Firefox Borrows From Tor Browser Again, Blocks Canvas Fingerprinting (bleepingcomputer.com)

An anonymous reader writes: Mozilla engineers have borrowed yet another feature from the Tor Browser and starting with version 58 Firefox will block attempts to fingerprint users using the HTML5 canvas element. The technique is widely used in the advertising industry to track users across sites. Firefox 58 is scheduled for release on January 16, 2018.

Canvas fingerprinting blocking is the second feature Mozilla engineers have borrowed from the Tor Project. Previously, Mozilla has added a mechanism to Firefox 52 that prevents websites from fingerprinting users via system fonts. Mozilla's efforts to harden Firefox are part of the Tor Uplift project, an initiative to import more privacy-focused feature from the Tor Browser into Firefox.

Comments

Re:Addons

[markdavis]

I understand their reason and desire to switch to webextension, but the issue is that there are some things that many of us need to do that NO "webextension" addon is going to be allowed to do. This is because these new addons will not be allowed to modify the UI or underlying operation of the browser. Three such examples:

FlashStopper (stops html5 video autoplay)
ClassicThemeRestorer (makes the UI bearable)
EnvironmentProxy (sets proxy based on environment variables)

I am confident other important addons will be retained- I already see that UblockOrigin, Adblock Plus (as "AdBlock 57+"), and NukeAnything all work. But I can't bear to use the browser without certain other things.

Re:Addons

[markdavis]

Well said. I think the main issue was and has been, however, that Mozilla hasn't really been listening to what the users (and often developers) are saying. We wouldn't complain about the loss of addons that modify the UI had Mozilla not taken away the native ability for user to control the UI. A classic example is "tabs on bottom." It was HUGELY unpopular when Firefox finally removed that single option. And there was really no good reason to remove it. Addons saved the day, and now that will be gone too. And they added insult to injury by adding stuff that users didn't care about or want, things like screenprint, hello, pocket... things that could have easily been optional or even included addons. Development resources that could have gone to filling that UI-control that users do want, and/or performance, and/or bug fixing.

My example of the "Flash Stopper" addon really is a perfect example of the jam in which people find themselves. It is something the browser should be able to do, natively and correctly. Autoplay of video is a HUGE annoyance to many users. And the built-in feature that Firefox offers to supposedly help control the problem is just broken. Here is the bug report: https://bugzilla.mozilla.org/s... 2 years and still broken! And now the addon that fixed the problem for perhaps 50,000 users (who managed to find it) will be forever gone because WebExtensions won't allow even third-parties to fix it.

My other example- the Environment Proxy is another perfect example. Up to version XX (forget which), Firefox honored the environment variables for simple proxy control. And one day- BAM, it is just broken. An addon came out to work around the problem, and many years later, there is STILL no native fix. And WebExtensions will take away that solution, too.

So please understand why I am complaining so loudly. It isn't just about not liking change, there are real issues that leave me and others in a real pickle.

Re:Unfortunately blocking is self identifying

[fahrbot-bot]

Unfortunately this sounds good on paper but in practice it's not going to make any difference for now. Until a sizable portion of browsers do this, blocking is actually going to be an identifying characteristic. The advertisers are going to get a line up of victims and instead of you being the one with Arial and Roboto on their hat, you're going to be the one wearing the tin foil one. That's still a unique, identifying feature until enough of us are wearing tin-foil that they can't tell us apart (by our hats).

Firefox usage is still above 5% nowadays. Not much, but enough to ensure improvement over identification through font fingerprinting. Blocking at least hides software (OS)/hardware details, which make targeting vulnerabilities a lot harder.

Though I can't attest to the validity of the argument, here's an article I thought was interesting describing how blocking canvas fingerprinting on a low-adoption scale may make one more easily trackable (as the blocking can be used as an identifier): How Canvas Fingerprint Blockers Make You Easily Trackable If the argument is valid, then adding the capability to Firefox and having blocking enabled by default will help eceryone.