storage estimate fingerprinting

[Thorin-Oakenpants]

hey gals and guys, I could do with some data for FF102+ - see https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41065

instructions

• either go to https://arkenfox.github.io/TZP/tests/engine.html and scroll to the end for the storage estimate value
• or just type this into your web console, hit enter, and then expand the promise

  • console.log(navigator.storage.estimate())

report back the value along with OS and VM status (and disk details if relevant, not really that important, as long as I know it's e.g. android). I suspect most desktops will all be the same (10gb) because most people will have plenty of disk space, so more or less after android and VM data

TIA ... have some free moon cakes 🥮 🥮 🥮

Here's the current data

   10737418240 : numerous windows + linux users with lots of disk size, Android Fabrizio 100gb spare from 128gb
    5778733465 : Android10 opusforlife 12gb spare from 64gb (Mull)
    5641604300 : Android Fabrizio 49gb spare from 64gb
    5512729395 : Android9 Thorin 44gb spare from 64gb
    5301081292 : Android bashonly 40gb spare from 64gb
    5256596684 : Win 10 VM 33gb spare from 52gb
    2934867968 : Debian XCFE 2glops 650gb spare from 1TB
    1521166745 : Ubuntu VM Fabrizio with 15GB of storage
    1177328025 : Android aleyvo 1.5gb spare from 16gb

[fxbrit]

FF 102.2.1 on Android. same results with latest TBA.

10737418240 : Android #1    (128 GB, about 100 GB are free)
 5641604300 : Android #2    (64 GB, about 40 GB are free)

my macOS is the same as your Windows, so your guess is right.

[VannTen]

10737418240 : Linux 

same as the rest of desktops.

[bashonly]

10737418240 : Linux 
 5301081292 : Android (24.31 GB used of 64.00 GB total)

[Thorin-Oakenpants]

yikes, I've updated OP, thanks you guys .. that looks nasty'ish. I mean we can surmise that the 5gb lots are 64gb devices (or lower?), but the variance is a bit disturbing for real-time cross site tracking (state actor?) - note the amount used/free seems to be proportional to the estimate

[2glops]

2934867968
FF 102 - Linux Debian

[Thorin-Oakenpants]

@2glops - what is your disk size and free disk space?

[2glops]

1 To / 650 Go free disk space

[Thorin-Oakenpants]

sorry, I don't understand what 1 and 650 mean. What is the free space available (e.g. 20gb) + what is total disk size (main system drive with firefox on it, e.g. 128gb)

[2glops]

1 Terabyte
650 Gigabyte free disk space

[aleyvo]

1177328025
FF 102.2.1, Android (16GB total / 1.5GB free)

[Thorin-Oakenpants]

thanks - I'll keep updating OP in order of the result descending

@aleyvo holy cow dude
@2glops ahh, thanks .. btw that is one weird result compared to the others - 650gb spare but a super low number

[aleyvo]

@aleyvo holy cow dude

Old device 😂

[Thorin-Oakenpants]

@aleyvo don't go installing pokemon in it

[cryptocat8]

• Windows 10 Pro 21H1
• FF 102.0.1

10737418240

[opusforlife2]

Windows 7, FF 102

• 10737418240

[rusty-snake]

10737418240 - Fedora Linux 36 (64bit) - Firefox for Fedora 102.0 (64bit) - /home partition: total 406G, used 190G, free 216G

[Thorin-Oakenpants]

yup, 10737418240 is the max result if you have a big drive (and/or big spare disk space?) - thanks guys

[opusforlife2]

Android 10 64GiB, 12 GiB free. Mull 102.1.1

• 5778733465

[Thorin-Oakenpants]

Thanks everyone, got what we need

[Jee-Hex]

Looks like disabling dom.storageManager.enabled might help but that pref was removed from the user.js in 96 (0634a56). Would it be feasible to temporarily disable the Storage API until the fix is uplifted to ESR?

[rusty-snake]

If you want to limit exposure of data to websites yes, but if you want to minimize fingerprinting no.

[Thorin-Oakenpants]

Well, TBH, when I removed it, 1735713 hadn't happened .. but regardless, it's not something that is a state tracking issue with partitioning and sanitizing

As for the FP, I pinged tjr and we have 1781277, which will happen when it happens. In the meantime this doesn't affect what FF can do re naive scripts - and for AF users (desktop) this is unlikely to be an issue (i.e unlikely to start coming down from 10GiB). Disabling the API would in fact make you really stand out (advanced scripts)