We should make a list of all super-cookies so we know what first-party isolation tests to run. Let's put this list somewhere in the repository.

Confirm that connections are isolated to a Tor circuit keyed to first party

We should design a declarative config file (in JSON) that allows us to specify browser test settings for selenium webdriver. To allow multiple local, remote, or browserstack tests.

Check if any unusual network activity connects outside Tor (see also #14). WebRTC, Websockets, etc., etc.

@azadi suggested we could add a dropdown or similar widget to allow people to filter by browser name

test username/password for silent autofill: see demo at https://senglehardt.com/test/dfpi/page_with_credentials.html

We want to download a list of all available Web APIs, and compare it to our own, manually-maintained list of known Web APIs. If new APIs are detected in any given browser, then report this on our website. Each API then needs to be triaged for whether it should be mitigated for fingerprinting, and if we can add a mitigration to resist-fingerprinting.js

I looked into that one recently and added it to Brave: brave/brave-browser#18020

On index.html we show results table with nothing else. Let's annotate with:

• Date
• Time
• Git hash
• Link to raw data

We can make test_unprotected.html look the same as our results table. Hopefully we can share the JS code.

Also write this into the repository, in JSON format.

And use chocolatey for installing browsers on windows?

gecko-webdriver, chromium-webdriver, etc., are needed for local testing. Automate downloading the right version for whatever platform we are on.

Right now our fingerprinting results data is a list of test maps. But each test has a unique name, so we can make a map from test name to results map. This will make analysis easier. We'll need to update the analysis code slightly as well.

Etag, Cookies, HSTS?

Make it more readable

https://github.com/tschaub/gh-pages looks useful for this

do anti-virus addons affect browser fingerprint?

Check if the browser (in Tor mode or super-PBM) is connecting through Tor.

Make sure no local DNS is happening

What is our strategy for testing fingerprinting mitigations and super-cookie mitigations? Fingerprinting mitigations are especially tricky to detect.

Look for things that violate first-party isolation (see #4)

Make sure we are getting lots of HTTPS (HTTPS Everywhere functionality or equivalent)

Right now, index.html uses unicode characters for checks and crosses (pass and fail). But these look different on each platform and sometimes ugly. We should replace them with icons. Probably inline SVG is the best, used as a CSS background-image.

DoH, ESNI, DNSSEC?, TLS 1.3?

• https://www.cloudflare.com/ssl/encrypted-sni/
• https://welcome.opendns.com/
• https://is-doh.help.every1dns.net/
• https://test.nextdns.io/

Check that we are able to connect to onion sites

We want to test on different platforms. This means setting up remote testing using selenium server and browser installs. Maybe docker instances are a good idea?

Look for things saved on disk in PBM or Tor mode.

The tests on css, font, image, prefetch become flaky in Chromium when the ServiceWorker tests run:

But if I disable ServiceWorkers, then the tests are no longer flaky:

So in 6874e71 I have disabled ServiceWorkers. But we should re-enable them in some way that doesn't interfere with the other tests.

We should test in private browsing mode of each browser.