Fingerprinting: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(→‎Extra credit: about canvas pixels fingerprinting)
No edit summary
 
(9 intermediate revisions by 5 users not shown)
Line 1: Line 1:
= Overview =
This page tracks the deployment of Firefox's Fingerprinting Protection (FPP) feature.


The EFF published an excellent study in May, detailing some of the various methods of fingerprinting a browser. See http://www.eff.org/deeplinks/2010/05/every-browser-unique-results-fom-panopticlick. They found that, over their study of around 1 million visits to their study website, '''83.6% of the browsers seen had a unique fingerprint; among those with Flash or Java enabled, 94.2%'''. This does '''not''' include cookies! They ranked the various bits of information in order of importance (i.e. how useful they are in uniquely identifying a browser): things like UA string, what addons are installed, and the font list of the system. We need to go through these, one by one, and do what we can to reduce the number of bits of information (entropy) it provides. In their study, they placed a lower bound on the fingerprint distribution of 18.1 bits of entropy. (This means that, choosing a browser at random, at best one in 286,777 other browsers will share its fingerprint.)
Other documents that may be relevant depending on the audience:


= Data =
<ul>
<li> SUMO page more appropriate for end-users of Firefox https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting
<li> SUMO page for end users who might have (accidently or not) enabled Resist Fingerprinting https://support.mozilla.org/en-US/kb/resist-fingerprinting
<li> Firefox's Fingerprinting Protection Architecture in Gory Detail https://docs.google.com/document/d/1FywogzvkWupoUoz4PcCp9nNd6aKOwBN-c2zRu2Xof9Y/edit?tab=t.0
<li> Source Docs on the implementation: https://firefox-source-docs.mozilla.org/toolkit/components/resistfingerprinting/resistfingerprinting/implementation.html
</ul>


The following data is taken from the published paper, https://panopticlick.eff.org/browser-uniqueness.pdf:
== Summary ==
''As of Firefox 151 Release, last updated 5/12/26, the following protections are enabled:''


<center>
{| class="wikitable"
{| border="1" cellpadding="6"
|+ '''Entropy of various pieces of browser information'''
|-
|-
| '''Variable''' || '''Entropy (bits)'''
! Protection !! Desktop FPP !! Android FPP !! Desktop Baseline !! Android Baseline
|-
|-
| plugins || 15.4
| CanvasRandomization || Yes || Yes || Yes || Nightly-only
|-
|-
| fonts || 13.9
| EfficientCanvasRandomization || Yes || Yes || Yes || Nightly-only
|-
|-
| user agent || 10.0
| FontVisibilityLangPack || Yes || Yes || ||
|-
|-
| http accept || 6.09
| JSMathFdlibm || Yes || Yes || ||
|-
|-
| screen resolution || 4.83
| MaxTouchPointsCollapse || Yes || Yes || Yes || Nightly-only
|-
|-
| timezone || 3.04
| NavigatorHWConcurrencyTiered || Yes || Yes || ||
|-
|-
| supercookies || 2.12
| ScreenAvailToResolution || Yes || Yes || Yes || Nightly-only
|-
| cookies enabled || 0.353
|}
|}
</center>


In all cases, data was either collected or inferred via HTTP, or collected by JS code and posted back to the server via AJAX.
== Desktop ==


== Plugins ==
{| class="wikitable"
|-
! Protection Name !! Channel !! Version !! Bugs
|-
| rowspan="8" | ScreenAvailToResolution
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Release as of 151'''
|-
| Baseline Release
| 151
| {{bug|2032123}}
|-
| Baseline Beta
| 151
| {{bug|2032123}}
|-
| Baseline Nightly
| 150
| {{bug|1990514}}
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}}
|-
| colspan="3" | Regressions: {{bug|2016747}}
|-
| rowspan="8" | MaxTouchPointsCollapse
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Release as of 151'''
|-
| Baseline Release
| 151
| {{bug|2032123}}
|-
| Baseline Beta
| 151
| {{bug|2032123}}
|-
| Baseline Nightly
| 150
| {{bug|1990514}}
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}}
|-
| colspan="3" | Regressions: {{bug|1991701}} (Linux touch disabled by companion fix {{bug|1957658}}, re-enabled in 146/147); {{bug|2021715}} (Linux Wayland count adjusted, 150)
|-
| rowspan="8" | EfficientCanvasRandomization
| colspan="3" | '''Enabled in FPP (PBM) Release as of 145; Enabled in Baseline Release as of 151'''
|-
| Baseline Release
| 151
| {{bug|2032123}}
|-
| Baseline Beta
| 151
| {{bug|2032123}}
|-
| Baseline Nightly
| 150
| {{bug|2021606}}
|-
| FPP (PBM) Release
| 145
| {{bug|1993304}}
|-
| FPP (PBM) Beta
| 145
| {{bug|1993304}}
|-
| FPP (PBM) Nightly
| 145
| {{bug|1993304}}
|-
| colspan="3" | Regressions: {{bug|2025570}} (Google Maps highway labels broken, fixed via RemoteSettings in 150/151)
|-
| rowspan="8" | CanvasRandomization
| colspan="3" | '''Enabled in FPP (PBM) Release as of 120; Enabled in Baseline Release as of 151'''
|-
| Baseline Release
| 151
| {{bug|2032123}}
|-
| Baseline Beta
| 151
| {{bug|2032123}}
|-
| Baseline Nightly
| 150
| {{bug|2021606}}
|-
| FPP (PBM) Release
| 120
| {{bug|1858181}}
|-
| FPP (PBM) Beta
| 120
| {{bug|1858181}}
|-
| FPP (PBM) Nightly
| 115
| {{bug|1825250}} (Nightly-only in 118–119 due to {{bug|1849903}})
|-
| colspan="3" | Regressions: {{bug|1852541}} (Google Meet can't join, fixed 120); {{bug|1876149}} (onshape.com getImageData); {{bug|1882761}} (Google Maps highway symbols); {{bug|1887161}} (canvas getImageData slow in PBM on maps/Airbnb, fixed via SipHash in 134 then superseded by EfficientCanvasRandomization); {{bug|1905884}} (visual bugs on canvas-heavy sites); {{bug|1957426}} (meta); {{bug|1957427}} (wpt.fyi image comparison, fixed via overrides); {{bug|2010274}} (SoundCloud audio waveform broken in PBM/ETP Strict); {{bug|2025570}} (Google Maps Baseline, shared with EfficientCanvasRandomization)
|-
| rowspan="5" | FontVisibilityLangPack
| colspan="3" | '''Enabled in FPP (PBM) Release as of 118'''
|-
| FPP (PBM) Release
| 118
| {{bug|1849903}}
|-
| FPP (PBM) Beta
| 118
| {{bug|1849903}}
|-
| FPP (PBM) Nightly
| 118
| {{bug|1849903}}
|-
| colspan="3" | Regressions: {{bug|1827475}} (meta); {{bug|1850672}} (localized font names not in standard list, fixed 118.0.2/119); {{bug|1854950}} (broken rendering on Linux with no native distro fonts, fixed 119/120)
|-
| rowspan="4" | JSMathFdlibm
| colspan="3" | '''Enabled in FPP (PBM) Release as of 134'''
|-
| FPP (PBM) Release
| 134
| {{bug|1887682}}
|-
| FPP (PBM) Beta
| 134
| {{bug|1887682}}
|-
| FPP (PBM) Nightly
| 134
| {{bug|1887682}}
|-
| rowspan="5" | NavigatorHWConcurrencyTiered
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143'''
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}} (renamed and tiered in 144 via {{bug|1984333}})
|-
| colspan="3" | Regressions: {{bug|1984132}}; {{bug|1982336}}
|}


The PluginDetect JS library was used to check for 8 common plugins on that platform, plus extra code to estimate the Acrobat Reader version. Data sent by AJAX post.
== Android ==


