigation & legacy code removal, it was confirmed that there are no FP issues here
  • 1369328 popup windows open in new tabs
    • It is felt that this is covered by new windows being rounded
  • 1308340 checkbox in about:preferences#privacy for privacy.resistFingerprinting
  • 1364261 UTC timezone spoof: make optional
    • see 1401440 (split RFP)
  • 1431909 Canvas: separate canvas from RFP
    • see 1401440 (split RFP)
  • 1364398 Window Rounding: resizing doesn't handle multiple windows on start
  • 1392844 ensure that Stylo respects privacy.resistFingerprinting
    • ^^ nothing needed to be done
  • 1466027 UA spoof: Dev/Beta/Nightly spoofs next ESR too early
    • ^^ WONTFIX, as this means code designed for stable would not get tested before stable
    • it could have been stuck behind a hidden pref, but not my call. I guess Nightly/Dev/Beta users will be more unique for one or two releases per ESR cycle
  • 1485268 Reader View (again!) invalid
  • 1333933 disable/spoof fingerpintable features
    • original ticket for flipping prefs, kept around for the info/lists. no longer needed

CHANGELOG

  • Aug 02: 1466027 (UA spoof & Dev/Beta/Nightly) moved from followups → wontfix
  • Aug 21: 1485249 (WebGL) → pending
  • Aug 21: 1485258 (charset), 1485264 (highrestime), 1485266 (native colors), 1485268 (reader view), 1358149 (audio FP), 1485280 (speech recognition) → pending
  • Aug 24: 1485268 (reader view), 1333933 (original privacy pref flipping ticket) → invalid
  • Aug 24: 1472808 (spoof keyboard based on locale), 1407366 (dynamically round viewport) → pending
  • Aug 24: 1462115 (UTC+filepicker) → followups
  • Sep 08: 1448423 (go read the bug) → followups
  • Oct 10: 1363508 (pointer events) → 64+
  • Oct 20: 1492766 (pointerEvent.pointerid) → pending

...

@Thorin-Oakenpants Thorin-Oakenpants changed the title from meta: privacy.resistFingerprinting to meta: tor uplift: privacy.resistFingerprinting Feb 19, 2017

Thorin-Oakenpants pushed a commit that referenced this issue Feb 19, 2017

Roman-Nopantski
removed tor uplift investigation section
I have created three issues for tracking items of interest from the tor uplift: #7 `resistFingerprinting`, #8 `FPI` and #15 `the rest`
@Atavic

This comment has been minimized.

Atavic commented Jun 26, 2017

@Thorin-Oakenpants A different UTC has no breakage, only drawback is that a recent post - like this comment - is listed as posted 9 hours ago, in my case.

@Atavic

This comment has been minimized.

Atavic commented Jun 27, 2017

@Thorin-Oakenpants

Amirite?

Yep. Timestamps start from your PC.

On Twitter I got messages posted some hours in the future!

@Atavic

This comment has been minimized.

Atavic commented Jul 19, 2017

Window.innerWidth:

Width (in pixels) of the browser window viewport including, if rendered, the vertical scrollbar.

There's a Screen Resolution Spoof script for Greasemonkey.

You can test it on Resolution Inspector page.

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Jul 20, 2017

@Atavic A GM script will not cover all methods to determine measurements (css, js, and more) of multiple items (screen, browser, innners etc). using the gm script will simply fuck everything up and raise your entropy

@earthlng earthlng referenced this issue Aug 7, 2017

Closed

sticky: add-ons #12

@share3141

This comment has been minimized.

share3141 commented Aug 8, 2017

I have completely removed CTR - in fact all legacy extensions except NoScript, Ublock Origin, HTTPS Everywhere, and Umatrix.
I do not have any .CSS files.
My issue appears to be similar to the above - some pixels are being trimmed off the top.
I have set the properties of FF (desktop icon) to open "maximized" and the menu bar is almost invisible it is up so high on the screen.
When I change the properties of FF to open "normal" and then maximize the screen everything looks ok.
I know it has something to do with the entries in user.js (THANK YOU VERY MUCH) because I have built a new profile and left out the user.js file and no issues appear. I also introduced the user.js gradually to the new profile by copying sections of my other profile (user.js) to try and narrow down the issue. No luck - I can't seem to figure out where it breaks.
The privacy.window.max
settings are commented out and do not appear in the pref.js. It first appeared in FF 55 beta and now appears in FF 56 beta. It's not fatal behavior but it bugs me!

