feat(privacy): block Web Audio fingerprinting by default - #236
Closed
seonghobae wants to merge 34 commits into
Closed
feat(privacy): block Web Audio fingerprinting by default#236seonghobae wants to merge 34 commits into
seonghobae wants to merge 34 commits into
Conversation
Add CanvasNoise classes, canonicalized WebGL renderer tokens, standard Web Audio normalization, bounded WebRTC interface policy, and a fail-closed Canvas/WebGL/WebAudio/WebRtc surface-admission contract. Test-first: the stealth_noise_surface integration tests fail against an empty crate and pass once the module lands. Production functions, lines, regions, and branches remain fully covered by the workspace coverage gate.
Add ADR 0111 for the bounded canvas/WebGL/WebAudio/WebRtc enumerated classes and fail-closed surface admission, and index it as a Proposed branch-only decision in both the ADR index and the documentation index. The Python ADR-provenance contract now also guards ADR 0111 placement.
Extend the browser-fingerprinting section with the render/media surface re-identification basis (Laperdrix et al., 2020) and the bounded-class over per-session-randomization decision (W3C, 2025), and guard ADR 0111 provenance in the Python documentation contract.
Add the stealth surface slice to the changelog Added section and to the product-technical-gap-baseline active workstream table as Proposed ADR 0111 control-plane evidence with no real-browser or anti-evasion claim.
Add UaBrand, HintsArchitecture, HintsBitness, HintsPlatform, and UaClientHints contracts bound to the User-Agent Client Hints draft (WICG, 2026): at-most-32-char ASCII brand names, enumerated architecture/bitness/platform tokens, required non-empty brand list, and the spec rule that a non-mobile user agent reports an empty model. Test-first: ua_client_hints_surface fails on unresolved imports and passes once the module lands; production functions, lines, regions, and branches remain 100% covered.
Add ADR 0112 for the bounded UA-CH surface (ASCII brand grammar with a 32-char name bound, enumerated architecture/bitness/platform tokens, non-empty brand list, empty-model rule for non-mobile user agents) and index it as Proposed branch-only in both documentation indexes. The Python ADR-provenance contract now guards ADR 0112 placement.
Add the WICG User-Agent Client Hints Draft Community Group Report (2026) reference and the legacy-User-Agent fingerprinting rationale to doctoring, and record the UA-CH slice in the changelog and product gap baseline.
Add PresentationPlatform::hints_platform as the single source of truth for the presentation-to-hints platform mapping and require_hints_coherence, which fails closed when a UaClientHints platform contradicts the presented presentation platform. This closes the classic cross-surface reidentification hole where a page reconciles navigator.platform, userAgentData.platform, and the profile into one identity. Test-first: profile_coherence_surface fails on unresolved imports and passes once the module lands; production functions, lines, regions, and branches remain 100% covered.
Add ADR 0113 for the presentation-platform/UA-token/UA-CH-platform triad agreement and index it as Proposed branch-only in both documentation indexes. The Python ADR-provenance contract now guards ADR 0113 placement.
Add the platform-coherence slice to doctoring, the changelog, and the product gap baseline as Proposed ADR 0113 control-plane evidence with no real-browser claim.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
Exact-head maintenance audit for 5abd124 (base bcda885):\n\n- CodeGraph trace confirms the bounded path from WebAudioFingerprintPolicy through deterministic guard rendering to the checked-in MV3 MAIN-world document_start asset; current source includes all-frame and about:blank/origin-fallback matching.\n- Local evidence on Rust 1.97.1: fingerprint guard tests 7 passed, workspace clippy with -D warnings passed, fmt check passed, git diff --check passed; Python Web Audio contract tests 6 passed.\n- Hosted exact-head checks are successful: Rust contracts, Production coverage, and Pinned Chrome for Testing MV3 fixture.\n- No unresolved non-outdated review threads or formal approvals are present. The PR remains draft, so it is intentionally not marked ready or merged. |
seonghobae
changed the base branch from
feat/stealth-profile-coherence
to
feat/privacy-presentation-identity
August 29, 2026 11:54
This was referenced Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Superseded by #245 after the original stacked branch diverged from the live predecessor and could no longer be safely restacked without conflicts. The Web Audio privacy delta was replayed non-destructively onto current
feat/stealth-profile-coherenceas one clean commit, preserving the 18 intended files and requiring fresh exact-head checks. Historical #236 remains evidence for the original TDD/browser work; it is not treated as current-head verification.