Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Desktop] WebGL Drawing FP blocking not working correctly when FP set to Strict #10675

Closed
LaurenWags opened this issue Jul 9, 2020 · 5 comments
Assignees
Labels
closed/not-actionable feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields OS/Desktop

Comments

@LaurenWags
Copy link
Member

Description

When testing on our QA test pages for FP farbling, I noticed that if FP is set to Strict, WebGL Drawing does not appear to be working correctly.

Per discussion with @pes10k logging this and tagging @pilgrim-brave to hopefully take a look.

Steps to Reproduce

  1. Clean profile 1.11.92
  2. Navigate to https://dev-pages.bravesoftware.com/farbling.html and https://dev-pages.brave.software/farbling.html
  3. Confirm FP setting is Standard in shields
  4. Generate FPs on both pages, confirm they look as expected. (ie. - they are the same across each row on each page but differ between pages for all that have Version - 1.11)

Standard

  1. Restart browser.
  2. For both pages, change FP to Allow All in shields
  3. Generate FPs, confirm they look as expected. (ie - they are the same across each row and the same on both pages)

Allow All

  1. Restart browser.
  2. For both pages, change FP to Strict in shields
    10 Generate FPs.

Actual result:

WebGL Drawing is the same on both pages
Strict

Expected result:

Expected WebGL Drawing to be different on both pages (but the same across its row)

Reproduces how often:

easily

Brave version (brave://version info)

1.11.92

Version/Channel Information:

  • Can you reproduce this issue with the current release? n/a, strict setting not available in 1.10.x
  • Can you reproduce this issue with the beta channel?
  • Can you reproduce this issue with the dev channel? yes (1.11.x)
  • Can you reproduce this issue with the nightly channel?

Other Additional Information:

  • Does the issue resolve itself when disabling Brave Shields?
  • Does the issue resolve itself when disabling Brave Rewards?
  • Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

cc @rebron @brave/legacy_qa

@LaurenWags LaurenWags added feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields QA/Yes OS/Desktop labels Jul 9, 2020
@btlechowski
Copy link

Reproduced on:

Brave 1.12.102 Chromium: 84.0.4147.89 (Official Build) dev (64-bit)
Revision 19abfe7bcba9318a0b2a6bc6634a67fc834aa592-refs/branch-heads/4147@{#852}
OS Ubuntu 18.04 LTS

image

@pes10k
Copy link
Contributor

pes10k commented Jul 28, 2020

Thanks all for documenting this!

cc @pilgrim-brave

@pes10k
Copy link
Contributor

pes10k commented Aug 31, 2020

I've updated the test page text so that is clear that the farbling-style protections (different per-session, per-etld+1) should only hold in "standard" protections, and not "strict" (bc in strict we just block WebGL drawing all together, since its too difficult to randomize), and so blocking will look identical in all origins.

Thanks @LaurenWags for reporting!

@pes10k
Copy link
Contributor

pes10k commented Aug 31, 2020

i've labeled "not actionable" only bc there isn't a "it was pete's test fault, not Mark's code fault" option ;)

@LaurenWags
Copy link
Member Author

Removing QA/Yes tag since it's been tagged closed/not-actionable, but I did confirm both pages now reflect that WebGL Drawing farbling is only available in "standard" mode 👍

Screen Shot 2020-08-31 at 10 27 04 AM

Screen Shot 2020-08-31 at 10 27 13 AM

@LaurenWags LaurenWags removed the QA/Yes label Aug 31, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
closed/not-actionable feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields OS/Desktop
Projects
None yet
Development

No branches or pull requests

4 participants