This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 22553 - navigator.plugins and navigator.mimeTypes
Summary: navigator.plugins and navigator.mimeTypes
Status: RESOLVED FIXED
Alias: None
Product: WHATWG
Classification: Unclassified
Component: HTML (show other bugs)
Version: unspecified
Hardware: Other other
: P3 normal
Target Milestone: Unsorted
Assignee: Ian 'Hixie' Hickson
QA Contact: contributor
URL:
Whiteboard:
Keywords:
: 22554 (view as bug list)
Depends on:
Blocks: 22406
  Show dependency tree / graph
 
Reported: 2013-07-03 14:22 UTC by Ian 'Hixie' Hickson
Modified: 2013-07-09 01:20 UTC (History)
3 users (show)

See Also:

Attachments

Description Ian 'Hixie' Hickson 2013-07-03 14:22:48 UTC 
Need to spec navigator.plugins, since everyone implements it and nobody else is speccing it.
Comment 1 Ian 'Hixie' Hickson 2013-07-04 00:07:06 UTC 
Man, this is a horrible fingerprinting vector.

See also: https://bugzilla.mozilla.org/show_bug.cgi?id=757726

That bug suggests randomising the order and limiting the enumerable list to only well-known values, but still leaving rare plugins in the list so they can be tested for. (It similarly limits navigator.mimeTypes, obviously.)

This seems insufficient for any serious attempt at preventing fingerprinting.
Comment 2 Ian 'Hixie' Hickson 2013-07-04 00:08:58 UTC 
bz: You really think we should keep this around? Is there not some way we can keep it around in a Web-compatible way that is just the same on every browser?
Comment 3 Ian 'Hixie' Hickson 2013-07-04 00:09:47 UTC 
*** Bug 22554 has been marked as a duplicate of this bug. ***
Comment 4 Boris Zbarsky 2013-07-04 03:24:50 UTC 
I don't know.  I do know we've had sites break on us when we broke something about navigator.plugins (largely by failing to instantiate Flash as needed).  I can't speak to navigator.mimeTypes...

From a purely theoretical perspective, I would love these to die a horrible death.  I'm just not sure I can remove them from Gecko any time in the next several years, say.  :(

We _are_ hoping to get away without plug-ins entirely in Servo, though.
Comment 5 Ian 'Hixie' Hickson 2013-07-08 19:36:48 UTC 
Ok well I guess I'll spec it for now.
Comment 6 contributor 2013-07-09 01:19:57 UTC 
Checked in as WHATWG revision r8036.
Check-in comment: navigator.plugins and company
http://html5.org/tools/web-apps-tracker?from=8035&to=8036