Monthly Archives: November 2013

Cloaking plugin names to limit browser fingerprinting in Firefox

Web analytics software often tracks people using a “fingerprint” of their browsers’ unique characteristics. Bumper stickers are a good analogy. If you see a blue Volkswagen with the same uncommon bumper stickers as a blue Volkswagen you saw yesterday, there is a very good chance it is the same person driving the same car. If you don’t want people to recognize your car, you can remove your bumper stickers or display the same bumper stickers seen on many other cars. The list of plugins and fonts installed on your computer are like bumper stickers on your browser.

For more technical details of fingerprinting, see Mozilla’s Fingerprinting wiki, the EFF’s Panopticlick demo, or the HTML Standard’s “hidden plugins” description.

I landed a fix for bug 757726 so Firefox 28 will “cloak” uncommon plugin names from navigator.plugins[] enumeration. This change does not disable any plugins; it just hides some plugin names.

If you find that a website no longer recognize your installed plugin when running Firefox 28, this is likely a side effect of bug 757726. Please file a new bug blocking bug 757726 so we can fix our whitelist of uncloaked plugin names or have a web compatibility evangelist reach out to the website author to fix their code.

This code change will reduce browser uniqueness by “cloaking” uncommon plugin names from navigator.plugins[] enumeration. If a website does not use the “Adobe Acrobat NPAPI Plug-in, Version 11.0.02” plugin, why does it need to know that the “Adobe Acrobat NPAPI Plug-in, Version 11.0.02” plugin is installed? If a website does need to know whether the plugin is installed or meets minimum version requirements, it can still check navigator.plugins[“Adobe Acrobat NPAPI Plug-in, Version 11.0.02”] or navigator.mimeTypes[“application/vnd.fdf”].enabledPlugin (to workaround problem plugins that short-sightedly include version numbers in their names).

For example, the following JavaScript reveals my installed plugins:

for (plugin of navigator.plugins) console.log(plugin.name);
“Shockwave Flash”
“QuickTime Plug-in 7.7.3”
“Default Browser Helper”
“Unity Player”
“Google Earth Plug-in”
“Silverlight Plug-In”
“Java Applet Plug-in”
“Adobe Acrobat NPAPI Plug-in, Version 11.0.02”
“WacomTabletPlugin”

navigator.plugins[“Unity Player”].name // get cloaked plugin by name
“Unity Player”

But with plugin cloaking, the same JavaScript will not reveal as much personally-identifying information about my browser:

for (plugin of navigator.plugins) console.log(plugin.name);
“Shockwave Flash”
“QuickTime Plug-in 7.7.3”
“Java Applet Plug-in”

navigator.plugins[“Unity Player”].name // get cloaked plugin by name
“Unity Player”

In theory, all plugin names could be cloaked because web content can query navigator.plugins[] by plugin name. Unfortunately, we could not cloak all plugin names because many popular websites check for Flash or QuickTime by enumerating navigator.plugins[] and comparing plugin names one by one, instead of just asking for navigator.plugins[“Shockwave Flash”] by name. These websites should be fixed.

The policy of which plugin names are uncloaked can be changed in the about:config pref “plugins.enumerable_names”. The pref’s value is a comma-separated list of plugin name prefixes (so the prefix “QuickTime” will match both “QuickTime Plug-in 6.4” and “QuickTime Plug-in 7.7.3”). The default pref cloaks all plugin names except Flash, Shockwave (Director), Java, and QuickTime. To cloak all plugin names, set the pref to the empty string “”. To cloak no plugin names, set the pref to magic value “*”.

I started hacking on this patch in my spare time 13 months ago. I finally found some time to complete it. :)

canada cialis viagra on line natural viagra what does viagra do how does viagra work cialis patent expiration date extended viagra 100mg price walmart cialis 5mg viagra substitute cialis sample generic viagra available in usa viagra without a doctor prescription pfizer viagra coupons cheap viagra wholesale cialis viagra pills for sale levitra canada buy viagra online generic levitra cialis or viagra viagra without a doctor prescription usa viagra from amazon generic for viagra viagra girls generic cialis at walmart viagra prices without insurance cialas does viagra work herbal viagra is viagra covered by insurance canada viagra generic cialis tadalafil buy cialis online 9 levitra at walmart how much does cialis cost liquid cialis cialis online buy viagra trial viagra sample online viagra generic viagra cialis prices viagra online levitra vs viagra for hardness viagra government funding what is levitra cialis for women canadian cialis levitra 20mg cialis alternative cialis dosage recommendations cialis on line where to buy viagra when will cialis go generic best price viagra viagra without prescription levitra cialis savings card pfizer viagra cheap cialis how long does viagra last price cialis cialis coupons printable order online viagra cialis side effects cialis for daily use how does cialis work cialis medication daily cialis cialis copay card cost of viagra how to take cialis viagra pharmacy viagra generic viagra coupons from pfizer cialis dosage strengths cialis 10 mg natural viagra alternatives that work viagra on line no prec sildenafil vs viagra sophia viagra cialis dosage cialis pricing healthy man viagra levitra coupons viagra from canada viagra single packs free viagra cost of levitra levitra 10mg revatio vs viagra lowest cialis prices what is cialis cost of cialis free cialis buy cialis levitra vs viagra cialis website viagra 100mg tablets retail price levitra generic cialis 5 mg cialis trial walgreens viagra substitute viagra government funded viagra savings offer cialis without a doctor’s prescription levitra vs cialis viagra dosage viagra cost viagra coupons non prescribed viagra viagra prices cialis inexpensive viagra pills side effects of viagra levitra 20 mg cialis coupon cialis 20mg directions cialis for men cialis pharmacy prices cialis patent expiration 2017 viagra samples cialis or viagra cialis 20 mg cialis otc over the counter viagra women viagra viagra costs viagra pills viagra activate viagra for women viagra dose viagra vs cialis vs levitra cialis daily levitra reviews cialis pills utilisation viagra levitra prices viagra patent expiration viagra vs cialis viagra side effects cialis coupons 2017 discount cialis cialis free trial otc viagra viagra alternatives online cialis viagra cialis cialis vs viagra cialis coupons cialis discount viagra ingredients viagra price generic cialis viagra single packs cost cialis cost cilias cialis pills for sale cvs pharmacy viagra coupons cialis reviews cialis for sale viamedic cialis cialis patent expiration generic viagra 100mg cialis generic cialis 5mg daily buy levitra cialis voucher how much does viagra cost cialis testimonials levitra vs viagra cialis samples cialis price cialis vs viagra viagra pill buy levitra online cialis generic tadalafil viagra coupons 75 off cialis canadian pharmacy viagra coupon cialis coupon print levitra side effects viagra canada cialis canada is viagra federally funded sex viagra for women does the government fund viagra cealis levitra without a doctor prescription generic for cialis cialis effects female viagra levitra online cialis cheap is viagra funded by government viagra best price how long does levitra last cialis samples overnight stendra vs viagra cialis coupons from manufacturer cialis 30 day sample is viagra government funded in america side effects of cialis cialis from canada cialis tadalafil levitra dosage cialis coupon 20 mg levitra 10 mg cialis for bph cialis 20mg erectile dysfunction cialis discount viagra cialis generic availability is viagra government funded female viagra pills cyalis levitra loc us viagra vs cialis vs levitra what is viagra viagra cialis professional levitra coupon viagra for sale 200 cialis coupon canadian viagra viagra vs cialis levitra cost cialis 30 day trial coupon viagra porn viagra sex levitra 20 mg cost walmart