[tor-bugs] #8725 [Firefox Patch Issues]: resource:// URIs leak information

[Tor Bug Tracker & Wiki]

#8725: resource:// URIs leak information
-------------------------------------+-------------------------------------
     Reporter:  holizz               |      Owner:  mikeperry
         Type:  defect               |     Status:  assigned
     Priority:  major                |  Milestone:
    Component:  Firefox Patch        |    Version:
  Issues                             |   Keywords:  tbb-fingerprinting,
   Resolution:                       |  tbb-rebase-regression
Actual Points:                       |  Parent ID:
       Points:                       |
-------------------------------------+-------------------------------------

Comment (by dservos):

 I have been playing around with accessing the js files in resource:// and
 it looks like this issue is a bit worse now that when it was first
 reported. In the proof of concept on marcorondini.eu, it was only checked
 that #tor.js existed. I believe that it could not easily be read in the
 version of tor at the time as there was a few "#" comments at the top
 which caused javascript errors when read using a script tag. However, in
 the current version of tor, the file is now called 000-tor-browser.js and
 can easily be read using a method similar to that used in marcorondini.eu.
 This is rather bad, as 000-tor-browser.js contains the tor browser version
 number, platform and real language. This would let you make a finger print
 that is unique at least to the tor browser version + platform + language
 (maybe even the cpu arch, since there is a 64bit version for Linux).

 I made a simple script on http://cs1.ca/ttest/dump.html witch dumps
 everything that can be read in resource://defaults/. Simply hashing this
 output would make for a good start at a finger print.

 A temporary fix until it can be dealt with upstream might be to put a few
 "#"s at the top of each file. I think they are parsed out the way the
 browser normally reads the files but would cause javascript errors when
 accessed like in the script I posted. Definitely not a permanent solution
 but it might be better than nothing.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8725#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online