Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fingerprinting 3.0: WebGL Debugging Followups #15882

Closed
xsvanc06 opened this issue May 16, 2021 · 3 comments · Fixed by brave/brave-core#8831
Closed

Fingerprinting 3.0: WebGL Debugging Followups #15882

xsvanc06 opened this issue May 16, 2021 · 3 comments · Fixed by brave/brave-core#8831
Assignees
@pes10k @pilgrim-brave
Labels
feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields OS/Desktop privacy QA Pass-Linux QA Pass-macOS QA Pass-Win64 QA/Test-All-Platforms QA/Yes release-notes/include
Milestone
1.27.x - Release

Comments

@xsvanc06
Copy link

xsvanc06 commented May 16, 2021 •
edited by pes10k
Loading

@xsvanc06 pointed out two fingerprinting improvements that would be good to make, regarding WebGL extension information. These changes would only be made in strict mode.

  • Change getSupportedExtensions to return ["WEBGL_debug_renderer_info"] instead of null. This would be a web compat improvement, not a privacy improvement
  • Change getExtension to return NULL for all values except WEBGL_debug_renderer_info

Original message

I've been testing WebGLRenderingContext.getSupportedExtensions() with farbling level maximum and I get null as return value, but I was expecting array. I looked at some tests in Brave and they are checking for null, so I guess it's intentional, may be related to #3326

And then WebGLRenderingContext.getExtension() should return bottom value at maximum level (I am guessing null) according to #9188, but I get same results on farbling level maximum and disabled. Wouldn't fingerprinting script just check for all possible extensions?

I am running Version 1.24.84 Chromium: 90.0.4430.93 (Official Build) (64-bit)
@pes10k pes10k self-assigned this May 17, 2021
@pes10k pes10k added privacy feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields labels May 17, 2021
@pes10k
Copy link
Contributor

pes10k commented May 17, 2021

Thank you for the issue @xsvanc06 !

I've been testing WebGLRenderingContext.getSupportedExtensions() with farbling level maximum and I get null as return value, but I was expecting array. I looked at some tests in Brave and they are checking for null, so I guess it's intentional, may be related to #3326

Good point, we should return an empty array here, good catch.

And then WebGLRenderingContext.getExtension() should return bottom value at maximum level (I am guessing null) according to #9188, but I get same results on farbling level maximum and disabled. Wouldn't fingerprinting script just check for all possible extensions?

This is a good point too, thanks! I'm going to repurpose this issue to cover those changes. Thank you very much for catching them!
@pes10k pes10k mentioned this issue May 17, 2021
Open
10 tasks
@pes10k pes10k changed the title [question] WebGL farbling - getSupportedExtensions, getExtension May 17, 2021
@pilgrim-brave pilgrim-brave mentioned this issue May 17, 2021
Merged
24 tasks
@pilgrim-brave pilgrim-brave added this to the 1.27.x - Nightly milestone May 25, 2021
@stephendonner
Copy link

@pes10k @pilgrim-brave - can we please get a testplan attached to brave/brave-core#8831? Thanks!
@stephendonner
Copy link

stephendonner commented Jun 8, 2021 •
edited by LaurenWags
Loading

Verified PASSED using the testplan from brave/brave-core#8831 on test sites https://dev-pages.brave.software/fingerprinting/strict-mode.html and https://dev-pages.bravesoftware.com/fingerprinting/strict-mode.html with build

Brave 1.27.48 Chromium: 91.0.4472.88 (Official Build) nightly (x86_64)
Revision 109e9cd038b94a631aea7d40ee3d56c1278f2597-refs/branch-heads/4472@{#1385}
OS macOS Version 11.4 (Build 20F71)

Steps:

  1. new profile
  2. loaded https://dev-pages.brave.software/fingerprinting/strict-mode.html and https://dev-pages.bravesoftware.com/fingerprinting/strict-mode.html
  3. disabled Shields
  4. clicked Generate values
  5. clicked on the hashes for WebGL - getSupportedExtensions
  6. confirmed they returned values for the above, on both pages

