{"action":"created","issue":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/11683","repository_url":"https://api.github.com/repos/brave/browser-laptop","labels_url":"https://api.github.com/repos/brave/browser-laptop/issues/11683/labels{/name}","comments_url":"https://api.github.com/repos/brave/browser-laptop/issues/11683/comments","events_url":"https://api.github.com/repos/brave/browser-laptop/issues/11683/events","html_url":"https://github.com/brave/browser-laptop/issues/11683","id":268845007,"number":11683,"title":"Fingerprinting protections bypassable","user":{"login":"snyderp","id":76526,"avatar_url":"https://avatars0.githubusercontent.com/u/76526?v=4","gravatar_id":"","url":"https://api.github.com/users/snyderp","html_url":"https://github.com/snyderp","followers_url":"https://api.github.com/users/snyderp/followers","following_url":"https://api.github.com/users/snyderp/following{/other_user}","gists_url":"https://api.github.com/users/snyderp/gists{/gist_id}","starred_url":"https://api.github.com/users/snyderp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snyderp/subscriptions","organizations_url":"https://api.github.com/users/snyderp/orgs","repos_url":"https://api.github.com/users/snyderp/repos","events_url":"https://api.github.com/users/snyderp/events{/privacy}","received_events_url":"https://api.github.com/users/snyderp/received_events","type":"User","site_admin":false},"labels":[{"id":451022958,"url":"https://api.github.com/repos/brave/browser-laptop/labels/feature/shields","name":"feature/shields","color":"84b6eb","default":false},{"id":315504236,"url":"https://api.github.com/repos/brave/browser-laptop/labels/privacy","name":"privacy","color":"5319e7","default":false},{"id":433043857,"url":"https://api.github.com/repos/brave/browser-laptop/labels/QA/checked-Linux","name":"QA/checked-Linux","color":"0e8a16","default":false},{"id":433043540,"url":"https://api.github.com/repos/brave/browser-laptop/labels/QA/checked-macOS","name":"QA/checked-macOS","color":"0e8a16","default":false},{"id":433043709,"url":"https://api.github.com/repos/brave/browser-laptop/labels/QA/checked-Win64","name":"QA/checked-Win64","color":"0e8a16","default":false},{"id":420081901,"url":"https://api.github.com/repos/brave/browser-laptop/labels/QA/test-plan-specified","name":"QA/test-plan-specified","color":"1d76db","default":false},{"id":506404384,"url":"https://api.github.com/repos/brave/browser-laptop/labels/release-notes/include","name":"release-notes/include","color":"c2e0c6","default":false},{"id":735570500,"url":"https://api.github.com/repos/brave/browser-laptop/labels/release/blocking","name":"release/blocking","color":"000000","default":false},{"id":314299292,"url":"https://api.github.com/repos/brave/browser-laptop/labels/security","name":"security","color":"eb6420","default":false}],"state":"closed","locked":false,"assignee":{"login":"snyderp","id":76526,"avatar_url":"https://avatars0.githubusercontent.com/u/76526?v=4","gravatar_id":"","url":"https://api.github.com/users/snyderp","html_url":"https://github.com/snyderp","followers_url":"https://api.github.com/users/snyderp/followers","following_url":"https://api.github.com/users/snyderp/following{/other_user}","gists_url":"https://api.github.com/users/snyderp/gists{/gist_id}","starred_url":"https://api.github.com/users/snyderp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snyderp/subscriptions","organizations_url":"https://api.github.com/users/snyderp/orgs","repos_url":"https://api.github.com/users/snyderp/repos","events_url":"https://api.github.com/users/snyderp/events{/privacy}","received_events_url":"https://api.github.com/users/snyderp/received_events","type":"User","site_admin":false},"assignees":[{"login":"snyderp","id":76526,"avatar_url":"https://avatars0.githubusercontent.com/u/76526?v=4","gravatar_id":"","url":"https://api.github.com/users/snyderp","html_url":"https://github.com/snyderp","followers_url":"https://api.github.com/users/snyderp/followers","following_url":"https://api.github.com/users/snyderp/following{/other_user}","gists_url":"https://api.github.com/users/snyderp/gists{/gist_id}","starred_url":"https://api.github.com/users/snyderp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snyderp/subscriptions","organizations_url":"https://api.github.com/users/snyderp/orgs","repos_url":"https://api.github.com/users/snyderp/repos","events_url":"https://api.github.com/users/snyderp/events{/privacy}","received_events_url":"https://api.github.com/users/snyderp/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/brave/browser-laptop/milestones/84","html_url":"https://github.com/brave/browser-laptop/milestone/84","labels_url":"https://api.github.com/repos/brave/browser-laptop/milestones/84/labels","id":2791306,"number":84,"title":"0.19.x Hotfix 3 (Release channel)","description":"","creator":{"login":"bbondy","id":831718,"avatar_url":"https://avatars2.githubusercontent.com/u/831718?v=4","gravatar_id":"","url":"https://api.github.com/users/bbondy","html_url":"https://github.com/bbondy","followers_url":"https://api.github.com/users/bbondy/followers","following_url":"https://api.github.com/users/bbondy/following{/other_user}","gists_url":"https://api.github.com/users/bbondy/gists{/gist_id}","starred_url":"https://api.github.com/users/bbondy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bbondy/subscriptions","organizations_url":"https://api.github.com/users/bbondy/orgs","repos_url":"https://api.github.com/users/bbondy/repos","events_url":"https://api.github.com/users/bbondy/events{/privacy}","received_events_url":"https://api.github.com/users/bbondy/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":35,"state":"open","created_at":"2017-09-25T19:22:59Z","updated_at":"2017-11-01T21:52:21Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2017-10-26T17:26:03Z","updated_at":"2017-11-01T21:58:55Z","closed_at":"2017-10-31T03:26:47Z","author_association":"CONTRIBUTOR","body":"## Test plan\r\n\r\nhttps://github.com/brave/browser-laptop/issues/11683#issuecomment-340532797\r\n\r\n----\r\n\r\n### Description\r\nMany of the current fingerprinting protections rely on removing references to methods from the global object.  However, you can get alternate references to the same methods by inserting a configured iframe element and grabbing the references off `iframe.contentWindow` or `iframe.contentDocument`.\r\n\r\n### Steps to Reproduce\r\n```\r\n//blocked\r\nconsole.log(HTMLCanvasElement.prototype.toDataURL);\r\n\r\nlet iframe = document.createElement(\"iframe\");\r\niframe.src = \"https://www.brave.com/\";\r\ndocument.body.appendChild(iframe);\r\n\r\n// Not blocked\r\nconsole.log(iframe.contentWindow.HTMLCanvasElement.prototype.toDataURL);\r\n\r\n// Do the bad stuff\r\nlet canvasToDataUrl = iframe.contentWindow.HTMLCanvasElement.prototype.toDataURL;\r\ncanvasToDataUrl.apply(someParentFrameCanvasElement);\r\n```\r\n\r\n**Actual result:**\r\nYou can get references to the fingerprinting related methods.\r\n\r\n**Expected result:**\r\nYou shouldn't be able to get to these methods.\r\n\r\n**Reproduces how often:** 100%\r\n\r\n### Brave Version\r\nAll versions\r\n\r\n**Reproducible on current live release:**\r\nYes"},"comment":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/comments/341255889","html_url":"https://github.com/brave/browser-laptop/issues/11683#issuecomment-341255889","issue_url":"https://api.github.com/repos/brave/browser-laptop/issues/11683","id":341255889,"user":{"login":"snyderp","id":76526,"avatar_url":"https://avatars0.githubusercontent.com/u/76526?v=4","gravatar_id":"","url":"https://api.github.com/users/snyderp","html_url":"https://github.com/snyderp","followers_url":"https://api.github.com/users/snyderp/followers","following_url":"https://api.github.com/users/snyderp/following{/other_user}","gists_url":"https://api.github.com/users/snyderp/gists{/gist_id}","starred_url":"https://api.github.com/users/snyderp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snyderp/subscriptions","organizations_url":"https://api.github.com/users/snyderp/orgs","repos_url":"https://api.github.com/users/snyderp/repos","events_url":"https://api.github.com/users/snyderp/events{/privacy}","received_events_url":"https://api.github.com/users/snyderp/received_events","type":"User","site_admin":false},"created_at":"2017-11-01T21:58:55Z","updated_at":"2017-11-01T21:58:55Z","author_association":"CONTRIBUTOR","body":"Ah, there are two issues here.  One is that logging on really does break if you deny first person tracking on Google.  This is part of the \"fix\", i'm short of ideas on what to do about this at the moment, without either 1) loosing all finger printing protections, or 2) patching chromium to guarantee that content scripts are injected into frames before control is returned to the parent frame\r\n\r\nThe second half of this is a implementation bug in my patch (sorry!) that is fixed in 008a704a626b6c7bc541dc0514d765e93bf23a51"}}
{"actor":{"display_login":"snyderp"}}