[tbb-bugs] #22919 [Applications/Tor Browser]: Form tracking and OS fingerprinting (only Windows, but without Javascript)

[Tor Bug Tracker & Wiki]

#22919: Form tracking and OS fingerprinting (only Windows, but without Javascript)
-------------------------------------------------+-------------------------
 Reporter:  basvd                                |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:
                                                 |  needs_review
 Priority:  High                                 |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Major                                |     Resolution:
 Keywords:  tbb-fingerprinting,                  |  Actual Points:
  TorBrowserTeam201910R                          |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by tom):

 This looks pretty good to me.

 > unsigned char rand_buf[4];

 Why 4 if we only ever use 3?

 > uint8_t *tempBuffer;

 Do we need this? Is there a reason I can't see not to just pass the buf
 into GenerateRandomBytes?

 > nsIRandomGenerator

 We recently added https://searchfox.org/mozilla-
 central/source/mfbt/RandomNum.cpp because we needed secure randomness
 before NSS was initialized. That's not the case here; but I don't think we
 ever profiled to see which API was faster. /shrug

 I'll pursue uplifting this at some point (I'll keep the tab open).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22919#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online