https://wiki.mozilla.org/api.php?action=feedcontributions&feedformat=atom&user=Mikeperry 2026-09-11T21:14:22Z User contributions MediaWiki 1.39.10 https://wiki.mozilla.org/index.php?title=Talk:Privacy/Roadmap_2011&diff=318030 2011-06-13T01:15:39Z

<p>Mikeperry: /* Deploy Safe and Rational Defaults */</p> <hr /> <div>=== Improve Private &amp; Semi-anonymous Browsing ===<br /> <br /> I think per-tab private mode is likely to be confusing. I think the more intuitive way to provide this linkability improvement is by isolating the browser state for a given top-level urlbar domain (ie the double-keying Cookie idea but applied to cache, DOM Storage, client certs, etc).<br /> <br /> OTOH, the ability to have a per-window private mode, or perhaps even just a single concurrent private mode consisting of many windows may make sense. For example, I think Chrome's Incognito Mode windows are very intuitive for this reason. I think it also does make sense to have all private browsing windows share the same virtual profile.<br /> <br /> On the third hand, the downside of concurrent use is that it makes the &quot;I'll just go to the wifi cafe or tether my cell phone&quot; use case more difficult. That user will end up linking themselves via all the activity in their previous tabs/windows.<br /> <br /> - [[mikeperry]]<br /> <br /> === Deploy Safe and Rational Defaults ===<br /> <br /> While I think that improving the referer situation is useful in some cases, it really doesn't do anything to stop bad actors. I think giving sites control over when referer info is sent to third parties should be a higher priority than just restricting it client side, so sites can control the leakage of their PII themselves. Right now it simply is not possible for sites to restrict referer for many elements. Providing trickle-down restrictions via CSS or via an attribute of the html or body tag would be ideal.<br /> <br /> Perhaps the way to do this for private browsing mode is to create an attribute that says &quot;Yes transmit referer&quot;, and have referer disabled or restricted otherwise.<br /> <br /> After all, if bad actors really want to pass data to their third parties, they have plenty of options available for this even if referer is restricted/eliminated...<br /> <br /> <br /> - [[mikeperry]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=317982 2011-06-12T04:16:20Z

<p>Mikeperry: /* Interface and Options */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> Ideally, these requirements would be satisfied in such a way as to make it difficult or impossible to determine if Anonymous Browsing is enabled, but this may come at a cost of some resistance to fingerprinting.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language. Further, dropping items from the UA string while only in Anonymous Browsing Mode would reveal the fact that the user is using the mode.<br /> <br /> The other way to handle this would be to simply pick a user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton.<br /> <br /> It should be noted that the Firefox minor revision and other properties can still be determined by inspecting Components.interfaces, so [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070] would need to be fixed for these protections to have any real value.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> Referer and querystring identifiers: {{bug|587523|Protect path of HTTP Referer Header when in a possible future anonymous mode}}<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Installed font presence provides a large amount of identifying information. Currently, the major culprit of leaking this information is plugins, as they provide an unsorted complete enumeration of all system fonts.<br /> <br /> There are ways to [http://flippingtypical.com/ query fonts for existence] in JavaScript and CSS, but this issue is not really worth dealing with until the plugin problem is solved, or it is decided that non-compliant plugins should be disabled.<br /> <br /> Because of the issues with localization and finding a common set of default fonts, the best option here is probably to limit the number of local fonts a tab can load. Precedence can be given to remote font files so they do not count against this limit. Research should be performed to find the typical number of fonts loaded by the top 1000 sites and set the limit high enough not to break any of them.<br /> <br /> ==Clock Delta+Precision==<br /> The Date object currently provides millisecond accuracy. This accuracy can be<br /> used as an identifier based on clock skew, or can be used to accurately measure<br /> user behaviours for use in fingerprinting.<br /> <br /> At least two companies claim to use this accuracy to fingerprint users when<br /> other methods fail:<br /> http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-finger-unauthorized-users.ars<br /> <br /> One possibility might be to quantize Date values to the second, and then add random, monotonically increasing amounts of milliseconds to subsequent calls during anonymous browsing mode, along with a random per-page or per-origin offset. Another possibility would be to simply bin the milliseconds to low resolution (250ms or so). Studies would need to be done to determine how effective either approach is.<br /> <br /> Additionally, interval timers and event timestamps would need reduced resolution, due to computational fingerprinting:<br /> http://w2spconf.com/2011/papers/jspriv.pdf<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode. This is obviously a long-term strategy.<br /> <br /> Similarly, another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> Shorter-term, it may be best to leverage the permissions manager to disable all plugins by default. If an object tag or an access to window.plugins is detected, the chrome could ask the user if they would like to enable that plugin for that top-level domain only. Keeping plugin permissions isolated to the top-level urlbar domain would at least cut down on linkability between domains.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, in general it is best to minimize options that have an effect on browser behavior. Such options become fingerprintable attributes.<br /> <br /> However, visual and local preferences are still desirable. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=317981 2011-06-12T04:06:44Z

<p>Mikeperry: /* Plug-Ins */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> Ideally, these requirements would be satisfied in such a way as to make it difficult or impossible to determine if Anonymous Browsing is enabled, but this may come at a cost of some resistance to fingerprinting.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language. Further, dropping items from the UA string while only in Anonymous Browsing Mode would reveal the fact that the user is using the mode.<br /> <br /> The other way to handle this would be to simply pick a user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton.<br /> <br /> It should be noted that the Firefox minor revision and other properties can still be determined by inspecting Components.interfaces, so [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070] would need to be fixed for these protections to have any real value.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> Referer and querystring identifiers: {{bug|587523|Protect path of HTTP Referer Header when in a possible future anonymous mode}}<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Installed font presence provides a large amount of identifying information. Currently, the major culprit of leaking this information is plugins, as they provide an unsorted complete enumeration of all system fonts.<br /> <br /> There are ways to [http://flippingtypical.com/ query fonts for existence] in JavaScript and CSS, but this issue is not really worth dealing with until the plugin problem is solved, or it is decided that non-compliant plugins should be disabled.<br /> <br /> Because of the issues with localization and finding a common set of default fonts, the best option here is probably to limit the number of local fonts a tab can load. Precedence can be given to remote font files so they do not count against this limit. Research should be performed to find the typical number of fonts loaded by the top 1000 sites and set the limit high enough not to break any of them.<br /> <br /> ==Clock Delta+Precision==<br /> The Date object currently provides millisecond accuracy. This accuracy can be<br /> used as an identifier based on clock skew, or can be used to accurately measure<br /> user behaviours for use in fingerprinting.<br /> <br /> At least two companies claim to use this accuracy to fingerprint users when<br /> other methods fail:<br /> http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-finger-unauthorized-users.ars<br /> <br /> One possibility might be to quantize Date values to the second, and then add random, monotonically increasing amounts of milliseconds to subsequent calls during anonymous browsing mode, along with a random per-page or per-origin offset. Another possibility would be to simply bin the milliseconds to low resolution (250ms or so). Studies would need to be done to determine how effective either approach is.<br /> <br /> Additionally, interval timers and event timestamps would need reduced resolution, due to computational fingerprinting:<br /> http://w2spconf.com/2011/papers/jspriv.pdf<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode. This is obviously a long-term strategy.<br /> <br /> Similarly, another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> Shorter-term, it may be best to leverage the permissions manager to disable all plugins by default. If an object tag or an access to window.plugins is detected, the chrome could ask the user if they would like to enable that plugin for that top-level domain only. Keeping plugin permissions isolated to the top-level urlbar domain would at least cut down on linkability between domains.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=317980 2011-06-12T03:54:09Z

