4 ms·

Why Gibiru attempts to take the canvas image data of my browser?

9 points by hosa 3y ago

LanzVonL 3y ago
Because they want you to use their site with Tor Browser exclusively, obviously.
hosa 3y ago
Firefox has blocked their attempt for canvas, why would they need it while most sites don’t ? n.b. Gibiru is a supposedly private search website based on Google..
- crumpled 3y ago
  The obvious answer is browser fingerprinting. You probably already knew that. I'm just mentioning the missing context of this post.
  - snitch182 3y ago
    Yeah, you can fingerprint by using fonts on canvas. The are oh so slightly differently aliased. If i recall correctly.
  - hosa 3y ago
    Yes I do already know that.. I find it criminal that they call themselves private then take your fingerprint.. Even Google and Bing don’t do that!
jp57 3y ago
Browser fingerprinting and/or bot detection (ie. unreasonably small windows.)
- yjftsjthsd-h 3y ago
  Why would a bot have an unreasonably small window?
  - araes 3y ago
    Because then the bot can hide its activity like the Facebook pixel, where it's visibly difficult for human users to detect (while being relatively easy for computers and scripts to detect). A lot of security is very similar. A camera in the business that is visibly difficult to detect, yet can easily observe movement within the business. Its also one of the main areas in online interaction lately. Anything that marks an actor as "not a human". The security arms race has escalated a lot lately, since now bots can write comparably well and pull a fake image to pass face / camera checks, or similar security. You can't do "find the motorcycle" cause now the bots are better than the humans in many cases. The text recognition failed a long time ago, because it quickly devolved into image tests that humans are not actually that great at. Unfortunately, the entire problem (in my opinion), is trying to secure a realm for human use, that humans are not native to. Computers are better at being computers.
  - rolph 3y ago
    conserving resources, by minimizing things it doesnt need. just what size is unreasonable comes to mind. i run with 3 displays one of them is tiled with browser windows. -that makes me curious about how many i can tile up until threshold size and the windows start triggering false +ives
  - kvonhorn 3y ago
    Because it's running in a $4/month instance w/512MB memory and is rendering its Chrome window in Xvfb, which has been allocated a 640x480 frame buffer.
dvh 3y ago
In one of my projects I used it to detect if browser supports blur filter and if not fall back on stack box blur.
JulianWasTaken 3y ago
Perhaps the link for this post being the homepage of a website that the post title is intimating is a security or privacy risk isn't the greatest idea, regardless of the answer to the question?

9 points by hosa 3y ago

Because they want you to use their site with Tor Browser exclusively, obviously.

hosa 3y ago

Firefox has blocked their attempt for canvas, why would they need it while most sites don’t ? n.b. Gibiru is a supposedly private search website based on Google..

crumpled 3y ago
The obvious answer is browser fingerprinting. You probably already knew that. I'm just mentioning the missing context of this post.
- snitch182 3y ago
  Yeah, you can fingerprint by using fonts on canvas. The are oh so slightly differently aliased. If i recall correctly.
- hosa 3y ago
  Yes I do already know that.. I find it criminal that they call themselves private then take your fingerprint.. Even Google and Bing don’t do that!

jp57 3y ago

Browser fingerprinting and/or bot detection (ie. unreasonably small windows.)

yjftsjthsd-h 3y ago
Why would a bot have an unreasonably small window?
- araes 3y ago
  Because then the bot can hide its activity like the Facebook pixel, where it's visibly difficult for human users to detect (while being relatively easy for computers and scripts to detect). A lot of security is very similar. A camera in the business that is visibly difficult to detect, yet can easily observe movement within the business. Its also one of the main areas in online interaction lately. Anything that marks an actor as "not a human". The security arms race has escalated a lot lately, since now bots can write comparably well and pull a fake image to pass face / camera checks, or similar security. You can't do "find the motorcycle" cause now the bots are better than the humans in many cases. The text recognition failed a long time ago, because it quickly devolved into image tests that humans are not actually that great at. Unfortunately, the entire problem (in my opinion), is trying to secure a realm for human use, that humans are not native to. Computers are better at being computers.
- rolph 3y ago
  conserving resources, by minimizing things it doesnt need. just what size is unreasonable comes to mind. i run with 3 displays one of them is tiled with browser windows. -that makes me curious about how many i can tile up until threshold size and the windows start triggering false +ives
- kvonhorn 3y ago
  Because it's running in a $4/month instance w/512MB memory and is rendering its Chrome window in Xvfb, which has been allocated a 640x480 frame buffer.

dvh 3y ago

In one of my projects I used it to detect if browser supports blur filter and if not fall back on stack box blur.

JulianWasTaken 3y ago

Perhaps the link for this post being the homepage of a website that the post title is intimating is a security or privacy risk isn't the greatest idea, regardless of the answer to the question?