Preferred language option fingerprinting issue in Tor Browser

Disclosed: 2017-10-24 06:57:45 By newfunction To torproject
Low
Vulnerability Details
I'm not so sure if this is an in-scope issue or by-design. But based on my understanding of [1], I feel that Tor doesn't want to make user configuration details of Tor Browser detectable by websites. But in about:preferences#content, there's a "Languages" section that allows users to "choose your preferred language for displaying pages". When users add a language here, there's no warning to tell them that this info will be sent to the websites. The language list will be available to websites in the "Accept-Language" HTTP request header, and in JavaScript API "navigator.languages". To fix this issue, I think there're three options: 1) remove this option from the settings; 2) let users configure a list of domains for which the language list is sent; other sites get the default value; 3) add a warning in the setting page: "the info of your added languages is sent to all sites, which may be used to fingerprint you" or something like this. [1] https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability, Sources of Fingerprinting Issues
Actions
View on HackerOne
Report Stats
  • Report ID: 281597
  • State: Closed
  • Substate: informative
  • Upvotes: 3
Share this report