6 ms·

Canvas Fingerprinting

101 points by janandonly 2y ago

thisislife2 2y ago
PaleMoon browser has a canvas.poisondata config setting (also available in the Preferences GUI) which prevents such fingerprinting. However, note that these things are not used in isolation - browser fingerprinting is done by collecting various other data too, and when collated together, these can provide enough uniqueness to identify (or categorise) your browser into some specific group. We are fighting a losing battle for privacy.
- kmeisthax 2y ago
  Hot take: instead of making fingerprints more unique, we should be striving to make fingerprints as identical as possible, so they stop being useful as fingerprints. In the case of Canvas 2D, that would mean standardized bit-level definitions of what all the canvas operations do, so all the browsers do the same thing.
  - deleted 2y ago
    [deleted]
  - modeless 2y ago
    Unfortunately this could only be done by forbidding web content from using GPUs at all. GPUs are extremely diverse compared to CPUs. It is not feasible to standardize bit-exact operations on diverse GPU hardware while maintaining reasonable performance. Some will say that we should forbid web content from using GPUs. But that would push apps and their users to native platforms that don't even try to minimize fingerprinting at a technical level, instead either relying on legal enforcement by monopoly gatekeepers (with all the problems that implies), or providing no protection against fingerprinting at all.
    - shiomiru 2y ago
      > Some will say that we should forbid web content from using GPUs. But that would push apps and their users to native platforms that don't even try to minimize fingerprinting at a technical level Conflating "websites" with "apps" is what lead to this mess in the first place. You can't just "try to minimize fingerprinting", you either prevent it or don't. And by the time you expose a GPU to the web, you're well inside the latter category. IMO the only solution to the tracking epidemic is making boundaries between the two clear. Just like some random blog can't read my GPS location without asking first, it shouldn't be given access to other tracking vectors without user consent either.
      - modeless 2y ago
        > You can't just "try to minimize fingerprinting" Plainly false. You can minimize the number of bits of entropy in the fingerprint even in situations where a couple of bits are unavoidable, and you can mitigate fingerprinting methods by detection and/or blocking. Browsers do this today. The web is crucial as the only free platform for distributing software to a huge chunk of consumer devices. Apple would love to strengthen their iOS app distribution monopoly by forbidding sophisticated web apps. That's why they have dragged their feet implementing more advanced web standards and limited their capabilities when they do implement them (for example making fullscreen mode unusable for games).
        shiomiru 2y ago
        > Plainly false. You can minimize the number of bits of entropy in the fingerprint even in situations where a couple of bits are unavoidable, A single API may just yield a couple of bits, but it adds up when there are hundreds of APIs, with new ones introduced every week. And you don't need that many bits to uniquely identify someone. But sure, leaking a few bits here and there might as well be unavoidable when two of the three major browser vendors are ad companies and preventing it isn't a priority. (See the saga about Google and 3rd-party cookies.) > and you can mitigate fingerprinting methods by detection and/or blocking. Browsers do this today. You can mitigate a finite set of fingerprinting methods that you know of. It becomes exponentially harder with every new tracking vector that is enabled by default, especially when the expectation is that things Just Work. (For example, blocking canvas readout breaks canvas-based image resizing on lots of websites that use the first result from stackoverflow.) > The web is crucial as the only free platform for distributing software to a huge chunk of consumer devices. Apple would love to strengthen their iOS app distribution monopoly by forbidding sophisticated web apps. That's why they have dragged their feet implementing more advanced web standards and limited their capabilities when they do implement them (for example making fullscreen mode unusable for games). Respectfully, I don't see a pressing need to solve the issue of "you don't own Apple devices you pay for" by stuffing every possible API under the sun into the browser. Besides, I'm not advocating against sophisticated web apps; I just wish browsers applied the principle of least privilege when adding features ripe for abuse. e.g. maybe I would allow GPU access for a web-based 3D game whose developer I trust, but not some random blog that will use it to either fingerprint me or run a cryptominer.
  - rsync 2y ago
    Hotter take: we should provide random answers to all of these measures. My user agent and canvas size and gpu capabilities should be unique on every single request. (Within reason, of course)
  - amy-petrik-214 2y ago
    As COVID has taught us "if only we had all obeyed the stay at home order" (which would have eliminated COVID and a chunk of dozens or hundreds of infectious diseases), relying on the bulk of man to "get with the plan" is a fool's errand, ipso facto the proposition of such is and was foolish for reason of blindness to this fact. That is to say, if we all have a "same browser" then there will be people with "not same", there will be divergences, it will be a mess. A very simple solution of polymorphic fingerprinting - the fingerprinters will get a fingerprint, a good looking one, just that it will be different each time. Even better to think of when the russians poisoned the ammunition in vietnams with bad bullets. Can't make them all bed or they'll toss the whole batch. I think they arrived at 1:10. The idea is to make fingerprinting as ugly as possible - up to and no further than the point that they are forced to cook up something even more evil.
iforgotmysocks 2y ago
Currently use Safari and there's no protection against canvas fingerprinting :( https://webkit.org/tracking-prevention/#anti-fingerprinting https://webkit.org/tracking-prevention/#anti-fingerprinting
- galad87 2y ago
  There is, try to load the website again in a new window or tab, it will show a different fingerprint.
atum47 2y ago
Apple once disabled canvas for their devices for this reason and broke all my apps, haha. 80% of my projects use canvas
krunck 2y ago
My Brave browser seems to be 100% unique.
- Beijinger 2y ago
  It should give a fingerprint. Try to reload in another tab and see if you stay unique and if the fingerprint changes. I am also unique, but I always stay unique ;-)
WillyWonkaJr 2y ago
You can test your browser here: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ Brave works super well for me. Chrome not so much.
- dngit 2y ago
  Thanks. I'm a bit confused by this tool. I ran and got this result > Our tests indicate that you have strong protection against Web tracking. Which sounds like a good thing. Then it follows with: > Your browser has a nearly-unique fingerprint This sounds like a bad thing to me because uniqueness makes me more identifiable. Do I interpret it correctly? What's the value I should look for?
- whitehexagon 2y ago
  This seems like a battle the end user can never win. The only idea I have is that everyone would run an identical, specially crafted, 'browser-vm' / container? that presents identical metrics and values for any amount of system query. Imagine the data start pouring in as every client is starting to present itself as a 68000 HTML5 only browser, with no react rubbish or javascript support. We might end up with a simpler, and faster internet again. Plus a lot of big tech and ad companies scratching their heads.
  - xyzal 2y ago
    You can change some metrics that contribute to the fingerprint between sessions, that the fingerprinting party assumes are stable over time. There is no utility for the fingerprintor of getting your unique fingerprint, when that fingerprint wont be registered ever again. If you use Firefox, look up the CanvasBlocker extension. It can even make the fingerprint appear consistent when first party domain is the same.
- aucisson_masque 2y ago
  I suggest you try here also, it's a commercial product used in real world. https://fingerprint.com/ https://fingerprint.com/ I tried safari, firefox and brave on it. Only brave failed this, every time. Went to look on Google and found several thread about people complaining brave anti fingerprinting doesn't work very well. For instance https://community.brave.com/t/fingerprinting-protection-no-longer-as-good/548139 https://community.brave.com/t/fingerprinting-protection-no-l...
frozenlettuce 2y ago
This is a pain point when making browser games, as custom fonts break way too easily in some environments.
- BrutalCoding 2y ago
  I’m not a game dev but I have occasionally made small throw-away projects with UE/Unity/GD. When you’d make a game for web on these, I’d assume they’ll be rendered as a canvas. That’s why I am thinking that custom fonts in a browser game are nothing more than just pixels to draw for the browser. I’m doing pretty much anything with Flutter now, even trying to build 2D games with it and unless I’m mistaken: it all renders on a canvas, which has its pros and cons, but in your case it would’ve been a non-issue, or did I misunderstand?
gnabgib 2y ago
Some discussion in 2015 (47 points, 12 comments) https://news.ycombinator.com/item?id=8887947 https://news.ycombinator.com/item?id=8887947
Beijinger 2y ago
I am not sure what it measures, but my privacy enhanced Firefox for browsing seems to show random numbers every time I load this URL and I always stay "unique". Another browser shows "signature stats". If I use my firefox, this won't even show. My Privacy Plug ins: Plug ins: Blend in and spoof most popular properties BP Privacy block all font and glyph detection Browser plugs fingerprint privacy randomizer Canvas Blocker Clear URLs Cockie Auto delete Decentral eyes NoScript Privacy Badger Temporary Containers uBlockOrigin
- nerdponx 2y ago
  That's because all of the content blocking actually results in a very distinct fingerprint. If you want to be un-fingerprintable, you need to look like a lot of other people.
  - jvanderbot 2y ago
    Unless there's a way to randomize your fingerprint. If truly random, it's probably v hard to say it's one person, two, three, etc with a huge db full of unique signatures originating from a known VPN exit.
    - Jerrrry 2y ago
      Serve sketchy uncorrelated users a subtle challenge that is unknowingly asymmetrically unique. Maybe like a captcha.
  - IggleSniggle 2y ago
    It doesn't matter if you're fingerprintable if your fingerprint is distinct on every visit.
    - Jerrrry 2y ago
      It is if you're the only one doing it. To hide a signal in noise, there must be noise.
danielvaughn 2y ago
I’m aware this is a naive question, but I find myself wondering why I care about being fingerprinted. Seems like it can detect my browser, device, and OS. I kind of assumed it could do that anyways. What security concerns do I face if someone finds that information?
- nerdponx 2y ago
  It can uniquely identify you, personally, danielvaughn, among a sea of millions of other "anonymized" users. That information can be used to provide precisely-targeted advertising -- or coming soon to a Kroger near you -- precisely targeted prices for products. And of course it's valuable to anyone who is interested in stalking or impersonating you and might be wiling to pay for access to that data, whether by insider leaks or hacking. It's your choice as to whether you personally care, but a lot of people do care, and the more people who don't care, the harder it is for those who do.
  - danielvaughn 2y ago
    Ah gotcha, that makes sense, thank you. Pretty wild that just a few parameters can uniquely identify individuals. That’s crazy.
    - nerdponx 2y ago
      If you're interested in the topic, it's a pervasive and not-fully-solved problem even in well-intentioned research, where special care is needed in order to avoid accidentally re-identifying individuals in anonymized data simply because they are too unique. Another classic example of this is behavioral uniqueness. Maybe 10 people got coffee and a donut at the corner store at 8 AM, but how many of them also went to work at ABC Corp that day and also got a pepperoni roll at the pizzeria for dinner at night? Probably just one person did that.
    - dishsoap 2y ago
      The thing is it's not just a few parameters. Modern browsers provide thousands.
dngit 2y ago
Are there any browser extensions or tools that effectively prevent fingerprinting including canvas fingerprinting? Or is this one of those privacy battles we just have to accept as unwinnable?
- begueradj 2y ago
  https://www.torproject.org https://www.torproject.org
  - dngit 2y ago
    Tor's great if you're okay with browsing the web at "stealth mode" speed! Have you found it practical for everyday use?
  - DeathArrow 2y ago
    TOR hides your IP address. It doesn't protect you from fingerprinting.
    - akimbostrawman 2y ago
      wrong https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift
      - DeathArrow 2y ago
        That is a modified browser. TOR network itself doesn't protect people from fingerprinting.
        akimbostrawman 2y ago
        how would a traffic protocol prevent browser fingerprinting? the closest would be traffic padding which tor does. https://spec.torproject.org/padding-spec/connection-level-padding.html https://spec.torproject.org/padding-spec/connection-level-pa...
- 2y ago
ruthmarx 2y ago
What I find more interesting is how some sites can detect your OS even if you block JS and change the user agent to indicate something different. I assume it's checking for known fonts or something similar.
- Nadya 2y ago
  That's a good assumption because that's exactly one way it is done. :)
- trod123 2y ago
  Fonts are the low hanging fruit. More sophisticated servers run a whole battery of hardware fingerprinting tests. It runs deep. If the device has been powered on for a certain period of time (usually a few minutes), the voltage normalizes and you get a unique clock skew signature based on the defects of the silicon, for each enumerable device that may be available from various JS API calls, or potential zero days, adds another data point for uniqueness. Passive listenings of local network traffic headers will provide a local network topology of metadata of local proximity devices that can often be cross referenced (since cable modems often collect this info as well as other embedded devices). Its a strategy called building a bridge. You start from the device which has an associated profile, that profile only need to be unique and may only start off as an identifier (nothing else) and the endpoint and you meet somewhere in the middle, backfilling information as you go. No personal info needed upfront. CSS previous visited link decorators is another avenue for fingerprinting. It violates same-domain policy, but there was a PoF back in 2021 where you could generate picture squares identical to a captcha asking for specific picture or puzzle that was generated to be tied to the CSS decorator (thus submitting your browser history beacons to that site in its entirety). Think it was varun.ch?
  - deleted 2y ago
    [deleted]
  - varun_ch 2y ago
    https://varun.ch/posts/history/ https://varun.ch/posts/history/ :)
bhouston 2y ago
I am confused. You can already ask the browser what OS, CPU, device and browser it is without fingerprinting the canvas. You can get the version of the browser, and OS as well. I use the popular US-Parser-JS library, works like a charm: https://www.npmjs.com/package/ua-parser-js https://www.npmjs.com/package/ua-parser-js. (I use it for https://web3dsurvey.com https://web3dsurvey.com.) (Also the WebGL and WebGPU APIs will also tell you the GPU hardware you have.)
- efilife 2y ago
  Canvases can vary very slighly between users' setups. The inconsistencies in rendering are used to fingerprint And to my knowledge you can't ask the browser about the cpu, only the number of cores. The regular fingerprinting you described would be just an user agent string that can be trivially spoofed
  - bhouston 2y ago
    > Canvases can vary very slighly between users' setups. The inconsistencies in rendering are used to fingerprint I think it overlaps mostly with OS, CPU, Browser, GPU Type, GPU driver version. These can already be queried by UA string and WebGL/WebGPU. It is easier to query them explicitly for most users but I guess canvas fingerprinting is a fallback for when these APIs do not return some of the data. > And to my knowledge you can't ask the browser about the cpu, only the number of cores. Generally you can. Not all browsers give up all info, but most browsers give up most of the info. Here is a demo of what you get from ua parsing: https://uaparser.dev/#demo https://uaparser.dev/#demo
    - IggleSniggle 2y ago
      Years ago you could get crazy specific fingerprints from canvas. It got far less precise when Chrome introduced jitter into timers and treated performance timers as security sensitive functions. The main difference between canvas and this other stuff is that canvas couldn't be spoofed whereas everything else could and can be spoofed, or was so general as to be useless as an identifier.
wwwtyro 2y ago
I know my priorities are questionable, but I'm more annoyed that I can't expect consistent canvas rendering.
- deleted 2y ago
  [deleted]
DeathArrow 2y ago
>It's very likely that your web browser is Chrome and your operating system is Android. Android guess is correct. But the browser is Edge, not Chrome.
buro9 2y ago
The safest way to browse the web in any browser is by disabling JavaScript or using a NoScript extension. A lot of the web works surprisingly well still, and you can turn on just what you need when you need it, placing your most visited sites on an allow list, but still denying a lot of third party things on those sites. The internet is a joy with js disabled virtually everywhere. And all the canvas fingerprinting, webrtc leak, font fingerprinting, super cookies, etc... are all defeated by simply not running JavaScript
- sureIy 2y ago
  I think the amount of useful websites that work without JS are on a steady decline. No one wants to invest into a 0.1% share, so if it works it's likely out of chance. Even newspapers have a bunch of popups that expect JS to be closed, so you have to hope uBlock is already configured to remove it for you.
  - buro9 2y ago
    Have you tried?
    - kvdveer 2y ago
      I have. Most information-type websites (blogs, recipes, news) work fine. Many app-style websites (email, bug tracking, chat) don't work, or have very poor ux. Guess which of these two categories I spend most of my time on...
  - checkyoursudo 2y ago
    But it is trivial to allow js per website using ublock. My default is no-js, and if there is some website I really want to use that requires js, then I enable it. If I find myself using that website regularly, then I make the permission permanent. It is literally zero burden. I am not some no-js evangelist or javascript hater or anything, but a huge amount of the web really does work fine (sometimes better even!) without js enabled by default. I don't think it has to be strictly either-or.
- 2y ago
aucisson_masque 2y ago
If I open the website It says I have 99,9% uniqueness. So I'm trackable right ? Yet when I open it again in another window, it says 100% uniqueness but it's a different Signature than previously. I think it's saying it can't track me, because signature would have to be the same for it to work yet I'm using regular Firefox, nothing fancy. Is that technique really effective or I'm just wrong about the signature not being the same ?
- trod123 2y ago
  This is just one of many aspects of fingerprinting. Canvas is only a single element. Each fingerprint component can be used to correlate other components, including TLS channel options which generally last the entire session the website is open for, or there's a network header that remains unchanged between NAT. Given tens of thousands of potentially fingerprintable elements, you only need 5 relatively unique elements between people for a 1 in 1million, each point thereafter exponentially increases that uniqueness.
  - nerdponx 2y ago
    I don't work in ad tech, but I expect that there are strong diminishing returns on this kind of thing. Yes, it's theoretically possible to do all of this advanced stuff to correlate and identify the long tail of users who have obfuscated fingerprints. But if you are in the targeted advertising business, are those users really all that valuable to target? They are probably nerds who don't buy a lot of new stuff and block ads anyway. I expect that being unique, but distinct on each run of the fingerprint algorithm, is probably good enough, unless you are concerned about a very motivated attacker trying to stalk you. On the other hand, there is also the fact that things like spoofing web APIs only goes so far. There are other fingerprinting techniques, such as measuring properties of the GPU, which might still uniquely identify your machine (how many people have such-and-such GPU in your ZIP code?).
- amelius 2y ago
  Maybe your browser has fingerprint mitigation techniques?
- 2y ago
chvid 2y ago
I am on Safari and if I open two private windows with this websites it will give me two different signature values. Chrome on the other hand will be give me two identical values. So I guess Apple is doing something ...
deleted 2y ago
[deleted]
ementally 2y ago
There seems to be a lot of misconceptions about how fingerprinting and anti-fingerprinting techniques work. I highly recommend reading this article, it is still WIP btw: https://github.com/privacyguides/privacyguides.org/blob/e81b8acc976f56e785c84de150784ea64191f87c/docs/advanced/browser-fingerprinting.md https://github.com/privacyguides/privacyguides.org/blob/e81b...
jagged-chisel 2y ago
“It's very likely that your web browser is Google Search App …” It’s not. Do I win?

101 points by janandonly 2y ago

PaleMoon browser has a canvas.poisondata config setting (also available in the Preferences GUI) which prevents such fingerprinting. However, note that these things are not used in isolation - browser fingerprinting is done by collecting various other data too, and when collated together, these can provide enough uniqueness to identify (or categorise) your browser into some specific group. We are fighting a losing battle for privacy.

kmeisthax 2y ago
Hot take: instead of making fingerprints more unique, we should be striving to make fingerprints as identical as possible, so they stop being useful as fingerprints. In the case of Canvas 2D, that would mean standardized bit-level definitions of what all the canvas operations do, so all the browsers do the same thing.
- deleted 2y ago
  [deleted]
- modeless 2y ago
  Unfortunately this could only be done by forbidding web content from using GPUs at all. GPUs are extremely diverse compared to CPUs. It is not feasible to standardize bit-exact operations on diverse GPU hardware while maintaining reasonable performance. Some will say that we should forbid web content from using GPUs. But that would push apps and their users to native platforms that don't even try to minimize fingerprinting at a technical level, instead either relying on legal enforcement by monopoly gatekeepers (with all the problems that implies), or providing no protection against fingerprinting at all.
  - shiomiru 2y ago
    > Some will say that we should forbid web content from using GPUs. But that would push apps and their users to native platforms that don't even try to minimize fingerprinting at a technical level Conflating "websites" with "apps" is what lead to this mess in the first place. You can't just "try to minimize fingerprinting", you either prevent it or don't. And by the time you expose a GPU to the web, you're well inside the latter category. IMO the only solution to the tracking epidemic is making boundaries between the two clear. Just like some random blog can't read my GPS location without asking first, it shouldn't be given access to other tracking vectors without user consent either.
    - modeless 2y ago
      > You can't just "try to minimize fingerprinting" Plainly false. You can minimize the number of bits of entropy in the fingerprint even in situations where a couple of bits are unavoidable, and you can mitigate fingerprinting methods by detection and/or blocking. Browsers do this today. The web is crucial as the only free platform for distributing software to a huge chunk of consumer devices. Apple would love to strengthen their iOS app distribution monopoly by forbidding sophisticated web apps. That's why they have dragged their feet implementing more advanced web standards and limited their capabilities when they do implement them (for example making fullscreen mode unusable for games).
      - shiomiru 2y ago
        > Plainly false. You can minimize the number of bits of entropy in the fingerprint even in situations where a couple of bits are unavoidable, A single API may just yield a couple of bits, but it adds up when there are hundreds of APIs, with new ones introduced every week. And you don't need that many bits to uniquely identify someone. But sure, leaking a few bits here and there might as well be unavoidable when two of the three major browser vendors are ad companies and preventing it isn't a priority. (See the saga about Google and 3rd-party cookies.) > and you can mitigate fingerprinting methods by detection and/or blocking. Browsers do this today. You can mitigate a finite set of fingerprinting methods that you know of. It becomes exponentially harder with every new tracking vector that is enabled by default, especially when the expectation is that things Just Work. (For example, blocking canvas readout breaks canvas-based image resizing on lots of websites that use the first result from stackoverflow.) > The web is crucial as the only free platform for distributing software to a huge chunk of consumer devices. Apple would love to strengthen their iOS app distribution monopoly by forbidding sophisticated web apps. That's why they have dragged their feet implementing more advanced web standards and limited their capabilities when they do implement them (for example making fullscreen mode unusable for games). Respectfully, I don't see a pressing need to solve the issue of "you don't own Apple devices you pay for" by stuffing every possible API under the sun into the browser. Besides, I'm not advocating against sophisticated web apps; I just wish browsers applied the principle of least privilege when adding features ripe for abuse. e.g. maybe I would allow GPU access for a web-based 3D game whose developer I trust, but not some random blog that will use it to either fingerprint me or run a cryptominer.
- rsync 2y ago
  Hotter take: we should provide random answers to all of these measures. My user agent and canvas size and gpu capabilities should be unique on every single request. (Within reason, of course)
- amy-petrik-214 2y ago
  As COVID has taught us "if only we had all obeyed the stay at home order" (which would have eliminated COVID and a chunk of dozens or hundreds of infectious diseases), relying on the bulk of man to "get with the plan" is a fool's errand, ipso facto the proposition of such is and was foolish for reason of blindness to this fact. That is to say, if we all have a "same browser" then there will be people with "not same", there will be divergences, it will be a mess. A very simple solution of polymorphic fingerprinting - the fingerprinters will get a fingerprint, a good looking one, just that it will be different each time. Even better to think of when the russians poisoned the ammunition in vietnams with bad bullets. Can't make them all bed or they'll toss the whole batch. I think they arrived at 1:10. The idea is to make fingerprinting as ugly as possible - up to and no further than the point that they are forced to cook up something even more evil.

iforgotmysocks 2y ago

Currently use Safari and there's no protection against canvas fingerprinting :( https://webkit.org/tracking-prevention/#anti-fingerprinting https://webkit.org/tracking-prevention/#anti-fingerprinting

galad87 2y ago
There is, try to load the website again in a new window or tab, it will show a different fingerprint.

atum47 2y ago

Apple once disabled canvas for their devices for this reason and broke all my apps, haha. 80% of my projects use canvas

krunck 2y ago

My Brave browser seems to be 100% unique.

Beijinger 2y ago
It should give a fingerprint. Try to reload in another tab and see if you stay unique and if the fingerprint changes. I am also unique, but I always stay unique ;-)

WillyWonkaJr 2y ago

You can test your browser here: https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/ Brave works super well for me. Chrome not so much.

dngit 2y ago
Thanks. I'm a bit confused by this tool. I ran and got this result > Our tests indicate that you have strong protection against Web tracking. Which sounds like a good thing. Then it follows with: > Your browser has a nearly-unique fingerprint This sounds like a bad thing to me because uniqueness makes me more identifiable. Do I interpret it correctly? What's the value I should look for?
whitehexagon 2y ago
This seems like a battle the end user can never win. The only idea I have is that everyone would run an identical, specially crafted, 'browser-vm' / container? that presents identical metrics and values for any amount of system query. Imagine the data start pouring in as every client is starting to present itself as a 68000 HTML5 only browser, with no react rubbish or javascript support. We might end up with a simpler, and faster internet again. Plus a lot of big tech and ad companies scratching their heads.
- xyzal 2y ago
  You can change some metrics that contribute to the fingerprint between sessions, that the fingerprinting party assumes are stable over time. There is no utility for the fingerprintor of getting your unique fingerprint, when that fingerprint wont be registered ever again. If you use Firefox, look up the CanvasBlocker extension. It can even make the fingerprint appear consistent when first party domain is the same.
aucisson_masque 2y ago
I suggest you try here also, it's a commercial product used in real world. https://fingerprint.com/ https://fingerprint.com/ I tried safari, firefox and brave on it. Only brave failed this, every time. Went to look on Google and found several thread about people complaining brave anti fingerprinting doesn't work very well. For instance https://community.brave.com/t/fingerprinting-protection-no-longer-as-good/548139 https://community.brave.com/t/fingerprinting-protection-no-l...

frozenlettuce 2y ago

This is a pain point when making browser games, as custom fonts break way too easily in some environments.

BrutalCoding 2y ago
I’m not a game dev but I have occasionally made small throw-away projects with UE/Unity/GD. When you’d make a game for web on these, I’d assume they’ll be rendered as a canvas. That’s why I am thinking that custom fonts in a browser game are nothing more than just pixels to draw for the browser. I’m doing pretty much anything with Flutter now, even trying to build 2D games with it and unless I’m mistaken: it all renders on a canvas, which has its pros and cons, but in your case it would’ve been a non-issue, or did I misunderstand?

gnabgib 2y ago

Some discussion in 2015 (47 points, 12 comments) https://news.ycombinator.com/item?id=8887947 https://news.ycombinator.com/item?id=8887947

Beijinger 2y ago

I am not sure what it measures, but my privacy enhanced Firefox for browsing seems to show random numbers every time I load this URL and I always stay "unique". Another browser shows "signature stats". If I use my firefox, this won't even show. My Privacy Plug ins: Plug ins: Blend in and spoof most popular properties BP Privacy block all font and glyph detection Browser plugs fingerprint privacy randomizer Canvas Blocker Clear URLs Cockie Auto delete Decentral eyes NoScript Privacy Badger Temporary Containers uBlockOrigin

nerdponx 2y ago
That's because all of the content blocking actually results in a very distinct fingerprint. If you want to be un-fingerprintable, you need to look like a lot of other people.
- jvanderbot 2y ago
  Unless there's a way to randomize your fingerprint. If truly random, it's probably v hard to say it's one person, two, three, etc with a huge db full of unique signatures originating from a known VPN exit.
  - Jerrrry 2y ago
    Serve sketchy uncorrelated users a subtle challenge that is unknowingly asymmetrically unique. Maybe like a captcha.
- IggleSniggle 2y ago
  It doesn't matter if you're fingerprintable if your fingerprint is distinct on every visit.
  - Jerrrry 2y ago
    It is if you're the only one doing it. To hide a signal in noise, there must be noise.

danielvaughn 2y ago

I’m aware this is a naive question, but I find myself wondering why I care about being fingerprinted. Seems like it can detect my browser, device, and OS. I kind of assumed it could do that anyways. What security concerns do I face if someone finds that information?

