Commit Graph

21 Commits

Author SHA1 Message Date
sal
464a570201 Fix Intl.DateTimeFormat cross-compartment crash and Connection API robustness
OrigDateTimeFormat constructor called inside exportFunction callback failed
in Firefox compartment boundary. Moved construction to content-script-scope
helper. Also added addEventListener/removeEventListener to Connection override
to prevent crashes in real-time apps like Discord.
2026-03-04 22:03:12 -06:00
sal
ac76f93fcb Bump version to 0.5.1 2026-03-04 21:38:50 -06:00
sal
5df1a6cfa5 Remove DOM dimension noise and fix document.fonts to prevent site crashes
DOM element dimension noise (offsetWidth/Height etc.) broke complex web apps
like Discord by returning fractional values where integers are expected.
Removed entirely — measureText noise is sufficient for font enumeration.

Changed document.fonts.check() to return true (uniform response) instead of
false, which caused font loading logic to hang in apps waiting for fonts.
2026-03-04 21:34:12 -06:00
sal
23759e34a4 Add search bar to popup for filtering containers 2026-03-04 21:30:03 -06:00
sal
d6dabb2646 Add GamepadAPI, WebGL readPixels noise, auto-prune, import/export, badge
New fingerprint vectors:
- Gamepad API: getGamepads() returns empty (prevents controller fingerprinting)
- WebGL readPixels: seeded pixel noise on framebuffer reads

New features:
- Auto-prune: configurable automatic removal of inactive containers
- Import/export: backup and restore all settings from options page
- Toolbar badge: shows active container count
- CHANGELOG.md: version history

Bumped to v0.5.0 with 20 spoofed fingerprint vectors.
2026-03-04 21:08:45 -06:00
sal
bbe40f87dc Bump version to 0.4.1 2026-03-01 16:30:43 -06:00
sal
448cd3e70d Keep auth redirects in originating container for session isolation
When a tab in a managed container navigates to an auth provider
(accounts.google.com), keep it in the current container instead of
reassigning. This ensures YouTube's Google login cookies stay in the
youtube.com container and aren't visible to drive.google.com.
2026-03-01 16:27:23 -06:00
sal
97464b7690 Skip all fingerprint overrides on Google auth domains
Early return in inject.js bypasses all spoofing on accounts.google.com
and accounts.youtube.com. Google does comprehensive browser verification
beyond just UA — platform, languages, WebGL, screen all trigger rejection.
2026-03-01 16:20:50 -06:00
sal
930814015b Skip User-Agent spoofing on Google auth domains to fix login rejection
Google's login detects UA mismatches and blocks sign-in as "insecure."
Skip UA/Accept-Language header modification and JS navigator.userAgent
override on accounts.google.com and accounts.youtube.com. All other
fingerprint vectors (canvas, WebGL, screen, etc.) remain active.
2026-03-01 16:13:18 -06:00
sal
159cbdf5ed Bump version to 0.4.0 2026-03-01 15:54:46 -06:00
sal
b09a8248af Add font enumeration hardening, document.fonts protection, Client Hints stripping, and WebGL parameter normalization
- Font enumeration: seeded noise on offsetWidth/Height, scrollWidth/Height, clientWidth/Height
- document.fonts: check() returns false, size returns 0, forEach is no-op
- Client Hints: strip Sec-CH-UA/Full-Version-List, override Platform/Mobile per container
- WebGL: merge PARAM_OVERRIDES into getParameter (MAX_TEXTURE_SIZE, attribs, etc.)
- Clean up dead code in WebGL extended section
- Test page: add Font DOM, document.fonts, and Client Hints test sections
- README: update vector table (18 vectors), add about:config and testing docs
2026-03-01 15:49:40 -06:00
sal
0c370240c2 Bump version to 0.3.0 2026-03-01 15:31:21 -06:00
sal
ed9355ced6 Add HTTP header spoofing, fix timezone overrides, and expand fingerprint coverage
- Spoof User-Agent and Accept-Language HTTP headers per container via
  webRequest.onBeforeSendHeaders, eliminating JS/HTTP header mismatch
- Wrap Intl.DateTimeFormat constructor to inject spoofed timezone
- Pre-create timezone formatters outside exportFunction callbacks to
  avoid cross-compartment issues with Date.toString/toTimeString
- Fix WebRTC relay-only config to use JSON serialization across
  Firefox compartment boundaries
- Add new fingerprint vector protections: speechSynthesis.getVoices(),
  matchMedia screen dimension queries, performance.now() precision
  reduction, navigator.storage.estimate(), WebGL extension normalization
- Add comprehensive fingerprint test page (test/fingerprint-test.html)
  covering all 17 vectors with per-container comparison support
2026-03-01 15:22:21 -06:00
sal
264a401cef Add coherent device profiles and User-Agent spoofing
Device archetypes ensure platform, GPU, resolution, and UA all match
(e.g. Linux profile gets Mesa renderers and X11 UA string). Spoofs
navigator.userAgent, appVersion, and oscpu per container.
2026-03-01 00:50:30 -06:00
sal
a371859273 Add data_collection_permissions for AMO submission 2026-03-01 00:27:51 -06:00
sal
1e7327e9df Bump version to 0.2.0 2026-02-28 23:48:01 -06:00
sal
93dee6f756 Update README with options page, vector controls, and whitelist docs 2026-02-28 23:44:50 -06:00
sal
ba6449c5b0 Add options page with vector controls, whitelist, and container management
- Options page (open_in_tab) with 4 sections: fingerprint vector toggles,
  domain whitelist, container table with delete, and bulk actions
- Per-vector spoofing control: 12 independent toggles (canvas, WebGL,
  audio, navigator, screen, timezone, WebRTC, fonts, clientRects,
  plugins, battery, connection)
- Domain whitelist bypasses containerization entirely
- Delete individual containers from options UI
- Remove dead code (tabOrigins, getContainerDomain)
- Refactor profile registration into buildProfileAndRegister helper
2026-02-28 23:43:12 -06:00
sal
246933599f Fix cross-domain navigation staying in wrong container
Tabs now switch to the correct container when navigating to a different
domain (e.g. clicking a search result on DDG). User-created containers
outside ContainSite are left alone.
2026-02-28 23:27:11 -06:00
sal
077a3d0d1b Add README and GPL-3.0 license 2026-02-28 23:27:11 -06:00
sal
a058d78c20 Initial release — per-site container isolation with unique device fingerprints
Automatic per-domain containers with hardened fingerprint spoofing:
canvas, WebGL, audio, navigator, screen, timezone, WebRTC, fonts,
ClientRects, plugins, battery, and connection APIs.
2026-02-28 22:59:46 -06:00