#10283: SpeechSynthesis API may be fingerprintable -------------------------------------------------+------------------------- Reporter: mikeperry | Owner: Type: task | Status: new Priority: High | Milestone: Component: Applications/Tor Browser | Version: Severity: Normal | Resolution: Keywords: ff52-esr, tbb-fingerprinting, tbb- | Actual Points: testcase, tbb-7.0-must-alpha, | TorBrowserTeam201704 | Parent ID: | Points: Reviewer: | Sponsor: None -------------------------------------------------+-------------------------
Comment (by arthuredelstein): Not only does speechSythesis.getVoices() allow voices to be listed, but there are callbacks that would allow JS to time how long a phrase takes to be "uttered". So one possibility is to disable this API: https://github.com/arthuredelstein/tor-browser/commit/10283 I suppose another way would be to fake the callback so it always returns the same duration for a given phrase. Or block the callback event altogether. Not sure which of these is the best option. -- Ticket URL: <https://trac.torproject.org/projects/tor/ticket/10283#comment:11> Tor Bug Tracker & Wiki <https://trac.torproject.org/> The Tor Project: anonymity online _______________________________________________ tor-bugs mailing list tor-bugs@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs