6 ms·

How accurate is canvas fingerprinting? And could it be used in the courts (which would seem a pertinent question for many Tor users)?

• noja 10y ago
  Someone else can answer better than me, but https://panopticlick.eff.org https://panopticlick.eff.org claims the canvas fingerprint provides 17 bits of identifying information (click detailed results after testing)
  • muizelaar 10y ago
    I think this is an over-estimation of the amount of entropy. If canvas hardware acceleration is disabled, the only things that can really have an impact on the output of the panopticlick canvas fingerprint are OS version, user-agent and available cpu vectorization instructions.
    • drvdevd 10y ago
      Interesting. I wonder to what extent one could trap vectorization instructions in e.g. KVM. Presumably they are unprivileged instructions on x86?
      • dom0 10y ago
        > Presumably they are unprivileged instructions on x86? They're all unprivileged; having to go to the kernel would defeat the purpose most of the time. Also, trapping them wouldn't make a difference. Fixing the CPUID fields on the other hand (so that these code paths are not taken in the first place)...
  • deleted 10y ago
    [deleted]
  • MR4D 10y ago
    On mine, the System Fonts give 17 bits of info (1 in roughly 200,000 computers). User-Agent is next with only 8 bits. Based on that alone, it seems that just replying back with either a blank font list or the minimal standard font list (e.g. only Times & Arial) would solve most of this problem. I'd love to see the Firefox team fix that first.
    • swsieber 10y ago
      I think they are working on the fonts problem.
    • kibwen 10y ago
      Unless every browser in the world adopts the same list, replying with a fixed list of fonts would make users of a given browser immediately recognizable (especially for low-marketshare browsers like Tor). Seems like you'd want a system where the response to a list-of-fonts query would be semi-random and likely to overlap with the lists that are naturally produced by other browsers.
      • eslaught 10y ago
        But user agents already identify the browser, right? I agree that implementing this first in Tor is probably not a good idea, but if Firefox were to do it first, then I don't see the problem. "They're a Firefox user" isn't nearly as specific information.
        • dexterdog 10y ago
          User agent gives the browser version and platform version. Two macs with the same OS version and the latest version of Chrome will have the same user agent.
          • nsgi 10y ago
            That's the point. With this feature, two computers with the latest version of Firefox would have the same font list.
• niftich 10y ago
  The 2012 UCSD paper [1] claims they observed 5.73 bits of entropy in their admittedly non-representative population. As with everything, it depends on the user's threat model. In a court setting, it'd depend on how individual pieces of evidence stack up against a user to make them look bad, and whether there is enough reasonable doubt. [1] https://cseweb.ucsd.edu/~hovav/papers/ms12.html https://cseweb.ucsd.edu/~hovav/papers/ms12.html
  • w8rbt 10y ago
    That's less than picking one character randomly from a keyboard. Seems pretty small to me. >>> import math >>> print math.log(95) / math.log(2) 6.56
    • twic 10y ago
      ObGolf: >>> print math.log(95, 2) 6.56985560833
• estrabd 10y ago
  It is frighteningly effective.