<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<pre><pre><b>On Sat, 17 Aug 2019 at</b><b> 21:17, Tom Ritter</b> <<a href="mailto:tor-dev%40lists.torproject.org?Subject=Re%3A%20%5Btor-dev%5D%20TBB%20Memory%20Allocator%20choice%20fingerprint%20implications&In-Reply-To=%3CCA%2BcU71%3DPeZGCAJNsPQy9QpKY9%3Dwz3vPdW8QKruF_ZwyanoyYzQ%40mail.gmail.com%3E" title="[tor-dev] TBB Memory Allocator choice fingerprint implications">tom at ritter.vg</a>> wrote:</pre><blockquote type="cite"><pre>On Sat, 17 Aug 2019 at 15:06, <a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev">procmem at riseup.net</a> <<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev">procmem at riseup.net</a>> wrote:
><i> Question for the Tor Browser experts. Do you know if it is possible to
</i>><i> remotely fingerprint the browser based on the memory allocator it is
</i>><i> using? (via JS or content rendering)
</i>
Fingerprint what aspect of the browser/machine?
</pre></blockquote>I'm not really sure (I'm of the opinion it should not matter) and so I'm curious as to what could
be affected if anything.
Some members of our team are divided about making it the default because of unknown consequences
which is what I'm trying to clear up.
<blockquote type="cite"><pre>
><i> We are thinking of switching Tor Browser to use the minimalist and
</i>><i> security oriented hardened_malloc written by Daniel Micay. Thanks.
</i>
I wouldn't advise giving up partitioning for.... what exactly? What
features does this allocator have that 68's jemalloc doesn't?
-tom</pre></blockquote>
So the original suggestion [0] was prompted by past research done by the Tor Browser team for a jemalloc
alternative. [1] Hardened_malloc wasn't around back then so it may be a worthy alternative for you guys to switch to too.
Hardened_malloc has a partitioned heap among many other defenses implemented if I understand their label
correctly (please see "Security properties" section in [2]). Also available on ARM.
[0] <a class="moz-txt-link-freetext" href="https://forums.whonix.org/t/hardened-malloc/7474">https://forums.whonix.org/t/hardened-malloc/7474</a>
[1] <a class="moz-txt-link-freetext" href="https://trac.torproject.org/projects/tor/ticket/10281">https://trac.torproject.org/projects/tor/ticket/10281</a>
[2] <a class="moz-txt-link-freetext" href="https://github.com/GrapheneOS/hardened_malloc">https://github.com/GrapheneOS/hardened_malloc</a>
***
PS. A related debate is on whether we should enable Apparmor and Firejail sandboxing for Tor Browser by default,
but again we don't know if restriction to resources and file paths on the machine is something that is remotely
detectable as an anomaly or not, ruining the fingerprint in the process. Input is appreciated. related thread:
<a class="moz-txt-link-freetext" href="https://forums.whonix.org/t/tor-browser-hardening-hardened-malloc-firejail-apparmor-vs-web-fingerprint/7851">https://forums.whonix.org/t/tor-browser-hardening-hardened-malloc-firejail-apparmor-vs-web-fingerprint/7851</a>
</pre>
</body>
</html>