Re: Helping ensure privacy + security

On 10/22/15 10:24 PM, Chris Antaki wrote:
> Also, do you think disabling plugin enumeration makes generating unique browser footprints more expensive/difficult? For instance, someone might be using a rare plugin, one that wouldn't be on even a well kept list of plugins to specifically search for. Perhaps it's something they made for themselves and a small group of their friends, team members, etc. In a situation like that, wouldn't disabling plugin enumeration add value?

Yes, hiding unique plugins definitely reduces browser fingerprinting. 
That's why I was motivated to write the plugin-hiding feature in the 
first place. :-)

However, there are much easier ways to track users than fingerprinting 
uncommon plugins. For example, supercookies use multiple tracking 
methods to make deleting a cookie very difficult. And, as shown on 
Panopticlick, Flash allows trackers to fingerprint all your system fonts 
(which may be hundreds), which exposes at least as much user entropy as 
the fingerprinting a dozen common and uncommon plugins.

Hiding plugins does reduce the amount of fingerprinting information 
available to trackers, but it is a small hole in a big bucket. And the 
C++ code to hide plugins added extra complexity to Firefox's already 
ugly plugin handling code.