3 ms·
Or even just draw the text in a canvas and check pixel colors. Which feature do you take away? Drawing text in canvas? Or inspecting the current content you’ve
by wlesieutre 7y ago
Or even just draw the text in a canvas and check pixel colors. Which feature do you take away? Drawing text in canvas? Or inspecting the current content you’ve drawn in it?
This sort of thing is used for even deeper GPU fingerprinting because the exact results of graphics commands can vary slightly. I’m not sure what browsers can/are doing to prevent that.
- na85 7y agoWhy does the site need to check pixel colours and inspect content that's been drawn? Why can't that be whitelisted per domain by the user?
- wlesieutre 7y agoIt would break sites that use canvas drawing for actual features like image editors, but it doesn't seem unreasonable to me. Browsers probably don't like breaking essential functionality of sites like that though, and permission prompt spam for every web feature might end up training users to just click "yes" on everything like Vista's UAC did. Still, an interesting middle ground between "JS can do whatever it wants" and "JS is disabled entirely" might be "JS can send data and styling to the DOM but has very limited access to read anything back." Maybe include some very basic functionality like ability to read the content inside a tag, but nothing more detailed about how an object is styled, how large it is, where it's positioned on the page, whether its hover or visited state is active, whether there's scroll overflow, etc. Related - a quick search suggests that Brave's tracking protection feature does kill the getImageData() function. https://community.brave.com/t/getimagedata-does-not-work-in-brave/43292 https://community.brave.com/t/getimagedata-does-not-work-in-...