[tor-bugs] #15646 [Tor Browser]: KeyboardEvent may allow fingerprinting of keyboard layout
Tor Bug Tracker & Wiki
blackhole at torproject.org
Mon Aug 3 16:20:29 UTC 2015
#15646: KeyboardEvent may allow fingerprinting of keyboard layout
-------------------------+-------------------------------------------------
Reporter: | Owner: arthuredelstein
cypherpunks | Status: needs_revision
Type: defect | Milestone:
Priority: major | Version:
Component: Tor | Keywords: ff38-esr, tbb-fingerprinting, tbb-5
Browser | .0a-highrisk, TorBrowserTeam201508,
Resolution: | GeorgKoppen201507R
Actual Points: | Parent ID:
Points: |
-------------------------+-------------------------------------------------
Comment (by arthuredelstein):
Replying to [comment:32 gk]:
> Replying to [comment:31 arthuredelstein]:
> > Replying to [comment:29 gk]:
> > > I am getting
> > > {{{
> > > event = keydown
> > > key = |
> > > charCode = 0
> > > which = 220
> > > code = Backslash
> > > keyCode = 220
> > > location = 0
> > > altKey = false
> > > ctrlKey = true
> > > metaKey = false
> > > shiftKey = true
> > > }}}
> > > with 5.0a4.
> >
> > Interesting. What keys are you actually pressing to get this result?
And what OS is this?
>
> Windows 7 and I press Right ALT + "<".
I think I understand what's happening now: on your keyboard, the Right Alt
key is being interpreted as an [https://en.wikipedia.org/wiki/AltGr_key
AltGr key], which is
[https://en.wikipedia.org/wiki/AltGr_key#Control_.2B_Alt_as_a_substitute
often emulated with Ctrl+Alt]. It seems Windows or Firefox is doing the
inverse substitution by re-interpreting AltGr as Ctrl+Alt.
So if this understanding is correct, it means that if you use the Left Alt
key instead, you should get `ctrlKey = false`. Is that what you see?
If so, then I will look into how to suppress this Ctrl signal when the
Right Alt key is pressed.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/15646#comment:33>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
More information about the tor-bugs
mailing list