[tbb-bugs] #26598 [Applications/Tor Browser]: disable User Timing API in ESR60

Tor Bug Tracker & Wiki blackhole at torproject.org
Mon Aug 20 17:45:54 UTC 2018

#26598: disable User Timing API in ESR60
 Reporter:  mcs                                  |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-fingerprinting-time-highres,     |  Actual Points:
  ff60-esr, TorBrowserTeam201808                 |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
Changes (by arthuredelstein):

 * status:  new => needs_review


 I examined the code for setResourceTimingBufferSize(...):
 and for Performance::InsertResourceEntry(...):

 When "privacy.resistFingerprinting" is true, InsertResourceEntry
 shortcuts. Therefore no entries are added, and
 performance.onresourcetimingbufferfull is never called, regardless of any
 past calls to `setResourceTimingBufferSize(unsigned long maxSize)`. So I
 am satisfied that there isn't a fingerprinting vector of supercookie
 mechanism exposed by this API.

Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26598#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

More information about the tbb-bugs mailing list