Do 'window.innerWidth' and 'window.innerHeight' in CSS pass back the values to the webserver?

Question

I have JavaScript turned off, and so no leakage of screen resolution to Panopticlick.eff.org fingerprint testing tool.

However, JonDonym's one - ip-check.info - has an alarming-looking vector down the bottom called 'Browser window'. Even with JS off, this value persists, and reveals even more uniqueness than the 'outer' screen resolution itself can - if you have Firefox's Menu Bar showing, the value changes - if you even zoom in (e.g. use NoSquint add-on on a larger screen), it changes, in fact it's in real-time as you change anything inside Firefox that affects the 'inner' window dimensions itself!

Without using JS, Flash or anything else aside from standard HTML and CSS - does this value get passed onto the webserver and thus can be used as a very serious de-anonymization vector?

Or, being dynamic and CSS, is it only local-browser residing, and so nothing to worry about at all?

Answer 1

Yes, an attacker can easily pass the value to a web server by using the triggered (size-specific) CSS rule to load a remote resource that encodes the size in its URL. You can even make this pretty efficient (as opposed to ip-check.info's inclusion of thousands of candidate CSS rules) by doing a binary search for the size using nested CSS inclusions.

You may want to set the menu bar to be always visible (and restart Tor Browser), that way it's not measurable.