[tor-bugs] #9268 [Tor Browser]: Resizing the browser window does not take size of taskbars and DPI into account

[Tor Bug Tracker & Wiki]

#9268: Resizing the browser window does not take size of taskbars and DPI into
account
-------------------------+-------------------------------------------------
     Reporter:  gk       |      Owner:  mikeperry
         Type:  defect   |     Status:  needs_review
     Priority:  major    |  Milestone:
    Component:  Tor      |    Version:
  Browser                |   Keywords:  tbb-fingerprinting, tbb-helpdesk-
   Resolution:           |  frequent, MikePerry201406R, tbb-firefox-patch
Actual Points:           |  Parent ID:
       Points:           |
-------------------------+-------------------------------------------------

Comment (by joebt):

 > ''1000=200*5, and 800=100*8. The multipliers don't have to be the same
 for width and height.''

 That's not the mathematical meaning of:

 > ''Right now, we set the size of new Tor Browser windows such that their
 content area is **'''a'''** 200x100 multiple.''

 Mike said, "__'''* A *''' multiple__," not "multiple'''S'''."  I took him
 at his word, since he's a learned person.

 "'''''* A * multiple''' of '''200x100'''''" - means they go together.
 e.g., 400x200, 1000x500.

 "''Multiple__'''S'''__ of 200(W) *'''AND'''* 100(H)''" means different
 factors can be used w/ each.

 What does it matter how it was written?  Because they don't ever mean the
 same thing.

 If they can have __different__ multipleS, then it should say "''multipleS
 of 200 and 100 (h x w)''."  Which one did you mean, Mike?

 Thanks for tip on about:config, but w/o testing & approval by Tor devs, I
 probably won't make changes w/o knowing all of the exact effects they
 have.  I could test, but what would your example of inner height = 700
 actually prove?

 I only used JS because the Browser Spy (& other) test sites can't get
 screen size unless JS is enabled.

 That brings up the other issue (which is huge).  Most websites don't work
 fully w/o JS enabled; __many not at all__.  Maybe a text-only blog does.
 So unless just going to a buddie's site to pick up your next instructions
 (a non-js site), many users have to enable JS or just not use most sites;
 certainly not fully use them.

 I'm pretty sure Tor devs know this.  That's why JS is enabled in TBB by
 default in NS.  Don't get me wrong - I keep it off by default.

 I'd guess there are 2 main views of Tor devs on JS in TBB:

 1) If we don't enable JS, much of the net is unusable (making a browser
 pointless).  And ? with all the other anonymity features of TBB & Tor,
 it's not the end of the world.

 2) Much of the net is unusable w/o JS and leaving it enabled will allow
 users to be identified.  But, we don't care, as long as we don't have to
 listen to whining.

 Since I seriously doubt it's the latter (or anything like it), there must
 be a good explanation why JS is enabled.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9268#comment:82>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online