Touch events leak absolute screen coordinates

In Firefox 24esr, Touch events are now available: https://developer.mozilla.org/en-US/docs/DOM/Touch_events. Unfortunately, these events contain absolute screen coodinates for touch event positions. We should report content-window relative coordinates for these fields.

added TorBrowserTeam201705R component::applications/tor browser ff52-esr owner::arthuredelstein priority::high resolution::fixed severity::normal sponsor::4 status::closed tbb-7.0-must-alpha tbb-fingerprinting-resolution tbb-firefox-patch tbb-testcase type::defect labels

Trac:
Cc: N/A to gk

Actually, it turns out Touch events were disabled for the desktop in FF24: https://bugzilla.mozilla.org/show_bug.cgi?id=888304. We have some time on this.

Trac:
Keywords: N/A deleted, ff31-esr added

Trac:
Keywords: N/A deleted, tbb-testcase added

Trac:
Keywords: N/A deleted, tbb-firefox-patch added

Trac:
Component: Firefox Patch Issues to Tor Browser

This is still not enabled in FF31. The pref is dom.w3c_touch_events.enabled. It is still 0 on my FF31 on Linux.

Trac:
Keywords: ff31-esr deleted, N/A added

Trac:
Keywords: N/A deleted, ff38-esr added

Trac:
Keywords: tbb-fingerprinting deleted, tbb-fingerprinting-resolution added

Still disabled in FF38.

Trac:
Keywords: ff38-esr deleted, ff45-esr added

Trac:
Owner: N/A to tbb-team
Status: new to assigned

Trac:
Cc: gk to gk, brade, mcs

Still off in esr45 -> esr52

Trac:
Severity: N/A to Normal
Sponsor: N/A to N/A
Keywords: ff45-esr deleted, ff52-esr added
Reviewer: N/A to N/A

It looks like TouchEvents will be enabled on Windows in ESR52 (unless something special is being done for ESR that Kathy and I missed). See: https://bugzilla.mozilla.org/show_bug.cgi?id=1244402

For Linux, it looks like TouchEvents were enabled in Firefox 45: https://bugzilla.mozilla.org/show_bug.cgi?id=1217515

However, on Linux firefox must be started with MOZ_USE_XINPUT2=1 in the environment for touch support to work at all; see: https://bugzilla.mozilla.org/show_bug.cgi?id=1207700

Trac:
Sponsor: N/A to Sponsor4

Trac:
Keywords: N/A deleted, tbb-7.0-must added

Getting those tickets on our March radar as well.

Trac:
Keywords: N/A deleted, TorBrowserTeam201703 added

The Touch objects that are accessible from the TouchEvents also contain "area" information including things like the radius of the area that was touched. I think that could be used for browser fingerprinting based on the size of the user's finger, how firm the touches are, etc. See: https://developer.mozilla.org/en-US/docs/Web/API/Touch

Moving tickets over to April

Trac:
Keywords: TorBrowserTeam201703 deleted, TorBrowserTeam201704 added

On the latest Tor Browser alpha, the pref "dom.w3c_touch_events.enabled" is set to 2 on Windows and Linux, which means "autodetect". Autodetect mode results in the Touch API being exposed only when touch hardware is present. So we should either set it to "1" (enable) or "0" (disable) to ensure that JS code can't fingerprint the user's hardware.

What do we get by setting it to "1"? I guess, it's pretty easy to find out that we are cheating in the case the underlying hardware does not support it?