Concerns about possible unremoved google connections

[Luka-Filipovic]

We can never be 100% sure every evil google does is removed from UC considering how big chromium's code is.

But is there any special concern you have about some possible privacy leak that isn't fixed with domain sub and existing patches?
It doesn't have to be deeply investigated, but just as an idea.

[ghost]

I think one big one is fingerprinting. I know that firefox offers this feature by default [3]
ungoogled-chromium has this in about:flags but its disabled by default and a bit confusing on what it actually does. So not sure if this is same thing. This type of fingerprinting is very bad if you use any type of proxy/vpn/tor. It kind of acts like real life ID.

• Enable get*ClientRects() fingerprint deception - Scale the output values of Range::getClientRects() and Element::getBoundingClientRect() with a randomly selected factor in the range -0.0003% to 0.0003%, which are recomputed on every document initialization. ungoogled-chromium flag, Bromite feature.

• Enable Canvas::measureText() fingerprint deception - Scale the output values of Canvas::measureText() with a randomly selected factor in the range -0.0003% to 0.0003%, which are recomputed on every document initialization. ungoogled-chromium flag, Bromite feature.

• Enable Canvas image data fingerprint deception - Slightly modifies at most 10 pixels in Canvas image data extracted via JS APIs. ungoogled-chromium flag, Bromite feature.

[1] https://en.wikipedia.org/wiki/Canvas_fingerprinting
[2] https://en.wikipedia.org/wiki/Device_fingerprint
[3] https://www.mozilla.org/en-US/firefox/features/block-fingerprinting/

[HarukaMa]

While those measurements could defeat some types of fingerprinting, be aware that some websites rely on those features to work correctly (#1139, and I've encountered another one since then but couldn't remember now).

[nilslindemann]

(...) some websites rely on those features to work correctly

An example is /branches/all on any GitHub Repo, for example https://github.com/python/cpython/branches/all.

This page will not load when Enable get*ClientRects() fingerprint deception is enabled under chrome://flags/.

[PF4Public]

See also #2389