@share3141

This comment has been minimized.

share3141 commented Aug 8, 2017

Well isn't this special!
I tried option #1 and no luck.
Option #2 took care of the problem.
One - thank you.
Two - what are the consequences of not having privacy.resistFingerprinting set to "True"?

@share3141

This comment has been minimized.

share3141 commented Aug 8, 2017

I have my task bar at the top...(I'm a very old former Apple user and never got out of the habit). I'm trying - I dual boot with Linux and I haven't moved the task bar to the top.

@share3141

This comment has been minimized.

share3141 commented Aug 8, 2017

Option 2 seems to resolve the issue but of course creates another one - privacy.resistingFingerprinting isn't set. I did move the taskbar to the bottom and did option #1 and #3 again. No change. Not fatal - just an extra click. At least I know know what is causing it so that makes me feel better. Thanks for your time.

@earthlng

This comment has been minimized.

Member

earthlng commented Aug 9, 2017

With privacy.resistingFingerprinting=true you're not supposed to use a maximized window

@share3141

This comment has been minimized.

share3141 commented Aug 9, 2017

I was unaware that with privacy.resistingFingerprinting=true you're not supposed to use a maximized window. Where is that info? So much to learn!

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Aug 9, 2017

Sorry @share3141 - that should be painfully aware. If it is trying to set your inner windows to round hundreds, it cannot conform to a maximized state because it has to resize the browser window - in a maximized state the browser window cannot be resized

Edit: didn't my tests say to open in a normal window? i.e not maximized.

  1. Don't open "maximized".
@earthlng

This comment has been minimized.

Member

earthlng commented Aug 9, 2017

I was unaware that with privacy.resistingFingerprinting=true you're not supposed to use a maximized window. Where is that info?

The 2nd [NOTE] under 418986 in 2699 (atm here)

What's described there is no longer very useful for FF55+ because you'd have to re-do it over and over again whenever you start FF (or even when opening a new window? I'm not sure - ESR user here xD)
Instead you can now use the 2 prefs under 2699b or try to learn to live with 1000x1000 ;)

@Thorin-Oakenpants I think we should definitely keep that info available for ESR users btw

@Theemim

This comment has been minimized.

Collaborator

Theemim commented Aug 9, 2017

My feeling is that it is a mistake for Mozilla to remove, or otherwise not support, individual prefs which can be used to control the same things that resistFingerprinting can. Because there are cases where enabling things with fingerprinting potential makes sense and could (should) be controllable on a per site basis. For example, fingerprinting is used by some banks and other orgs to recognize the devices you log in from. Without granular control, a user running into any problems at any important site (even one that may not be doing or abusing fingerprinting) will disable resistFingerprinting and lose all protections? I mean if Mozilla continues down this path. Am I missing something?

@2glops

This comment has been minimized.

Collaborator

2glops commented Aug 10, 2017

In 2699, the advise to use window.resizeTo should not be removed ?
With resistFingerprinting set to true, using window.resizeTo works, but only for the session. The setting is not persistent after restart.
2699a give the needed information for resizing the browser window.

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Aug 10, 2017

Nah. The info in the section header should stay 1) good info 2) ESR users 3) The 2699b explains what happens after 55+. I do not wish to duplicate info in 2699b, plus it does not belong there as people shouldn't be resizing FF55+ (but can tweak their new window sizes somewhat with the two privacy.window.maxInner prefs)

set new window sizes to round to hundreds .. let me emphasize that a little ... "set NEW WINDOW sizes...". Clearly when you start FF you create a new window. Any manually resizing is not meant to be persistent.

@ArchangeGabriel

This comment has been minimized.

