[Solved] TOR Browser default settings are not there

[nargja]

Hello,

so I recently found out that you can use font.system.whitelist in TOR Browser (and soon in normal FF too).
You can see here the default TOR Browser prefs: CLICK
I downloaded a Windows TOR Browser Bundle for testing and after installing you can check in about:config, that those settings (like font.system.whitelist) do exist. In the file system they are for whatever reason not in prefs.js like you would expect, but embedded in the xul.dll file (at least when I search for some strings from the prefs you will only find them in xul.dll).

Now comes the problem with the Browser in whonix (v6.0.8) - it lacks for example the font.system.whitelist pref.
My linux knowledge is limited so I could not find where the binary for tor browser are nor what is used instead of xul.dll or how the prefs system works there, but it seems that it’s either a problem within whonix, that updating the browser does not add those prefs or a problem with the tor browser itself, due to updating through several versions where this value (font.system.whitelist) probably did not exist.

When you go into about:config, do you have font.system.whitelist?

[entr0py]

it seems that it’s either a problem within whonix

Unlikely. See https://www.whonix.org/wiki/Tor_Browser#Tor_Browser_in_Whonix_differences

I could not find where the binary for tor browser are nor what is used instead of xul.dll

$ grep -r -i font.system.whitelist /home/user/.tb/
Binary file /home/user/.tb/tor-browser/Browser/libxul.so matches

You can try asking on a Tor mailing list: https://lists.torproject.org/cgi-bin/mailman/listinfo. Keep in mind any customizations you make may differentiate your fingerprint from other TBB users.

[nargja]

Thank you, I get the same result that the string is in that file.

When you go into about:config, do you have font.system.whitelist in the list?
If yes, how old is your TOR Browser installation?

[entr0py]

so I recently found out that you can use font.system.whitelist in TOR Browser (and soon in normal FF too).

Could you post the source please? I see this for Firefox 52: http://www.ghacks.net/2016/12/28/firefox-52-better-font-fingerprinting-protection/

These tickets may help you:

https://trac.torproject.org/projects/tor/query?status=accepted&status=assigned&status=closed&status=merge_ready&status=needs_information&status=needs_review&status=needs_revision&status=new&status=reopened&keywords=~font+fingerprint&component=Applications%2FTor+Browser&col=id&col=summary&col=status&col=owner&col=type&col=priority&col=milestone&order=priority

(especially 13313 16672) (Linux TBB uses its own bundled fonts - the prefs file you linked in OP is the Linux whitelist).

[nargja]

I just realized what the problem is.
In my first link it sets the prefs for MacOS and Windows, but not for Linux. This is because on Linux they don’t use the font.system.whitelist pref in TBB but use a file called fonts.conf.

[Patrick]

You’d have to compare Tor Browser in plain Debian vs Tor Browser in Whonix to see if there are any illegitimate differences.