Make sure Mozilla's own emoji font on Windows/Linux does not interfere with our font fingerprinting defense

Mozilla ships an own emoji font to Windows and Linux users (https://bugzilla.mozilla.org/show_bug.cgi?id=1231701). We should make sure that does not interfere with our font fingerprinting defense.

added component::applications/tor browser in Legacy / Trac ff52-esr in Legacy / Trac owner::tbb-team in Legacy / Trac priority::medium in Legacy / Trac severity::normal in Legacy / Trac sponsor::4 in Legacy / Trac status::new in Legacy / Trac type::task in Legacy / Trac labels

This ticket needs some love. Emoji Font additions for Gnu+Linux Tor Browser is discussed here, which seems relevant to this ticket: https://trac.torproject.org/projects/tor/ticket/18364

TL;DL: emoji fonts are broken in GNU+Linux for Tor Browser currently, including on trac.torproject.org which you would notice if you are using Tor Browser on GNU+Linux and viewing this post right now.

Trac:
Username: vegansalad

moved from legacy/trac#21740 (moved)

added Task label and removed 1 deleted label

removed 1 deleted label

@gk needs a fingerprinting label

added Fingerprinting label

This ticket needs some love

This ticket needs some MOAR love. But By not whitelisting the already-bundled Twemoji (Fenix excluded), this increases entropy: for example emoji's will fall back to a different emoji font on different platforms: probably not an issue for windows (Segoe UI Symbol?) or mac (Apple Color Emoji?), but linux distros may differ.

Note: we can't hide the major OS (win/mac/linux), but whitelisting it literally cannot do any harm - the utopia of font-fingerprinting defenses is to bundle and lock down every single font so all users are identical right down to the version - but that's almost impossible. But whitelisting Twemoji could do some good, not to mention providing a better emoji experience

Note: this has nothing to do with how fonts are used in other FPing techniques or subject to external factors (such as dpi, device pixel ratio)

bump! double-bump!

changed milestone to %Tor Browser: 10.5

Ok, I think we can set 10.5 as milestone here. We should be able to take this once the new Tor Browser for Android is out.

mentioned in issue #18172 (closed)

added Backlog label

added 1 deleted label

changed milestone to %Tor Browser: 11.0 Issues with previous release

mentioned in issue #40660 (closed)

mentioned in issue tor-browser-build#40387 (closed)

Just asking: The original issue #18172 (closed) is 6 years old and still not fixed. Is there any workaround for the average user?

BTW: Somehow TorBrowser in Linux can show more emojis than TorBrowser in Windows.

For testing: https://www.fileformat.info/info/emoji/browsertest.htm

Here's Windows, TB Alpha as if that matters

• Go to https://www.fileformat.info/info/emoji/browsertest.htm
• Scroll, notice almost all Hex, Decimal and UTF-8 render as tofu (boxes with hex codes)
• In a new tab edit font.system.whitelist to include Twemoji Mozilla
• Go back to your open test page and be STUNNED and AMAZED at the magically disappearing tofu and ENJOY the WONDERMENT of being able to use the web
• IMPORTANT : reset the pref when finished

For Frank's Sake ... can we get this added please (windows, linux - i don't think mac/android need it?) ... name dropping @sysrqb @gk @mikeperry @arma @richard ... I am not a font super-expert, but this will not add entropy (because everyone will use twemoji in the first instance for those PUAs code points instead of falling back to "some-other-font-depending-on-os/distro"). Things will only get worse the more emoji versions increase - https://emojipedia.org/ - we're now at v15

^ name-dropping @pierov too - this is simply not going to make font FPing worse, it is simply shipping a better font to support a range of code points. Fonts already differ in the other 50k code points and other metrics

can we do an FF102-esr, remove the TB-10-5-could and just do it already :)

@thorin we'd really love to ship it with 11.5 because we'll use emojis as a checksum for copying&pasting bridge strings (#40966 (closed)).

However, we're also evaluating whether to ship it on Mac, to have consistent appearing.

Do you think adding it also to Mac would be a bad idea?

Do you think adding it also to Mac would be a bad idea

yes - am writing in the other issue, see you there

to have consistent appearing

hmmm ... what about android? What does it look like in twemoji vs Mac's emoji font. I said in the other issue that mac already ships with emoji support, but from a FP/font perspective, swapping them in the whitelist is no big deal - might seem strange for some mac users, and adds to the TB bundle size

because we'll use emojis as a checksum

does a tofu break that? I don't understand this emoji checksumming at all - it is to provide a user readable string? :)

Sorry, I meant consistent appearance of our about:preferences#connection page (see on the alpha).

We've added 4 emojis to allow people being sure they've copied and pasted the correct bridge string.

Here are more technical details .

mentioned in issue #31666 (closed)

added Roadmap::Future label and removed Backlog label

mentioned in issue #41004 (closed)

marked this issue as related to #40966 (closed)

removed 1 deleted label

removed Roadmap::Future label

added Doing label

mentioned in merge request !305 (merged)

closed

assigned to @pierov

mentioned in merge request tor-browser-build!494 (merged)