ArchangeGabriel commented Aug 13, 2017

Well, I use Firefox in maximized windows all the time, so this might not be for me…

On Panopticlick, with resistFingerprinting:
Screen Size and Color Depth | 14.76 | 27658.0 | 1920x944x24
Time Zone | 3.91 | 15.07 | 0
Platform | 1.28 | 2.43 | Win32
User Agent | 10.11 | 1104.11 | Mozilla/5.0 (Windows NT 6.1; rv:50.0) Gecko/20100101 Firefox/50.0

Without:
Screen Size and Color Depth | 2.3 | 4.93 | 1920x1080x24
Time Zone | 2.08 | 4.22 | -120
Platform | 3.18 | 9.07 | Linux x86_64
User Agent | 13.87 | 14950.38 | Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0

And I’m not fond of switching my platform to Win32, even if it’s far less identifying obviously. So I would prefer a way to just change the UA to latest release instead of Nightly. I guess I can only go for manually editing it?

@ArchangeGabriel

This comment has been minimized.

ArchangeGabriel commented Aug 13, 2017

My problem with the OS is that this would be lying a lot and as you said in #195, very likely to create a mismatch.

Regarding windows size, I now understand thanks to your edit. It’s annoying to have to ask Firefox to go maximized each time I launch it though…

In the end I get that for now, resistFP makes me an outlier because of the mismatch it might causes. But once more people will use it (thanks to being more easily discoverable and the default in PB), it will makes me one of the many person with the same mismatches, while other settings not subjects to mismatch will be spoofed to a common value.

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Nov 14, 2017

** 1372073 - spoof/block various media device fingerprints (FF59+)

^^ not moved to resolved yet in first post yet. the ticket says the component is "WebRTC: Audio/Video" but I think this may covers more than WebRTC - I just want to get the wording right. Don't get me wrong, come FF59, we will be choosing to keep WebRTC disabled. Also note there is a new permissions UI for camera/mic with site exceptions in 57+. Earthlng or someone, can you give me some feedback on this - https://bugzilla.mozilla.org/show_bug.cgi?id=1372073

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Nov 15, 2017

bump again when we get close to 59

Awww man .. that ruins my workflow/methodology. The ticket just closed -> time to edit first post and add to js -> no longer have to deal with it, no need for reminders. Diffs for releases is the other trigger point, if I remember.

We can refine it in 59 diffs in we remember: went with
spoof/block fingerprinting in MediaDevices API

Ref: https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices - I am no expert, but this is not just WebRTC - i.e WebRTC is the component for zilla's chat thing. MediaDevices is more than that.

@Atavic

This comment has been minimized.

Atavic commented Nov 20, 2017

MediaDevices is a different API but a tool like WebRTC JavaScript library implements the Mediadevices API into WebRTC.

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Dec 21, 2017

FYI: if you were wondering about 1422862 Canvas: OffscreenCanvas doesn't respect Canvas Permission Prompt under the followups section ... OffscreenCanvas is not even enabled in FF - it is behind a pref which is default false anyway

/* 2028: disable offscreen canvas
 * [1] https://developer.mozilla.org/docs/Web/API/OffscreenCanvas ***/
user_pref("gfx.offscreencanvas.enabled", false);
@jawz101

This comment has been minimized.

jawz101 commented Jan 24, 2018

One thing that prevents me from using fingerprinting on Firefox for Android is the screen resolution thing. It makes no sense to blow a webpage up to full resolution when there's no way my mobile phone will display it properly. If the pref would disable that particular identifier if it's a mobile version of Firefox it would make so much more sense.

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Jan 24, 2018

@jawz101 The UA spoof I believe causes desktop pages to be served. FF59+ should fix this as it stops trying to hide Android as the platform. I actually wouldn't use this on mobile yet

@aesthicc

This comment has been minimized.

aesthicc commented Jan 26, 2018

Would it be possible to include a version of the user.js that has privacy.resistFingerprinting set to false? I did the setup in my user-overrides.js, I just think i might miss changes made in the future. Just an idea for ease of use.
Edit: or another idea that might be a bit over the top: Developing an application that generates a user.js file. With preset loading/saving

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Jan 26, 2018

Not interested in creating an app - too much work.

As for the privacy.resistFingerprinting (RFP), it is just ONE pref (ok, and some for windows sizes if you want that, and that mozAddonManager one - but they're all inactive), so if you do not want to use RFP, then its one line in your overrides section. That's about as simple as it gets.

