[tor-bugs] #25906 [Applications/Tor Browser]: Disable third-party tracking frameworks Adjust and Leanplum in mobile Tor Browser

[Tor Bug Tracker & Wiki]

#25906: Disable third-party tracking frameworks Adjust and Leanplum in mobile Tor
Browser
--------------------------------------+------------------------------
 Reporter:  gk                        |          Owner:  tbb-team
     Type:  defect                    |         Status:  needs_review
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:  tbb-mobile, ff60-esr      |  Actual Points:
Parent ID:  #26531                    |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+------------------------------
Changes (by sysrqb):

 * status:  new => needs_review


Comment:

 From ticket:25851#comment:1
 {{{
 LeanPlum is not included by default. It is only included if
 MOZ_ANDROID_MMA is
 true (false by default) and MOZ_ANDROID_GCM must be true (which we set
 false
 at configure time):
 ​https://gitweb.torproject.org/tor-browser.git/tree/.mozconfig-android?h
 =tor-
 browser-60.1.0esr-8.0-1&id=ce3ad196040db4886e953cf13fc8d24fdf712d4b#n34
 }}}

 From ticket:25851#comment:2
 {{{
 Adjust is excluded at build-time, so we can ignore that. It is excluded
 if MOZ_INSTALL_TRACKING is not set. This is similar to LeanPlum - it
 requires MOZ_ANDROID_GCM, too. We could change the MOZ_INSTALL_TRACKING
 default value, too (being extra safe) - but currently it will not be
 included.
 }}}

 This is safe as long as we don't include `--with-google-play-services`. We
 already include `ac_add_options --without-google-play-services` in
 `.mozconfig-android` so neither LeanPlum or Adjust are included.

 I also created a branch - `25906` in my repo - for review where we set the
 configure options as |false| by default, as another safety measure.

 In reality, even if leanplum or adjust were enabled, `mach configure`
 should fail because there is an additional dependency on specifying a
 `leanplum-sdk-file` and `adjust-sdk-file` which we don't include. But I'd
 prefer playing this safe.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/25906#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online