<p>Mikeperry: /* Clock Delta+Precision */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> Ideally, these requirements would be satisfied in such a way as to make it difficult or impossible to determine if Anonymous Browsing is enabled, but this may come at a cost of some resistance to fingerprinting.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language. Further, dropping items from the UA string while only in Anonymous Browsing Mode would reveal the fact that the user is using the mode.<br /> <br /> The other way to handle this would be to simply pick a user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton.<br /> <br /> It should be noted that the Firefox minor revision and other properties can still be determined by inspecting Components.interfaces, so [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070] would need to be fixed for these protections to have any real value.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> Referer and querystring identifiers: {{bug|587523|Protect path of HTTP Referer Header when in a possible future anonymous mode}}<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Installed font presence provides a large amount of identifying information. Currently, the major culprit of leaking this information is plugins, as they provide an unsorted complete enumeration of all system fonts.<br /> <br /> There are ways to [http://flippingtypical.com/ query fonts for existence] in JavaScript and CSS, but this issue is not really worth dealing with until the plugin problem is solved, or it is decided that non-compliant plugins should be disabled.<br /> <br /> Because of the issues with localization and finding a common set of default fonts, the best option here is probably to limit the number of local fonts a tab can load. Precedence can be given to remote font files so they do not count against this limit. Research should be performed to find the typical number of fonts loaded by the top 1000 sites and set the limit high enough not to break any of them.<br /> <br /> ==Clock Delta+Precision==<br /> The Date object currently provides millisecond accuracy. This accuracy can be<br /> used as an identifier based on clock skew, or can be used to accurately measure<br /> user behaviours for use in fingerprinting.<br /> <br /> At least two companies claim to use this accuracy to fingerprint users when<br /> other methods fail:<br /> http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-finger-unauthorized-users.ars<br /> <br /> One possibility might be to quantize Date values to the second, and then add random, monotonically increasing amounts of milliseconds to subsequent calls during anonymous browsing mode, along with a random per-page or per-origin offset. Another possibility would be to simply bin the milliseconds to low resolution (250ms or so). Studies would need to be done to determine how effective either approach is.<br /> <br /> Additionally, interval timers and event timestamps would need reduced resolution, due to computational fingerprinting:<br /> http://w2spconf.com/2011/papers/jspriv.pdf<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=317979 2011-06-12T03:47:35Z

<p>Mikeperry: /* Fonts and Font Lists */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> Ideally, these requirements would be satisfied in such a way as to make it difficult or impossible to determine if Anonymous Browsing is enabled, but this may come at a cost of some resistance to fingerprinting.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language. Further, dropping items from the UA string while only in Anonymous Browsing Mode would reveal the fact that the user is using the mode.<br /> <br /> The other way to handle this would be to simply pick a user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton.<br /> <br /> It should be noted that the Firefox minor revision and other properties can still be determined by inspecting Components.interfaces, so [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070] would need to be fixed for these protections to have any real value.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> Referer and querystring identifiers: {{bug|587523|Protect path of HTTP Referer Header when in a possible future anonymous mode}}<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Installed font presence provides a large amount of identifying information. Currently, the major culprit of leaking this information is plugins, as they provide an unsorted complete enumeration of all system fonts.<br /> <br /> There are ways to [http://flippingtypical.com/ query fonts for existence] in JavaScript and CSS, but this issue is not really worth dealing with until the plugin problem is solved, or it is decided that non-compliant plugins should be disabled.<br /> <br /> Because of the issues with localization and finding a common set of default fonts, the best option here is probably to limit the number of local fonts a tab can load. Precedence can be given to remote font files so they do not count against this limit. Research should be performed to find the typical number of fonts loaded by the top 1000 sites and set the limit high enough not to break any of them.<br /> <br /> ==Clock Delta+Precision==<br /> The Date object currently provides millisecond accuracy. This accuracy can be<br /> used as an identifier based on clock skew, or can be used to accurately measure<br /> user behaviours for use in fingerprinting.<br /> <br /> At least two companies claim to use this accuracy to fingerprint users when<br /> other methods fail:<br /> http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-finger-unauthorized-users.ars<br /> <br /> One possibility might be to quantize Date values to the second, and then add random, monotonically increasing amounts of milliseconds to subsequent calls during anonymous browsing mode, along with a random per-page or per-origin offset.<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317978 2011-06-11T23:51:01Z

<p>Mikeperry: </p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.* (multiple bugs)<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P1<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.1<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P2<br /> | Provide mechanisms to clear cert store and STS <br /> |<br /> |<br /> |<br /> | 2 &amp; 3<br /> |-<br /> | P3<br /> | Disable addons that don't observe &quot;private-browsing&quot; event/opt-in<br /> |<br /> |<br /> |<br /> | 1.1 &amp; 2<br /> |-<br /> | P3<br /> | Virtualized/memory-only permissions manager and site-specific options<br /> |<br /> |<br /> |<br /> | 2 &amp; 3<br /> |-<br /> | P3<br /> | Provide about:config pref to limit number of fonts loaded per tab<br /> |<br /> |<br /> |<br /> | 1.2 &amp; 2<br /> |-<br /> | P4<br /> | Expose local font loading control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 1.2 &amp; 2<br /> |-<br /> | P4<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2 &amp; 2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317977 2011-06-11T23:32:21Z

