7 ms·
Canvas fingerprinting on the web
- CJefferson 8y agoWhile this is an interesting website, which is it asking to take photos me record audio?
- avastel 8y agoHi, I am the author of the post. I run some fingerprinting tests sometimes for research purposes. Nevertheless I don't see which of the tests would ask for any audio or photos permissions. Which browser were you using?
- CJefferson 8y agoFirefox mobile
- the_pwner224 8y agoI'm on firefox mobile (Fennec F-Droid) and didn't get any permission request, on this page or a few of the other recent articles on that website... The site doesn't use HTTPS, perhaps someone is tampering with your connection? Some ISPs have been known to do that, but not for very nefarious purposes AFAIK.
- Thorrez 8y agoThe site uses https for me (and the HN link is https too). It does make 3 http requests, all for gravatar jpeg files.
- keyle 8y agoFYI Safari on macos had a permanent beachball on the page...
- jstanley 8y agoI'm on "Fennec F-Droid" (basically a debadged Firefox Mobile) and I too received an audio recording permission popup.
- johndough 8y ago> I run some fingerprinting tests Is that still legal considering the GDPR?
- mattferderer 8y agoI'm curious of what the benefit of Canvas is over just a random string of characters generated based on OS, browser, etc?
- m1el 8y agoText rendering depends on OS, browser, system configuration, browser configuration and installed fonts.
- CyberDildonics 8y agoYou only know what the browser tells you. Also that information can be used together with the fingerprinting from a canvas.
- the_pwner224 8y agoIt can't be changed. You can fake the user agent and JavaScript-accessible properties (Tor browser does this so every Tor user is indistinguishable), but canvas rendering depends on your actual OS, GPU, etc. Browsers could implement a software renderer to consistently draw canvases on all devices, but then you lose half the reason to use canvas - speed.
- est31 8y agoActually, on Firefox, the 2D canvas is drawn using skia, a CPU vector renderer. Think that Chrome does the same, but not sure. The WebGL canvas uses the GPU hardware though.
- kevingadd 8y agoFirefox and Chrome have been using hardware acceleration for Skia for ages. Even if you have HW acceleration shut off, Chrome is typically using SwiftShader to rasterize which basically emulates a GPU instead of doing traditional CPU rasterization. If you switch off hw accel in Chrome and Firefox your canvas performance will tank.
- 8y ago
- pcwalton 8y agoThis made me realize that my Pathfinder (vector graphics on GPU) work may have an unexpected benefit—unifying font and vector rendering paths across OS's to mitigate a bunch of these fingerprinting techniques. (My font rendering reads the OS settings to determine which rendering mode to use to match the underlying OS, but I think there's no need to do that for canvas.)
- jancsika 8y ago> (My font rendering reads the OS settings to determine which rendering mode to use to match the underlying OS, but I think there's no need to do that for canvas.) Not sure I understand. Are you saying that HTML and SVG text would match the OS's font rendering but HTML5 canvas text would not?
- pcwalton 8y agoCorrect. OS's are converging on font rendering modes these days anyway (e.g. subpixel AA was dropped in Edge and on macOS Mojave).
- z3t4 8y agoI'm using the Canvas extensively for rendering text. Would be happy if it got faster.
- gsnedders 8y agoSurely that doesn't deal with differences due to GPU rounding and similar?
- pcwalton 8y agoBecause I use highp everywhere, the only sources of rounding error I can think of are blending and quantization to 8-bit unorm. D3D requires that these round in a certain way: https://docs.microsoft.com/en-us/windows/desktop/direct3d10/d3d10-graphics-programming-guide-resources-data-conversion https://docs.microsoft.com/en-us/windows/desktop/direct3d10/... So I suspect that implementations behave the same way. It'll have to be tested, of course.
- ivanhoe 8y agoFunny moment is that Canvas Defender extension for Chrome warns about fingerprinting on this very site :)
- lewiscollard 8y agoI'm actually shocked, though maybe I shouldn't be. I'd always assumed that canvas fingerprinting was some theoretical technique that nobody would be evil enough to use, not one in active use in thousands of top websites. This is why we can't have nice things. :/
- ypolito 8y agoI have enabled the resistFingerprinting in my firefox about:config settings and this technique no longer seems to work on me. The only downside is that verifying ReCaptcha takes me around a minute to solve.
- justaj 8y agoOne big downside in that I've experienced is that everything is now defaulted to 100% zoom and I now manually have to adjust zoom levels.
- drankula3 8y agoI was not aware this was available, thank you! It appears to work on the mobile version of Firefox as well.
- svantana 8y agoWouldn't that just put you in the "no fingerprint" category? Presumably fairly few people use such techniques, so couldn't that make you more trackable, not less?
- FabHK 8y agoAny good defence against this for Safari on macOS? (There is this javascript blocker, JS Blocker, but when I last used it, the Safari memory usage would explode every other day, to the extent of rendering the machine unusable unless you managed to kill the process very quickly.)
- appleflaxen 8y agocan anyone explain how the web site reads out the information that the browser fingerprint provides? I get that the first step is to create a specific canvas image. but how does the server know what the result was?