[tor-bugs] #15646 [Tor Browser]: KeyboardEvent may allow fingerprinting of keyboard layout

[Tor Bug Tracker & Wiki]

#15646: KeyboardEvent may allow fingerprinting of keyboard layout
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:  arthuredelstein
  cypherpunks            |     Status:  needs_revision
         Type:  defect   |  Milestone:
     Priority:  major    |    Version:
    Component:  Tor      |   Keywords:  ff38-esr, tbb-fingerprinting, tbb-5
  Browser                |  .0a-highrisk, TorBrowserTeam201508,
   Resolution:           |  GeorgKoppen201507R
Actual Points:           |  Parent ID:
       Points:           |
-------------------------+-------------------------------------------------

Comment (by arthuredelstein):

 Replying to [comment:32 gk]:
 > Replying to [comment:31 arthuredelstein]:
 > > Replying to [comment:29 gk]:
 > > > I am getting
 > > > {{{
 > > > event = keydown
 > > > key = |
 > > > charCode = 0
 > > > which = 220
 > > > code = Backslash
 > > > keyCode = 220
 > > > location = 0
 > > > altKey = false
 > > > ctrlKey = true
 > > > metaKey = false
 > > > shiftKey = true
 > > > }}}
 > > > with 5.0a4.
 > >
 > > Interesting. What keys are you actually pressing to get this result?
 And what OS is this?
 >
 > Windows 7 and I press Right ALT + "<".

 I think I understand what's happening now: on your keyboard, the Right Alt
 key is being interpreted as an [https://en.wikipedia.org/wiki/AltGr_key
 AltGr key], which is
 [https://en.wikipedia.org/wiki/AltGr_key#Control_.2B_Alt_as_a_substitute
 often emulated with Ctrl+Alt]. It seems Windows or Firefox is doing the
 inverse substitution by re-interpreting AltGr as Ctrl+Alt.

 So if this understanding is correct, it means that if you use the Left Alt
 key instead, you should get `ctrlKey = false`. Is that what you see?


 If so, then I will look into how to suppress this Ctrl signal when the
 Right Alt key is pressed.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15646#comment:33>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online