<p>Mikeperry: </p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.*<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P1<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.1<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P2<br /> | Provide mechanisms to clear cert store and STS <br /> |<br /> |<br /> |<br /> | 2 &amp; 3<br /> |-<br /> | P3<br /> | Disable addons that don't observe &quot;private-browsing&quot; event/opt-in<br /> |<br /> |<br /> |<br /> | 1.1 &amp; 2<br /> |-<br /> | P3<br /> | Virtualized/memory-only permissions manager and site-specific options<br /> |<br /> |<br /> |<br /> | 2 &amp; 3<br /> |-<br /> | P3<br /> | Provide about:config pref to limit number of fonts loaded per tab<br /> |<br /> |<br /> |<br /> | 1.2 &amp; 2<br /> |-<br /> | P4<br /> | Expose local font loading control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 1.2 &amp; 2<br /> |-<br /> | P4<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2 &amp; 2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317976 2011-06-11T23:27:57Z

<p>Mikeperry: </p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.*<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P1<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.1<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P2<br /> | Provide mechanisms to clear cert store and STS <br /> |<br /> |<br /> |<br /> | 2 &amp; 3<br /> |-<br /> | P3<br /> | Disable addons that don't observe &quot;private-browsing&quot; event/opt-in<br /> |<br /> |<br /> |<br /> | 1.1,2<br /> |-<br /> | P3<br /> | Virtualized/memory-only permissions manager and site-specific options<br /> |<br /> |<br /> |<br /> | 2 &amp; 3<br /> |-<br /> | P3<br /> | Provide about:config pref to limit number of fonts loaded per tab<br /> |<br /> |<br /> |<br /> | 1.2 &amp; 2<br /> |-<br /> | P4<br /> | Expose local font loading control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 1.2 &amp; 2<br /> |-<br /> | P4<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2 &amp; 2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317975 2011-06-11T23:21:11Z

<p>Mikeperry: /* Features and bugs */</p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.*<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P1<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.1<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P2<br /> | Provide mechanisms to clear cert store and STS <br /> |<br /> |<br /> |<br /> | 2 &amp; 3<br /> |-<br /> | P3<br /> | Virtualized/memory-only permissions manager and site-specific options<br /> |<br /> |<br /> |<br /> | 2 &amp; 3<br /> |-<br /> | P3<br /> | Provide about:config pref to limit number of fonts loaded per tab<br /> |<br /> |<br /> |<br /> | 1.2 &amp; 2<br /> |-<br /> | P4<br /> | Expose local font loading control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 1.2 &amp; 2<br /> |-<br /> | P4<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2 &amp; 2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317974 2011-06-11T23:18:10Z

<p>Mikeperry: /* Features and bugs */</p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.*<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P1<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.1<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P2<br /> | Provide mechanisms to clear cert store and STS <br /> |<br /> |<br /> |<br /> | 2,3<br /> |-<br /> | P3<br /> | Virtualized/memory-only permissions manager and site-specific options<br /> |<br /> |<br /> |<br /> | 2,3<br /> |-<br /> | P3<br /> | Provide about:config pref to limit number of fonts loaded per tab<br /> |<br /> |<br /> |<br /> | 1.2,2<br /> |-<br /> | P4<br /> | Expose local font loading control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 1.2,2<br /> |-<br /> | P4<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2,2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317973 2011-06-11T23:12:56Z

<p>Mikeperry: /* Features and bugs */</p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2<br /> |-<br /> | P2<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.1<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.*<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P2<br /> | Provide mechanisms to clear cert store and STS <br /> |<br /> |<br /> |<br /> | 2,3<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P2<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2,2<br /> |-<br /> | P3<br /> | Virtualized/memory-only permissions manager and site-specific options<br /> |<br /> |<br /> |<br /> | 2,3<br /> |-<br /> | P3<br /> | Expose local font loading control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 1.2,2<br /> |-<br /> | P3<br /> | Provide about:config pref to limit number of fonts loaded per tab<br /> |<br /> |<br /> |<br /> | 1.2,2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317972 2011-06-11T23:07:44Z

<p>Mikeperry: /* Features and bugs */</p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2<br /> |-<br /> | P2<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.1<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.*<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P2<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2,2<br /> |-<br /> | P3<br /> | Virtualized/memory-only permissions manager and site-specific options<br /> |<br /> |<br /> |<br /> | 2,3<br /> |-<br /> | P3<br /> | Expose local font loading control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 1.2,2<br /> |-<br /> | P3<br /> | Provide about:config pref to limit number of fonts loaded per tab<br /> |<br /> |<br /> |<br /> | 1.2,2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317971 2011-06-11T23:04:50Z

<p>Mikeperry: /* Features and bugs */</p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2<br /> |-<br /> | P2<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.1<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.*<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P3<br /> | Virtualized/memory-only permissions manager and site-specific options<br /> |<br /> |<br /> | 2,3<br /> |-<br /> | P3<br /> | Expose local font loading control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 1.2,2<br /> |-<br /> | P3<br /> | Provide about:config pref to limit number of fonts loaded per tab<br /> |<br /> |<br /> |<br /> | 1.2,2<br /> |-<br /> | P2<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2,2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317970 2011-06-11T22:59:32Z

<p>Mikeperry: /* Features and bugs */</p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2,2<br /> |-<br /> | P2<br /> | Limit CSS3 resolution and window.screen info to render window size<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Block content-window script from accessing Components.*<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local disk privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P3<br /> | Expose font control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P2<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2,2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317969 2011-06-11T22:46:07Z

<p>Mikeperry: </p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1.2,2<br /> |-<br /> | P2<br /> | Expose display resolution to about:config spoofing<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> | 1.2<br /> |-<br /> | P1<br /> | Make local privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P3<br /> | Expose font control to XPCOM/observers<br /> |<br /> |<br /> |<br /> | 2<br /> |-<br /> | P2<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1.2,2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317968 2011-06-11T22:37:43Z

