[DISCUSSION] Fingerprinting

Hi everyone, I'd like to propose some changes to how Phoenix handles fingerprinting. Posting this here so that we can discuss it - because I'd really like to hear if there's any opposition to these changes, anything I'm missing, etc. I'll try to make this fairly brief *(previous attempt at writing this went on wayyyy too long...)*. **Currently**, in Standard/`Base` Phoenix configs *(what we recommend and what most people are using)*, we enable ETP Strict - which by extension, enables FPP (Mozilla's Fingerprinting Protection). This is currently better than nothing, but quite basic (Randomizes canvas data and restricts visibility of fonts). In Extended/`Hardened` Phoenix configs *(and IronFox by extension)*, we enable RFP (Resist Fingerprinting). This is very comprehensive (as it changes a **lot** of things...), and RFP also includes security advantages *(due to the attack surface reduction and reduced timer precision)*, but this comes at the cost of breakage and undesirable behavior for users. Simply put, it's not really possible to use RFP and not run into issues... This breakage is *especially* noticeable on Android, as one of RFP's protections includes blocking the extraction of canvas data. On desktop, Firefox prompts/asks permission for this *(meaning you can allow the extraction of canvas data for websites as needed while keeping RFP's other protections intact), but on Android, these prompts aren't supported; instead, Firefox **always** blocks the extraction of canvas data. This very commonly causes issues on lots of websites *(most notably breaks uploading images; rather than uploading your image, it will upload random patterns/pixels. This is quite problematic, especially due to the fact that in some cases, users may not even be aware their intended image wasn't actually uploaded...)*. Something else important to note is that you *can* exempt certain websites from RFP via the `privacy.resistFingerprinting.exemptedDomains` pref *(We currently do this for Apple Maps due to it breaking with one of RFP's protections...)* - but there are 2 major problems here. * 1: Websites added here are exempt from **all** of RFP's protections. Websites that break from RFP typically only do so due so to a single protection - so why disable RFP entirely for it and lose all of its other fingerprinting protections + security benefits? * 2: Websites added here are **also** exempt from FPP; meaning not only do you lose RFP for these websites, but you also lose **all fingerprinting protection**, period. Again, **why should we need to make this trade-off just for what is in a lot of cases just one single protection?** Since it's a given that you **will** experience breakage with RFP *(Especially on Android due to the canvas extraction explained above)*, your options are to either 1: deal with it and use a separate browser/etc. (meaning you'll likely be using something less private & secure and lose all of Phoenix's other benefits that aren't related to fingerprinting), 2: use it, but exempt websites with `privacy.resistFingerprinting.exemptedDomains`; meaning you lose RFP's security advantages + **all** fingerprinting protection, or 3: don't use RFP, and use FPP (meaning you're stuck with far weaker/less comprehensive protection). **So, I'm proposing another option here.** FPP allows customizing the fingerprinting protections it provides globally via the `privacy.fingerprintingProtection.overrides` pref. Setting it to `+AllTargets` effectively makes FPP identical to RFP in terms of what it protects, **and we can further customize it from there.** **For Phoenix, I propose setting `privacy.fingerprintingProtection.overrides` as follows:** ### For Standard/`Base` Phoenix configs: 1. **On Desktop:** We set `privacy.fingerprintingProtection.overrides` to `+AllTargets,-CanvasExtractionBeforeUserInputIsBlocked,-CSSPrefersColorScheme,-FrameRate,-HttpUserAgent,-JSDateTimeUTC`. To break down the `privacy.fingerprintingProtection.overrides` here: * `+AllTargets` - Enables all targets for FPP instead of the basic default ones described above. This effectively makes FPP = to RFP in terms of protection. * `-CanvasExtractionBeforeUserInputIsBlocked` - Prevents automatically dismissing permission prompts to extract canvas data, so that users are always notified and can act accordingly. Despite what the name suggests, extraction of canvas data **is** still blocked by default, and it's only allowed if the user grants permission. * `-CSSPrefersColorScheme` - Enables support for [CSS `prefers-color-scheme`](https://developer.mozilla.org/docs/Web/CSS/@media/prefers-color-scheme), allowing users to enable Dark Mode. * `-FrameRate` - Enables displaying content over 60FPS, important for users who have displays over 60HZ... * `-HttpUserAgent` - Prevents spoofing the OS in the HTTP user agent header. This is similar to Tor Browser's default behavior *(they have their own pref: privacy.resistFingerprinting.spoofOsInUserAgentHeader)*. This info is leaked elsewhere (like via navigator) so this brings little to no benefit, in exchange for weird breakage. *(Ex. trying to download Brave via the `Get Brave` button [on their website](https://brave.com/)...)