[tor-bugs] #26598 [Applications/Tor Browser]: disable User Timing API in ESR60

Tor Bug Tracker & Wiki blackhole at torproject.org
Mon Aug 20 17:45:54 UTC 2018


#26598: disable User Timing API in ESR60
-------------------------------------------------+-------------------------
 Reporter:  mcs                                  |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-fingerprinting-time-highres,     |  Actual Points:
  ff60-esr, TorBrowserTeam201808                 |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by arthuredelstein):

 * status:  new => needs_review


Comment:

 I examined the code for setResourceTimingBufferSize(...):
 https://dxr.mozilla.org/mozilla-
 esr60/rev/dd52b41d2b775e5c7261ce52795268b7670635fc/dom/performance/Performance.cpp#407
 and for Performance::InsertResourceEntry(...):
 https://dxr.mozilla.org/mozilla-
 esr60/rev/dd52b41d2b775e5c7261ce52795268b7670635fc/dom/performance/Performance.cpp#413

 When "privacy.resistFingerprinting" is true, InsertResourceEntry
 shortcuts. Therefore no entries are added, and
 performance.onresourcetimingbufferfull is never called, regardless of any
 past calls to `setResourceTimingBufferSize(unsigned long maxSize)`. So I
 am satisfied that there isn't a fingerprinting vector of supercookie
 mechanism exposed by this API.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26598#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online


More information about the tor-bugs mailing list