Choose: Simple Style

chrome://-Detect (Only Firefox)

║▌║▌│█║▌║│█│█║║║▌│║

/Tracking/Fingerprinting/active/chrome_detect/

  • $ fingerprint@info:~ echo $CHROME-DETECT
  • Name:

    chrome://-Detect

    Original feature purpose:

    In a browser, the chrome is any visible aspect aside from the webpages themselves (e.g., toolbars, menu bars, tabs). This is not to be confused with the Google Chrome browser.
    For more details see e.g. MDN web docs

    Chrome providers
    A supplier of chrome for a given window type (e.g., for the browser window) is called a chrome provider. Providers work together to supply a complete set of chrome for a particular window. This ranges from the images on the toolbar buttons to the files that describe the text, content, and appearance of the window itself.

    • Content:
      The content provider contains JavaScript files which define the user interface.
    • Skin:
      The skin provider is responsible for providing a complete set of files which
      describes the visual appearance of the chrome. A Skin provider provides CSS files and images.
    • For more details see e.g. MDN web docs

    Chrome registry
    The Gecko runtime maintains a service known as the chrome registry which provides mappings from chrome package names to the physical location of chrome packages on disk.
    This chrome registry is configurable and persistent, and thus, a user can install different chrome providers, and select a preferred skin and locale. This is accomplished through xpinstall and the extension manager.
    For more details see e.g. MDN web docs


    FP-Explanation:

    Mozilla Firefox locates and reads the root chrome.manifest file for extensions and themes from disk.
    A user can access chrome resources via the internal Firefox browser URI scheme chrome://.
    The default permissions defined in the chrome.manifest file allow specific paths to be called from any web page.
    For example, chrome://browser/content/* or chrome://global/content/*.

    In consequence of these default permissions, hundreds of chrome resources (e.g., JavaScript, CSS, image files such as JPG, PNG, or SVG, as well as other file types) can be loaded from web pages without the knowledge or consent of the browser user.
    Differences in the presence of certain files can reveal Firefox versions as well as the operating systems used (Windows, Mac, Linux, Android).

    This technique works alongside with Firefox's built-in fingerprinting protection activated, in private sessions and in the latest Firefox releases.
    From Firefox version 21 (May 2013) each version is uniquely identifiable - including operating system detection.



    This technique works for Firefox-based browsers. For demonstration purposes the following browsers/browser versions were added:

    • Detection for Cliqz Version 1.23.3 (63.03+1.32.3, 2019) on Windows (32-bit)
      (without checking Cliqz exclusive files)
    • Detection for Cliqz Version 1.25.3 (65.0.1+1.34.1, 2019) on Linux (64-Bit)
      (without checking Cliqz exclusive files)
    • Detection for Pale Moon 28 (2019) on Windows (32-bit) and Linux (64-bit)
      (without checking Pale Moon exclusive files)
    • Detection for Waterfox 56.2.8 (2019) on Windows (32-bit) and Linux (64-bit)
      (without checking Waterfox exclusive files)


    FP-Type:

    active

    FP-Categories:

    js, hardware-dependent, software-dependent, unchanged-consistent

    Counter-measures:

    • Firefox: Block chrome:// scheme access completely
      Description: It should only be allowed to load chrome://-URIs locally.
      Description: No external web pages should have access.
      Problem: Possible functionality losses for the user.

    • Tor Browser: Block chrome:// scheme access completely
      Description: Access to all local schemes (e.g. resource://, chrome://-URIs) is blocked.
      Info: Functionality losses for the user will be accepted as tradeoff for privacy.
      Problem: The default Tor configuration allows websites to access chrome:// files

    Unwise counter-measures:

    • Manual access permission or file modifications
      Description: Modifying chrome files (omni.ja) and manifest permissions
      Problem: Generates an individual, potentially unique Firefox version, which differs from other/existing versions.

    • User Agent spoofing
      Description: Spoof the User Agent (browser, browser version, operating system, ...)
      Problem: Actual Firefox version will be recognized.


    Publications/References:


  • $ fingerprint@info:~ run chrome-detect-demo
  • Demo:

    >> Jump to chrome://-Detect Demo <<


chrome://-Detect: Results

Your Firefox version is: Test is running...
Your operating system is: Test is running...

Refresh page.






Image Resource Counter: 0/0
IMG Resources successfully loaded:

IMG Resources failed to load:


JavaScript Resource Counter: 0/0
JS Resources successfully loaded:

JS Resources failed to load:


Cascading Style Sheets Resource Counter: 0/0
CSS Resources successfully loaded:

CSS Resources failed to load: