Investigate WebVR API 1.1 for fingerprinting/linkability risks

Virtual Reality (VR) is coming to the browser. Mozilla intends to enable VR support some time between ESR52 and ESR 59 for Windows and Linux at least (see: https://bugzilla.mozilla.org/show_bug.cgi?id=1343368 and https://groups.google.com/forum/?_escaped_fragment_=topic/mozilla.dev.platform/TB2gVavDe6w#!topic/mozilla.dev.platform/TB2gVavDe6w)

The W3C draft is on: https://w3c.github.io/webvr/archive/prerelease/1.1/

added TorBrowserTeam201809 in Legacy / Trac component::applications/tor browser in Legacy / Trac ff60-esr in Legacy / Trac owner::tbb-team in Legacy / Trac priority::high in Legacy / Trac severity::normal in Legacy / Trac status::new in Legacy / Trac type::enhancement in Legacy / Trac labels

Investigating any new browser change is always good, but will webvr even work with WebGL blocked by default in NoScript?

There's always a chance something could leak or be detectable, even if virtual reality doesn't work for users. A brief search of NoScript's site and the web didn't turn up any discussion of NoScript adding a block webVR option.

In TBB - Fx 52.2, about:config pref "dom.vr.oculus.enabled" is true, by default. It looks like 6 other similar prefs are set false, for now.

For those already checking it out in Fx nightlies, doesn't it show up under plugins manager, where it can be disabled?

Trac:
Username: joebt

Firefox 60 is the new ESR.

Trac:
Keywords: ff59-esr deleted, ff60-esr added

In Firefox 60 ESR, WebVR is enabled by default on Windows (in Firefox >= 60 non-ESR, it is also enabled on macOS). Assuming we do not have time to audit the code that implements this feature, we should set dom.vr.enabled to false in browser/app/profiles/000-tor-browser.js

Yes, you should definitely do this with high priority =)

Bumping prio.

Trac:
Priority: Medium to High

Disabling WebVR for now until we have it properly audited: bug_21607 (https://gitweb.torproject.org/user/gk/tor-browser.git/commit/?h=bug_21607&id=110dd4538adff67d4014684da52a518d17c1be39) in my public tor-browser repo.

Trac:
Cc: N/A to mcs, brade
Keywords: N/A deleted, TorBrowserTeam201808R added
Status: new to needs_review

r=mcs LGTM

Thanks! Cherry-picked to tor-browser-60.1.0esr-8.0-1 (commit 110dd4538adff67d4014684da52a518d17c1be39). Leaving the ticket open for the actual investigation.

Trac:
Status: needs_review to new
Keywords: TorBrowserTeam201808R deleted, TorBrowserTeam201808 added

Moving our tickets to September 2018

Trac:
Keywords: TorBrowserTeam201808 deleted, TorBrowserTeam201809 added

mentioned in issue legacy/trac#26401 (moved)

moved from legacy/trac#21607 (moved)

mentioned in commit d7442e65

added Feature label and removed 1 deleted label

removed 1 deleted label

added Fingerprinting Icebox labels

removed Fingerprinting label

added Fingerprinting Roadmap::Future Task labels

removed Feature label

removed Icebox label

mentioned in issue #40783 (closed)

added All Platforms label

mentioned in issue #41496 (closed)

WebVR is disabled by default on all platforms - https://support.mozilla.org/en-US/kb/view-virtual-reality-firefox-webvr

WebXR is not supported yet either - https://developer.mozilla.org/en-US/docs/Web/API/WebXR_Device_API

@richard +1 closing, if webXR ever gets turned on then we can open a new ticket, or we could use this one to set the webXR prefs for future proofing - please advise

001-base-profile.js - line 368

pref("dom.vr.enabled", false); // Bug 21607: Disable WebVR for now

notes:

• FF97+ 1750902 Disable WebVR by default
• https://developer.mozilla.org/en-US/docs/Web/API/WebVR_API

  • DEPRECATED, replaced by WebXR

• FF72+ 1581374 .. dom.vr.webxr.enabled false
  • been false ever since
• https://developer.mozilla.org/en-US/docs/Web/API/WebXR_Device_API

  • EXPERIMENTAL

We can

• remove the old pref or add a note
• MDN says WebXR isn't supported, so I think the pref from 72 is something else, but add it if you want to harden/futureproof
• easy peasy

added Apps::Type::Audit label

Web VR/XR etc is literally abandonware now and default off on all platforms

closed