<p>Mikeperry: </p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1,3<br /> |-<br /> | P1<br /> | Expose display resolution to about:config spoofing<br /> |<br /> |<br /> |<br /> |<br /> |-<br /> | P2<br /> | Double-key Cache, DOM Storage, client certs, http auth<br /> |<br /> |<br /> |<br /> |<br /> |-<br /> | P1<br /> | Make local privacy optional in Private Browsing Mode<br /> |<br /> |<br /> |<br /> |<br /> |-<br /> | P3<br /> | Expose font control to XPCOM/observers<br /> |<br /> |<br /> |<br /> |<br /> |-<br /> | P2<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1,2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Privacy/Roadmap/Tor&diff=317967 2011-06-11T22:24:32Z

<p>Mikeperry: </p> <hr /> <div>= Advancing Anonymity =<br /> <br /> This document is a high-level vision for enhancing anonymity on the web, especially supporting the efforts of [http://www.torproject.org the Tor project]. Not everyone wants to be completely anonymous, but we should help those who want control their anonymity online.<br /> <br /> '''Related:'''<br /> * [[Security/Anonymous_Browsing]]<br /> * [[Thirdparty]]<br /> <br /> == Vision ==<br /> Ultimately, it's really hard to be anonymous online right now. On top of that, it's really hard for projects to harness Firefox as a platform that can be extended into an anonymity-instilling tool. We want it to be easy for users to be as anonymous as possible in Firefox, and it should be easy for Tor developers to make sure Firefox is easy to configure as a platform for anonymous browsing.<br /> <br /> There are three desired outcomes that will make Firefox a better home for Tor:<br /> # Better API-level switches for add-ons like torbutton to control Firefox's behavior<br /> # Improve Private Browsing Mode<br /> ## Reduced Fingerprintability (leaky pipes)<br /> ## Robust suite of experimental/radical privacy features<br /> # Better local security and privacy (non-network anonymity)<br /> <br /> = Features and bugs =<br /> <br /> {|class=wikitable<br /> ! Priority<br /> ! Item<br /> ! Status<br /> ! ETA<br /> ! Owner<br /> ! Outcomes<br /> |-<br /> | P1<br /> | {{bug|565965|Double-key cookies}}<br /> | {{StatusAtRisk|status=stalled}}<br /> | TBD<br /> | <br /> | 1,3<br /> |-<br /> | P1<br /> | Expose display resolution to about:config spoofing<br /> |<br /> |<br /> |<br /> |<br /> |-<br /> | P2<br /> | [[Opt-in activation for plugins]]<br /> |<br /> | TBD<br /> | <br /> | 1,2<br /> |}<br /> <br /> = Roadmap =<br /> <br /> Links to implementation plan and progress:<br /> * [[Firefox/Flight Tracking]]<br /> * [[Firefox/Features]]<br /> <br /> <br /> <br /> [[Category:Roadmaps]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Talk:Privacy/Roadmap_2011&diff=317909 2011-06-11T00:11:58Z

<p>Mikeperry: /* Deploy Safe and Rational Defaults */</p> <hr /> <div>=== Improve Private &amp; Semi-anonymous Browsing ===<br /> <br /> I think per-tab private mode is likely to be confusing. I think the more intuitive way to provide this linkability improvement is by isolating the browser state for a given top-level urlbar domain (ie the double-keying Cookie idea but applied to cache, DOM Storage, client certs, etc).<br /> <br /> OTOH, the ability to have a per-window private mode, or perhaps even just a single concurrent private mode consisting of many windows may make sense. For example, I think Chrome's Incognito Mode windows are very intuitive for this reason. I think it also does make sense to have all private browsing windows share the same virtual profile.<br /> <br /> On the third hand, the downside of concurrent use is that it makes the &quot;I'll just go to the wifi cafe or tether my cell phone&quot; use case more difficult. That user will end up linking themselves via all the activity in their previous tabs/windows.<br /> <br /> - [[mikeperry]]<br /> <br /> === Deploy Safe and Rational Defaults ===<br /> <br /> While I think that improving the referer situation is useful in some cases, it really doesn't do anything to stop bad actors. I think giving sites control over when referer info is sent to third parties should be a higher priority than just restricting it client side, so sites can control the leakage of their PII themselves. Right now it simply is not possible to restrict referer for many elements. Providing trickle-down restrictions via CSS or via an attribute of the html or body tag would be ideal.<br /> <br /> After all, if bad actors really want to pass data to their third parties, they have plenty of options available for this even if referer is restricted/eliminated...<br /> <br /> - [[mikeperry]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Talk:Privacy/Roadmap_2011&diff=317906 2011-06-11T00:09:40Z

<p>Mikeperry: /* Deploy Safe and Rational Defaults */</p> <hr /> <div>=== Improve Private &amp; Semi-anonymous Browsing ===<br /> <br /> I think per-tab private mode is likely to be confusing. I think the more intuitive way to provide this linkability improvement is by isolating the browser state for a given top-level urlbar domain (ie the double-keying Cookie idea but applied to cache, DOM Storage, client certs, etc).<br /> <br /> OTOH, the ability to have a per-window private mode, or perhaps even just a single concurrent private mode consisting of many windows may make sense. For example, I think Chrome's Incognito Mode windows are very intuitive for this reason. I think it also does make sense to have all private browsing windows share the same virtual profile.<br /> <br /> On the third hand, the downside of concurrent use is that it makes the &quot;I'll just go to the wifi cafe or tether my cell phone&quot; use case more difficult. That user will end up linking themselves via all the activity in their previous tabs/windows.<br /> <br /> - [[mikeperry]]<br /> <br /> === Deploy Safe and Rational Defaults ===<br /> <br /> While I think that improving the referer situation is useful in some cases, it really doesn't do anything to stop bad actors. I think giving sites control over when referer info is sent to third parties should be a higher priority than just restricting it client side, so sites can control the leakage of their PII themselves. Right now it simply is not possibly to restrict referer for many elements. Providing trickle-down restrictions via CSS or via an attribute of the html or body tag would be ideal.<br /> <br /> After all, if bad actors really want to pass data to their third parties, they have plenty of options available for this even if referer is restricted/eliminated...<br /> <br /> - [[mikeperry]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Talk:Privacy/Roadmap_2011&diff=317904 2011-06-11T00:07:11Z

<p>Mikeperry: Created page with &quot;=== Improve Private &amp; Semi-anonymous Browsing === I think per-tab private mode is likely to be confusing. I think the more intuitive way to provide this linkability improvement ...&quot;</p> <hr /> <div>=== Improve Private &amp; Semi-anonymous Browsing ===<br /> <br /> I think per-tab private mode is likely to be confusing. I think the more intuitive way to provide this linkability improvement is by isolating the browser state for a given top-level urlbar domain (ie the double-keying Cookie idea but applied to cache, DOM Storage, client certs, etc).<br /> <br /> OTOH, the ability to have a per-window private mode, or perhaps even just a single concurrent private mode consisting of many windows may make sense. For example, I think Chrome's Incognito Mode windows are very intuitive for this reason. I think it also does make sense to have all private browsing windows share the same virtual profile.<br /> <br /> On the third hand, the downside of concurrent use is that it makes the &quot;I'll just go to the wifi cafe or tether my cell phone&quot; use case more difficult. That user will end up linking themselves via all the activity in their previous tabs/windows.<br /> <br /> - [[mikeperry]]<br /> <br /> === Deploy Safe and Rational Defaults ===<br /> <br /> While I think that improving the referer situation is useful in some cases, it really doesn't do anything to stop bad actors. I think giving sites the ability to better control over when referer info is sent to third parties should be a higher priority than just restricting it client side, so sites can control the leakage of their PII better themselves. Right now it simply is not possibly to restrict referer for many elements. Also, providing trickle-down restrictions via CSS or via an attribute of the html or body tag would be ideal.<br /> <br /> After all, if bad actors really want to pass data to their third parties, they have plenty of options available for this even if referer is restricted/eliminated...<br /> <br /> - [[mikeperry]]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234300 2010-06-28T18:14:28Z

<p>Mikeperry: /* User Agent */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> Ideally, these requirements would be satisfied in such a way as to make it difficult or impossible to determine if Anonymous Browsing is enabled, but this may come at a cost of some resistance to fingerprinting.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language. Further, dropping items from the UA string while only in Anonymous Browsing Mode would reveal the fact that the user is using the mode.<br /> <br /> The other way to handle this would be to simply pick a user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton.<br /> <br /> It should be noted that the Firefox minor revision and other properties can still be determined by inspecting Components.interfaces, so [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070] would need to be fixed for these protections to have any real value.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Installed font presence provides a large amount of identifying information. Currently, the major culprit of leaking this information is plugins, as they provide an unsorted complete enumeration of all system fonts.<br /> <br /> There are ways to [http://flippingtypical.com/ query fonts for existence] in JavaScript and CSS, but this issue is not really worth dealing with until the plugin problem is solved, or it is decided that non-compliant plugins should be disabled.<br /> <br /> Long term, the best option would be to standardize on a small, common set of fonts for the mode that are typically available on all platforms, or simply set browser.display.use_document_fonts to 0.<br /> <br /> ==Clock Delta+Precision==<br /> The Date object currently provides millisecond accuracy. This accuracy can be<br /> used as an identifier based on clock skew, or can be used to accurately measure<br /> user behaviours for use in fingerprinting.<br /> <br /> At least two companies claim to use this accuracy to fingerprint users when<br /> other methods fail:<br /> http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-finger-unauthorized-users.ars<br /> <br /> One possibility might be to quantize Date values to the second, and then add random, monotonically increasing amounts of milliseconds to subsequent calls during anonymous browsing mode, along with a random per-page or per-origin offset.<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234295 2010-06-28T18:03:51Z

<p>Mikeperry: /* Clock Delta+Precision */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> Ideally, these requirements would be satisfied in such a way as to make it difficult or impossible to determine if Anonymous Browsing is enabled, but this may come at a cost of some resistance to fingerprinting.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language.<br /> <br /> The other way to handle this would be to assume that there is no way to prevent a remote website from determining if a user is in anonymous browsing mode by testing for any of the other protections in this document. If this is the case, then anonymous mode could simply pick its own uniform user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton. However, providing an anonymous browsing mode that makes it difficult to determine if anonymous browsing is enabled has numerous obvious advantages, so this may not be an option.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Installed font presence provides a large amount of identifying information. Currently, the major culprit of leaking this information is plugins, as they provide an unsorted complete enumeration of all system fonts.<br /> <br /> There are ways to [http://flippingtypical.com/ query fonts for existence] in JavaScript and CSS, but this issue is not really worth dealing with until the plugin problem is solved, or it is decided that non-compliant plugins should be disabled.<br /> <br /> Long term, the best option would be to standardize on a small, common set of fonts for the mode that are typically available on all platforms, or simply set browser.display.use_document_fonts to 0.<br /> <br /> ==Clock Delta+Precision==<br /> The Date object currently provides millisecond accuracy. This accuracy can be<br /> used as an identifier based on clock skew, or can be used to accurately measure<br /> user behaviours for use in fingerprinting.<br /> <br /> At least two companies claim to use this accuracy to fingerprint users when<br /> other methods fail:<br /> http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-finger-unauthorized-users.ars<br /> <br /> One possibility might be to quantize Date values to the second, and then add random, monotonically increasing amounts of milliseconds to subsequent calls during anonymous browsing mode, along with a random per-page or per-origin offset.<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234293 2010-06-28T17:57:45Z

<p>Mikeperry: /* Fonts and Font Lists */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> Ideally, these requirements would be satisfied in such a way as to make it difficult or impossible to determine if Anonymous Browsing is enabled, but this may come at a cost of some resistance to fingerprinting.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language.<br /> <br /> The other way to handle this would be to assume that there is no way to prevent a remote website from determining if a user is in anonymous browsing mode by testing for any of the other protections in this document. If this is the case, then anonymous mode could simply pick its own uniform user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton. However, providing an anonymous browsing mode that makes it difficult to determine if anonymous browsing is enabled has numerous obvious advantages, so this may not be an option.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Installed font presence provides a large amount of identifying information. Currently, the major culprit of leaking this information is plugins, as they provide an unsorted complete enumeration of all system fonts.<br /> <br /> There are ways to [http://flippingtypical.com/ query fonts for existence] in JavaScript and CSS, but this issue is not really worth dealing with until the plugin problem is solved, or it is decided that non-compliant plugins should be disabled.<br /> <br /> Long term, the best option would be to standardize on a small, common set of fonts for the mode that are typically available on all platforms, or simply set browser.display.use_document_fonts to 0.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234284 2010-06-28T17:42:36Z

