3 ms·

Plugin fingerprint protection was removed 3 years ago by a poorly-reasoned patch, favoring the large bug of unimpeded surveillance over the very tiny bug of sit

by Zooper 8y ago

Plugin fingerprint protection was removed 3 years ago by a poorly-reasoned patch, favoring the large bug of unimpeded surveillance over the very tiny bug of sites looping through non-existent lists if and only if they need to interact with a plugin. Seeing the conversation, I'm looking for a different browser. "remove_plugins-enumerable_names.patch Bug 757726 hid most plugins from navigator.plugins enumeration to reduce fingerprinting. Plugin detection scripts could ask for a plugin or MIME type by name, but they couldn't get a list of all installed plugins. Unfortunately, the feature had to be disabled because it broke pretty much all plugin detection scripts because they naively search for the desired plugin using an O(n) loop instead of a O(1) query. This patch removes the disabled code because it is unlikely we could ever re-enable it. In addition to removing the obsolete navigator.plugin tests for detecting hidden plugins, it adds tests for detecting click-to-play and disabled plugins."

gsnedders 8y ago
Note with Firefox supporting only one NPAPI plugin now (Flash), as of https://bugzilla.mozilla.org/show_bug.cgi?id=1269807 https://bugzilla.mozilla.org/show_bug.cgi?id=1269807, the enumeration case is identical to the probe case.
bzbarsky 8y ago
The site bug wasn't "sites looping through non-existent lists if and only if they need to interact with a plugin". It was sites trying to detect whether Flash is installed by looping over the list, deciding it's not installed, and not trying to play the video (or the game or whatever), instead pointing the user to a "Download Flash" page. This affected enough sites that it was a serious problem for users, not a "very tiny bug". In any case, at this point Firefox supports exactly one plug-in, so all enumeration can tell you is whether Flash is installed or not. That's still one bit of data, of course, but that bit could be extracted even with the "no enumeration" patch by explicitly querying whether Flash is supported.

by Zooper 8y ago

gsnedders 8y ago

Note with Firefox supporting only one NPAPI plugin now (Flash), as of https://bugzilla.mozilla.org/show_bug.cgi?id=1269807 https://bugzilla.mozilla.org/show_bug.cgi?id=1269807, the enumeration case is identical to the probe case.

bzbarsky 8y ago

The site bug wasn't "sites looping through non-existent lists if and only if they need to interact with a plugin". It was sites trying to detect whether Flash is installed by looping over the list, deciding it's not installed, and not trying to play the video (or the game or whatever), instead pointing the user to a "Download Flash" page. This affected enough sites that it was a serious problem for users, not a "very tiny bug". In any case, at this point Firefox supports exactly one plug-in, so all enumeration can tell you is whether Flash is installed or not. That's still one bit of data, of course, but that bit could be extracted even with the "no enumeration" patch by explicitly querying whether Flash is supported.