Skip to content

Features that gngr will not support

hrj edited this page Jul 26, 2018 · 14 revisions

Never ever

  • WPAD (4)
  • Battery Status API (1) & (2)
  • Hyper-link auditing
  • Geo Location
  • Any Camera or Mic APIs
  • Resource timing APIs. (5)
  • Etag header
  • Last-modified header (unless the LSBs are fudged)
  • Most of the navigator API.

Needs more thought

These features are good to have sometimes, but have fingerprinting potential. They should surely be opt-in though.

References

  1. http://blog.add0n.com/2016/03/23/html5-apis-fingerprint-users-how-to-prevent.html
  2. https://blog.lukaszolejnik.com/battery-status-readout-as-a-privacy-risk/
  3. https://www.browserleaks.com/
  4. https://news.ycombinator.com/item?id=12167209
  5. https://github.com/w3c/resource-timing/issues/64
  6. https://www.chromium.org/Home/chromium-security/client-identification-mechanisms
  7. http://www.ieee-security.org/TC/SP2013/papers/4977a541.pdf