Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
-+-
 Reporter:  Thorin   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-resolution, tbb-  |  Actual Points:
  mobile, tbb-parity, ff68-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by Thorin):

 Replying to [comment:7 tom]:
 > Ah so this is basically the Visual Viewport I just emailed about,
 suggesting we don't care about this.

 My tests from OP were from https://bugzilla.mozilla.org/show_bug.cgi?id=1512813. I'm not sure if I
 got the issue right, TBH, and there isn't one

 On desktop (admittedly my desktop is not touch capable) all metrics (js
 and css) stay in sync, on android they do not (where I can only use pinch
 to zoom).

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
-+-
 Reporter:  Thorin   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting-resolution, tbb-  |  Actual Points:
  mobile, tbb-parity, ff68-esr   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  tbb-fingerprinting, tbb-mobile, tbb-parity => tbb-
 fingerprinting-resolution, tbb-mobile, tbb-parity, ff68-esr


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
-+-
 Reporter:  Thorin   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting, tbb-mobile,  |  Actual Points:
  tbb-parity |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Description changed by gk:

Old description:

> I am not sure if this is an issue for TB. I do not have a touch device on
> which to install TB8. But since Tor Uplift's RFP underlines this
> protection, it might be prudent for someone to check it out.
>
> My Android has a low screen res, the web content loads at a higher res -
> when I pinch to zoom and re-run/refresh: the viewport shows entropy.
> Ignore the css media measurements. Just focus on the five JS results:
> screen, available screen, outer, inner and viewport
>
> Control
> - device should be hidpi/retina/whatever-you-call-it
> - load test page [1]
> - all the widths/heights (except viewport: e.g 17px less width) should be
> the same (i.e `1000 x 1000`)
> - zoom in to `133%`
> - refresh or rerun button
> - all the widths/heights (except viewport e.g 13px less width) should be
> the same (e.g `750 x 750`)
>
> STR
> - device should be hidpi
> - load the test page
> - all the widths/heights (except viewport) should be the same (e.g `980 x
> 1522`)
> - zoom in (fingers on a touch device)
> - scroll to the left and hit `re-run tests`
> - scroll back to the right and viewport is still based on the old value
> - also, in the pic in [2] css media still shows it's using the old values
> (`980`) (ignore that it's missing the height values: not sure why it does
> that: I think it's because it hits a fraction, I see the same thing on
> desktop)
>

> Is this just a quirk? Or is the viewport not properly spoofed in all
> situations?
>
> [1]
> https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
> [2] https://github.com/ghacksuserjs/TorZillaPrint/issues/34

New description:

 I am not sure if this is an issue for TB. I do not have a touch device on
 which to install TB8. But since Tor Uplift's RFP underlines this
 protection, it might be prudent for someone to check it out.

 My Android has a low screen res, the web content loads at a higher res -
 when I pinch to zoom and re-run/refresh: the viewport shows entropy.
 Ignore the css media measurements. Just focus on the five JS results:
 screen, available screen, outer, inner and viewport

 Control
 - device should not be hidpi/retina/whatever-you-call-it
 - load test page [1]
 - all the widths/heights (except viewport: e.g 17px less width) should be
 the same (i.e `1000 x 1000`)
 - zoom in to `133%`
 - refresh or rerun button
 - all the widths/heights (except viewport e.g 13px less width) should be
 the same (e.g `750 x 750`)

 STR
 - device should be hidpi
 - load the test page
 - all the widths/heights (except viewport) should be the same (e.g `980 x
 1522`)
 - zoom in (fingers on a touch device)
 - scroll to the left and hit `re-run tests`
 - scroll back to the right and viewport is still based on the old value
 - also, in the pic in [2] css media still shows it's using the old values
 (`980`) (ignore that it's missing the height values: not sure why it does
 that: I think it's because it hits a fraction, I see the same thing on
 desktop)


 Is this just a quirk? Or is the viewport not properly spoofed in all
 situations?

 [1] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
 [2] https://github.com/ghacksuserjs/TorZillaPrint/issues/34

--

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
-+-
 Reporter:  Thorin   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting, tbb-mobile,  |  Actual Points:
  tbb-parity |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by tom):

 Ah so this is basically the Visual Viewport I just emailed about,
 suggesting we don't care about this.

 The user behavior of zooming and panning can, in theory, give fairly good
 confidence that User A is *not* User B - because User A zoomed to 150% and
 User B zoomed to 200%.  But to suggest that User B and USer C are the same
 because they both zoomed to approximately 200% - even if they panned in
 similar ways - seems waay too guessy to be a concern.

 I'll also note that on Desktop, I don't beleive we stop the user from
 zooming in on a webpage which is essentially the same thing.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
-+-
 Reporter:  Thorin   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting, tbb-mobile,  |  Actual Points:
  tbb-parity |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by Thorin):

 Thanks sysrqb. I'm not worried about #27083 here (and I used FF+RFP as TB
 for Android wasn't out at the time), just focused on second issue

 > `screen resolution`, `available resolution`, `outer window`, `inner
 window`, and `view port`. And these remain as the original values after
 pinch-to-zoom:

 Not for me.

