Review Mozilla 1810641: Enable overscroll on Windows on all channels

added 13.0 stable Code Audit Desktop Fingerprinting UX FF115-esr labels

assigned to @henry

marked this issue as related to tor-browser-spec#40060 (closed)

https://www.mozilla.org/en-US/firefox/113.0/releasenotes/

On Windows, the elastic overscroll effect has been enabled by default. When two-finger scrolling on the touchpad or scrolling on the touchscreen, you will now see a bouncing animation when scrolling past the edge of a scroll container.

How do you plan to measure this and add it to a fingerprint?

OT: we already leak touch (via user gestures) until we deal with that other maxtouch/pointer issue

Unknown, I would naively assume users with the bouncing animation would have different scroll, content visibility, etc events which would allow a website to determine 'yep' this person is using a touch device.

But seeing how we already leak touch (yes/no) then this is not an additional problem.

@thorin do we have a meta-ticket for touch detection/fingerprinting and if not can you make one and collate the relevant things that would need to be fixed that you are already aware of?

OK, here's a video - https://github.com/yokoffing/Betterfox/issues/197#issue-1816841671 - so looking at that, it should be simple enough to detect if overscroll is "used" [1] (I tested several days ago and the pref doesn't alter any window or css2 properties). Honestly, I don't understand why this feature even exists. If you hit the bottom/top, then hit the bottom/top and stop.

[1] first search result: https://stackoverflow.com/questions/27335320/detect-the-end-of-overscroll edit: not sure if this was what I was looking for, but anyway, you can listen for and check positions of elements

So I think we can mostly fix touch FPing. 99% sure we can standardize all the results in #28535 (comment 2906361) the same for all platforms. So at least all users will look the same with clicking buttons (mouse, pen, touch) etc

Now, I'm not an expert on this, but it is on my radar - was that a touch exhibits other behaviors/properties? radiusX/Y? And someone using the scrollbar or mouse wheel, or page up/down or ctrl-home/ctrl-end is very different to finger scrolling. So I'm inclined to believe that #28535 should have no bearing on what we decide here

I'll have to have a play with this on my touch laptop

I haven't forgotten about some sort of meta touch ticket - it's buried in my ToDo

https://patrickhlauke.github.io/ is my go to ... the results page is interesting - I don't think we can hide when touch is used, but we might/should be able to hide entropy until then

needs more cowbell

oh right, almost forgot. I removed some "touch" results on TZP, because they are duplicated in window properties

"Touch", "TouchEvent", "TouchList","ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart"

notes

// dom.w3c_touch_events.enabled: 0=disabled (macOS) 1=enabled 2=autodetect (linux/win/android)
// autodetection is currently only supported on Windows and GTK3 (and assumed on Android)
// on touch devices: 0 (all false) 1 or 2 (all true)

now I need to check my laptop: maybe I need to disable the mouse, because I tested the hash in TB13 for window properties and it was stable across devices (but it changes with slider, to be expected)

on my android, the overscroll is nothing like that video. It just creates an arc of transparent color. Also tested in nightly by toggling the pref in about:confg. on my laptop I can't get anything, except now I have fingerprints on my screen .. more to follow

do we have a meta-ticket for touch detection/fingerprinting and if not can you make one

done = #42069

@thorin: So then this is a case of 'no more entropy than being touch detection', in which case we can leave as is and re-visit once we've fixed touch detection?

I think so. ~~buy me some more devices e.g. windows tablet, touch enabled mac laptop~~ needs more cowbell

thorin: So then this is a case of 'no more entropy than being touch detection', in which case we can leave as is and re-visit once we've fixed touch detection?

@richard Since this has gone through the initial investigation, I'll un-assign myself.

Not sure if we want to change the labels to remove "13.0 stable" if we're going to leave this as is for now.

in which case we can leave as is and re-visit once we've fixed touch detection

why closed? @richard

I think this still needs more work. At the very least I think we should disable it, not enable it

@thorin tldr what pref do we need to disable for 13.0?

It's apz.overscroll.enabled and is default true on windows (and mac if I'm reading it right) - see https://phabricator.services.mozilla.com/D174042

I personally don't "see"get" what overscroll achieves. If we set it to false for all platforms except android, then any entropy from this one method is definitely gone. But that's not to say the entropy isn't present elsewhere, e.g. detecting two fingers, or it's equivalency of something else (I struggled to get any overscroll on my touch laptop TBH) - hence meta ticket

needs information, leave open, bump to 13.5