ToDo: followsups / extras / ideas #3

[Thorin-II]

🔹 Pages I use to keep tabs on a few things

• SpiderMonkey
• L10N
• Experimental features (not always up to date!)

---

🟥 ToDo

🟩 perf

• ongoing: reduce fonts in list(s) - see #34

🟩 isVars

• harden isFF with items from isEngine, and thus isEngine for gecko/goanna
• replace isEngine math (for non-gecko/goanna)
• harden isOS
• harden navKeys with knownGood, knownPoison from isEngine

🟩 general: fingerprints, sections, lies

• general: add overlay popup to show results for each section and overall
  • examples: https://developer.chrome.com/blog/what-is-the-top-layer/
• general: add a user-initiated i.e [click here]'s global FP
  • reset each gRun
  • update or add each metric when a metric is run
• handle passing objects as well as arrays
• don't use .join()
  • don't use .join() on arrays for all sDetail data (where we can now use objects or arrays)
  • don't use .join() anywhere else unless we have to (or it is safe)
• preserve typeof where possible
  * e.g. screen metric width/height is a joined string but we already test for NaN
• general: ongoing
  • knownLies (from mathematical proofs etc)
  • apply prototypeLies to metrics
  • logic -> check knownLies -> if no lies then check prototypeLie -> into the section hash data -> into overall hash data
• general: ongoing
  • robust error handling, detection of script blockage: e.g. screen.js needs work

🟦 screen

• screen: viewport units
  • viewport units sv*
  • viewport units lv* units on android
• screen: android: dynamic toolbar
• document.documentElement
• from expand screen methods #29
  • intersectionObserver
  • matchMedia object
  • detect screen via getComputedStyle: https://jsfiddle.net/jrnca3wh/
  • @media: https://jsfiddle.net/w8qxu1p2/1/
  • @import can access media queries: https://jsfiddle.net/873kspn4/1/

🟦 ua

• WorkerNavigator
• ua: refactor
  • always return 11 results
  • relax oscpu for specific linux distro strings
  • harden oscpu: win7 vs win8/10 via tiny font check
  • harden userAgent from the other parts: i.e userAgent is constructed using a set method
  • bypass more parts of the userAgent than just version where possible
  • only bypass the six "hardcoded" parts - we always detect without proxyLies
  • don't try to bypass the variable FF strings because that may indeed be the string, e.g forks, special user builds, useragent-override pref(s) ... only detect untrustworthy via proxyLies

🟦 feature detection

• feature detection: new math test for android if isVer is FF68+
  • moved to misc, split into RFP vs other, extended tests to cover android entropy

🟦 language

• language: investigate NumberFormat v3 1648137 + 1795756
• language: add fractionalSecondDigits etc
  • see 1645107, also FF121 1855747
  • https://github.com/tc39/ecma402/pull/347
• future
  • Intl.Segmenter - 1423593, github, spec
  • Temporal - 1519167, github, article, spec + cookbook
  • Intl.LocaleInfo - 1693576, github
  • Intl.Enumeration - github
  • Intl.MessageFormat - github

🟦 storage

• storage: auto-output estimate as it doesn't need permission
• storage: finish the tests

🟦 devices

• devices: screen refresh - see add animation / screen refresh/hrtz #168
• devices: more pointer tests
  • android: touch tests: radiusX/Y, screenX/Y, clientX/Y
  • pointerid
• devices: enumerate gamepads/vrdisplays

🟦 svg

• svg: such as
  • ExtentOfChar
  • SVGTextContentElement.prototype.getComputedTextLength
  • SVGPathElement.prototype.getTotalLength
  • SVGGeometryElement.getPointAtLength()

🟦 canvas

• canvas: add noise fingerprint (just for toDataURL)
• canvas: harden RFP random detection - see https://arkenfox.github.io/TZP/tests/canvasrfp.html
• canvas: add offscreenCanvas
• canvas: add convertToBlob

🟦 webgl

• webgl: add properties/parameters: split into 1, 2, experimental groups and subgroups e.g. affected by RFP/prefs
  • split: e.g. minimal mode RFP restrictions in 1217290 FF57+
• webgl: add image tests
  • make sure to expand/test on error entropy for readPixels
  • e.g. in VM's which usually block the graphics driver and the error messages can differ
  • make sure error entropy is handled for TB slider and VMs

🟦 audio

• audio: see audioLies + audio data #67
  • expand methods: see audioLies + audio data #67 (comment)
  • detect known lie: see audioLies + audio data #67 (comment)
  • MOAR: see DynamicsCompressorNode.reduction - audioLies + audio data #67 (comment)
• audio: android bug? ac-outputLatency is always 0 even after two tries
  • see 1612093 as well
  • we can ignore this, since we it is hard-coded in RFP, is zero otherwise, except on newer android versions where we just return "variable" (not entirely sure this is the case for android, but since we know RFP protects this, we don't need to collect entropy)

🟦 fonts

• fonts: add domrect methods (bounding, bounding range, client, client range)
  • and use this (if trustworthy) for sizes (more precision)
• fonts: graphite: use base64
• fonts: transform - on domrect
• fonts: fontFace: enumerate some weighted fonts, check RFP/TB leaks
• fonts: max sizes
• fonts: add system-ui to tests 1226042
• fonts: update lists
  • windows up to 11
  • mac up to macOS 15
    • now 10.15 is the minimum in ESR128+ we can also clean out some old crap
  • android updated with moz telemetry data
  • linux: load some VMs and pick the eyes out
• fonts: add more enumeration methods (maybe via [click here])
  • font face (we already have a smaller test for weighted fonts + leaks)
  • offscreenCanvas (we already a smaller test for leaks)
  • svg
• text-autosize aka font inflation / font boosting (acessibility)
• unicode support + FP based on code points assigned per script/version
• emoji support + FP
• textMetrics: offscreenCanvas
• textMetrics: randomness
  • https://gregtatum.com/writing/2021/diacritical-marks/ for combining unicode
  • double char non-matching
  • combine char with preceeding/next char in looped list: triple-variable-char test
  • number of decimal places
  • non 128ths

🟦 media

• media: improve audio/video lists
  • reduce list for perf (we only care about FF), add items for entropy
• media: mediacapabilities FP
  • also see 1461454
  • https://w3c.github.io/media-capabilities/#security-privacy-considerations
• media: image hash: encoding/decoding FP?

🟦 css

• css: prefers-contrast notation - tests, article
  • WTF is this 1658780
• css: detect changes to expected values (e.g. dark readers)
  • e.g. window.getComputedStyle(document.getElementsByTagName("body")[0]).backgroundColor

🟦 elements

• clientrect
  • add more methods: BBox, rootBounds etc
• line height
  • loop sizes, use clientrect lies to determine fallback method, transform scale to hopefully force decimal precision: devicePixelRatio may cause entropy plus it also means clientrect lies make sense
  • transform:scale() to force decimals
  • loop by generic-value font-family
• mathml
  • https://frederic-wang.fr/update-on-open-type-math-fonts.html
  • loop sizes
  • transform:scale() to force decimals
  • use domrect, not offSet
  • record width and height
  • use multiple mathml divs to measure different mathml things
    • e.g. https://privacycheck.sec.lrz.de/active/fp_ml/fp_ml.html
    • http://eyeasme.com/Joe/MathML/MathML_browser_test.html
• widgets / form controls
• all other elements

🟦 timing

• timing: yay!

🟦 misc

---

🟫 BACKBURNER

• fonts: can we do anything with zalgo
  • https://en.wikipedia.org/wiki/Zalgo_text, http://www.eeemo.net/, https://lingojam.com/GlitchTextGenerator
  • interesting: https://gregtatum.com/writing/2021/diacritical-marks/
• general: make worker fingerprint global
  • waste of time until we start adding lots of worker tests
  • currently there is only the ua and language sections, results are not used anywhere
  • instead all worker data should be a separate global FP which we use after the fact to report lies
    • i.e we still output a sub-section worker hash (and diffs to doc), but report lies/mismatches in global
• general: make iframes fingerprint global (same deal as workers above)
• language: injecting resource:// css files for app lang leaks
• other: WebRTC
• other: isAdBlocking [also: hash of results]
• other: sanitizing / zombie storage - prototype
• screen: mod border-snapping subPixel devicePixelRatio PoC to use clientrect for more precision

...

[abrahamjuliot]

I'm currently at 140kb and CSS is 157kb 😭.

[Thorin-II]

well I got my 11.5 yr old PC down to ~210ms (including adding the webgl at around 15ms)

anyway, here's my new rig, current code

• this is running as file:// and then hitting F5 to eliminate noise and get a stable and best case
  

@abrahamjuliot ... I think I can get down to 50ms . what do you think?

[abrahamjuliot]

Nice. Do we lose a lot of entropy with shorter font lists? Maybe that can be cut by half.