Canvas fingerprinting on the web

https://antoinevastel.com/browser%20fingerprinting/2019/02/19/canvas-fingerprint-on-the-web.html

by avastel • 7 years ago

102 36 7 years ago

CJefferson2• 7 years ago

While this is an interesting website, which is it asking to take photos me record audio?

avastel• 7 years ago

Hi, I am the author of the post. I run some fingerprinting tests sometimes for research purposes. Nevertheless I don't see which of the tests would ask for any audio or photos permissions. Which browser were you using?

CJefferson2• 7 years ago

Firefox mobile

keyle• 7 years ago

FYI Safari on macos had a permanent beachball on the page...

jstanley• 7 years ago

I'm on "Fennec F-Droid" (basically a debadged Firefox Mobile) and I too received an audio recording permission popup.

johndough• 7 years ago

I run some fingerprinting tests

Is that still legal considering the GDPR?

mattferderer• 7 years ago

I'm curious of what the benefit of Canvas is over just a random string of characters generated based on OS, browser, etc?

m1el• 7 years ago

Text rendering depends on OS, browser, system configuration, browser configuration and installed fonts.

CyberDildonics• 7 years ago

You only know what the browser tells you. Also that information can be used together with the fingerprinting from a canvas.

the_pwner2242• 7 years ago

It can't be changed. You can fake the user agent and JavaScript-accessible properties (Tor browser does this so every Tor user is indistinguishable), but canvas rendering depends on your actual OS, GPU, etc. Browsers could implement a software renderer to consistently draw canvases on all devices, but then you lose half the reason to use canvas - speed.

est313• 7 years ago

Actually, on Firefox, the 2D canvas is drawn using skia, a CPU vector renderer. Think that Chrome does the same, but not sure. The WebGL canvas uses the GPU hardware though.

pcwalton4• 7 years ago

GPU differences don't show up very well—the OpenGL spec and the D3D "spec" have standardized behavior across GPUs fairly well at this point. What does show up are text rendering differences and the different software vector renderers (Core Graphics vs. Skia vs. Cairo vs. Direct2D).

A lot of Canvas is still in software. I'm working to change that, but it's a work in progress…

pcwalton4• 7 years ago

This made me realize that my Pathfinder (vector graphics on GPU) work may have an unexpected benefit—unifying font and vector rendering paths across OS's to mitigate a bunch of these fingerprinting techniques.

(My font rendering reads the OS settings to determine which rendering mode to use to match the underlying OS, but I think there's no need to do that for canvas.)

jancsika• 7 years ago

(My font rendering reads the OS settings to determine which rendering mode to use to match the underlying OS, but I think there's no need to do that for canvas.)

Not sure I understand. Are you saying that HTML and SVG text would match the OS's font rendering but HTML5 canvas text would not?

pcwalton4• 7 years ago

Correct. OS's are converging on font rendering modes these days anyway (e.g. subpixel AA was dropped in Edge and on macOS Mojave).

z3t4• 7 years ago

I'm using the Canvas extensively for rendering text. Would be happy if it got faster.

gsnedders2• 7 years ago

Surely that doesn't deal with differences due to GPU rounding and similar?

pcwalton4• 7 years ago

Because I use highp everywhere, the only sources of rounding error I can think of are blending and quantization to 8-bit unorm. D3D requires that these round in a certain way: https://docs.microsoft.com/en-us/windows/desktop/direct3d10/...

So I suspect that implementations behave the same way. It'll have to be tested, of course.

ivanhoe• 7 years ago

Funny moment is that Canvas Defender extension for Chrome warns about fingerprinting on this very site :)

lewiscollard• 7 years ago

I'm actually shocked, though maybe I shouldn't be. I'd always assumed that canvas fingerprinting was some theoretical technique that nobody would be evil enough to use, not one in active use in thousands of top websites.

This is why we can't have nice things. :/

ypolito• 7 years ago

I have enabled the resistFingerprinting in my firefox about:config settings and this technique no longer seems to work on me.

The only downside is that verifying ReCaptcha takes me around a minute to solve.

justaj• 7 years ago

One big downside in that I've experienced is that everything is now defaulted to 100% zoom and I now manually have to adjust zoom levels.

drankula3• 7 years ago

I was not aware this was available, thank you! It appears to work on the mobile version of Firefox as well.

svantana• 7 years ago

Wouldn't that just put you in the "no fingerprint" category? Presumably fairly few people use such techniques, so couldn't that make you more trackable, not less?

FabHK• 7 years ago

Any good defence against this for Safari on macOS?

(There is this javascript blocker, JS Blocker, but when I last used it, the Safari memory usage would explode every other day, to the extent of rendering the machine unusable unless you managed to kill the process very quickly.)

appleflaxen• 7 years ago

can anyone explain how the web site reads out the information that the browser fingerprint provides? I get that the first step is to create a specific canvas image. but how does the server know what the result was?

Canvas fingerprinting on the web

Related Stories