[tbb-bugs] #17423 [Tor Browser]: Look into Yan's browser fingerprinting tricks

Mon Oct 26 00:10:50 UTC 2015

#17423: Look into Yan's browser fingerprinting tricks
---------------------------------+--------------------------------
     Reporter:  arthuredelstein  |      Owner:  tbb-team
         Type:  defect           |     Status:  new
     Priority:  Medium           |  Milestone:
    Component:  Tor Browser      |    Version:
     Severity:  Normal           |   Keywords:  tbb-fingerprinting
Actual Points:                   |  Parent ID:
       Points:                   |    Sponsor:
---------------------------------+--------------------------------
 Yan has a brilliant slide deck on browser fingerprinting, here:
 https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf

 We need to figure out which of these vulnerabilities Tor Browser has, and
 fix them. Do we need to isolate HSTS and HPKP caches to URL bar domain?
 Apparently #1517 (reduce JS time precision) helps protect Tor Browser from
 Yan's implementations, but there may be ways around that limitation.

 There is also a demo here: https://zyan.scripts.mit.edu/sniffly/

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17423>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online