[tbb-bugs] #17423 [Tor Browser]: Look into Yan's browser fingerprinting tricks

Mon Oct 26 03:29:47 UTC 2015

#17423: Look into Yan's browser fingerprinting tricks
--------------------------------+--------------------------
 Reporter:  arthuredelstein     |          Owner:  tbb-team
     Type:  defect              |         Status:  new
 Priority:  Medium              |      Milestone:
Component:  Tor Browser         |        Version:
 Severity:  Normal              |     Resolution:
 Keywords:  tbb-fingerprinting  |  Actual Points:
Parent ID:                      |         Points:
  Sponsor:                      |
--------------------------------+--------------------------

Comment (by zyan):

 (yan here)

 I am fairly certain that the 301-redirect cache timing attack mentioned at
 the end is not feasible thanks to #1517, at least.

 Note there is an chrome bug for a non-timing HSTS attack that has the same
 fingerprinting impact as Sniffly. I believe it works in Firefox as well.
 https://code.google.com/p/chromium/issues/detail?id=436451#c34

 Chrome fixed it and then reverted the fix because it broke things. TBB
 should probably just copy their original fix.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17423#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online