<p>Mikeperry: /* Behavior */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> Ideally, these requirements would be satisfied in such a way as to make it difficult or impossible to determine if Anonymous Browsing is enabled, but this may come at a cost of some resistance to fingerprinting.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language.<br /> <br /> The other way to handle this would be to assume that there is no way to prevent a remote website from determining if a user is in anonymous browsing mode by testing for any of the other protections in this document. If this is the case, then anonymous mode could simply pick its own uniform user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton. However, providing an anonymous browsing mode that makes it difficult to determine if anonymous browsing is enabled has numerous obvious advantages, so this may not be an option.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234282 2010-06-28T17:39:14Z

<p>Mikeperry: /* Screen Resolution and Properties */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language.<br /> <br /> The other way to handle this would be to assume that there is no way to prevent a remote website from determining if a user is in anonymous browsing mode by testing for any of the other protections in this document. If this is the case, then anonymous mode could simply pick its own uniform user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton. However, providing an anonymous browsing mode that makes it difficult to determine if anonymous browsing is enabled has numerous obvious advantages, so this may not be an option.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> Some combination of these could help to make it hard to determine if the user is actually in Anonymous browsing mode. For example, providing a valid, but resized render window, lying about the size of the actual window to some standard platform size, and lying about the desktop size to return the most popular resolution just larger than the current window size.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234192 2010-06-28T12:58:03Z

<p>Mikeperry: /* Relevant Bugzilla Entries */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language.<br /> <br /> The other way to handle this would be to assume that there is no way to prevent a remote website from determining if a user is in anonymous browsing mode by testing for any of the other protections in this document. If this is the case, then anonymous mode could simply pick its own uniform user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton. However, providing an anonymous browsing mode that makes it difficult to determine if anonymous browsing is enabled has numerous obvious advantages, so this may not be an option.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=440892 Bug 440892]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234183 2010-06-28T12:04:51Z

<p>Mikeperry: /* Relevant Bugzilla Entries */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language.<br /> <br /> The other way to handle this would be to assume that there is no way to prevent a remote website from determining if a user is in anonymous browsing mode by testing for any of the other protections in this document. If this is the case, then anonymous mode could simply pick its own uniform user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton. However, providing an anonymous browsing mode that makes it difficult to determine if anonymous browsing is enabled has numerous obvious advantages, so this may not be an option.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=575230 Bug 575230]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234177 2010-06-28T11:30:47Z

<p>Mikeperry: /* User Agent */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> User agent can be handled two different ways. One way would be to simply reduce the amount of entropy provided by the standard user agent headers. There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bug for this], but some high-entropy items may end up being too useful to drop, such as the operating system and Accept-Language.<br /> <br /> The other way to handle this would be to assume that there is no way to prevent a remote website from determining if a user is in anonymous browsing mode by testing for any of the other protections in this document. If this is the case, then anonymous mode could simply pick its own uniform user agent string that is determined to be one of the more common Firefox user agent strings currently in use. This is the approach taken by Torbutton. However, providing an anonymous browsing mode that makes it difficult to determine if anonymous browsing is enabled has numerous obvious advantages, so this may not be an option.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234175 2010-06-28T11:15:45Z

<p>Mikeperry: /* Relevant Bugzilla Entries */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234174 2010-06-28T11:13:36Z

<p>Mikeperry: /* Relevant Bugzilla Entries */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234050 2010-06-26T23:42:24Z

<p>Mikeperry: /* Interface and Options */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> One way to provide this mode would be to expose it as an option for private browsing mode. If the actual web usability impact can be kept low, there should be no reason why this couldn't be enabled by default for Private Browsing Mode sessions.<br /> <br /> However, if the impact is potentially higher, the browser could provide two independent modes, one for an &quot;Off the record&quot; mode, where nothing is recorded on disk, and another for a &quot;Tracking Resistance&quot; mode, that enables the features here.<br /> <br /> According to [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers], Private Browsing Mode may be suffering from &quot;Mode Error&quot;, where users enable the mode, but forget to ever disable it because of poor UI indication. A better UI might provide clear graphical indication that private browsing mode is enabled for a particular window.<br /> <br /> As far as options, it may be desirable to provide a Private Browsing Mode dialog with a few preferences. Some users may prefer that there be *no* UI indication that private browsing mode is enabled. Others may prefer that their non-private tabs and windows not be closed, so that they can use the two modes concurrently. Some users may not want Private Browsing Mode to write any data to disk, while others may only care about web tracking.<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234048 2010-06-26T23:26:52Z

<p>Mikeperry: /* Metadata */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [http://crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html An analysis of private browsing modes in modern browsers]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=234047 2010-06-26T23:24:51Z

<p>Mikeperry: /* Behavior */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> ==Livemark updates==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233956 2010-06-26T14:01:07Z

<p>Mikeperry: /* Use Cases */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233952 2010-06-26T13:49:48Z

<p>Mikeperry: /* Plug-Ins */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> Another option might be to leverage the out of process execution of plugins to restrict their ability to access the local system while the mode is enabled.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233950 2010-06-26T13:27:46Z

<p>Mikeperry: /* Cookies */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies and DOM Storage==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233949 2010-06-26T13:20:47Z

<p>Mikeperry: /* Plug-Ins */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> Plugins are abysmal for privacy in several respects. First, because of the wide variety of browser plugins, the presence or absence of plugins from navigator.plugins actually provides a large amount of information.<br /> <br /> Second, plugins themselves will happily provide websites with a large amount of identifying information about a user, including their list of installed fonts, their CPU model and speed, their local interface IP addresses, username, hostname, and so on. In addition, plugins can also have their own data and cookie stores, that they allow websites to manipulate.<br /> <br /> The best course of action may be to develop an independent policy for what plugins are allowed to do in anonymous and private browsing modes with respect to the above information. Any plugins that do not advertise their adherence to this policy should be disabled during the mode.<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233947 2010-06-26T13:11:09Z

<p>Mikeperry: /* Screen Resolution and Properties */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> Desktop resolution provides about 5 bits of identifying information, and window and decoration sizes provide yet more. This information is available both through window.screen and [https://developer.mozilla.org/En/CSS/Media_queries CSS media queries].<br /> <br /> There are a couple of options for anonymous browsing mode to handle this data. One would be to lie, and to present websites with a common desktop resolution, and round the reported browser resolution to some multiple of pixels.<br /> <br /> A another option would be to tell websites that the desktop resolution is the render window, and resize the render window to either a popular common resolution, or to a multiple of 50px. The downside of this approach is that it has shortcomings when the window is maximized, because window decoration and scrollbar sizes will prevent rounding to an actual multiple of 50px.<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233940 2010-06-26T10:53:05Z

