[tor-bugs] #3323 [TorBrowserButton]: Revisit WebGL

[Tor Bug Tracker & Wiki]

#3323: Revisit WebGL
-------------------------------------------------+--------------------------
 Reporter:  mikeperry                            |          Owner:  mikeperry                    
     Type:  defect                               |         Status:  new                          
 Priority:  major                                |      Milestone:  TorBrowserBundle 2.3.x-stable
Component:  TorBrowserButton                     |        Version:                               
 Keywords:  tbb-fingerprinting, MikePerry201206  |         Parent:                               
   Points:                                       |   Actualpoints:                               
-------------------------------------------------+--------------------------

Comment(by mikeperry):

 Replying to [comment:1 mikeperry]:
 > The API calls that concern me for fingerprinting issues are:
 >   getParameter() specifically RENDERER, VENDOR, VERSION, and VIEWPORT.

 This is implemented in WebGLContext::GetParameter(). It appears that
 RENDERER, VENDOR, and VERSION are all actually Mozilla strings. I should
 double-check these things aren't available elsewhere, too.

 "Minimal mode" appears to apply to this GetParameter() function
 (specifically the parameters surrounding texture, buffer, vector and
 vertex attribute sizes), and is exported as
 WebGLContext::MinCapabilityMode(). It looks like it in fact can serve to
 defend against normalizing some fingerprintable attributes. It is also
 used in WebGLContext::InitAndValidateGL() for the setting same values as
 member variables there.

 The VIEWPORT is not governed by minimal mode.

 >   getSupportedExtensions() and getExtension()

 These two are in fact fully disabled by webgl.disable_extensions, which
 has no other effect atm.

 >   getContextAttributes() mostly for the display depth..

 Not governed by minimal mode.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3323#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online