From 69ba260877a0dfb9326a633967b1f86eaa7f00a5 Mon Sep 17 00:00:00 2001 From: Carmelo Messina Date: Fri, 24 Jan 2025 15:43:30 +0100 Subject: [PATCH] PublicKeyCredential fingerprinting mitigations: Removes the possibility of obtaining the presence of Windows Hello and Bluetooth by querying the PublicKeyCredential of the webauth api in the Windows platform (#1758) --- ...redential-fingerprinting-mitigations.patch | 78 +++++++++++++++++++ docs/FEATURES.md | 3 +- 2 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 build/patches/PublicKeyCredential-fingerprinting-mitigations.patch diff --git a/build/patches/PublicKeyCredential-fingerprinting-mitigations.patch b/build/patches/PublicKeyCredential-fingerprinting-mitigations.patch new file mode 100644 index 00000000..f2151057 --- /dev/null +++ b/build/patches/PublicKeyCredential-fingerprinting-mitigations.patch @@ -0,0 +1,78 @@ +From: uazo +Date: Thu, 23 Jan 2025 17:01:50 +0000 +Subject: PublicKeyCredential fingerprinting mitigations + +Removes the possibility of obtaining the presence of Windows Hello and +Bluetooth by querying the PublicKeyCredential of the webauth api in +the Windows platform +--- + .../webauth/authenticator_common_impl.cc | 22 +++++++++++++++++++ + .../webauth/authenticator_common_impl.h | 2 +- + 2 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/content/browser/webauth/authenticator_common_impl.cc b/content/browser/webauth/authenticator_common_impl.cc +--- a/content/browser/webauth/authenticator_common_impl.cc ++++ b/content/browser/webauth/authenticator_common_impl.cc +@@ -1691,6 +1691,7 @@ void AuthenticatorCommonImpl::GetClientCapabilities( + MakeCapability(client_capabilities::kRelatedOrigins, true)); + + IsHybridTransportSupported( ++ caller_origin, + base::BindOnce(&MakeCapability, client_capabilities::kHybridTransport) + .Then(barrier_callback)); + +@@ -1707,6 +1708,7 @@ void AuthenticatorCommonImpl::GetClientCapabilities( + } + + void AuthenticatorCommonImpl::IsHybridTransportSupported( ++ const url::Origin& caller_origin, + base::OnceCallback callback) { + // Similar to Web Bluetooth API (`navigator.bluetooth.getAvailability()`) we + // want respect the policy and return `false` if the policy is enforced. +@@ -1715,6 +1717,19 @@ void AuthenticatorCommonImpl::IsHybridTransportSupported( + std::move(callback).Run(false); + return; + } ++ const url::Origin& embedding_origin = ++ GetRenderFrameHost()->GetMainFrame()->GetLastCommittedOrigin(); ++ ++ switch (GetContentClient()->browser()->AllowWebBluetooth( ++ GetBrowserContext(), caller_origin, ++ embedding_origin)) { ++ case ContentBrowserClient::AllowWebBluetoothResult::BLOCK_POLICY: ++ case ContentBrowserClient::AllowWebBluetoothResult::BLOCK_GLOBALLY_DISABLED: ++ std::move(callback).Run(false); ++ return; ++ case ContentBrowserClient::AllowWebBluetoothResult::ALLOW: ++ break; ++ } + + if (!device::BluetoothAdapterFactory::Get()->IsLowEnergySupported()) { + std::move(callback).Run(false); +@@ -1765,6 +1780,13 @@ void AuthenticatorCommonImpl::ContinueIsUvpaaAfterOverrideCheck( + IsUserVerifyingPlatformAuthenticatorAvailableCallback callback, + bool is_get_client_capabilities_call, + std::optional is_uvpaa_override) { ++#if BUILDFLAG(IS_WIN) ++ if ((true)) { ++ // always expose Windows Hello active, even if it is not ++ std::move(callback).Run(true); ++ return; ++ } ++#endif + if (is_uvpaa_override) { + std::move(callback).Run(*is_uvpaa_override); + return; +diff --git a/content/browser/webauth/authenticator_common_impl.h b/content/browser/webauth/authenticator_common_impl.h +--- a/content/browser/webauth/authenticator_common_impl.h ++++ b/content/browser/webauth/authenticator_common_impl.h +@@ -252,7 +252,7 @@ class CONTENT_EXPORT AuthenticatorCommonImpl : public AuthenticatorCommon { + // Bluetooth adapter that supports BLE. If so, runs |callback| with `true`. + // Otherwise, or if Bluetooth is disabled by Permissions Policy, runs + // |callback| with `false`. +- void IsHybridTransportSupported(base::OnceCallback callback); ++ void IsHybridTransportSupported(const url::Origin& caller_origin, base::OnceCallback callback); + + // `is_get_client_capabilities_call` is true if this call originated from the + // `GetClientCapabilities` method. The UMA metric is only recorded if this is +-- diff --git a/docs/FEATURES.md b/docs/FEATURES.md index b62ca589..17bc940e 100644 --- a/docs/FEATURES.md +++ b/docs/FEATURES.md @@ -21,7 +21,6 @@ - Disable visited pseudo class - Disable WebGPU - Disable GamePad API by default (https://www.w3.org/TR/gamepad/#fingerprinting-mitigation) -- Disable Posture API by default (https://github.com/w3c/device-posture/blob/gh-pages/security-privacy-self-assessment.md) Also disable gamepadconnected and gamepaddisconnected, see https://jshelter.org/gp/ - Disable WebGL by default - Disable WebRTC by default @@ -41,12 +40,14 @@ Also disable gamepadconnected and gamepaddisconnected, see https://jshelter.org/ - Do not expose local IP addresses with webRTC - Allows the use of the api DocumentPiP only with the content setting popup allowed (https://wicg.github.io/document-picture-in-picture/#privacy-considerations) - Multi-Screen Window Placement API fix (screen.isExtended) +- Disable Posture API by default (https://github.com/w3c/device-posture/blob/gh-pages/security-privacy-self-assessment.md) - (ANDROID) Do not follow night mode for dark mode preference when theme is set to system default - (DESKTOP) Enable HighEfficiencyMode by default - (DESKTOP) Enable percent based scrolling for mousewheel - (DESKTOP) Enable Keyboard Layout API mitigation - (WINDOWS) Disable Windows ClearType Text Tuner setting (active in rdp sessions) - (WINDOWS) Hide the presence of the webcam if the user has not given permission +- (WINDOWS) PublicKeyCredential fingerprinting mitigations, see #1758 #### Tracking navigation - Enable network isolation features