IE does not allow enumeration via <code>navigator.plugins</code>. We could follow suit here ([https://bugzilla.mozilla.org/show_bug.cgi?id=757726 bug 757726]). A short list could be brute-forced by simply including several plugin-specific objects in a page. I'm not sure what can be done about that, other than perhaps limiting the number of plugin types a page can display?
{| class="wikitable"
 
|-
== Fonts ==
! Protection Name !! Channel !! Version !! Bugs
 
|-
System fonts collected by Flash or Java applet, if installed, and sent via AJAX post. Font list was not sorted, which provides a bit or two of additional entropy. We can ask Adobe to either limit this list by default; or ask them to implement an API such that we can provide the list to them; or (made possible by OOPP) replace the OS API calls they use to get the font list, and give them our own. None of these things are easy, but given that this is #1, we should definitely do something here. The fastest option is probably to hack the OS API calls ourselves.
| rowspan="5" | ScreenAvailToResolution
 
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Nightly-only as of 151'''
Font lists can also be determined by CSS introspection. We could perhaps reduce the available set to a smaller number of common fonts; and back off (exponentially?) if script attempts to brute-force the list. Could require that sites provide unusual fonts via WOFF?
|-
 
| Baseline Nightly
== User Agent ==
| 151
 
| {{bug|2032123}}
Detected from HTTP header. Pretty simple fix, but has the potential for breakage (as with any UA change!). For instance: <code>Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20100106
|-
Ubuntu/9.10 (karmic) Firefox/3.5.7</code>. Remedies: remove the last point digit in the Firefox and Gecko versions, and the Gecko build date; for Linux, remove distribution and version; possibly remove CPU. Windows is actually the least unique since the OS version string only identifies the major version (e.g. XP), and by far the majority of users are on it.
| FPP (PBM) Release
 
| 143
Remove language and "Firefox" as well?
| {{bug|1978414}}
 
|-
Boris Zbarsky points out that most parts of the UA lead to bad sniffing.  Irish "ga-IE" and "Minef'''ie'''ld" get detected as IE.  Sites incorrectly sniff based on OS.  Sites sniff for Gecko years rather than Gecko versions.  Going from 3.0.9 to 3.0.10 probably breaks things.  And quite a few sites sniff for "Firefox", which is a threat to the continued freedom of the web.  So removing things from the UA string has a long-term positive effect on compatibility as well as privacy.
| FPP (PBM) Beta
 
| 143
:There is another issue with UA spoofing. For some reason, Components.classes and Components.interfaces exist in the content-window javascript namespace. Gregory Fleischer used this to test for the existence of ephemeral interfaces to [http://pseudo-flaw.net/tor/torbutton/fingerprint-firefox.html fingerprint both OS and Firefox version], down to the minor revision (FF3.5.3 was the latest release at the time). He has a [http://pseudo-flaw.net/content/defcon/dc-17-demos/ number of other fingerprinting demos] you should investigate as well. -- [[User:mikeperry|mikeperry]]
| {{bug|1978414}}
 
|-
 
| FPP (PBM) Nightly
:Filed [https://bugzilla.mozilla.org/show_bug.cgi?id=http-fingerprint bugs]. [[User:Hsivonen|Hsivonen]] 09:33, 18 June 2010 (UTC)
| 143
 
| {{bug|1978414}}
== HTTP ACCEPT ==
|-
 
| rowspan="5" | MaxTouchPointsCollapse
Example: <code>text/html, */* ISO-8859-1,utf-8;q=0.7,*;q=0.7 gzip,deflate en-  
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Nightly-only as of 151'''
us,en;q=0.5</code>. Not sure we can do much here?
|-
 
| Baseline Nightly
== Screen resolution ==
| 151
 
| {{bug|2032123}}
Example: <code>1280x800x24</code>. Can't mess with this, except perhaps to always report "24" for the color depth -- of dubious value.
|-
 
| FPP (PBM) Release
:Mapping "32" to "24" or vice versa in the color depth would reduce entropy by ~0.9 bits.  May be worthwhile.
| 143
 
| {{bug|1978414}}
:Torbutton takes two countermeasures with respect to screen resolution: quantising AvailWidth and AvailHeight, and setting Width and Height to the values of AvailWidth and AvailHeight.  Torbutton currently errs in not doing this if the window is maximised.  These measures might be appropriate in private browsing mode. -- [[User:Pde|Pde]] 03:12, 15 June 2010 (UTC)
|-
 
| FPP (PBM) Beta
== Timezone ==
| 143
 
| {{bug|1978414}}
Too useful to break.
|-
 
| FPP (PBM) Nightly
== Supercookies ==
| 143
 
| {{bug|1978414}}
The reported entropy includes '''only''' whether the following were enabled: DOM localStorage, DOM sessionStorage, and (for IE) userData. It did '''not''' test Flash LSOs, Silverlight cookies, HTML5 databases, or DOM globalStorage. We can't do anything to prevent testing whether these are enabled, but we can lock them down for third parties, as we will with cookies.
|-
 
| rowspan="5" | EfficientCanvasRandomization
For Flash and Silverlight we need to pressure them to implement better APIs for controlling and clearing stored data. This is undoubtedly '''more important''' than anything else on this list, though it was ignored in this study since it does not fit within their definition of fingerprinting. We could be aggressive here by using the new Flash API for private browsing mode very liberally; or do something with the OS APIs as mentioned above.
| colspan="3" | '''Enabled in FPP (PBM) Release as of 145; Enabled in Baseline Nightly-only as of 151'''
 
|-
== Cookies enabled ==
| Baseline Nightly
 
| 151
Irrelevant due to low amount of entropy.
| {{bug|2032123}}
 
|-
= Extra credit =
| FPP (PBM) Release
 
| 145
Other fingerprinting methods were mentioned, but not included, in the study. A Gartner report on fingerprinting services was referenced in the study, which will undoubtedly be interesting to read.
| {{bug|1993304}}
 
|-
Examples:
| FPP (PBM) Beta
:HTML5 Canvas: "After plugins and plugin-provided information, we believe that the HTML5 Canvas is the single largest fingerprinting threat browsers face today." - Tor Project. ([http://cseweb.ucsd.edu/~hovav/dist/canvas.pdf Pixel Perfect: Fingerprinting Canvas in HTML5], [https://www.browserleaks.com/canvas HTML5 Canvas Fingerprinting]).
| 145
 
| {{bug|1993304}}
== Other data acquired via plugins ==
|-
 
| FPP (PBM) Nightly
Undoubtedly Flash and Java provide other interesting tidbits. ActiveX and Silverlight, for example, allow querying the "CPU type and many other details". More study needed here.
| 145
 
| {{bug|1993304}}
== Clock skew measurements ==
|-
 
| rowspan="6" | CanvasRandomization
"41st Parameter looks at more than 100 parameters, and at the core of its algorithm is a time differential parameter that measures the time difference between a user’s PC (down to the millisecond) and a server’s PC." We can't break the millisecond resolution of Date.now, but we could try adding a small (< 100ms) offset to it. This would be generated per-origin, and would last for some relatively short time: life of session, life of tab, etc. Would have to be careful that it can't be reversed.
| colspan="3" | '''Enabled in FPP (PBM) Release as of 120; Enabled in Baseline Nightly-only as of 151'''
 
|-
:Clock skew measurement isn't really a browser issue; it tends to be exposed by the operating system at the TCP level.  It would be appropriate to assume that an attacker can obtain 4-6 bits of information about the identity of a host by this method.  -- [[User:Pde|Pde]] 02:55, 15 June 2010 (UTC)
| Baseline Nightly
 
| 151
::This is not 100% correct. According to [http://www.faqs.org/rfcs/rfc1323.html RFC 1323] sections 3.2 and 4.2.2, timestamps may only be used if the initial syn packet (not syn+ack) contains a timestamp field. This is a property of the client OS, and may be controllable on some platforms. The timestamp value is also not absolute, but is typically some arbitrary number of milliseconds with no specific reference point. TLS also has a timestamp, but this value is fully controlled by Firefox. -- [[User:mikeperry|mikeperry]]
| {{bug|2032123}}
 
|-
:::Agree that one could turn off the TCP RTTM option at the OS layer.  My naive intuition is that all modern OSes have this turned on, and turning it off would be a radical intervention bad for congestion avoidance and  possibly fingerprintable itself.  Note that clock skew is a function of how fast a clock ticks, not of what time the clock has.  An arbitrary reference point is sufficient for measuring clock skew.  -- [[User:Pde|Pde]] 08:23, 9 December 2010 (PST)
| FPP (PBM) Release
 
| 120
:Note also that it's not just clock skew, but also clock precision that can allow for fingerprinting - both in terms of how long certain operations take on a system and in terms of user action. For example, [http://www.scoutanalytics.com/ Scout Analytics] provides software to fingerprint users based on [http://arstechnica.com/tech-policy/news/2010/02/firm-uses-typing-cadence-to-finger-unauthorized-users.ars typing cadence]. One can also imagine tight loops of timed javascript that fingerprint users based on certain resource-intensive calls. One possibility might be to quantize Date values to the second, and then add random, monotonically increasing amounts of milliseconds to subsequent calls during private browsing mode. -- [[User:mikeperry|mikeperry]]
| {{bug|1858181}}
 
|-
== TCP stack ==
| FPP (PBM) Beta
 
| 120
"ThreatMetrix claims that it can detect irregularities in the TCP/IP stack and can pierce through proxy servers". Not sure what this means yet.
| {{bug|1858181}}
 
|-
:nmap's host fingerprinting options (and source code) are the first place to start for understanding the TCP/IP stack issues. Again, there's not much the browser can do about that. 
| FPP (PBM) Nightly
 
| 115
:As for "pierce through proxy servers", my best guess is that they use the raw socket infrastructure provided by Flash, which does not respect the browser's proxy settings, in order to learn the client's IP.  Not sure if Java and Silverlight have similar problems. -- [[User:Pde|Pde]] 02:58, 15 June 2010 (UTC)
| {{bug|1825250}} (Nightly-only in 118–119 due to {{bug|1849903}})
 
|-
== JS behavioral tests ==
| colspan="3" | Regressions: {{bug|1852541}} (Google Meet can't join, fixed 120); {{bug|1876149}} (onshape.com getImageData); {{bug|1882761}} (Google Maps highway symbols); {{bug|1887161}} (canvas getImageData slow in PBM, fixed via SipHash in 134 then superseded by EfficientCanvasRandomization); {{bug|1905884}} (visual bugs on canvas-heavy sites); {{bug|1957426}} (meta); {{bug|1957427}} (wpt.fyi image comparison, fixed via overrides)
 
|-
Can be used to gather information about whether certain addons are installed, exact browser version, etc. Probably nothing we can do here.
| rowspan="5" | FontVisibilityLangPack
 
| colspan="3" | '''Enabled in FPP (PBM) Release as of 134 (removed 124–133 via {{bug|1826412}}, re-enabled via {{bug|1928705}})'''
== Recommend privacy-related addons and services ==
|-
 
| FPP (PBM) Release
"TorButton has evolved to give considerable thought to fingerprint resistance [19] and may be receiving the levels of scrutiny necessary to succeed in that project [15]. NoScript is a useful privacy enhancing technology that seems to reduce fingerprintability."
| 134
 
| {{bug|1928705}}
"We identified only three groups of browser with comparatively good resistance to fingerprinting: those that block JavaScript, those that use TorButton, and certain types of smartphone."
|-
 
| FPP (PBM) Beta
We should study what TorButton does, and see if we can integrate some of its features. We can also recommend it, NoScript, and Flashblock to users. We could suggest improvements to relevant addons, such as providing options for blocking third party but not first party content. (This doesn't strictly solve anything, but makes gathering the data more difficult, since the third party now relies on the first party to collect it.)
| 134
 
| {{bug|1928705}}
:Unfortunately Flashblock does not appear to prevent Flash from reading and writing LSOs, so it's doubtful it can be relied upon to protect against fingerprinting.  -- [[User:Pde|Pde]] 03:00, 15 June 2010 (UTC)
|-
 
| FPP (PBM) Nightly
== User interface ==
| 118
 
| {{bug|1849903}} (removed in 124 via {{bug|1826412}}, re-added in 134 via {{bug|1928705}})
Things like geolocation, database access and such require the user to grant permission for a given site. For geolocation, this is done with an infobar. We should do everything we can to make it clear to users what they're providing, and give them centralized control of those permissions in the privacy panel. This is what the UX privacy proposals seek to do.
|-
| colspan="3" | Regressions: {{bug|1946625}} (Brahmic scripts broken on older Samsung Android); {{bug|1956251}} (cxcricket.co Bangla Sangam MN font missing from Android font list)
|-
| rowspan="4" | JSMathFdlibm
| colspan="3" | '''Enabled in FPP (PBM) Release as of 134'''
|-
| FPP (PBM) Release
| 134
| {{bug|1887682}}
|-
| FPP (PBM) Beta
| 134
| {{bug|1887682}}
|-
| FPP (PBM) Nightly
| 134
| {{bug|1887682}}
|-
| rowspan="5" | NavigatorHWConcurrencyTiered
| colspan="3" | '''Enabled in FPP (PBM) Release as of 143'''
|-
| FPP (PBM) Release
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Beta
| 143
| {{bug|1978414}}
|-
| FPP (PBM) Nightly
| 143
| {{bug|1978414}} (renamed and tiered in 144 via {{bug|1984333}})
|-
| colspan="3" | Regressions: {{bug|1984132}}; {{bug|1982336}}
|}

Latest revision as of 18:25, 12 May 2026

This page tracks the deployment of Firefox's Fingerprinting Protection (FPP) feature.

Other documents that may be relevant depending on the audience:

Summary

As of Firefox 151 Release, last updated 5/12/26, the following protections are enabled:

Protection Desktop FPP Android FPP Desktop Baseline Android Baseline
CanvasRandomization Yes Yes Yes Nightly-only
EfficientCanvasRandomization Yes Yes Yes Nightly-only
FontVisibilityLangPack Yes Yes
JSMathFdlibm Yes Yes
MaxTouchPointsCollapse Yes Yes Yes Nightly-only
NavigatorHWConcurrencyTiered Yes Yes
ScreenAvailToResolution Yes Yes Yes Nightly-only

Desktop

Protection Name Channel Version Bugs
ScreenAvailToResolution Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Release as of 151
Baseline Release 151 bug 2032123
Baseline Beta 151 bug 2032123
Baseline Nightly 150 bug 1990514
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414
Regressions: bug 2016747
MaxTouchPointsCollapse Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Release as of 151
Baseline Release 151 bug 2032123
Baseline Beta 151 bug 2032123
Baseline Nightly 150 bug 1990514
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414
Regressions: bug 1991701 (Linux touch disabled by companion fix bug 1957658, re-enabled in 146/147); bug 2021715 (Linux Wayland count adjusted, 150)
EfficientCanvasRandomization Enabled in FPP (PBM) Release as of 145; Enabled in Baseline Release as of 151
Baseline Release 151 bug 2032123
Baseline Beta 151 bug 2032123
Baseline Nightly 150 bug 2021606
FPP (PBM) Release 145 bug 1993304
FPP (PBM) Beta 145 bug 1993304
FPP (PBM) Nightly 145 bug 1993304
Regressions: bug 2025570 (Google Maps highway labels broken, fixed via RemoteSettings in 150/151)
CanvasRandomization Enabled in FPP (PBM) Release as of 120; Enabled in Baseline Release as of 151
Baseline Release 151 bug 2032123
Baseline Beta 151 bug 2032123
Baseline Nightly 150 bug 2021606
FPP (PBM) Release 120 bug 1858181
FPP (PBM) Beta 120 bug 1858181
FPP (PBM) Nightly 115 bug 1825250 (Nightly-only in 118–119 due to bug 1849903)
Regressions: bug 1852541 (Google Meet can't join, fixed 120); bug 1876149 (onshape.com getImageData); bug 1882761 (Google Maps highway symbols); bug 1887161 (canvas getImageData slow in PBM on maps/Airbnb, fixed via SipHash in 134 then superseded by EfficientCanvasRandomization); bug 1905884 (visual bugs on canvas-heavy sites); bug 1957426 (meta); bug 1957427 (wpt.fyi image comparison, fixed via overrides); bug 2010274 (SoundCloud audio waveform broken in PBM/ETP Strict); bug 2025570 (Google Maps Baseline, shared with EfficientCanvasRandomization)
FontVisibilityLangPack Enabled in FPP (PBM) Release as of 118
FPP (PBM) Release 118 bug 1849903
FPP (PBM) Beta 118 bug 1849903
FPP (PBM) Nightly 118 bug 1849903
Regressions: bug 1827475 (meta); bug 1850672 (localized font names not in standard list, fixed 118.0.2/119); bug 1854950 (broken rendering on Linux with no native distro fonts, fixed 119/120)
JSMathFdlibm Enabled in FPP (PBM) Release as of 134
FPP (PBM) Release 134 bug 1887682
FPP (PBM) Beta 134 bug 1887682
FPP (PBM) Nightly 134 bug 1887682
NavigatorHWConcurrencyTiered Enabled in FPP (PBM) Release as of 143
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414 (renamed and tiered in 144 via bug 1984333)
Regressions: bug 1984132; bug 1982336

Android

Protection Name Channel Version Bugs
ScreenAvailToResolution Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Nightly-only as of 151
Baseline Nightly 151 bug 2032123
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414
MaxTouchPointsCollapse Enabled in FPP (PBM) Release as of 143; Enabled in Baseline Nightly-only as of 151
Baseline Nightly 151 bug 2032123
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414
EfficientCanvasRandomization Enabled in FPP (PBM) Release as of 145; Enabled in Baseline Nightly-only as of 151
Baseline Nightly 151 bug 2032123
FPP (PBM) Release 145 bug 1993304
FPP (PBM) Beta 145 bug 1993304
FPP (PBM) Nightly 145 bug 1993304
CanvasRandomization Enabled in FPP (PBM) Release as of 120; Enabled in Baseline Nightly-only as of 151
Baseline Nightly 151 bug 2032123
FPP (PBM) Release 120 bug 1858181
FPP (PBM) Beta 120 bug 1858181
FPP (PBM) Nightly 115 bug 1825250 (Nightly-only in 118–119 due to bug 1849903)
Regressions: bug 1852541 (Google Meet can't join, fixed 120); bug 1876149 (onshape.com getImageData); bug 1882761 (Google Maps highway symbols); bug 1887161 (canvas getImageData slow in PBM, fixed via SipHash in 134 then superseded by EfficientCanvasRandomization); bug 1905884 (visual bugs on canvas-heavy sites); bug 1957426 (meta); bug 1957427 (wpt.fyi image comparison, fixed via overrides)
FontVisibilityLangPack Enabled in FPP (PBM) Release as of 134 (removed 124–133 via bug 1826412, re-enabled via bug 1928705)
FPP (PBM) Release 134 bug 1928705
FPP (PBM) Beta 134 bug 1928705
FPP (PBM) Nightly 118 bug 1849903 (removed in 124 via bug 1826412, re-added in 134 via bug 1928705)
Regressions: bug 1946625 (Brahmic scripts broken on older Samsung Android); bug 1956251 (cxcricket.co Bangla Sangam MN font missing from Android font list)
JSMathFdlibm Enabled in FPP (PBM) Release as of 134
FPP (PBM) Release 134 bug 1887682
FPP (PBM) Beta 134 bug 1887682
FPP (PBM) Nightly 134 bug 1887682
NavigatorHWConcurrencyTiered Enabled in FPP (PBM) Release as of 143
FPP (PBM) Release 143 bug 1978414
FPP (PBM) Beta 143 bug 1978414
FPP (PBM) Nightly 143 bug 1978414 (renamed and tiered in 144 via bug 1984333)
Regressions: bug 1984132; bug 1982336
Retrieved from "https://wiki.mozilla.org/index.php?title=Fingerprinting&oldid=1257347"