5 ms·
A lot of Firefox's fingerprinting protection is genuinely helpful because the stuff it's blocking can be used to very, very precisely target you. Canvas/WebGL
by danShumway 7y ago
A lot of Firefox's fingerprinting protection is genuinely helpful because the stuff it's blocking can be used to very, very precisely target you.
Canvas/WebGL fingerprinting is a good example of this. Yes, very few people block it, but the fingerprinting for canvas is so individualized to each device that there is no hiding in the crowd if you leave it enabled. You're hiding in a crowd of size 1.
Think of it like wearing gloves during the summer. Yes, that's unusual. But a human fingerprint (except in rare-ish cases) will usually be good enough to track an individual person. In a world where people are regularly collecting fingerprints or tracking them around town to figure out who's been in what stores, being unusual is preferable to being unique.
There are a few settings (normalizing screen sizes) where the benefits aren't so clear-cut. But at the very, very least, you should be doing stuff like turning off webRTC/webGL/canvas. The majority of changes being listed here are strict improvements to privacy.
- rwmurrayVT 7y agoI have only just taken an interest in the canvas fingerprinting. My understanding is that it relies on a unique hash of an "image" created using HTML5, including the time it takes to draw. Is it not possible to alter this hash by throttling or slightly modifying some GPU settings? I know this is a weird and most likely highly technical question. I'm just curious.
- danShumway 7y agoShort answer, I don't know, but probably not? Long answer, I'm also curious about this. I feel like the future of fingerprinting resistance isn't refusing to give up information (since sites can block you or force you to turn the settings back on) -- it's lying. Don't block microphone access, just feed it white noise. Don't block the location, just spoof it. BUT, a bunch of people who are smarter than me have decided that zeroing out the canvas is better than making it return random values, so for the moment, I assume there's something they know that I don't.
- Santosh83 7y agoThe CanvasBlocker extension which has been around for longer than Firefox started implementing anti-fingerprinting measures does exactly this: spoof canvas readout values. Since blocking Javascript is no longer an option for most people, blocking fingerprintable APIs simply breaks many sites. What we need is frictionless ways to spoof values for these APIs unless the user trusts the site in which case real values can be sent (example the site needs to work and fake values will not be useful to the user).
- rwmurrayVT 7y agoThe existence of software such as fraudfox and antidetect makes me believe there are certainly effective ways to "just lie".
- jdashg 7y agoMuch of canvas 2d fingerprinting relied on system fonts, which browsers have started to restrict access to these days. WebGL fingerprinting, in my investigation, seems to be identifiable by gpu vendor, and potentially by generation, but not individual GPU. So there's still bits of info, but not as bad as they used to be, or as bad as people generally fear.
- penguinalgebra 7y ago> which browsers have started to restrict access to these days Any chance you could point me to a source on this?