[tor-bugs] #16672 [Tor Browser]: Text rendering allows fingerprinting

[Tor Bug Tracker & Wiki]

#16672: Text rendering allows fingerprinting
---------------------------+-----------------------------------------------
     Reporter:             |      Owner:  tbb-team
  arthuredelstein          |     Status:  new
         Type:  defect     |  Milestone:
     Priority:  normal     |    Version:
    Component:  Tor        |   Keywords:  tbb-fingerprinting-fonts, tbb-5.0
  Browser                  |  Parent ID:
   Resolution:             |
Actual Points:             |
       Points:             |
---------------------------+-----------------------------------------------

Comment (by dcf):

 Replying to [ticket:16672 arthuredelstein]:
 > Using dcf's font fingerprinting demo,
 >
 > https://www.bamsoftware.com/talks/fc15-fontfp/fontfp.html#demo
 >
 > gk [ticket:13313#comment:24 observed] that different operating systems
 render glyphs in the *same* font differently:
 >
 > > I just tested that on two 32bit Linux systems (one Ubuntu 12.04 and
 one Debian testing) and even there are differeces visible with bundled
 fonts (the diff is attached). I guess this means shipping the alpha with
 it is fine (it can't get worse wrt to the status quo :) ) but we might
 want to have an estimation about what the current solution really helps us
 for the stable series before we ship it there.

 The differences in attachment:linux32diff:ticket:13313, i.e. differences
 in 1 or 2 pixels of height, look like they are probably caused by hinting
 settings. That's what gk and I found last September when we were looking
 intensively at some examples. Could you try e.g. U+20B9 at

 https://people.torproject.org/~dcf/fonttest.html#viewer

 What we did before was to make screenshots of the renderings and then diff
 them. (In Gimp, Open as Layers, then change the layer mode of the top
 layer to "Difference".) Here's an example from the past of what a
 difference in hinting settings looks like:
 [[Image(u+018d-cursive-diff.png)]]
 You can tell it is due to hinting because the non-black pixels are all
 shades of gray. If the difference had instead been caused by LCD
 subpixels, then they would be colored.

 In the past, we wanted to disable all subpixel antialiasing, because of
 hardware differences in RGB versus BGR subpixel ordering, and vertical
 versus horizonal subpixels (when people rotate their monitors). A quick
 and dirty test for subpixels is to run the xmag program and check the
 edges of glyphs. If subpixels are disabled, then the antialiased pixels
 will all be gray; otherwise they will be shades of blue and red. (See
 https://www.bamsoftware.com/talks/fc15-fontfp/fontfp.html#textrendering
 for example.)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16672#comment:10>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online