Fingerprinting: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(Created page with '= Overview = The EFF published an excellent study in May, detailing some of the various methods of fingerprinting a browser. See http://www.eff.org/deeplinks/2010/05/every-brows…')
 
No edit summary
 
(28 intermediate revisions by 10 users not shown)
Line 1: Line 1:
= Overview =
This page tracks the deployment of Firefox's Fingerprinting Protection (FPP) feature.


The EFF published an excellent study in May, detailing some of the various methods of fingerprinting a browser. See http://www.eff.org/deeplinks/2010/05/every-browser-unique-results-fom-panopticlick. They found that, over their study of around 1 million visits to their study website, '''83.6% of the browsers seen had a unique fingerprint; among those with Flash or Java enabled, 94.2%'''. This does '''not''' include cookies! They ranked the various bits of information in order of importance (i.e. how useful they are in uniquely identifying a browser): things like UA string, what addons are installed, and the font list of the system. We need to go through these, one by one, and do what we can to reduce its ''surprisal'' -- the number of bits of information (entropy) it provides. In their study, they placed a lower bound on the fingerprint distribution of 18.1 bits of entropy. (This means that, choosing a browser at random, at best one in 286,777 other browsers will share its fingerprint.)
Other documents that may be relevant depending on the audience:


= Data =
<ul>
<li> SUMO page more appropriate for end-users of Firefox https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting
<li> SUMO page for end users who might have (accidently or not) enabled Resist Fingerprinting https://support.mozilla.org/en-US/kb/resist-fingerprinting
<li> Firefox's Fingerprinting Protection Architecture in Gory Detail https://docs.google.com/document/d/1FywogzvkWupoUoz4PcCp9nNd6aKOwBN-c2zRu2Xof9Y/edit?tab=t.0
<li> Source Docs on the implementation: https://firefox-source-docs.mozilla.org/toolkit/components/resistfingerprinting/resistfingerprinting/implementation.html
</ul>


The following data is taken from the published paper, https://panopticlick.eff.org/browser-uniqueness.pdf:
== Summary ==
''As of Firefox 151 Release, last updated 5/12/26, the following protections are enabled:''


{|
{| class="wikitable"
|+Entropy of various pieces of browser information
|-
|-
| Variable || Entropy (bits)
! Protection !! Desktop FPP !! Android FPP !! Desktop Baseline !! Android Baseline
|-
|-
| plugins || 15.4
| CanvasRandomization || Yes || Yes || Yes || Nightly-only
|-
|-
| fonts || 13.9
| EfficientCanvasRandomization || Yes || Yes || Yes || Nightly-only
|-
|-
| user agent || 10.0
| FontVisibilityLangPack || Yes || Yes || ||
|-
|-
| http accept || 6.09
| JSMathFdlibm || Yes || Yes || ||
|-
|-
| screen resolution || 4.83
| MaxTouchPointsCollapse || Yes || Yes || Yes || Nightly-only
|-
|-
| timezone || 3.04
| NavigatorHWConcurrencyTiered || Yes || Yes || ||
|-
|-
| supercookies || 2.12
| ScreenAvailToResolution || Yes || Yes || Yes || Nightly-only
|}
 
== Desktop ==
 
{| class="wikitable"
|-
! Protection Name !! Channel !! Version !! Bugs
|-
| rowspan="8" | ScreenAvailToResolution
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Release as of 151'''
|-
| Baseline Release
| 151
| {{bug|2032123}}
|-
| Baseline Beta
| 151
| {{bug|2032123}}
|-
| Baseline Nightly
| 150
| {{bug|1990514}}
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}}
|-
| colspan="3" | Regressions: {{bug|2016747}}
|-
| rowspan="8" | MaxTouchPointsCollapse
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Release as of 151'''
|-
| Baseline Release
| 151
| {{bug|2032123}}
|-
| Baseline Beta
| 151
| {{bug|2032123}}
|-
| Baseline Nightly
| 150
| {{bug|1990514}}
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}}
|-
| colspan="3" | Regressions: {{bug|1991701}} (Linux touch disabled by companion fix {{bug|1957658}}, re-enabled in 146/147); {{bug|2021715}} (Linux Wayland count adjusted, 150)
|-
| rowspan="8" | EfficientCanvasRandomization
| colspan="3" | '''Enabled in FPP (PBM) Release as of 145; Enabled in Baseline Release as of 151'''
|-
| Baseline Release
| 151
| {{bug|2032123}}
|-
| Baseline Beta
| 151
| {{bug|2032123}}
|-
| Baseline Nightly
| 150
| {{bug|2021606}}
|-
| FPP (PBM) Release
| 145
| {{bug|1993304}}
|-
| FPP (PBM) Beta
| 145
| {{bug|1993304}}
|-
| FPP (PBM) Nightly
| 145
| {{bug|1993304}}
|-
| colspan="3" | Regressions: {{bug|2025570}} (Google Maps highway labels broken, fixed via RemoteSettings in 150/151)
|-
| rowspan="8" | CanvasRandomization
| colspan="3" | '''Enabled in FPP (PBM) Release as of 120; Enabled in Baseline Release as of 151'''
|-
| Baseline Release
| 151
| {{bug|2032123}}
|-
| Baseline Beta
| 151
| {{bug|2032123}}
|-
| Baseline Nightly
| 150
| {{bug|2021606}}
|-
| FPP (PBM) Release
| 120
| {{bug|1858181}}
|-
| FPP (PBM) Beta
| 120
| {{bug|1858181}}
|-
| FPP (PBM) Nightly
| 115
| {{bug|1825250}} (Nightly-only in 118–119 due to {{bug|1849903}})
|-
| colspan="3" | Regressions: {{bug|1852541}} (Google Meet can't join, fixed 120); {{bug|1876149}} (onshape.com getImageData); {{bug|1882761}} (Google Maps highway symbols); {{bug|1887161}} (canvas getImageData slow in PBM on maps/Airbnb, fixed via SipHash in 134 then superseded by EfficientCanvasRandomization); {{bug|1905884}} (visual bugs on canvas-heavy sites); {{bug|1957426}} (meta); {{bug|1957427}} (wpt.fyi image comparison, fixed via overrides); {{bug|2010274}} (SoundCloud audio waveform broken in PBM/ETP Strict); {{bug|2025570}} (Google Maps Baseline, shared with EfficientCanvasRandomization)
|-
| rowspan="5" | FontVisibilityLangPack
| colspan="3" | '''Enabled in FPP (PBM) Release as of 118'''
|-
|-
| cookies enabled || 0.353
| FPP (PBM) Release
| 118
| {{bug|1849903}}
|-
| FPP (PBM) Beta
| 118
| {{bug|1849903}}
|-
| FPP (PBM) Nightly
| 118
| {{bug|1849903}}
|-
| colspan="3" | Regressions: {{bug|1827475}} (meta); {{bug|1850672}} (localized font names not in standard list, fixed 118.0.2/119); {{bug|1854950}} (broken rendering on Linux with no native distro fonts, fixed 119/120)
|-
| rowspan="4" | JSMathFdlibm
| colspan="3" | '''Enabled in FPP (PBM) Release as of 134'''
|-
| FPP (PBM) Release
| 134
| {{bug|1887682}}
|-
| FPP (PBM) Beta
| 134
| {{bug|1887682}}
|-
| FPP (PBM) Nightly
| 134
| {{bug|1887682}}
|-
| rowspan="5" | NavigatorHWConcurrencyTiered
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143'''
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}} (renamed and tiered in 144 via {{bug|1984333}})
|-
| colspan="3" | Regressions: {{bug|1984132}}; {{bug|1982336}}
|}
|}


The definitions of each variable follow.
== Android ==
 
{| class="wikitable"
|-
! Protection Name !! Channel !! Version !! Bugs
|-
| rowspan="5" | ScreenAvailToResolution
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Nightly-only as of 151'''
|-
| Baseline Nightly
| 151
| {{bug|2032123}}
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}}
|-
| rowspan="5" | MaxTouchPointsCollapse
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Nightly-only as of 151'''
|-
| Baseline Nightly
| 151
| {{bug|2032123}}
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}}
|-
| rowspan="5" | EfficientCanvasRandomization
| colspan="3" | '''Enabled in FPP (PBM) Release as of 145; Enabled in Baseline Nightly-only as of 151'''
|-
| Baseline Nightly
| 151
| {{bug|2032123}}
|-
| FPP (PBM) Release
| 145
| {{bug|1993304}}
|-
| FPP (PBM) Beta
| 145
| {{bug|1993304}}
|-
| FPP (PBM) Nightly
| 145
| {{bug|1993304}}
|-
| rowspan="6" | CanvasRandomization
| colspan="3" | '''Enabled in FPP (PBM) Release as of 120; Enabled in Baseline Nightly-only as of 151'''
|-
| Baseline Nightly
| 151
| {{bug|2032123}}
|-
| FPP (PBM) Release
| 120
| {{bug|1858181}}
|-
| FPP (PBM) Beta
| 120
| {{bug|1858181}}
|-
| FPP (PBM) Nightly
| 115
| {{bug|1825250}} (Nightly-only in 118–119 due to {{bug|1849903}})
|-
| colspan="3" | Regressions: {{bug|1852541}} (Google Meet can't join, fixed 120); {{bug|1876149}} (onshape.com getImageData); {{bug|1882761}} (Google Maps highway symbols); {{bug|1887161}} (canvas getImageData slow in PBM, fixed via SipHash in 134 then superseded by EfficientCanvasRandomization); {{bug|1905884}} (visual bugs on canvas-heavy sites); {{bug|1957426}} (meta); {{bug|1957427}} (wpt.fyi image comparison, fixed via overrides)
|-
| rowspan="5" | FontVisibilityLangPack
| colspan="3" | '''Enabled in FPP (PBM) Release as of 134 (removed 124–133 via {{bug|1826412}}, re-enabled via {{bug|1928705}})'''
|-
| FPP (PBM) Release
| 134
| {{bug|1928705}}
|-
| FPP (PBM) Beta
| 134
| {{bug|1928705}}
|-
| FPP (PBM) Nightly
| 118
| {{bug|1849903}} (removed in 124 via {{bug|1826412}}, re-added in 134 via {{bug|1928705}})
|-
| colspan="3" | Regressions: {{bug|1946625}} (Brahmic scripts broken on older Samsung Android); {{bug|1956251}} (cxcricket.co Bangla Sangam MN font missing from Android font list)
|-
| rowspan="4" | JSMathFdlibm
| colspan="3" | '''Enabled in FPP (PBM) Release as of 134'''
|-
| FPP (PBM) Release
| 134
| {{bug|1887682}}
|-
| FPP (PBM) Beta
| 134
| {{bug|1887682}}
|-
| FPP (PBM) Nightly
| 134
| {{bug|1887682}}
|-
| rowspan="5" | NavigatorHWConcurrencyTiered
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143'''
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}} (renamed and tiered in 144 via {{bug|1984333}})
|-
| colspan="3" | Regressions: {{bug|1984132}}; {{bug|1982336}}
|}

Latest revision as of 18:25, 12 May 2026

This page tracks the deployment of Firefox's Fingerprinting Protection (FPP) feature.

Other documents that may be relevant depending on the audience:

Summary

As of Firefox 151 Release, last updated 5/12/26, the following protections are enabled:

Protection Desktop FPP Android FPP Desktop Baseline Android Baseline
CanvasRandomization Yes Yes Yes Nightly-only
EfficientCanvasRandomization Yes Yes Yes Nightly-only
FontVisibilityLangPack Yes Yes
JSMathFdlibm Yes Yes
MaxTouchPointsCollapse Yes Yes Yes Nightly-only
NavigatorHWConcurrencyTiered Yes Yes
ScreenAvailToResolution Yes Yes Yes Nightly-only

Desktop

Protection Name Channel Version Bugs
ScreenAvailToResolution Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Release as of 151
Baseline Release 151 bug 2032123
Baseline Beta 151 bug 2032123
Baseline Nightly 150 bug 1990514
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414
Regressions: bug 2016747
MaxTouchPointsCollapse Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Release as of 151
Baseline Release 151 bug 2032123
Baseline Beta 151 bug 2032123
Baseline Nightly 150 bug 1990514
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414
Regressions: bug 1991701 (Linux touch disabled by companion fix bug 1957658, re-enabled in 146/147); bug 2021715 (Linux Wayland count adjusted, 150)
EfficientCanvasRandomization Enabled in FPP (PBM) Release as of 145; Enabled in Baseline Release as of 151
Baseline Release 151 bug 2032123
Baseline Beta 151 bug 2032123
Baseline Nightly 150 bug 2021606
FPP (PBM) Release 145 bug 1993304
FPP (PBM) Beta 145 bug 1993304
FPP (PBM) Nightly 145 bug 1993304
Regressions: bug 2025570 (Google Maps highway labels broken, fixed via RemoteSettings in 150/151)
CanvasRandomization Enabled in FPP (PBM) Release as of 120; Enabled in Baseline Release as of 151
Baseline Release 151 bug 2032123
Baseline Beta 151 bug 2032123
Baseline Nightly 150 bug 2021606
FPP (PBM) Release 120 bug 1858181
FPP (PBM) Beta 120 bug 1858181
FPP (PBM) Nightly 115 bug 1825250 (Nightly-only in 118–119 due to bug 1849903)
Regressions: bug 1852541 (Google Meet can't join, fixed 120); bug 1876149 (onshape.com getImageData); bug 1882761 (Google Maps highway symbols); bug 1887161 (canvas getImageData slow in PBM on maps/Airbnb, fixed via SipHash in 134 then superseded by EfficientCanvasRandomization); bug 1905884 (visual bugs on canvas-heavy sites); bug 1957426 (meta); bug 1957427 (wpt.fyi image comparison, fixed via overrides); bug 2010274 (SoundCloud audio waveform broken in PBM/ETP Strict); bug 2025570 (Google Maps Baseline, shared with EfficientCanvasRandomization)
FontVisibilityLangPack Enabled in FPP (PBM) Release as of 118
FPP (PBM) Release 118 bug 1849903
FPP (PBM) Beta 118 bug 1849903
FPP (PBM) Nightly 118 bug 1849903
Regressions: bug 1827475 (meta); bug 1850672 (localized font names not in standard list, fixed 118.0.2/119); bug 1854950 (broken rendering on Linux with no native distro fonts, fixed 119/120)
JSMathFdlibm Enabled in FPP (PBM) Release as of 134
FPP (PBM) Release 134 bug 1887682
FPP (PBM) Beta 134 bug 1887682
FPP (PBM) Nightly 134 bug 1887682
NavigatorHWConcurrencyTiered Enabled in FPP (PBM) Release as of 143
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414 (renamed and tiered in 144 via bug 1984333)
Regressions: bug 1984132; bug 1982336

Android

Protection Name Channel Version Bugs
ScreenAvailToResolution Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Nightly-only as of 151
Baseline Nightly 151 bug 2032123
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414
MaxTouchPointsCollapse Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Nightly-only as of 151
Baseline Nightly 151 bug 2032123
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414
EfficientCanvasRandomization Enabled in FPP (PBM) Release as of 145; Enabled in Baseline Nightly-only as of 151
Baseline Nightly 151 bug 2032123
FPP (PBM) Release 145 bug 1993304
FPP (PBM) Beta 145 bug 1993304
FPP (PBM) Nightly 145 bug 1993304
CanvasRandomization Enabled in FPP (PBM) Release as of 120; Enabled in Baseline Nightly-only as of 151
Baseline Nightly 151 bug 2032123
FPP (PBM) Release 120 bug 1858181
FPP (PBM) Beta 120 bug 1858181
FPP (PBM) Nightly 115 bug 1825250 (Nightly-only in 118–119 due to bug 1849903)
Regressions: bug 1852541 (Google Meet can't join, fixed 120); bug 1876149 (onshape.com getImageData); bug 1882761 (Google Maps highway symbols); bug 1887161 (canvas getImageData slow in PBM, fixed via SipHash in 134 then superseded by EfficientCanvasRandomization); bug 1905884 (visual bugs on canvas-heavy sites); bug 1957426 (meta); bug 1957427 (wpt.fyi image comparison, fixed via overrides)
FontVisibilityLangPack Enabled in FPP (PBM) Release as of 134 (removed 124–133 via bug 1826412, re-enabled via bug 1928705)
FPP (PBM) Release 134 bug 1928705
FPP (PBM) Beta 134 bug 1928705
FPP (PBM) Nightly 118 bug 1849903 (removed in 124 via bug 1826412, re-added in 134 via bug 1928705)
Regressions: bug 1946625 (Brahmic scripts broken on older Samsung Android); bug 1956251 (cxcricket.co Bangla Sangam MN font missing from Android font list)
JSMathFdlibm Enabled in FPP (PBM) Release as of 134
FPP (PBM) Release 134 bug 1887682
FPP (PBM) Beta 134 bug 1887682
FPP (PBM) Nightly 134 bug 1887682
NavigatorHWConcurrencyTiered Enabled in FPP (PBM) Release as of 143
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414 (renamed and tiered in 144 via bug 1984333)
Regressions: bug 1984132; bug 1982336
Retrieved from "https://wiki.mozilla.org/index.php?title=Fingerprinting&oldid=1257347"