Repeated the above, with the following shields configurations:

Shields off

dev-pages.brave.software dev-pages.bravesoftware.com
Screen Shot 2021-06-08 at 2 01 58 PM Screen Shot 2021-06-08 at 2 04 24 PM

Shields on, fingerprinting standard

dev-pages.brave.software dev-pages.bravesoftware.com
Screen Shot 2021-06-08 at 2 11 46 PM Screen Shot 2021-06-08 at 2 12 03 PM

Shields on, fingerprinting strict

dev-pages.brave.software dev-pages.bravesoftware.com
Screen Shot 2021-06-08 at 2 06 06 PM Screen Shot 2021-06-08 at 2 06 17 PM

All configurations have the same output for the following:

WebGL - getExtension("WEBGL_debug_renderer_info")

dev-pages.brave.software dev-pages.bravesoftware.com
Screen Shot 2021-06-08 at 2 32 20 PM Screen Shot 2021-06-08 at 2 32 42 PM

WebGL - getExtension("WEBGL_lose_context")

dev-pages.brave.software dev-pages.bravesoftware.com
Screen Shot 2021-06-08 at 2 32 25 PM Screen Shot 2021-06-08 at 2 31 46 PM

Verification passed on


Brave | 1.27.78 Chromium: 91.0.4472.114 (Official Build) beta (64-bit)
-- | --
Revision | 4bb19460e8d88c3446b360b0df8fd991fee49c0b-refs/branch-heads/4472@{#1496}
OS | Windows 10 OS Version 2004 (Build 19041.1052)

Shields off

dev-pages.brave.software dev-pages.bravesoftware.com
image image

Shields on, fingerprinting standard

dev-pages.brave.software dev-pages.bravesoftware.com
image image

Shields on, fingerprinting strict

dev-pages.brave.software dev-pages.bravesoftware.com
image image

All configurations have the same output for the following:

WebGL - getExtension("WEBGL_debug_renderer_info")

dev-pages.brave.software dev-pages.bravesoftware.com
image image

WebGL - getExtension("WEBGL_lose_context")

dev-pages.brave.software dev-pages.bravesoftware.com
image image

Verification passed on

Brave	1.27.89 Chromium: 91.0.4472.124 (Official Build) beta (64-bit)
Revision	7345a6d1bfcaff81162a957e9b7d52649fe2ac38-refs/branch-heads/4472_114@{#6}
OS	Linux

Shields off

dev-pages.brave.software dev-pages.bravesoftware.com
1-shields off 2-shields off

Shields on, fingerprinting standard

dev-pages.brave.software dev-pages.bravesoftware.com
1-std fp 2-std fp

Shields on, fingerprinting strict

dev-pages.brave.software dev-pages.bravesoftware.com
1-strict fp 2-strict fp

All configurations have the same output for the following:

WebGL - getExtension("WEBGL_debug_renderer_info")

dev-pages.brave.software dev-pages.bravesoftware.com
1-WEBGL_debug_renderer_info 2-WEBGL_debug_renderer_info

WebGL - getExtension("WEBGL_lose_context")

dev-pages.brave.software dev-pages.bravesoftware.com
1-WEBGL_lose_context 2-WEBGL_lose_context
@LaurenWags LaurenWags mentioned this issue Jul 22, 2021
Closed
@arthuredelstein arthuredelstein mentioned this issue Jun 22, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature/shields/fingerprint The fingerprinting (aka: "device recognition") protection provided in Shields OS/Desktop privacy QA Pass-Linux QA Pass-macOS QA Pass-Win64 QA/Test-All-Platforms QA/Yes release-notes/include
6 participants
@pes10k @stephendonner @xsvanc06 @LaurenWags @GeetaSarvadnya @pilgrim-brave