Fingerprinting protection mode unintentionally breaks several popular sites

[bsclifton]

Did you search for similar issues before submitting this one?
yes

Describe the issue you encountered:
After globally enabling fingerprinting protection mode, I noticed some popular sites are broken

Expected behavior:
The user opts-in for protection (and they are warned about this) so being broken might truly be the expected behavior. However, it might not be obvious to the user that something is wrong.

We have an opportunity to consider changing the expected behavior to one of the following:

1. Give the user more clues so that it seems more obvious to them that fingerprinting was blocked (so that they know to try disabling it)
2. Have a list of popular sites that are known to use canvas (or other fingerprinting methods). If the user visits one, we can show a warning if fingerprinting protection is on (ex: maybe a fat exclamation mark over the lion head that when hovered shows something like, "WARNING: this site is known to have issues w/ fingerprinting turned")

• Platform (Win7, 8, 10? macOS? Linux distro?):
  Windows 10
• Brave Version:
  0.11.2
• Steps to reproduce:
  1. Enable fingerprinting protection
  2. Create a Google hangout and join it
  3. You will get dropped within a minute or so
• Steps to reproduce:
  1. Enable fingerprinting protection
  2. Go to https://icloud.com
  3. Notice page spins and does not load
• Screenshot if needed:
• Any related issues:

[srirambv]

Same issue for Dropbox for PDF documents. Any PDF document link doesn't load just shows the loading ticker. Disabling Fingerprint loads the document.

[diracdeltas]

probably fixable by having fingerprinting protection enabled for 3rd party only. however i don't think this is high priority since fp is off-by-default with a warning that it will break sites.

[diracdeltas]

Same issue in Google sheets

[diracdeltas]

the biggest downside of having canvas/webgl fp block on for third-party only is that we will report as not blocking fingerprinting on sites like panopticlick and browserleaks.

[BrendanEich]

Could block canvasfp based on curated 1p block-list? 3p seems the big threat, the check whether you are vuln 1p tests are few and well known enough to manage a list.

[BrendanEich]

@diracdeltas: would it help to know the URL of the script (the "third party") that does the canvas operations we detect, as opposed to the site URL (the first party)?

[diracdeltas]

would it help to know the URL of the script (the "third party") that does the canvas operations we detect, as opposed to the site URL (the first party)?

that's what i meant; i think we already have a way to detect the third party URL

[bsclifton]

report of issue w/ messenger.com #3719 (comment)

[bsclifton]

reported issue w/ maps.google.com #2341

[bsclifton]

May include fonts.google.com
#2242

[bsclifton]

includes photos.google.com
#6114

[getsetbro]

Could the Shield Exceptions allow for wildcards in domains? example: "*.google.com"

[srirambv]

+1 from community on icloud.com
https://community.brave.com/t/icloud-and-fingerprinting/1037

[srirambv]

+1 from community on https://sketchfab.com/
https://community.brave.com/t/sketchfab-not-loading-3dmodels-with-fingerprinting-protection-on/1752

[ghost]

Same problem with charts made with this library: https://fvancop.github.io/ChartNew.js/demo_program/index.html

I'm using this in one of my projects, and the fingerprinting protection blocks the canvas and breaks the page.

[diracdeltas]

if anyone here wants to compile a list of known sites that break due to fp protection based on the comments in github and support, that would help greatly in implementing an exception dialog.

[bsclifton]

+1 from users @ckaylinpercipio @newmanea
(see #8861 for more info)

They experienced issues opening Google Sheets files:

#2343

[rnsjunkmail]

Re: iCloud

I still have to turn off fingerprinting to access iCloud as of June 20, 2017. I first reported seeing this in August of 2016 as i recall it. Anyway, I am wondering if Fingerprinting can be broken down into sub-parts and those that break iCloud could be identified. Maybe even say a Fingerprinting Security Level system could be established with Level 1 being the lowest level of FP security and the highest being open-ended so the levels can be compared.

I am also if Brave can send the most common font set to the sire and retranslate the returning html to what Brave needs thereby masking the site with respect to fonts. Perhaps this technique can be tried with those components of fingerprinting that are most often uniquely identifying of a user. I would worry about the overhead, but perhaps with the increased speed of CPUs and hardware and systems in general this isn't a major issue. I would suspect that anything that could be requested for fp purposes that could be masked by substituting the most generic response would enhance fingerprinting protection.

In summary, here are some ideas:

1. Fingerprinting protection level reporting for each site (the less the site asks the more limited it will be in its ability to fingerprint a user). Allow the user to fine tune fp protection in their shields and, additionally, include the option to modify requested info to make it more generic.
2. Masking by substitution. Sending info to requests that is generic as possible and even translating from say Times New Roman to the actual font used by the user. If the font set sent to the site is different than the users actual font set and is more generic the fp is thwarted to some degree.
3. Minimize the font info and uniqueness of the system sent to the site by making it as generic as possible. Only send the site what it really needs to know and try to send it something that makes the fp it has more innocuous and inaccurate.
4. Establish whitelist for some sites.. I don't lean toward this idea because the user loses visibility to their being fingerprinted.

Maybe something here will be helpful?

[luixxiul]

+1 from https://community.brave.com/t/fingerprinting-protection-causes-many-problems/5061/5?u=suguru

[bsclifton]

Closing in favor of brave/brave-browser#1025