Re: [tor-bugs] #25794 [Applications/Tor Browser]: Sanitize PointerEvent

[Tor Bug Tracker & Wiki]

#25794: Sanitize PointerEvent
-+-
 Reporter:  arthuredelstein  |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  closed
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:  fixed
 Keywords:  tbb-8.0-issues, tbb-regression,  |  Actual Points:
  tbb-fingerprinting, TorBrowserTeam201812R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * status:  needs_review => closed
 * resolution:   => fixed


Comment:

 Thanks. Cherry-picked to `tor-browser-60.3.0esr-8.5-1` (commit
 c20210b1a017c4e94157c1acfbef18e878202ff4) and `tor-browser-60.3.0es-8.0-1`
 (commit 3c03aad30d2b2b0e92359f15a1a95cfb2354544e). I opened #28729 for
 thinking about how we should deal with that for Firefox 68 ESR.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #25794 [Applications/Tor Browser]: Sanitize PointerEvent

[Tor Bug Tracker & Wiki]

#25794: Sanitize PointerEvent
-+-
 Reporter:  arthuredelstein  |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-8.0-issues, tbb-regression,  |  Actual Points:
  tbb-fingerprinting, TorBrowserTeam201812R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by mcs):

 r=brade, r=mcs
 The patch looks good.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #25794 [Applications/Tor Browser]: Sanitize PointerEvent

[Tor Bug Tracker & Wiki]

#25794: Sanitize PointerEvent
-+-
 Reporter:  arthuredelstein  |  Owner:  tbb-
 |  team
 Type:  defect   | Status:
 |  needs_review
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-8.0-issues, tbb-regression,  |  Actual Points:
  tbb-fingerprinting, TorBrowserTeam201811R  |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:
 tbb-8.0-issues, tbb-regression, tbb-fingerprinting,
 TorBrowserTeam201811
 =>
 tbb-8.0-issues, tbb-regression, tbb-fingerprinting,
 TorBrowserTeam201811R
 * status:  new => needs_review


Comment:

 `bug_25794_v2` (https://gitweb.torproject.org/user/gk/tor-
 browser.git/commit/?h=bug_25794_v2=53880c99aef73b446796e1261149e7635c2913da)
 has a fix for review. Pointer events are disabled on mobile, so we are
 good from that perspective already.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #25794 [Applications/Tor Browser]: Sanitize PointerEvent

[Tor Bug Tracker & Wiki]

#25794: Sanitize PointerEvent
-+-
 Reporter:  arthuredelstein  |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-8.0-issues, tbb-regression,  |  Actual Points:
  tbb-fingerprinting, TorBrowserTeam201811   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-

Comment (by gk):

 Replying to [comment:4 gk]:
 > I guess we should disable that for now and enable it again when
 switching to esr68. I am amenable testing it in 8.5aX as well and shipping
 it in 8.5.

 https://bugzilla.mozilla.org/show_bug.cgi?id=1492766 landed, but all in
 all that looks like a ton to backport. Let's disable it for now.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #25794 [Applications/Tor Browser]: Sanitize PointerEvent

[Tor Bug Tracker & Wiki]

#25794: Sanitize PointerEvent
-+-
 Reporter:  arthuredelstein  |  Owner:  tbb-
 |  team
 Type:  defect   | Status:  new
 Priority:  Medium   |  Milestone:
Component:  Applications/Tor Browser |Version:
 Severity:  Normal   | Resolution:
 Keywords:  tbb-8.0-issues, tbb-regression,  |  Actual Points:
  tbb-fingerprinting, TorBrowserTeam201809   |
Parent ID:   | Points:
 Reviewer:   |Sponsor:
-+-
Changes (by gk):

 * keywords:  ff60-esr, tbb-fingerprinting =>
 tbb-8.0-issues, tbb-regression, tbb-fingerprinting,
 TorBrowserTeam201809


Comment:

 I guess we should disable that for now and enable it again when switching
 to esr68. I am amenable testing it in 8.5aX as well and shipping it in
 8.5.

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #25794 [Applications/Tor Browser]: Sanitize PointerEvent

[Tor Bug Tracker & Wiki]

#25794: Sanitize PointerEvent
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  ff60-esr, tbb-fingerprinting  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Description changed by arthuredelstein:

Old description:

> Simon alerted me to the fact that PointerEvents have been enabled in
> Firefox 59 (ttps://bugzilla.mozilla.org/show_bug.cgi?id=1411467). We
> should sanitize events these under privacy.resistFingerprinting = true.
>
> https://developer.mozilla.org/en-US/docs/Web/API/Pointer_events

New description:

 Simon alerted me to the fact that PointerEvents have been enabled in
 Firefox 59 (https://bugzilla.mozilla.org/show_bug.cgi?id=1411467). We
 should sanitize events these under privacy.resistFingerprinting = true.

 https://developer.mozilla.org/en-US/docs/Web/API/Pointer_events

--

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #25794 [Applications/Tor Browser]: Sanitize PointerEvent

[Tor Bug Tracker & Wiki]

#25794: Sanitize PointerEvent
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  ff60-esr, tbb-fingerprinting  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--

Comment (by arthuredelstein):

 Bugzilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1363508

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs

Re: [tor-bugs] #25794 [Applications/Tor Browser]: Sanitize PointerEvent

[Tor Bug Tracker & Wiki]

#25794: Sanitize PointerEvent
--+--
 Reporter:  arthuredelstein   |  Owner:  tbb-team
 Type:  defect| Status:  new
 Priority:  Medium|  Milestone:
Component:  Applications/Tor Browser  |Version:
 Severity:  Normal| Resolution:
 Keywords:  ff60-esr, tbb-fingerprinting  |  Actual Points:
Parent ID:| Points:
 Reviewer:|Sponsor:
--+--
Changes (by arthuredelstein):

 * keywords:  ff60-esr => ff60-esr, tbb-fingerprinting


Old description:

> Simon alerted me to the fact that
>  PointerEvents have been enabled in Firefox 59
> (ttps://bugzilla.mozilla.org/show_bug.cgi?id=1411467). We should sanitize
> events these under privacy.resistFingerprinting = true.
>
> https://developer.mozilla.org/en-US/docs/Web/API/Pointer_events

New description:

 Simon alerted me to the fact that PointerEvents have been enabled in
 Firefox 59 (ttps://bugzilla.mozilla.org/show_bug.cgi?id=1411467). We
 should sanitize events these under privacy.resistFingerprinting = true.

 https://developer.mozilla.org/en-US/docs/Web/API/Pointer_events

--

--
Ticket URL: 
Tor Bug Tracker & Wiki 
The Tor Project: anonymity online
___
tor-bugs mailing list
tor-bugs@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs