Prevent navigator/gecko.buildID leaks

[nodiscc]

https://bugzilla.mozilla.org/show_bug.cgi?id=583181
https://www.browserleaks.com/javascript#comments
http://browserspy.dk/showprop.php

[pyllyukko]

This is definitely a problem, yes. Firefox doesn't seem to respect gecko.buildID or any of the other settings :/

[nodiscc]

I can confirm that changing the *.buildID settings has no effect.

Random Agent Spoofer did not work for me, original Build ID is always visible to https://www.browserleaks.com/javascript

[pyllyukko]

Try now? :)

[nodiscc]

@pyllyukko your fix does not work for me (original buildID still displayed)

@CHEF-KOCH I can confirm that Random Agent spoofer does not affect the Build ID value on the test page for me (all script injection options enabled). I'm trying to locate where the lockPrefs file should reside, http://kb.mozillazine.org/Locking_preferences only describes locking for the Windows platform. I've tried ~/.mozilla/firefox/*/, /usr/share/iceweasel/{pref,profile} without results.

Iceweasel 44.0.2-1 on Debian GNU/Linux stretch/sid

Please reopen?

@fmarier any clue?

[pyllyukko]

Please reopen?

Will do.

[pyllyukko]

@pyllyukko your fix does not work for me (original buildID still displayed)

That's odd.

Iceweasel 44.0.2-1 on Debian GNU/Linux stretch/sid

Seems to work on my Debian 8 + Iceweasel 38.6.1. I wonder what's up?!

[nodiscc]

I will retry with a freshly created profile.

[nodiscc]

Confirmed in newly created profile

$ apt-cache policy iceweasel
iceweasel:
  Installed: 45.0~b5-1
  Candidate: 45.0~b5-1
  Version table:
 *** 45.0~b5-1 700
          1 http://ftp.fr.debian.org/debian experimental/main amd64 Packages
        100 /var/lib/dpkg/status
     44.0.2-1 600
        500 http://ftp.fr.debian.org/debian stretch/main amd64 Packages
        200 http://ftp.fr.debian.org/debian unstable/main amd64 Packages
$ git clone https://github.com/pyllyukko/user.js
$ firefox --no-remote -P #create profile, exit
$ cp user.js/user.js ~/.mozilla/firefox/
$ cp user.js/user.js ~/.mozilla/firefox/*.mynewprofile/
$ firefox --no-remote -P #run with mynewprofile, go to http://browserspy.dk/showprop.php
#page shows buildID 20160214103951

May it be an iceweasel-specific bug? Is someone able to reproduce with Iceweasel/Firefox/another branding?

[pyllyukko]

It works on my Iceweasel (see the User-Agent on the screenshot).

$ apt-cache policy iceweasel
iceweasel:
  Installed: 38.7.0esr-1~deb8u1
  Candidate: 38.7.0esr-1~deb8u1
  Version table:
 *** 38.7.0esr-1~deb8u1 0
        500 http://security.debian.org/ jessie/updates/main amd64 Packages
        100 /var/lib/dpkg/status
     38.5.0esr-1~deb8u2 0
        500 http://ftp.funet.fi/pub/linux/mirrors/debian/ jessie/main amd64 Packages

[nodiscc]

Fixed in Firefox 45.1.0esr-1 in Debian (pref general.buildID.override now actually overrides the buildId)