Describe OS type fingerprinting in TBB design doc.
Mike Perry commited on 2014-11-01 06:52:49
Zeige 1 geänderte Dateien mit 41 Einfügungen und 12 Löschungen.
- projects/torbrowser/design/index.html.en 65b6e98d5..8a32571b2
| ... | ... |
@@ -1,5 +1,5 @@ |
| 1 | 1 |
<?xml version="1.0" encoding="UTF-8"?> |
| 2 |
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1" /></head><body><div class="article"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">October 30th, 2014</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="sect1"><a href="#idp35210336">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#components">1.1. Browser Component Overview</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary-goals">3.1. Adversary Goals</a></span></dt><dt><span class="sect2"><a href="#adversary-positioning">3.2. Adversary Capabilities - Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">4. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">4.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">4.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. Other Security Measures</a></span></dt></dl></dd><dt><span class="sect1"><a href="#BuildSecurity">5. Build Security and Package Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="#idp37001088">5.1. Achieving Binary Reproducibility</a></span></dt><dt><span class="sect2"><a href="#idp37036336">5.2. Package Signatures and Verification</a></span></dt><dt><span class="sect2"><a href="#idp37040272">5.3. Anonymous Verification</a></span></dt></dl></dd><dt><span class="appendix"><a href="#Transparency">A. Towards Transparency in Navigation Tracking</a></span></dt><dd><dl><dt><span class="sect1"><a href="#deprecate">A.1. Deprecation Wishlist</a></span></dt><dt><span class="sect1"><a href="#idp37071376">A.2. Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp35210336"></a>1. Introduction</h2></div></div></div><p> |
|
| 2 |
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>The Design and Implementation of the Tor Browser [DRAFT]</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1" /></head><body><div class="article"><div class="titlepage"><div><div><h2 class="title"><a id="design"></a>The Design and Implementation of the Tor Browser [DRAFT]</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Mike</span> <span class="surname">Perry</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:mikeperry#torproject org">mikeperry#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Erinn</span> <span class="surname">Clark</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:erinn#torproject org">erinn#torproject org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Steven</span> <span class="surname">Murdoch</span></h3><div class="affiliation"><div class="address"><p><code class="email"><<a class="email" href="mailto:sjmurdoch#torproject org">sjmurdoch#torproject org</a>></code></p></div></div></div></div><div><p class="pubdate">October 30th, 2014</p></div></div><hr /></div><div class="toc"><p><strong>Table of Contents</strong></p><dl class="toc"><dt><span class="sect1"><a href="#idp33097664">1. Introduction</a></span></dt><dd><dl><dt><span class="sect2"><a href="#components">1.1. Browser Component Overview</a></span></dt></dl></dd><dt><span class="sect1"><a href="#DesignRequirements">2. Design Requirements and Philosophy</a></span></dt><dd><dl><dt><span class="sect2"><a href="#security">2.1. Security Requirements</a></span></dt><dt><span class="sect2"><a href="#privacy">2.2. Privacy Requirements</a></span></dt><dt><span class="sect2"><a href="#philosophy">2.3. Philosophy</a></span></dt></dl></dd><dt><span class="sect1"><a href="#adversary">3. Adversary Model</a></span></dt><dd><dl><dt><span class="sect2"><a href="#adversary-goals">3.1. Adversary Goals</a></span></dt><dt><span class="sect2"><a href="#adversary-positioning">3.2. Adversary Capabilities - Positioning</a></span></dt><dt><span class="sect2"><a href="#attacks">3.3. Adversary Capabilities - Attacks</a></span></dt></dl></dd><dt><span class="sect1"><a href="#Implementation">4. Implementation</a></span></dt><dd><dl><dt><span class="sect2"><a href="#proxy-obedience">4.1. Proxy Obedience</a></span></dt><dt><span class="sect2"><a href="#state-separation">4.2. State Separation</a></span></dt><dt><span class="sect2"><a href="#disk-avoidance">4.3. Disk Avoidance</a></span></dt><dt><span class="sect2"><a href="#app-data-isolation">4.4. Application Data Isolation</a></span></dt><dt><span class="sect2"><a href="#identifier-linkability">4.5. Cross-Origin Identifier Unlinkability</a></span></dt><dt><span class="sect2"><a href="#fingerprinting-linkability">4.6. Cross-Origin Fingerprinting Unlinkability</a></span></dt><dt><span class="sect2"><a href="#new-identity">4.7. Long-Term Unlinkability via "New Identity" button</a></span></dt><dt><span class="sect2"><a href="#other-security">4.8. Other Security Measures</a></span></dt></dl></dd><dt><span class="sect1"><a href="#BuildSecurity">5. Build Security and Package Integrity</a></span></dt><dd><dl><dt><span class="sect2"><a href="#idp39143984">5.1. Achieving Binary Reproducibility</a></span></dt><dt><span class="sect2"><a href="#idp39178848">5.2. Package Signatures and Verification</a></span></dt><dt><span class="sect2"><a href="#idp39182784">5.3. Anonymous Verification</a></span></dt></dl></dd><dt><span class="appendix"><a href="#Transparency">A. Towards Transparency in Navigation Tracking</a></span></dt><dd><dl><dt><span class="sect1"><a href="#deprecate">A.1. Deprecation Wishlist</a></span></dt><dt><span class="sect1"><a href="#idp39214016">A.2. Promising Standards</a></span></dt></dl></dd></dl></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp33097664"></a>1. Introduction</h2></div></div></div><p> |
|
| 3 | 3 |
|
| 4 | 4 |
This document describes the <a class="link" href="#adversary" title="3. Adversary Model">adversary model</a>, |
| 5 | 5 |
<a class="link" href="#DesignRequirements" title="2. Design Requirements and Philosophy">design requirements</a>, and <a class="link" href="#Implementation" title="4. Implementation">implementation</a> of the Tor Browser. It is current as of Tor Browser |
| ... | ... |
@@ -655,13 +655,13 @@ system-wide extensions (through the use of |
| 655 | 655 |
disabled, which prevents Flash cookies from leaking from a pre-existing Flash |
| 656 | 656 |
directory. |
| 657 | 657 |
|
| 658 |
- </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>4.3. Disk Avoidance</h3></div></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp36779392"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 658 |
+ </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="disk-avoidance"></a>4.3. Disk Avoidance</h3></div></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp38917584"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 659 | 659 |
|
| 660 | 660 |
The User Agent MUST (at user option) prevent all disk records of browser activity. |
| 661 | 661 |
The user should be able to optionally enable URL history and other history |
| 662 | 662 |
features if they so desire. |
| 663 | 663 |
|
| 664 |
- </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp36780752"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 664 |
+ </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp38918944"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 665 | 665 |
|
| 666 | 666 |
We achieve this goal through several mechanisms. First, we set the Firefox |
| 667 | 667 |
Private Browsing preference |
| ... | ... |
@@ -735,7 +735,7 @@ the url bar origin for which browser state exists, possibly with a |
| 735 | 735 |
context-menu option to drill down into specific types of state or permissions. |
| 736 | 736 |
An example of this simplification can be seen in Figure 1. |
| 737 | 737 |
|
| 738 |
- </p><div class="figure"><a id="idp36803456"></a><p class="title"><strong>Figure 1. Improving the Privacy UI</strong></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="NewCookieManager.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> |
|
| 738 |
+ </p><div class="figure"><a id="idp38941648"></a><p class="title"><strong>Figure 1. Improving the Privacy UI</strong></p><div class="figure-contents"><div class="mediaobject" align="center"><img src="NewCookieManager.png" align="middle" alt="Improving the Privacy UI" /></div><div class="caption"><p></p> |
|
| 739 | 739 |
|
| 740 | 740 |
This example UI is a mock-up of how isolating identifiers to the URL bar |
| 741 | 741 |
origin can simplify the privacy UI for all data - not just cookies. Once |
| ... | ... |
@@ -1325,6 +1325,35 @@ fingerprinting: timestamp quantization and jitter. |
| 1325 | 1325 |
|
| 1326 | 1326 |
</p><p><span class="command"><strong>Implementation Status:</strong></span> |
| 1327 | 1327 |
We have no implementation as of yet. |
| 1328 |
+ </p></li><li class="listitem">Operating System type fingerprinting |
|
| 1329 |
+ <p> |
|
| 1330 |
+ |
|
| 1331 |
+As we mentioned in the introduction of this section, OS type fingerprinting is |