<p>Mikeperry: /* Relevant Bugzilla Entries */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=<br /> <br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=429070 Bug 429070]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint Bug 572650 (Meta)]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=418986 Bug 418986]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=290456 Bug 290456]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=448743 Bug 448743]<br /> * [https://bugzilla.mozilla.org/show_bug.cgi?id=435159 Bug 435159]</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233938 2010-06-26T10:34:13Z

<p>Mikeperry: </p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> =Interface and Options=<br /> <br /> =Impact=<br /> <br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233937 2010-06-26T10:28:37Z

<p>Mikeperry: /* SSL */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Requirements=<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> <br /> The SSL Layer currently exposes a few different pieces of identifying information that would need to be altered while the user is in anonymous browsing mode. Stored client certificates must be disabled during the mode. All current SSL session identifiers must be cleared upon entering the mode.<br /> <br /> Stored server and CA certificates may also need to be optionally disabled, though this should be left to user preference.<br /> <br /> Finally, the SSL handshake also contains a timestamp from the client. A small random, per-domain offset could be added to it, but since it is already truncated to the second, this may not be terribly important.<br /> <br /> ==Form Fill==<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233934 2010-06-26T10:11:37Z

<p>Mikeperry: /* Behavior */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Requirements=<br /> <br /> =Behavior=<br /> <br /> This section describes the major browser behaviours the mode will need to alter in order to address the adversary model. Many of these come from the [[Fingerprinting]] page, but some are just general privacy mechanisms.<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Cookies==<br /> <br /> ==Location Information==<br /> <br /> ==External Protocol Handlers==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Clock Delta+Precision==<br /> <br /> ==Screen Resolution and Properties==<br /> <br /> ==HTTP Headers/Activity==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==SSL==<br /> SSL certs, etc.<br /> <br /> ==Form Fill==<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233932 2010-06-26T09:35:17Z

<p>Mikeperry: /* Adversary Model */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting]] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Requirements=<br /> <br /> =Behavior=<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Advertised Capabilities==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==Security==<br /> SSL certs, etc.<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233931 2010-06-26T09:33:19Z

<p>Mikeperry: /* Adversary Model */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing using unique identifiers, in obtaining location information, and in [[Fingerprinting|fingerprinting] the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty|Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Requirements=<br /> <br /> =Behavior=<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Advertised Capabilities==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==Security==<br /> SSL certs, etc.<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233929 2010-06-26T09:29:23Z

<p>Mikeperry: /* Adversary Model */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Private Browsing Mode, in particular, is primarily concerned with preventing the storage of browsing data. <br /> <br /> This document will focus on network-based tracking mechanisms. In particular, the adversary is interested in correlation of regular mode browsing to anonymous mode browsing, in obtaining location information, and in fingerprinting the user's browser characteristics.<br /> <br /> The adversary may have many motivations for doing this, but to keep scope simple, it may be best to assume that their primary motivation is to correlate user web activity for purposes of tracking users against their will for purposes of serving ads. A large class of adversaries (the ad networks) are interested in deploying semi-intrusive mechanisms to do so, in light of increasing number of users choosing to clear their cookies regularly, and in light of potential future [[Thirdparty Third Party Cookie]] protection mechanisms implemented by the major browsers.<br /> <br /> =Requirements=<br /> <br /> =Behavior=<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Advertised Capabilities==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==Security==<br /> SSL certs, etc.<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233926 2010-06-26T09:11:19Z

<p>Mikeperry: /* Adversary Model */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> The adversary is interested in tracking the user by any means necessary. However, mechanisms that are already being addressed by other projects will not be discussed in this document. Examples of this include protections given by Private Browsing Mode, and general planned privacy protections, such as the [https://developer.mozilla.org/en/CSS/Privacy_and_the_:visited_selector CSS Visited Selector] spoofing.<br /> <br /> =Requirements=<br /> <br /> =Behavior=<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Advertised Capabilities==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==Security==<br /> SSL certs, etc.<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233921 2010-06-26T08:27:05Z

<p>Mikeperry: </p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =Adversary Model=<br /> <br /> =Requirements=<br /> <br /> =Behavior=<br /> <br /> ==User Agent==<br /> <br /> ==Caches and History==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Advertised Capabilities==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==Security==<br /> SSL certs, etc.<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?<br /> <br /> =Relevant Bugzilla Entries=</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233920 2010-06-26T08:14:21Z

<p>Mikeperry: /* The Privacy Power User */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features. However, it looks as if the proposed [[Labs/Weave|Weave]] Identity project called [[Labs/Weave/Identity/Account_Manager|Account Manager]] could be extended to support this use case.<br /> <br /> =User Agent Considerations=<br /> <br /> ==Caches and History==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Advertised Capabilities==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==Security==<br /> SSL certs, etc.<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233693 2010-06-25T10:53:51Z

<p>Mikeperry: /* The Paranoid */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They clear their cookies regularly, and may disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features.<br /> <br /> =User Agent Considerations=<br /> <br /> ==Caches and History==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Advertised Capabilities==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==Security==<br /> SSL certs, etc.<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?</div>

Mikeperry https://wiki.mozilla.org/index.php?title=Security/Anonymous_Browsing&diff=233692 2010-06-25T10:51:07Z

