about:networking#networkid should be normalized

Seems to be based off of some hardware configuration hash given that its' the same between different 'firefox-like' browsers.

added Sponsor 131 label

added Next label

added Bug label

added Desktop label

added All Platforms label and removed Desktop label

added Q2 label

assigned to @pierov

removed Next label

added Doing label

Function to analyze: NetlinkService::CalculateNetworkID() in netwerk/system/netlink/NetlinkService.cpp.

Or, even better, it's based on CalculateIDForFamily.

It uses some combination of gateway, MAC addresses and in general of routes. There are even some functions for non-Ethernet links. Now I'm really curious on what this is used for.

Uhm. Maybe it's for captive portal detection.

Could be for WebSockets, too.

I think that the public GetNetworkId (in C++)/networkId (in JS) are used for:

• this about page
• a nasty extension API that gladly isn't public on release (https://bugzilla.mozilla.org/show_bug.cgi?id=1550605, thanks @ma1 for finding the details)
• telemetry in DoH (more or less "anonymized" with an additional seed)

So, I think returning an empty string for these cases should be safe (the nasty API returns undefined in case).

I should audit a little bit more, but at the moment I've thought of this strategy: a pair of implementations already have a seed as local-rubbish. We could change it to be a random ID regenerated at every browser start: we'll keep everything working, but it could help if we missed any leak of the internal mNetworkId member.

We could use nsID, for example (it is fallible, but we could avoid computing an ID or refuse to save the computed one, if the seed creation failed).

More about the network ID: https://bugzilla.mozilla.org/show_bug.cgi?id=1567627

I would appreciate some documentation on its need. I think Mozilla itself should randomize the ID in the way I proposed, or explicitly write why they don't want to.

I think Mozilla itself should randomize the ID

https://bugzilla.mozilla.org/show_bug.cgi?id=1817756

added Upstream label

marked this issue as related to tor-browser-build#40758 (closed)

mentioned in merge request !558 (merged)

closed

removed Doing label

marked this issue as related to #41661

mentioned in issue #41661