|
| 1332 |
+currently considered a lower priority, due simply to the numerous ways that |
|
| 1333 |
+characteristics of the Operating System type may leak into content, and the |
|
| 1334 |
+comparatively low contribution of OS to overall entropy. In particular, there |
|
| 1335 |
+are likely to be many ways to measure the differences in widget size, |
|
| 1336 |
+scrollbar size, and other rendered details on a page. Also, directly exported |
|
| 1337 |
+OS routines, such as the Math library, expose differences in their |
|
| 1338 |
+implementations due to these results. |
|
| 1339 |
+ |
|
| 1340 |
+ |
|
| 1341 |
+ </p><p><span class="command"><strong>Design Goal:</strong></span> |
|
| 1342 |
+ |
|
| 1343 |
+We intend to reduce or eliminate OS type fingerprinting to the best extent |
|
| 1344 |
+possible, but recognize that the effort for reward on this item is not as high |
|
| 1345 |
+as other areas. The entropy on the current OS distribution is somewhere around |
|
| 1346 |
+2 bits, which is much lower than other vectors which can also be used to |
|
| 1347 |
+fingerprint configuration and user-specific information. |
|
| 1348 |
+ |
|
| 1349 |
+ </p><p><span class="command"><strong>Implementation Status:</strong></span> |
|
| 1350 |
+ |
|
| 1351 |
+We have no defenses deployed that address OS type fingerprinting, but nothing |
|
| 1352 |
+else. Several defenses may help also mitigate it, in addition to reducing a |
|
| 1353 |
+lot more entropy elsewhere. You can see the major areas of OS fingerprinting |
|
| 1354 |
+we're aware of using the tag <a class="ulink" href="https://trac.torproject.org/projects/tor/query?keywords=~tbb-fingerprinting-os" target="_top">tbb-fingerprinting-os |
|
| 1355 |
+on our bugtracker</a>. |
|
| 1356 |
+ |
|
| 1328 | 1357 |
</p></li></ol></div></div><p> |
| 1329 | 1358 |
For more details on identifier linkability bugs and enhancements, see the <a class="ulink" href="https://trac.torproject.org/projects/tor/query?keywords=~tbb-fingerprinting&status=!closed" target="_top">tbb-fingerprinting tag in our bugtracker</a> |
| 1330 | 1359 |
</p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="new-identity"></a>4.7. Long-Term Unlinkability via "New Identity" button</h3></div></div></div><p> |
| ... | ... |
@@ -1333,11 +1362,11 @@ In order to avoid long-term linkability, we provide a "New Identity" context |
| 1333 | 1362 |
menu option in Torbutton. This context menu option is active if Torbutton can |
| 1334 | 1363 |
read the environment variables $TOR_CONTROL_PASSWD and $TOR_CONTROL_PORT. |
| 1335 | 1364 |
|
| 1336 |
- </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp36963888"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 1365 |
+ </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp39106608"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"> |
|
| 1337 | 1366 |
|
| 1338 | 1367 |
All linkable identifiers and browser state MUST be cleared by this feature. |
| 1339 | 1368 |
|
| 1340 |
- </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp36965136"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1369 |
+ </blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp39107856"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1341 | 1370 |
|
| 1342 | 1371 |
First, Torbutton disables Javascript in all open tabs and windows by using |
| 1343 | 1372 |
both the <a class="ulink" href="https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsIDocShell#Attributes" target="_top">browser.docShell.allowJavascript</a> |
| ... | ... |
@@ -1382,7 +1411,7 @@ privacy and security issues. |
| 1382 | 1411 |
Fingerprinting</a> is a statistical attack to attempt to recognize specific |
| 1383 | 1412 |
encrypted website activity. |
| 1384 | 1413 |
|
| 1385 |
- </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp36979248"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1414 |
+ </p><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp39122096"></a>Design Goal:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1386 | 1415 |
|
| 1387 | 1416 |
We want to deploy a mechanism that reduces the accuracy of <a class="ulink" href="https://en.wikipedia.org/wiki/Feature_selection" target="_top">useful features</a> available |
| 1388 | 1417 |
for classification. This mechanism would either impact the true and false |
| ... | ... |
@@ -1404,7 +1433,7 @@ Congestion-Sensitive BUFLO</a>. It may be also possible to <a class="ulink" href |