<p>Mikeperry: /* Use Cases */</p> <hr /> <div>''This page will serve as a design requirements and discussion for an Anonymous Browsing Mode. Whether or not it is implemented, the requirements and goals for such a mode will be documented here.''<br /> <br /> =Anonymous Browsing Mode=<br /> <br /> Unlike Private Browsing, which mainly attempts to protect a user from a local attacker, Anonymous Browsing will serve to minimize the amount of identifying data that is available to a remote (web or network) attacker (for example, consider the EFF [http://panopticlick.eff.org/ panopticlick project]). The main motivations behind such a mode are to prevent user tracking and fingerprinting, but there are many use cases.<br /> <br /> == Scope of this Document ==<br /> <br /> This working document will serve as an explanation of '''why''' users will want Anonymous Browsing, '''how''' such a mode would behave and '''what''' will need to be different in this mode from regular browsing sessions for such a mode to be useful.<br /> <br /> == Metadata ==<br /> <br /> {|<br /> |''Driver'': || [[User:Sidstamm|Sid Stamm]]<br /> |-<br /> |''Status'': || Brainstorming<br /> |-<br /> |''Started'': || 24-June-2010<br /> |}<br /> Relevant Links:<br /> * [https://www.torproject.org/torbutton/design/ Torbutton Design Document] and [https://www.torproject.org/torbutton/design/#adversary Adversary Model]<br /> * [[Fingerprinting]]<br /> <br /> =Use Cases=<br /> <br /> Users of anonymous browsing mode would be concerned about tracking from Internet sites under various circumstances, and may or may not be concerned about local records on their computer's disk.<br /> <br /> Public awareness of the privacy issues surrounding using the web is rising, as evidenced by the need for advertising networks to resort to flash cookies and fingerprinting due to the frequency with which normal users clear their cookies. The popularity of privacy-enhancing addons and the private browsing modes of the major browsers also suggest that a mode that helps to mitigate ubiquitous web tracking may be a key differentiator against competing browsers.<br /> <br /> The target users of this mode may have a number of different browsing behaviours and needs. It is best to represent these behaviours as &quot;stories&quot;, to better understand the needs of different types of users, and to properly design feature and option choices to accommodate them.<br /> <br /> == The Medical Patient/Abuse Victim ==<br /> <br /> The medical patient has some kind of condition that they would prefer that ad networks not be aware of: possibly one that puts them at risk for raised medical, life, or auto insurance premiums, or carries other social stigma. Such a user may decide to use the mode after receiving mysterious targeted ads for their condition while visiting unrelated sites.<br /> <br /> They are possibly a member of a number of online support groups that they log in to and post to under a pseudonym (such as alcoholics anonymous, narcanon, etc) using the mode.<br /> <br /> They are likely an occasional user, and would remain logged in to social media services, their email account, and other websites continuously during normal browsing, but would prefer a clean slate for web usage relating to their condition.<br /> <br /> They may or may not be concerned about records of anonymous web activity on their own computer. They likely use the mode from home, but may opt to use a proxy.<br /> <br /> == The Pseudonymous Blogger ==<br /> <br /> The pseudonymous blogger maintains a politically or technically controversial blog that may expose them to subpoena risk to uncover their identity. There have been several cases of Apple in particular demanding the identity of bloggers posting about unreleased or otherwise secret product releases or features. Bloggers in China and other countries also face risk of attempts to identify them.<br /> <br /> This user likely uses public wifi, a prepaid data device, a VPN, or a proxy to access the Internet, as opposed to their normal Internet connection.<br /> <br /> If operating in the United States, this user is likely not concerned about logs on their local disk.<br /> <br /> This user may wish to preserve their &quot;Anonymous mode&quot; cookies beyond a single session, but does not want them mixing with their normal cookies. They may have a seperate Facebook, twitter, and other social media accounts for their blogging persona, in addition to their regular persona.<br /> <br /> == The Anonymous Commenter ==<br /> <br /> The anonymous commenter is a user who is posting relevant information to a blog post or news article. Those that truly require anonymity need it because they have inside or privileged information relevant to a story. <br /> <br /> Most likely, they spend the majority of their Internet usage logged into a number of services online that record various things about them, and may log them into arbitrary services automatically due to federated login systems such as OpenID, and have been exposed to a number of ad networks intent on tracking them.<br /> <br /> They use Anonymous Mode to ensure that the blog or news site (which may have numerous advertising partnerships) would have a very hard time correlating their comment to their normal browsing.<br /> <br /> They likely do not care about their activity being recorded to their computer's disk. They most likely use the mode from home, but may use public wifi or a proxy.<br /> <br /> == The Whistleblower/Anonymous Tipster ==<br /> Similar to the Anonymous Commenter, the whistleblower uses the web normally for the majority of the time. However, at some point they discover wrongdoing at their workplace or otherwise need to anonymously contact the press.<br /> <br /> The whistleblower will only use the mode once or rarely, though they may create an email account to establish communication with the press. <br /> <br /> They will likely use public wifi, a prepaid data device, and/or a proxy.<br /> <br /> == The Paranoid ==<br /> Just because you're paranoid doesn't mean they aren't out to get you.<br /> <br /> The paranoid wants to avoid most of their activity being recorded by ad networks and services. They are suspicious of Facebook, social media sites, and tend not to be logged in to any services continuously. They are the types that currently disable javascript and/or run NoScript, BetterPrivacy, RequestPolicy, Adblock Plus, TACO, CookieCuller, and other addons to improve their privacy online. These are some of the most popular Firefox addons on addons.mozilla.org. <br /> <br /> They likely use the mode continuously from home.<br /> <br /> == The Privacy Power User ==<br /> <br /> The power user would prefer to maintain multiple independent identities logged in to various social media services. They would prefer to be able to configure their browser to quickly switch between these identities, which may represent different personae, or may simply represent individual services or websites that they do not want to be logged in to concurrently.<br /> <br /> They likely author independent blogs, have multiple email accounts, post on multiple mailinglists/web forums, contribute to a number of open source projects, and/or operate multiple twitter feeds, all under different pseudonyms.<br /> <br /> They likely use a prepaid data device or proxy of some sort. They are not concerned about their activity being stored on their computer: in fact they would prefer it, to ease their ability to remain logged in to services and retain history and bookmarks without suffering the privacy consequences.<br /> <br /> They would likely also prefer the ability to configure their browser to only retain cookies for certain sites, and to periodically clear all other browser state. They would be satisfied if these features were available only through addons, as opposed to core browser features.<br /> <br /> =User Agent Considerations=<br /> <br /> ==Caches and History==<br /> <br /> ==Fonts and Font Lists==<br /> Locale issues, standard font lists, etc.<br /> <br /> ==Advertised Capabilities==<br /> User-Agent string, Accept headers, etc.<br /> <br /> ==Plug-Ins==<br /> <br /> ==Extensions/Add-Ons==<br /> <br /> ==Security==<br /> SSL certs, etc.<br /> <br /> =Impact=<br /> How much will this impact web experience for the users? Sure we can break things in the name of anonymity if users opt for such a mode, but how much is tolerable?</div>

Mikeperry