From 19970dcc6e96a1fc7dc526f496692c5692b54ab8 Mon Sep 17 00:00:00 2001 From: Ricardo Lafuente Date: Jun 10 2022 12:14:52 +0000 Subject: [PATCH 1/2] website: Move wrapper links to JS Shield page --- diff --git a/website/theme/templates/base.html b/website/theme/templates/base.html index ae99a99..35f1340 100644 --- a/website/theme/templates/base.html +++ b/website/theme/templates/base.html @@ -128,15 +128,6 @@
  • JavaScript Shield
  • Network Boundary Shield
  • Fingerprint Detector
    • - {% for p in pages if p.category == "wrappers" %} - {% if p.url.strip('/') == slug %} -
  • - {% else %} -
  • - {% endif %} - {{ p.title }} -
    • - {% endfor %}
  • diff --git a/website/theme/templates/page.html b/website/theme/templates/page.html index ccdbf45..22ec290 100644 --- a/website/theme/templates/page.html +++ b/website/theme/templates/page.html @@ -14,6 +14,21 @@ {{ page.content }} + {% if page.slug == 'levels' %} + + {% endif %} + {# source link #} {#

    {{ tr.gotoSourceCode }}

    #} From 2d7fc3011357508b663ced729f051ffb5308abf3 Mon Sep 17 00:00:00 2001 From: Ricardo Lafuente Date: Jun 10 2022 12:14:52 +0000 Subject: [PATCH 2/2] website: Copyedit the JS Shield page for better structure --- diff --git a/website/content/pages/levels.md b/website/content/pages/levels.md index 4bef4a5..f5377b0 100644 --- a/website/content/pages/levels.md +++ b/website/content/pages/levels.md @@ -1,33 +1,24 @@ -Title: Protection Shields - -## JavaScript Shield levels +--- +Title: JavaScript Shield +--- JavaScript Shield modifies the behaviour of the JavaScript environment availble for the visited webpage. JShelter provides fake information to confuse fingerprinters or make webpage triggered attacks impossible or harder. JavaScript Shield internally consists of wrappers, small pieces of code that modify the original behaviour of a JavaScript API (a function or a property) defined by standards. The behaviour of the most of the wrappers can be divided into several categories: -* Precision reduction: The original value is too precise and it is not necessary for most use cases. JavaScript Shield modifies the values so that typical and benign use cases are not affected. +* **Precision reduction**: The original value is too precise and it is not necessary for most use cases. JavaScript Shield modifies the values so that typical and benign use cases are not affected. -* Provide fake information: Some wrappers provide fake information mostly to confuse fingerprinters. For example, canvas wrappers modifify the image so that the same instructions produce different result in each session and for each domain. +* **Provide fake information**: Some wrappers provide fake information mostly to confuse fingerprinters. For example, canvas wrappers modifify the image so that the same instructions produce different result in each session and for each domain. -* Hide information: Some APIs provide information that is not generally needed and can be hidden from most of the pages. Depending on the API, JavaScript Shield might return an error, an empty value, or block the API completely. +* **Hide information**: Some APIs provide information that is not generally needed and can be hidden from most of the pages. Depending on the API, JavaScript Shield might return an error, an empty value, or block the API completely. See our blog posts for more information on [browser fingerprinting counter-measures](/fingerprinting/) and [farbling](/farbling/). -JShelter supports following levels: - -### Turn JavaScript Shield off - -Use for pages that you trust and you want ot give them access to full APIs supported by the browser. - -### Turn fingerprinting protection off - -Apply security counter-measures that are likely not to break web pages but do not defend against fingerprinting. Disable APIs that are not commonly used. Use this level if Fingerprint Detector reports low likelihood of fingerprinting, you trust the visited service, and/or you think that the protection makes the page slow or broken and your temptation to use the service is so high that you do not want to be protected. - -### Recommended - -Make the browser appear differently to distinct fingerprinters. Apply security counter-measures that are likely not to break web pages. Slightly modify the results of API calls in different way on different domains so that the cross-site fingerprint is not stable. The generated fingerprint values also differ with each browser restart. If you need a different fingerprint for the same website without restart, use incognito mode. Keep in mind that even if you log out from a site, clear your cookies, change your IP address, the modified APIs will provide a way to compute the same fingerprint. Restart your browser if you want to change your fingerprint. If in doubt, use this level. +## Protection levels -### Strict +JShelter supports the following protection levels: -Enable all non-experimental protection. The wrapped APIs return fake values. Some APIs are blocked completely, others provide meaningful but rare values. Some return values are meaningless. This level will make you fingerprintable because the results of API calls are generally modified in the same way on all webistes and in each session. Use this level if you want to limit the information provided by your browser. If you are worried about fingerprinters, make sure the Fingerprint Detector is activated. +* **Turn JavaScript Shield off**: Use for pages that you trust and you want to give them access to full APIs supported by the browser. +* **Turn fingerprinting protection off**: Apply security counter-measures that are likely not to break web pages but do not defend against fingerprinting. Disable APIs that are not commonly used. Use this level if Fingerprint Detector reports low likelihood of fingerprinting, you trust the visited service, and/or you think that the protection makes the page slow or broken and your temptation to use the service is so high that you do not want to be protected. +* **Recommended**: Make the browser appear differently to distinct fingerprinters. Apply security counter-measures that are likely not to break web pages. Slightly modify the results of API calls in different way on different domains so that the cross-site fingerprint is not stable. The generated fingerprint values also differ with each browser restart. If you need a different fingerprint for the same website without restart, use incognito mode. Keep in mind that even if you log out from a site, clear your cookies, change your IP address, the modified APIs will provide a way to compute the same fingerprint. Restart your browser if you want to change your fingerprint. If in doubt, use this level. +* **Strict**: Enable all non-experimental protection. The wrapped APIs return fake values. Some APIs are blocked completely, others provide meaningful but rare values. Some return values are meaningless. This level will make you fingerprintable because the results of API calls are generally modified in the same way on all webistes and in each session. Use this level if you want to limit the information provided by your browser. If you are worried about fingerprinters, make sure the Fingerprint Detector is activated.