| 1404 | 1433 |
defenses</a> such that they only use existing spare Guard bandwidth capacity in the Tor |
| 1405 | 1434 |
network, making them also effectively no-overhead. |
| 1406 | 1435 |
|
| 1407 |
- </p></blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp36986144"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1436 |
+ </p></blockquote></div></div><div class="sect3"><div class="titlepage"><div><div><h4 class="title"><a id="idp39128912"></a>Implementation Status:</h4></div></div></div><div class="blockquote"><blockquote class="blockquote"><p> |
|
| 1408 | 1437 |
Currently, we patch Firefox to <a class="ulink" href="https://gitweb.torproject.org/torbrowser.git/blob/maint-2.4:/src/current-patches/firefox/0017-Randomize-HTTP-request-order-and-pipeline-depth.patch" target="_top">randomize |
| 1409 | 1438 |
pipeline order and depth</a>. Unfortunately, pipelining is very fragile. |
| 1410 | 1439 |
Many sites do not support it, and even sites that advertise support for |
| ... | ... |
@@ -1463,7 +1492,7 @@ contend with. For this reason, we have deployed a build system |
| 1463 | 1492 |
that allows anyone to use our source code to reproduce byte-for-byte identical |
| 1464 | 1493 |
binary packages to the ones that we distribute. |
| 1465 | 1494 |
|
| 1466 |
- </p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp37001088"></a>5.1. Achieving Binary Reproducibility</h3></div></div></div><p> |
|
| 1495 |
+ </p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp39143984"></a>5.1. Achieving Binary Reproducibility</h3></div></div></div><p> |
|
| 1467 | 1496 |
|
| 1468 | 1497 |
The GNU toolchain has been working on providing reproducible builds for some |
| 1469 | 1498 |
time, however a large software project such as Firefox typically ends up |
| ... | ... |
@@ -1582,7 +1611,7 @@ container. We addressed umask by setting it explicitly in our Gitian |
| 1582 | 1611 |
descriptor scriptlet, and addressed the hostname and kernel version leaks by |
| 1583 | 1612 |
directly patching the aspects of the Firefox build process that included this |
| 1584 | 1613 |
information into the build. |
| 1585 |
- </p></li></ol></div></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp37036336"></a>5.2. Package Signatures and Verification</h3></div></div></div><p> |
|
| 1614 |
+ </p></li></ol></div></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp39178848"></a>5.2. Package Signatures and Verification</h3></div></div></div><p> |
|
| 1586 | 1615 |
|
| 1587 | 1616 |
The build process produces a single sha256sums.txt file that contains a sorted |
| 1588 | 1617 |
list the SHA-256 hashes of every package produced for that build version. Each |
| ... | ... |
@@ -1616,7 +1645,7 @@ and by their nature are based on non-public key material, providing native |
| 1616 | 1645 |
code-signed packages while still preserving ease of reproducibility |
| 1617 | 1646 |
verification has not yet been achieved. |
| 1618 | 1647 |
|
| 1619 |
- </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp37040272"></a>5.3. Anonymous Verification</h3></div></div></div><p> |
|
| 1648 |
+ </p></div><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="idp39182784"></a>5.3. Anonymous Verification</h3></div></div></div><p> |
|
| 1620 | 1649 |
|
| 1621 | 1650 |
Due to the fact that bit-identical packages can be produced by anyone, the |
| 1622 | 1651 |
security of this build system extends beyond the security of the official |
| ... | ... |
@@ -1730,7 +1759,7 @@ possible for us to <a class="ulink" href="https://trac.torproject.org/projects/t |
| 1730 | 1759 |
ourselves</a>, as they are comparatively rare and can be handled with site |
| 1731 | 1760 |
permissions. |
| 1732 | 1761 |
|
| 1733 |
- </p></li></ol></div></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp37071376"></a>A.2. Promising Standards</h2></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://web-send.org" target="_top">Web-Send Introducer</a><p> |
|
| 1762 |
+ </p></li></ol></div></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="idp39214016"></a>A.2. Promising Standards</h2></div></div></div><div class="orderedlist"><ol class="orderedlist" type="1"><li class="listitem"><a class="ulink" href="http://web-send.org" target="_top">Web-Send Introducer</a><p> |
|
| 1734 | 1763 |
|
| 1735 | 1764 |
Web-Send is a browser-based link sharing and federated login widget that is |
| 1736 | 1765 |
designed to operate without relying on third-party tracking or abusing other |
| 1737 | 1766 |