5 ms·

I'd like to see the canvas fingerprinting dealt with in Firefox mainline, it's used everywhere.

• HappyTypist 10y ago
  How do you fix it without disabling canvas?
  • csulok 10y ago
    I don't think it can be solved without origin specific permissions - to allow using local fonts and whatnot used on the canvas, at the same time I don't think that would be an issue.
    • gsnedders 10y ago
      You don't even need canvas to do font-sniffing. It gets better with canvas, but it's largely good-enough without.
      • sintaxi 10y ago
        why don't browsers just ship with its own fonts?
        • Drdrdrq 10y ago
          They used to, loooong time ago... At least I think so? I seem to remember Netscape on Linux bundling the fonts, not sure what they did with Arial/Helvetica on Windows 3.1. However good fonts are a massive undertaking and only make sense for OS vendors, at least the fonts which include many languages.
        • kibwen 10y ago
          Few (none?) of the ancient "web-safe fonts" are permissively licensed. And nice-looking fonts that look good on all OSes and that have a large set of glyph coverage are quite expensive to make (though I'm sure Google/Microsoft/Apple could afford it).
          • simcop2387 10y ago
            Google does sort of do this with the Droid family of fonts. https://fonts.google.com/specimen/Droid+Sans https://fonts.google.com/specimen/Droid+Sans They're not perfect though, but it is a start. I think one or two of Apple's might be permissively licensed also but I'm not certain.
  • noja 10y ago
    The tor version of Firefox patches it to be unique per website iirc. There is this Firefox add-on that does something similar: https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/ https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
• SamBam 10y ago
  How accurate is canvas fingerprinting? And could it be used in the courts (which would seem a pertinent question for many Tor users)?
  • noja 10y ago
    Someone else can answer better than me, but https://panopticlick.eff.org https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identifying information (click detailed results after testing)
    • muizelaar 10y ago
      I think this is an over-estimation of the amount of entropy. If canvas hardware acceleration is disabled, the only things that can really have an impact on the output of the panopticlick canvas fingerprint are OS version, user-agent and available cpu vectorization instructions.
      • drvdevd 10y ago
        Interesting. I wonder to what extent one could trap vectorization instructions in e.g. KVM. Presumably they are unprivileged instructions on x86?
        • dom0 10y ago
          > Presumably they are unprivileged instructions on x86? They're all unprivileged; having to go to the kernel would defeat the purpose most of the time. Also, trapping them wouldn't make a difference. Fixing the CPUID fields on the other hand (so that these code paths are not taken in the first place)...
    • deleted 10y ago
      [deleted]
    • MR4D 10y ago
      On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits. Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem. I'd love to see the Firefox team fix that first.
• bifurcation 10y ago
  Fingerprinting (in general) is the next thing on the agenda after First Party Isolation. Addressing canvas fingerprinting is in the plan: https://wiki.mozilla.org/Security/Fingerprinting https://wiki.mozilla.org/Security/Fingerprinting https://bugzilla.mozilla.org/show_bug.cgi?id=1041818 https://bugzilla.mozilla.org/show_bug.cgi?id=1041818