[tor-bugs] #13018 [Applications/Tor Browser]: Math routines are OS fingerprintable

[Tor Bug Tracker & Wiki]

#13018: Math routines are OS fingerprintable
-------------------------------------------------+-------------------------
 Reporter:  mikeperry                            |          Owner:  tbb-
                                                 |  team
     Type:  defect                               |         Status:  new
 Priority:  Medium                               |      Milestone:
Component:  Applications/Tor Browser             |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  tbb-fingerprinting-os-version,       |  Actual Points:
  ff31-esr                                       |
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by gk):

 * cc: Thorin (added)


Comment:

 From #29566 (which I closed as duplicate):
 {{{

 **part2: math.cos Windows: FF vs TB**

 results: see attachment
 test: https://thorin-oakenpants.github.io/testing/ (for as long as I leave
 it there)

 I do not know if that ticket/patch causes this, but there is a difference
 between TB vs FF for no discernible reason (e.g Linux doesn't differ
 between FF and TB)

 Look at the first result. FF: `minus 0.374...` vs TB `plus 0.840...`

 **part3: math.cos reveals platform**

 finally, to the meat and potatoes. See attachment. I'm using math.cos
 because it always returns a value between -1 and 1 (i.e no NaN or
 Infinity). The following tests show that, so far, the last four values can
 be used to detect windows or Linux, and so far one Android major version
 (v5.*). I am fully expecting the first four value to betray other Android
 and macOS/macOS X. My testing is incomplete, but enough to prove os FP'ing
 }}}
 and
 {{{
 Thanks :) Yup, that was the ticket. Wow, 4 years. That ticket is about the
 functions added in FF25+ - e.g like those in
 https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.html#math -
 which doesn't **seem** to differ in 60+ anyway (those FF25+ functions
 probably need more testing I guess)

 Also note, that sin() can also have differences, I'm just not sure on
 which values over which platforms produce the desired results (and I could
 probably find more functions) - I'm sure the solution for this would fix
 any functions, so I'm not going to dig any further (except to show combos
 for mac and other android versions using cos)

 Edit: https://developer.mozilla.org/en-
 US/docs/Web/JavaScript/Reference/Global_Objects/Math#Browser_compatibility
 - `cos`, `sin` etc were FF version 1 compatible
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13018#comment:27>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online