[tor-bugs] #10283 [Applications/Tor Browser]: SpeechSynthesis API may be fingerprintable

[Tor Bug Tracker & Wiki]

#10283: SpeechSynthesis API may be fingerprintable
-------------------------------------------------+-------------------------
 Reporter:  mikeperry                            |          Owner:
     Type:  task                                 |         Status:  new
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  ff52-esr, tbb-fingerprinting, tbb-   |  Actual Points:
  testcase, tbb-7.0-must-alpha,                  |
  TorBrowserTeam201704                           |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:  None
-------------------------------------------------+-------------------------

Comment (by arthuredelstein):

 Not only does speechSythesis.getVoices() allow voices to be listed, but
 there are callbacks that would allow JS to time how long a phrase takes to
 be "uttered". So one possibility is to disable this API:

 https://github.com/arthuredelstein/tor-browser/commit/10283

 I suppose another way would be to fake the callback so it always returns
 the same duration for a given phrase. Or block the callback event
 altogether. Not sure which of these is the best option.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10283#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online