* * `-JSDateTimeUTC` - Disables spoofing the timezone to `UTC-0`. 2. **On Android:** We set `privacy.fingerprintingProtection.overrides` to `+AllTargets,-CanvasExtractionBeforeUserInputIsBlocked,-CanvasImageExtractionPrompt,-CSSPrefersColorScheme,-FrameRate,-JSDateTimeUTC`. * `CanvasImageExtractionPrompt` - Allows websites to extract canvas data by default. Android doesn't support the prompt like desktop does like described above, so this is important for preventing breakage. We still randomize the canvas data extracted, and canvas data extraction by third parties is still blocked. * We remove `-HttpUserAgent` here since this isn't a problem on Android *(It spoofs OS to Android 10, so it doesn't cause issues like desktop)* ### For Extended/`Hardened` Phoenix configs *(Also applies to ex. IronFox)*: 1. **On Desktop:** We set `privacy.fingerprintingProtection.overrides` to `+AllTargets,-CanvasExtractionBeforeUserInputIsBlocked,-CSSPrefersColorScheme,-FrameRate`. * We remove `-HttpUserAgent` because it *can* be nice for those who disable JavaScript. *(Also protects OS in server logs, etc.)*. We can set granular overrides for websites that it causes issues on. 3. **On Android:** We set `privacy.fingerprintingProtection.overrides` to `+AllTargets,-CanvasImageExtractionPrompt,-CanvasExtractionBeforeUserInputIsBlocked,-CSSPrefersColorScheme,-FrameRate`. * We remove `-JSDateTimeUTC`, so that the timezone is still spoofed to `UTC-0`. This can be useful in certain cases (such as VPN users who's server is in a different region than their own, and want to avoid exposing their timezone/locale). ___ Additionally, using FPP, we can set granular per-site overrides via the `privacy.fingerprintingProtection.granularOverrides` pref. For example, instead of just adding `beta.maps.apple.com` to `privacy.resistFingerprinting.exemptedDomains`, we can set `privacy.fingerprintingProtection.granularOverrides` to `[{"firstPartyDomain": "apple.com", "overrides": "-WebGLRenderCapability"}]`. The downside is this applies to `apple.com` rather than solely `beta.maps.apple.com`... but now we can still keep all of RFP's fingerprinting protections intact for Apple Maps **except** for the `WebGLRenderCapability` target, meaning it'll work as expected. We can add more websites here as needed, and also take advantage of Mozilla's own per-site FPP overrides (via the `privacy.fingerprintingProtection.remoteOverrides.enabled` pref). Using these granular overrides, users can also enable certain protections we don't for specific websites if desired, etc. The downside to this new approach *(& customizing overrides like this in general, especially globally - which we'll have to make users aware of...)* is that we'll no longer always blend in with RFP users on standard Firefox or otherwise for these specific protections/targets. I'm not convinced this is a major issue to worry about. We already stand out from those users with other metrics, who are themselves still uniquely identifiable anyways through other means. **Unless you're using Tor Browser, you will always be fingerprintable in some way**. All we can do at the end of the day is fool naive fingerprinters *(Phoenix blocks known fingerprinters via Firefox's built-in lists + on desktop, uBlock Origin & our custom config, so this is already only talking about certain edge cases for fingerprinters we don't already catch...)*, and since we still preserve the majority of RFP's protections, when compared to RFP *(Phoenix's Extended/`Hardened` configs)*, I still feel that we're still fooling these naive fingerprinters effectively. When compared to default FPP on Firefox *(Standard/`Base` Phoenix configs, AKA I suspect most users...)*, we're now providing far more comprehensive protection against fingerprinting, but without all the breakage/weirdness, etc. Really curious to hear thoughts on this. :)