nerdponx 2y ago
It can uniquely identify you, personally, danielvaughn, among a sea of millions of other "anonymized" users. That information can be used to provide precisely-targeted advertising -- or coming soon to a Kroger near you -- precisely targeted prices for products. And of course it's valuable to anyone who is interested in stalking or impersonating you and might be wiling to pay for access to that data, whether by insider leaks or hacking. It's your choice as to whether you personally care, but a lot of people do care, and the more people who don't care, the harder it is for those who do.
- danielvaughn 2y ago
  Ah gotcha, that makes sense, thank you. Pretty wild that just a few parameters can uniquely identify individuals. That’s crazy.
  - nerdponx 2y ago
    If you're interested in the topic, it's a pervasive and not-fully-solved problem even in well-intentioned research, where special care is needed in order to avoid accidentally re-identifying individuals in anonymized data simply because they are too unique. Another classic example of this is behavioral uniqueness. Maybe 10 people got coffee and a donut at the corner store at 8 AM, but how many of them also went to work at ABC Corp that day and also got a pepperoni roll at the pizzeria for dinner at night? Probably just one person did that.
  - dishsoap 2y ago
    The thing is it's not just a few parameters. Modern browsers provide thousands.

dngit 2y ago

Are there any browser extensions or tools that effectively prevent fingerprinting including canvas fingerprinting? Or is this one of those privacy battles we just have to accept as unwinnable?

begueradj 2y ago
https://www.torproject.org https://www.torproject.org
- dngit 2y ago
  Tor's great if you're okay with browsing the web at "stealth mode" speed! Have you found it practical for everyday use?
- DeathArrow 2y ago
  TOR hides your IP address. It doesn't protect you from fingerprinting.
  - akimbostrawman 2y ago
    wrong https://wiki.mozilla.org/Security/Tor_Uplift https://wiki.mozilla.org/Security/Tor_Uplift
    - DeathArrow 2y ago
      That is a modified browser. TOR network itself doesn't protect people from fingerprinting.
      - akimbostrawman 2y ago
        how would a traffic protocol prevent browser fingerprinting? the closest would be traffic padding which tor does. https://spec.torproject.org/padding-spec/connection-level-padding.html https://spec.torproject.org/padding-spec/connection-level-pa...
2y ago

ruthmarx 2y ago

What I find more interesting is how some sites can detect your OS even if you block JS and change the user agent to indicate something different. I assume it's checking for known fonts or something similar.

Nadya 2y ago
That's a good assumption because that's exactly one way it is done. :)
trod123 2y ago
Fonts are the low hanging fruit. More sophisticated servers run a whole battery of hardware fingerprinting tests. It runs deep. If the device has been powered on for a certain period of time (usually a few minutes), the voltage normalizes and you get a unique clock skew signature based on the defects of the silicon, for each enumerable device that may be available from various JS API calls, or potential zero days, adds another data point for uniqueness. Passive listenings of local network traffic headers will provide a local network topology of metadata of local proximity devices that can often be cross referenced (since cable modems often collect this info as well as other embedded devices). Its a strategy called building a bridge. You start from the device which has an associated profile, that profile only need to be unique and may only start off as an identifier (nothing else) and the endpoint and you meet somewhere in the middle, backfilling information as you go. No personal info needed upfront. CSS previous visited link decorators is another avenue for fingerprinting. It violates same-domain policy, but there was a PoF back in 2021 where you could generate picture squares identical to a captcha asking for specific picture or puzzle that was generated to be tied to the CSS decorator (thus submitting your browser history beacons to that site in its entirety). Think it was varun.ch?
- deleted 2y ago
  [deleted]
- varun_ch 2y ago
  https://varun.ch/posts/history/ https://varun.ch/posts/history/ :)

bhouston 2y ago

I am confused. You can already ask the browser what OS, CPU, device and browser it is without fingerprinting the canvas. You can get the version of the browser, and OS as well. I use the popular US-Parser-JS library, works like a charm: https://www.npmjs.com/package/ua-parser-js https://www.npmjs.com/package/ua-parser-js. (I use it for https://web3dsurvey.com https://web3dsurvey.com.) (Also the WebGL and WebGPU APIs will also tell you the GPU hardware you have.)

