#25451: Tor window size leaks information --------------------------------------+--------------------------- Reporter: cypherpunks | Owner: tbb-team Type: defect | Status: closed Priority: Medium | Milestone: Component: Applications/Tor Browser | Version: Severity: Normal | Resolution: duplicate Keywords: | Actual Points: Parent ID: | Points: Reviewer: | Sponsor: --------------------------------------+--------------------------- Changes (by gk):
* status: new => closed * resolution: => duplicate Comment: Replying to [ticket:25451 cypherpunks]: > Tor's default browser size is too small and resizing can leak information, because resizing to a common internal window size is difficult. The window size quantizing that tor browser does/used to do (I can't get it to work in this latest version, 7.0.7) was never very good anyway, and typically resulting in fairly unique fingerprints as per EFF panopticlick. You should update your Tor Browser as version 7.0.7 is meanwhile full of serious and known security bugs. > A workaround is to somehow get the internal window size (the size of the content window, sans toolbars and etc), and make it a common monitor resolution by resizing the window to that size + the size of the toolbars, for example I have been using: > {{{ > until xdotool search --name "About Tor - Tor Browser" windowsize 1920 1183 ; do > sleep 0.5; > done > }}} > > on tor browser startup which gives me an internal window size of 1920x1080, which panopticlick says has only 2.44 bits of identifying information (1/5 browsers share this value, supposedly). > > However, this is fragile, and minuscule changes to font rendering settings that change font sizes by so much as a pixel can completely throw this off and result in an extremely unique browser fingerprint. > > I can think of a few ways this might be solved, some of which may work in combination with each other: > > * Have a setting in Tor Browser for a fixed content window size, which will resize the whole window to fit You can already do that by using `privacy.window.maxInnerWidth` and `privacy.window.maxInnerHeight`. Not sure how many folks are using them, though. You might stand out quite a bit. > * Have some kind of prompt for the user to choose between common browser content window sizes (is there information anywhere on which sizes are the most common?) > * Default to the largest common browser window size, and on resize snap the window size to other common browser content window resolutions > > Most of these involve knowing ahead of time which browser content window sizes are common however, which I couldn't find online. Yes, and that is part of the problem. I still think we should get #14429 working and try if that fits the needs of our users. Marking this one as a duplicate. -- Ticket URL: <https://trac.torproject.org/projects/tor/ticket/25451#comment:3> Tor Bug Tracker & Wiki <https://trac.torproject.org/> The Tor Project: anonymity online
_______________________________________________ tor-bugs mailing list tor-bugs@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs