notes

[Thorin-Oakenpants]

various notes from the old repo

---

Promises

words of wisdom from kkapsner

That's doable but a better way would be to have eight promises - one for each test. Then you can combine them with Promise.all in all the configurations you need them. Something like this (please use better names!):

var p1 = getWorker1Promise();
...
var p5 = getWorker5Promise();
var p6 = getIframe1Promise();
...
var p8 = getIframe3Promise();

Promise.all([p1, ..., p5]).then(outputWorkerData);
Promise.all([p6, p7, p8]).then(outputIframeData);
Promise.all([p1, ...., p8]).then(combineAndCompareAll);

---

FP scripts

• go to https://github.com/mozilla-services/shavar-prod-lists/blob/master/disconnect-blacklist.json
• search for FingerprintingGeneral

---

WASM

abraham:
There are ways to use WASM to interact with browser APIs, but does WASM make way to create a virtual context or scope? Iframes have their own browsing context/document environment, and Workers have their own global scope/event loop.

Here's an example of canvas fingerprinting in Rust.

• https://drbh.github.io/wasm-fingerprint/
• https://github.com/drbh/wasm-fingerprint/blob/master/src/lib.rs

kkapsner: The timings in the script are too tight for Firefox. If you set a debugger break point at line 441 it works. AND CB is protecting against it!

---

DOMRect / SVG

Links

• getBounds
• MDN getBBox
• MDN getExtentOfChar
• MDN intersectionRect
• boundingClientRect
• MDN rootBounds

Note that source

As of Firefox 76, the IntersectionObserver() constructor now accepts a Document object as its root, as well as an Element object. This lets you explicitly use a window's entire content area as the intersection bounds. We should verify that this does not allow someone to defeat the protections provided by letterboxing (probably it does not)

---

canvas stability

I see changes in some canvas results across FF releases. The hashes that change are

• toDataURL + toBlob (and mozGetAsFile if applicable): they're the same hash
• getImageData

for example: for me on windows

60
==
      3x a5ad50aa3a7411825a4c0b...
getImage e7209e6a032dddcd83f6bb...

61-71
==
      3x 4c406afafa6f85d3f152ea...
getImage 094f27144dd0e3c0a20a14...

72-73
==
      3x 98a30b2999315acb01047a...
getImage 197bbc428ccd88b6a75b3f...

74-76, Beta77, Nightly (the hash changed, not just dropping mozGetAsFile)
==
      2x 3cc435fec7e69a56f50420...
getImage 1230e7b2c39c38540940a5...

Dev77.0b9 (sometimes Beta)
==
      2x 2cc1b50af4dfc47ba1b35b...
getImage 904fc496441e05e2f41d1c...

I wonder what causes these changes

• changes to css/layout or kerning or something: TZP is using Cwm fjordbank glyphs vext quiz, \ud83d\ude03
• I don't think it would be anything in mozilla's actual canvas code: not the way it's jumping around in Beta/Dev

---

widgets

from tom: Had someone look at this, and they had the following to say:

1. "I assume these five items are not widgets? (progress bariframe, image, datetime and text area)" - actually only iframe and image are not technically widgets.
2. Without running a lot of tests himself, he couldn't say off-hand if the CSS is successfully leveling the playing field as asked in the "Help" section.
3. Regarding any other widgets to add: :shorlander put together a comprehensive page with our widgets. You may want to take a look at it: http://stephenhorlander.com/form-controls.html
4. We're working on removing native styling for our widgets and using our own, consistent styling. It would be very interesting to know whether "unstyled" widgets also suffer from fingerprinting issues. You can try this by setting the widgets to "-moz-appearance: none;", which is what :shorlander did on the left side of his page.

---

line breaking

Article: https://www.otsukare.info/2020/08/21/khmer-line-breaking

Can be used to?:

• detect browser: e.g. FF vs others <-- pointless, there are so many other ways to do this
• OS: e.g Khmer on FF doesn't wrap on Android (currently) - see web compat linked below

Pitfalls?

• font availability : see jfkthame's comments at web compat 56316
• zoom: be aware of it, and probably only do the test if isFF (see comments in example below)
• perf

Notes:

• https://github.com/w3c/sealreq/
• Thai, Lao, and Khmer are languages that are written with no spaces between words. Spaces do occur, but they serve as phrase delimiters, rather than word delimiters.
• quote from article (emphasis mine)

  • Line-breaking for SEAsian languages that are written without word spaces (e.g. Thai, Lao, Khmer) is based on calling an operating system API to find potential word-break positions. Hence the results are platform-dependent

example test: https://w3c.github.io/i18n-tests/css-text/line-breaking/exp-km-line-break-000.html

• Windows: FF left, chrome right at 100% zoom
• top and bottom examples don't line-break in FF but do in Chrome
• increase zoom: look at the middle one
  • FF: the single line-break, stays the single
  • chrome: it creates more line-breaks
• 

[Thorin-Oakenpants]

@abrahamjuliot : two questions

q1: is there a better way to do this: rather than rely on a hardcoded count of promises, how would I do a "for each promise" "for each result"

	Promise.all([
		functionA(),
		function99(),
		funtionSomethingElse(), // <-- three promises: but what if I add more
	]).then(function(result){
		for (let i=0; i < 3; i++) {  // <-- I would have to update the < number
			myarray.push(result[i])
		}
		// do stuff with myarray
	})

q2: is there a cleaner way to specify a variable: e.g. compare = chk+i

	if (i == 0) { compare = chk0
	} else if (i == 1) {compare = chk1
	} else if (i == 2) {compare = chk2
	} else if (i == 3) {compare = chk3
	}

-tia

[abrahamjuliot]

q1

let collection = [
    functionA,
    function99,
    functionA
    // add as many as you like
]

Promise.all(
    // compile array with each promise called
    collection.map(function(fn) {
        return fn()
    })
).then(function(result) {
    // for loop
    let len = promises.length
    for (let i = 0; i < len; i++) {
        myarray.push(result[i])
    }

    // or forEach 
    collection.forEach(function(currentValue, index) {
        myarray.push(result[index])
    })
})

q2

I'm terrible at naming variables. It usually takes x number of revisions till I can make sense of it. But, I like starting with a comment on what it holds or what it should do and then my goal is to find a name that makes the comment unneeded. For example, chk1 = [ ] // holds cat and mouse checks could instead be named catMouseChecks.

EDIT: I think I answered the wrong question. Let me try again...

chk+1 converts the array to a string: [1,2,3]+1 == "1,2,31". But, you could use chk[i] format if chk is an object of numeric property names, like chk = { 0: [ ], 1: [ ] }.

let chk = {
	0: [], // access with chk[0]
	1: [],
	2: [],
	3: []
}

if (i == 0) {
    compare = chk[i]
} else if (i == 1) {
    compare = chk[i]
} else if (i == 2) {
    compare = chk[i]
} else if (i == 3) {
    compare = chk[i]
}

// shorter single assignment
compare = (
	i == 0 ? chk[i] :
	i == 1 ? chk[i] :
	i == 2 ? chk[i] :
	chk[i] // i == 3
)

[kkapsner]

DOMRect / SVG

I'm working on that (there are some bugs in the CB code). Stay tuned.

[kkapsner]

Please check the updated test page.

[Thorin-Oakenpants]

Awesome: I've been wanting to dig into this for ages. TB has open tickets about some SVG items. It's all on my ToDo list. So much to do, so little time. Imma just going to keep plodding away getting existing things finished before I add more things: and really dig into your test but it looks exciting 💋 How much entropy is gained would be interesting

[Thorin-Oakenpants]

@kkapsner .. this didn't affect your tests did it? I remember you saying in the old repo something about bugs and MDN documentation not matching

[kkapsner]

No - it was something different. The used classes did not match MDN and the bugs were in CB.

[Thorin-Oakenpants]

@kkapsner I assume there's no point in looking at DOMRectReadOnly vs DOMRect

... anyway .. it says Available in workers in FF69+ ... can that be used to unmask real measurements? .. also @abrahamjuliot (who is always busy)

[kkapsner]

DOMRectReadOnly and DOMRect should behave the same (unless an addon messes with one but forgot the other). In fact DOMRect inherits from DOMRectReadOnly:

it says Available in workers in FF69+ ... can that be used to unmask real measurements?

I don't think so. There is no document in the worker and no rendering of HTML.

[Thorin-Oakenpants]

Thanks

This is what I thought ... a worker runs in a global context which is different from the current window - so I was surprised to see that listed there and wondered if there was some "workaround" like passing a "context" or "element" reference?

unless an addon messes with one but forgot the other

Yup, that was my point. We test things, like iframe access methods .. and whammo, someone forgot something (I see Brave still hasn't patched those iframes with canvas - etc see https://github.com/brave/brave-browser/issues/12453 ).

So if domrect was altered, the "parent" domrectreadonly might not be? We should make a test for that, right?

[kkapsner]

We should make a test for that, right?

Should be easy enough.

[Thorin-Oakenpants]

@kkapsner It's going to take me a while before I get around to the SVG and other "domrect" stuff, but I had a sneaky thought about css aspect-ratio ...

not sure what it could be used with, and I'm yet to try .. but I'm thinking this could be used to generate boxes with known decimals to detect spoofing - it's on my massive ToDo list, but I just thought I'd throw this idea at you

[kkapsner]

I think it will behave similar to a height or width set with decimals: up to certain precision the browser will match that but will do other numbers beyond it.

[Thorin-Oakenpants]

Yeah, it's in my notes: I was thinking I could force something like 1/3 and the result should be 1.3333333333 or whatever, but it may depend on the limitations of the API (not the measuring one) and variables such as pixel snapping, rounding, devicePixelRatio/subpixels, zoom/css-devicePixels (I think I could work around this) .. just something devious I thought about last night as I went to sleep

[abrahamjuliot]

I leave it unsorted. Moving Event is nice workaround for the console issue. There might also be a number of prefs that remove/add properties and/or change the order, and sorting might not handle these. I've noticed a change in these modes:

• RFP
• TB Safer Security Level
• Dev tool device simulation (responsive design mode)

[abrahamjuliot]

I think sorting is good to handle the console issue. We could capture both and then leave the unsorted in the loose fingerprint.

[abrahamjuliot]

responsive design mode

It's the tiny phone/tablet icon in the console menu (or ctrl+shift+M).

[Thorin-Oakenpants]

good article - https://www.otsukare.info/2022/10/25/css-values-definitions - @abrahamjuliot FYI