[tor-bugs] #33534 [Applications/Tor Browser]: Review FF release notes from FF69 to latest (FF73)

[Tor Bug Tracker & Wiki]

#33534: Review FF release notes from FF69 to latest (FF73)
--------------------------------------+--------------------------------
 Reporter:  pospeselr                 |          Owner:  pospeselr
     Type:  defect                    |         Status:  assigned
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:                            |  Actual Points:  12
Parent ID:                            |         Points:
 Reviewer:                            |        Sponsor:  Sponsor58-must
--------------------------------------+--------------------------------

Comment (by Thorin):

 Replying to [comment:6 pospeselr]:
 > {{{
 > 74:
 >     TextMetrics interface updated, canvas fingerprinting?
 >         - https://bugzilla.mozilla.org/show_bug.cgi?id=1102584
 > }}}

 https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#fonts -
 see the textmetric entry and click the view details

 RFP doesn't protect against this. The prefs (all added in 74+) are
 - `dom.textMetrics.actualBoundingBox.enabled` FF74+ default true
 - `dom.textMetrics.baselines.enabled` - 76 Nightly still at default false
 - `dom.textMetrics.emHeight.enabled` - 76 Nightly still at default false
 - `dom.textMetrics.fontBoundingBox.enabled` - 76 Nightly still at default
 false

 measureText uses floats (which may be affected by OS), so the precision is
 much higher than say domrect (which uses app-units - e.g. 1/60th of a CSS
 pixel). Additionally, text layout goes from device pixels (which _are_
 affected by DPI) to CSS pixels: so it could also be affected by DPI (but
 no one knows for sure)

 I'm not sure if it really adds any more entropy than other font
 measurements like dcf's unicode glyphs - but it is another avenue

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33534#comment:7>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online