 If you look at https://github.com/ghacksuserjs/TorZillaPrint/issues/34 **I
 get the inverse of your result** (if I read it right): i.e. css media is
 static, but the JS results change => indication of hidpi or something:
 maybe letterboxing kicking in solves this (I haven't tried yet)?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
-+-
 Reporter:  Thorin   |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-fingerprinting, tbb-mobile,  |  Actual Points:
  tbb-parity |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by sysrqb):

 * keywords:  tbb-fingerprinting, tbb-mobile => tbb-fingerprinting, tbb-
 mobile, tbb-parity


Comment:

 Thanks Thorin. I see two problems here. The first is related to exact
 screen dimensions (#27083) and the other is inconsistency of reported
 values. On the webpage on Android, I see these are (approximately) the
 same (based on pinch-to-zoom level): `screen resolution`, `available
 resolution`, `outer window`, `inner window`, and `view port`. And these
 remain as the original values after pinch-to-zoom: `[css] screen
 resolution` and `[css] inner window`.

 It seems like there isn't a feedback channel from the pinch-to-zoom
 function into the CSS engine (whatever that is). I also wonder if rounding
 the zoom level into buckets will help with this (in addition to any screen
 rounding and/or letterboxing we add). By this I mean on desktop, you can
 only zoom-in and zoom-out by fixed values, but pinch-to-zoom is relatively
 arbitrary. We can think about only allowing specific zoom levels.

 And, as a side note, this seems partly broken with Firefox Nightly on
 Android, so we should test this after the 68esr rebase.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
+--
 Reporter:  Thorin  |  Owner:  tbb-team
 Type:  defect  | Status:  new
 Priority:  Medium  |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  tbb-fingerprinting, tbb-mobile  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by gk):

 * keywords:  tbb-fingerprinting => tbb-fingerprinting, tbb-mobile


--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
+--
 Reporter:  Thorin  |  Owner:  tbb-team
 Type:  defect  | Status:  new
 Priority:  Medium  |  Milestone:
Component:  Applications/Tor Browser|Version:
 Severity:  Normal  | Resolution:
 Keywords:  tbb-fingerprinting, tbb-mobile  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
Changes (by gk):

 * keywords:  tbb-fingerprinting => tbb-fingerprinting, tbb-mobile


Comment:

 What happens

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
--+--
 Reporter:  Thorin|  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-fingerprinting|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by Thorin):

 Actually, that only fixed zoom messing with the css output.

 So css @media (width/height, device-width/device-height, min-width/min-
 height, min-device-width/min-device-height) and my viewport code don't get
 spoofed

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
--+--
 Reporter:  Thorin|  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-fingerprinting|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by Thorin):

 ignore the css: I was using `width`/`height` instead of `min-width`/`min-
 height` and likewise using `device-width`/`device-height` instead of `min-
 device-width`/`min-device-height`

 So that just leaves why is the viewport spoofed on my desktop (FF/TB), but
 not my Android phone (FF+RFP)?

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
--+--
 Reporter:  Thorin|  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-fingerprinting|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by Thorin):

 * Attachment "examples.png" added.

 top=TB desktop, bottom=FFondroid+RFP

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
--+--
 Reporter:  Thorin|  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  tbb-fingerprinting|  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by Thorin):

 why can't I edit the initial bug ..

 Control - should be **not** hidpi or whatever

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

[tor-bugs] #30542 [Applications/Tor Browser]: pinch-to-zoom viewport vs other screen/window

[Tor Bug Tracker & Wiki]

#30542: pinch-to-zoom viewport vs other screen/window
+--
 Reporter:  Thorin  |  Owner:  tbb-team
 Type:  defect  | Status:  new
 Priority:  Medium  |  Component:  Applications/Tor Browser
  Version:  |   Severity:  Normal
 Keywords:  tbb-fingerprinting  |  Actual Points:
Parent ID:  | Points:
 Reviewer:  |Sponsor:
+--
 I am not sure if this is an issue for TB. I do not have a touch device on
 which to install TB8. But since Tor Uplift's RFP underlines this
 protection, it might be prudent for someone to check it out.

 My Android has a low screen res, the web content loads at a higher res -
 when I pinch to zoom and re-run/refresh: the viewport shows entropy.
 Ignore the css media measurements. Just focus on the five JS results:
 screen, available screen, outer, inner and viewport

 Control
 - device should be hidpi/retina/whatever-you-call-it
 - load test page [1]
 - all the widths/heights (except viewport: e.g 17px less width) should be
 the same (i.e `1000 x 1000`)
 - zoom in to `133%`
 - refresh or rerun button
 - all the widths/heights (except viewport e.g 13px less width) should be
 the same (e.g `750 x 750`)

 STR
 - device should be hidpi
 - load the test page
 - all the widths/heights (except viewport) should be the same (e.g `980 x
 1522`)
 - zoom in (fingers on a touch device)
 - scroll to the left and hit `re-run tests`
 - scroll back to the right and viewport is still based on the old value
 - also, in the pic in [2] css media still shows it's using the old values
 (`980`) (ignore that it's missing the height values: not sure why it does
 that: I think it's because it hits a fraction, I see the same thing on
 desktop)


 Is this just a quirk? Or is the viewport not properly spoofed in all
 situations?

 [1] https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#screen
 [2] https://github.com/ghacksuserjs/TorZillaPrint/issues/34

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs