[tbb-bugs] #16672 [Tor Browser]: Text rendering allows fingerprinting

[Tor Bug Tracker & Wiki]

#16672: Text rendering allows fingerprinting
-------------------------+-------------------------------------------------
     Reporter:           |      Owner:  tbb-team
  arthuredelstein        |     Status:  needs_review
         Type:  defect   |  Milestone:
     Priority:  normal   |    Version:
    Component:  Tor      |   Keywords:  tbb-fingerprinting-fonts, tbb-5.0,
  Browser                |  TorBrowserTeam201508R
   Resolution:           |  Parent ID:
Actual Points:           |
       Points:           |
-------------------------+-------------------------------------------------

Comment (by arthuredelstein):

 I discovered that my whitelisting patch interferes with font rendering
 settings for fonts.conf on linux. So here are two patches that revert the
 whitelisting for Linux only. Instead, on Linux, we rely completely on
 dcf's fonts.conf file. I tested and was able to confirm that the font
 settings in fonts.conf (such as `hinting` and `antialias`) are then
 correctly used by Tor Browser.

 https://github.com/arthuredelstein/tor-browser/commits/16672+3

 And here are builds for this patch for testing:

 https://people.torproject.org/~arthuredelstein/downloads/16672-3-builds/

 The rest of the whitelisting patch is still useful for Mac and Windows,
 especially because we are using some default OS fonts. On Linux, I think
 dcf's patch is best -- we should avoid using system fonts as these are
 much more varied between Linux flavors.

 Unfortunately, even though the fonts.conf settings are working correctly,
 I am getting different checksums between Ubuntu and Debian. So apparently
 some other settings or libraries need to be included. I'll investigate
 this further after Aug 21.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16672#comment:19>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online