efilife 2y ago
Canvases can vary very slighly between users' setups. The inconsistencies in rendering are used to fingerprint And to my knowledge you can't ask the browser about the cpu, only the number of cores. The regular fingerprinting you described would be just an user agent string that can be trivially spoofed
- bhouston 2y ago
  > Canvases can vary very slighly between users' setups. The inconsistencies in rendering are used to fingerprint I think it overlaps mostly with OS, CPU, Browser, GPU Type, GPU driver version. These can already be queried by UA string and WebGL/WebGPU. It is easier to query them explicitly for most users but I guess canvas fingerprinting is a fallback for when these APIs do not return some of the data. > And to my knowledge you can't ask the browser about the cpu, only the number of cores. Generally you can. Not all browsers give up all info, but most browsers give up most of the info. Here is a demo of what you get from ua parsing: https://uaparser.dev/#demo https://uaparser.dev/#demo
  - IggleSniggle 2y ago
    Years ago you could get crazy specific fingerprints from canvas. It got far less precise when Chrome introduced jitter into timers and treated performance timers as security sensitive functions. The main difference between canvas and this other stuff is that canvas couldn't be spoofed whereas everything else could and can be spoofed, or was so general as to be useless as an identifier.

wwwtyro 2y ago

I know my priorities are questionable, but I'm more annoyed that I can't expect consistent canvas rendering.

deleted 2y ago
[deleted]

DeathArrow 2y ago

>It's very likely that your web browser is Chrome and your operating system is Android. Android guess is correct. But the browser is Edge, not Chrome.

buro9 2y ago

The safest way to browse the web in any browser is by disabling JavaScript or using a NoScript extension. A lot of the web works surprisingly well still, and you can turn on just what you need when you need it, placing your most visited sites on an allow list, but still denying a lot of third party things on those sites. The internet is a joy with js disabled virtually everywhere. And all the canvas fingerprinting, webrtc leak, font fingerprinting, super cookies, etc... are all defeated by simply not running JavaScript

sureIy 2y ago
I think the amount of useful websites that work without JS are on a steady decline. No one wants to invest into a 0.1% share, so if it works it's likely out of chance. Even newspapers have a bunch of popups that expect JS to be closed, so you have to hope uBlock is already configured to remove it for you.
- buro9 2y ago
  Have you tried?
  - kvdveer 2y ago
    I have. Most information-type websites (blogs, recipes, news) work fine. Many app-style websites (email, bug tracking, chat) don't work, or have very poor ux. Guess which of these two categories I spend most of my time on...
- checkyoursudo 2y ago
  But it is trivial to allow js per website using ublock. My default is no-js, and if there is some website I really want to use that requires js, then I enable it. If I find myself using that website regularly, then I make the permission permanent. It is literally zero burden. I am not some no-js evangelist or javascript hater or anything, but a huge amount of the web really does work fine (sometimes better even!) without js enabled by default. I don't think it has to be strictly either-or.
2y ago

aucisson_masque 2y ago

If I open the website It says I have 99,9% uniqueness. So I'm trackable right ? Yet when I open it again in another window, it says 100% uniqueness but it's a different Signature than previously. I think it's saying it can't track me, because signature would have to be the same for it to work yet I'm using regular Firefox, nothing fancy. Is that technique really effective or I'm just wrong about the signature not being the same ?

trod123 2y ago
This is just one of many aspects of fingerprinting. Canvas is only a single element. Each fingerprint component can be used to correlate other components, including TLS channel options which generally last the entire session the website is open for, or there's a network header that remains unchanged between NAT. Given tens of thousands of potentially fingerprintable elements, you only need 5 relatively unique elements between people for a 1 in 1million, each point thereafter exponentially increases that uniqueness.
- nerdponx 2y ago
  I don't work in ad tech, but I expect that there are strong diminishing returns on this kind of thing. Yes, it's theoretically possible to do all of this advanced stuff to correlate and identify the long tail of users who have obfuscated fingerprints. But if you are in the targeted advertising business, are those users really all that valuable to target? They are probably nerds who don't buy a lot of new stuff and block ads anyway. I expect that being unique, but distinct on each run of the fingerprint algorithm, is probably good enough, unless you are concerned about a very motivated attacker trying to stalk you. On the other hand, there is also the fact that things like spoofing web APIs only goes so far. There are other fingerprinting techniques, such as measuring properties of the GPU, which might still uniquely identify your machine (how many people have such-and-such GPU in your ZIP code?).
amelius 2y ago
Maybe your browser has fingerprint mitigation techniques?
2y ago

chvid 2y ago

I am on Safari and if I open two private windows with this websites it will give me two different signature values. Chrome on the other hand will be give me two identical values. So I guess Apple is doing something ...

deleted 2y ago

[deleted]

ementally 2y ago

There seems to be a lot of misconceptions about how fingerprinting and anti-fingerprinting techniques work. I highly recommend reading this article, it is still WIP btw: https://github.com/privacyguides/privacyguides.org/blob/e81b8acc976f56e785c84de150784ea64191f87c/docs/advanced/browser-fingerprinting.md https://github.com/privacyguides/privacyguides.org/blob/e81b...

jagged-chisel 2y ago

“It's very likely that your web browser is Google Search App …” It’s not. Do I win?