[tor-bugs] #16404 [Applications/Tor Browser]: Review WebGL2 spec for fingerprinting issues

[Tor Bug Tracker & Wiki]

#16404: Review WebGL2 spec for fingerprinting issues
-------------------------------------------------+-------------------------
 Reporter:  mikeperry                            |          Owner:  gk
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  ff52-esr, tbb-fingerprinting,        |  Actual Points:
  TorBrowserTeam201705R, GeorgKoppen201705,      |
  tbb-7.0-must                                   |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:  None
-------------------------------------------------+-------------------------
Changes (by gk):

 * keywords:
     ff52-esr, tbb-fingerprinting, TorBrowserTeam201705, GeorgKoppen201705,
     tbb-7.0-must
     =>
     ff52-esr, tbb-fingerprinting, TorBrowserTeam201705R,
     GeorgKoppen201705, tbb-7.0-must
 * status:  assigned => needs_review


Comment:

 https://browserleaks.com/webgl has WebGL2 values as well and there are a
 bunch of them that are different on different platforms/computers ("3.7.2
 Setting and getting state" has a good overview of what information is made
 available with the new WebGL version).

 One thing we could do is trying to determine whether we want to bind at
 least some of those values to our modified minimal mode as well (see
 #16005). But for the time being (i.e. for preparing a 7.0 release)
 disabling WebGL2 seems to be the best solution. This is done by flipping
 `webgl.enable-webgl2` to `false`.

 See `bug_16404` (https://gitweb.torproject.org/user/gk/tor-
 browser.git/commit/?h=bug_16404&id=746c4951890769f50bbec2c73193ab31c169b7c2)
 for that patch. I opened #22333 for thinking harder about a possible
 middle-ground between disabling WebGL2 and getting the full fingerprinting
 flavor.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16404#comment:13>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online