/* My Overrides ***/
user_pref("privacy.resistFingerprinting", false); // 4501: i am not ready for RFP
// reminder on updates to re-enable the 4600 section **IMPORTANT**

I know there are a ton of things that are covered under RFP, and more to come, but its still one pref. Nothing to miss except keeping up to date with what RFP covers - which is what this sticky issue is for, as well as the ever-growing list of items in the user.js 4500 section header

Also be aware that if you do not want RFP, then you can also flip section 4600 on by changing one character (eg to get back some timing attack mitigations, etc), although the whole section is inactive BUT you would have already applied it (assuming it the section was previously enabled), except anything new moved there sine your last update (but these also would have been in their original state prior to being moved there).

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Mar 1, 2018

@overdodactyl the bug you want to tell these people here ( https://www.reddit.com/r/firefox/comments/80yqnx/google_apps_privacyresistfingerprinting_problems/ ) is this one

1433592 Keyboard: don't spoof/suppress CTRL key (regression from 1222285 FF59+)

@overdodactyl

This comment has been minimized.

Collaborator

overdodactyl commented Mar 1, 2018

Thanks Pants! Just passed along the info :)

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Mar 1, 2018

@overdodactyl Why can people not learn to read. Marked solved as follows

OP on reddit

EDIT: Exceptions on a per-site basis are not currently possible, due to this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1433592). However, RFP will be opened to the Privacy API, so extensions like uBO should be able to utilize it.

The bug linked is about reverting the breakage that the CTRL key causes due to the keyboard FP mitigation in 1222285. It has nothing to do with the Privacy API & extensions .. which is already available in 58 (its right there in the first post in this issue, if you want the bugzilla). The privacy API is not a solution anyway, because it's a global switch (what if you load a dozen sites at once or session restore a 100 tabs etc). The solution for RFP (which is not ready yet for the masses) is to reduce some of the breakage, patch holes, test like crazy, maybe do some studies, add to PB mode as a trial .. and maybe add a UI setting.

@overdodactyl

This comment has been minimized.

Collaborator

overdodactyl commented Mar 1, 2018

Hmm ya, I either wasn't clear with what I said or it was misinterpreted a bit.

After linking the ctrl bug I proposed possibly using a different profile for google apps if the bug was preventing them from keeping RFP on. The mention of the privacy API being able to use it was more of a suggestion towards, in the future, uBO and other extensions might be able to quickly turn it on/off.

I agree it's not a solution, but if someone's not willing to keep RFP on because of a bug like this, it's a reasonable alternative in an isolated profile to be able to quickly toggle it on/off as needed.

@Thorin-Oakenpants

This comment has been minimized.

@overdodactyl

This comment has been minimized.

Collaborator

overdodactyl commented Mar 7, 2018

Just did, thanks :)

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Mar 22, 2018

Interesting roapmap: https://wiki.mozilla.org/Firefox/Roadmap

Webrender: aimed at FF64
Privacy Stuff: aimed at end of Q3 - so probably FF63 will get a UI for RFP

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Oct 25, 2018

@earthlng 1501875 - does this affect RFP?

@earthlng

This comment has been minimized.

Member

earthlng commented Oct 25, 2018

not sure what you mean by "affect" but I just tested with a japanese FF63 and the string in the brackets is in japanese characters even with RFP enabled.
They have a test for this but that test most likely only ever runs on en-US versions and therefore they didn't notice the problem.

@Thorin-Oakenpants

This comment has been minimized.

Member

Thorin-Oakenpants commented Oct 25, 2018

It won't affect TBBv8 because it's a very recent change/regression. Comment 3 lists options. If they don't suppress leaking locale via this, then RFP will need to do so. At the moment RFP advises you should be using en-US (warns you otherwise). I'm not savy enough to work this stuff out, but I swear locale is leaked in more places (eg via formatting)

@earthlng

This comment has been minimized.

Member

earthlng commented Oct 25, 2018

correction!
during testing a prompt came up at one point asking me this:

言語設定を英語に変更すると、個人情報の特定がより難しくなりプライバシーが強化されます。英語版のウェブページを表示しますか?

Obviously I had no idea what that means and clicked the button which I assumed would be "cancel" because I thought it's something Activity-Stream or telemetry related.

Turns out this translates to

Changing the language setting to English will make it more difficult to identify your personal information and enhance your privacy. Do you want to view the English version of the webpage?

and was triggered by me enabling RFP. Clicking the other non-cancel button and testing again shows that RFP then spoofs the timezone string correctly in english as (Coordinated Universal Time)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment