7 ms·

Detecting Noise in Canvas Fingerprinting

41 points by avastel 2y ago

Etheryte 2y ago
While this field is always interesting to read about, I absolutely refuse to give any technical input on how to improve fingerprinting, even if it's to fight bots. If you work on tracking, my opinion of you as a person is well summarized by apenwarr [0]: > Can I work for a bad company and still be a good person? > No. [0] https://apenwarr.ca/log/20201121 https://apenwarr.ca/log/20201121
- AndrewThrowaway 2y ago
  What is "a bad company"? Google? Amazon? Facebook? Tesla? Tinder? Boeing? Rheinmetall? Lockheed Martin? Pfizer?
  - a-french-anon 2y ago
    "Would the world be better without it (inb4 it'll be replaced in all but name)?" Google? Amazon? Facebook? Tinder? Yes. Boeing? Lockheed Martin? No. Tesla? Pfizer? Unknown. You're welcome.
    - internetter 2y ago
      Under what criterion were your answers decided? To play the devil's advocate: Google has vastly improved access to information. Facebook has allowed hundreds of millions of people to remain in each other's lives even while separated by oceans. Amazon made it much easier to acquire very specific items. Tinder has helped people find love.
      - vlovich123 2y ago
        Almost feels like a viewpoint that changes depending on how old you are & what your life experiences have been. I’m glad OP is so certain in his judgement though, especially ranking war machine companies as good for the world.
        a-french-anon 2y ago
        People would go to war even with sticks and rocks, but the technological advances made by those companies probably trickled down to general aviation and produced generally interesting "things".
        vlovich123 2y ago
        The amount of damage you can do and how quickly you can do it with sticks and rocks is a lot more contained and your ability to force project gets exponentially more expensive exponentially more quickly. Well researchers employed by Google are where transformers were presented which is how all modern AI companies build their models. I'd categorize generative AI as generally interesting things. Or a massively useful search platform, they solved email (until they stopped really paying attention to it). They also promulgated Android which has a lot of fans. And that's just the very visible stuff you'll see as someone not in the field. They've also contributed to storage & distributed systems research in very tangible ways. Or the research they've been doing into protein folding with AI via AlphaFold. Amazon pioneered modern cloud computing in such a way that they were the only game in town for a long time before Google and Microsoft attempted to compete. But sure, it sounds like your bias is against any company that's a "virtual" company and for companies that produce "real" things. However, you may want to ask yourself whether those companies would be able to build those "real" things as efficiently without all the virtual technology supporting them & letting them offload that complexity.
        a-french-anon 2y ago
        No, you're jumping to conclusions. if I put Google or Amazon in the "bad" bin, it's because I don't think all those technological advances (everything considered) make the world a better or more interesting place. I mean: AI? Cloud? Is this really the future you wanted? In my eyes, advances in FEM simulation is what you can really argue for when talking about "support for builders of meatspace things".
        vlovich123 2y ago
    - immibis 2y ago
      Why is making planes that drop bombs on brown people not bad?
      - deleted 2y ago
        [deleted]
- batch12 2y ago
  The quote is throwaway nonsense. No argument is made. I counter it with my own- Yes. By what standard are bad companies or good people measured? Do you define that? Religion? The current popular opinion?
  - Etheryte 2y ago
    By your own moral compass of course. There is no such thing as objective good or objective bad, it's all in the eye of the beholder. Surely you would've covered this in literature class in your youth? Likewise, me thinking someone is a bad person doesn't mean it's some objective and universal truth. It's literally, like, my opinion, man.
    - deleted 2y ago
      [deleted]
    - jgalt212 2y ago
      Don't be so cynical. There are universal truths.
      - Trasmatta 2y ago
        Such as?
        jgalt212 2y ago
        Muggers are bad people.
        lcnPylGDnU4H9OF 2y ago
        Muggers disagree.
        jgalt212 2y ago
        You must be a fan of the Barber Paradox.
- hugodellinger 2y ago
  To be honest, they are focusing here on detecting tweaks used by scrappers to bypass bot protection, not on building an unique and stable fingerprint of a browser.
  - genewitch 2y ago
    I scrape sites from time to time to back them up. I am kind of annoyed that this is going to get more difficult as time goes on thanks to societal leeches that have more rights than everyone (read "at least facebook, but probably X, and any other AI company not attached to a bookstore or book archival project") pirating content in 1998-2003. I know i have "no right" to archive content, but it comes in handy.
- immibis 2y ago
  Bad people win, as evidenced by almost everything. If you want to be good later you probably have to be bad now. Good on you if you don't, though.
xnx 2y ago
Fingerprinting is terrifying. That a device (and therefore a specific person) can be reliably identified across all sites and across time is a major failure of browser design.
- Klaster_1 2y ago
  While I agree that browser vendors could potentially have handled this better, I am more incline to view this as a regulation failure - that fingerprinting is permitted in the first place. By acting in this manner, ad companies offload the cost of to browser vendors, general public and reduce overall societal trust. This is especially concerning when Google exploits its positions as an ad company and browser vendor, see the Menifest V3 situation for an example.
  - Tade0 2y ago
    > I am more incline to view this as a regulation failure - that fingerprinting is permitted in the first place. In the EU it's not without explicit consent outside of a few, clearly defined cases. Of course compliance is not 100%.
  - dale_glass 2y ago
    Regulation isn't universal, so it won't fix the issue. A company wanting to work around that can just contract with another running out of a country without such regulations. Browsers should do their best to make fingerprinting a non-viable approach.
    - StilesCrisis 2y ago
      I don't think fingerprinting can be stopped as long as JavaScript exists. There will always be some minor difference you can exploit or some cache you can misuse.
      - didntcheck 2y ago
        There is also the fact that there can be legitimate uses for APIs which expose information by design One of the few good ideas Google proposed is Privacy Budget [1], which now appears to be abandoned. In short the browser estimates how much information each risky API call discloses, and blocks further calls if the sum exceeds some threshold [1] https://developers.google.com/privacy-sandbox/protections/privacy-budget# https://developers.google.com/privacy-sandbox/protections/pr...
AndrewThrowaway 2y ago
I feel conflicted about this. On one hand canvas being client side will always lead to cat and mouse game where fraudsters can always generate required "answer". On the other hand innocent users will always be fingerprinted by ad networks and similar.
- jonatron 2y ago
  The purpose is important, if my fingerprint is used to detect fraud (eg my browser has just tried 100 other credit cards), I'm less bothered than if cloudflare are reading my fingerprint then blocking me viewing a web page for no good reason.
  - Ukv 2y ago
    Castle.io's customers seem to include marketing platforms, and their listed use-cases include preventing account sharing and alt accounts. Can understand why a company would want to be able to uniquely identify users, but also from a user/privacy perspective it's something I'd very much like my browser/extensions to block.
    - jgalt212 2y ago
      Detecting account sharing is a tricky business. It's pretty easy to detect if one account is using two different machines. But it's quite hard to unambiguously say it's one person using both machines or two different people each using one machine each.
nprateem 2y ago
According to this post the only people who care about not being tracked are running bots and fraudsters.
hoseja 2y ago
"fraudsters" and "bots" Sure, Jan. Whatever lets you sleep at night.
jgalt212 2y ago
I've never heard of Castle before. Do any current Castle clients care to share opinions of their service as compared to Cloudflare Turnstile or Google ReCaptcha?
EfficientDude 2y ago
Wow I didn't realize that Canvas Fingerprinting was exclusively used to detect fraudsters! Especially the wily ones who figured out how to delete their cookies! That's really cool - like how they scan everybody's files now to detect pedophiles (exclusively!).
Bengalilol 2y ago
What if I do: delete CanvasRenderingContext2D.prototype.toDataURL; Shouldn’t delete set the function back to native code? Same with: const offscreen = new OffscreenCanvas(1, 1); const nativeToDataURL = Object.getPrototypeOf(offscreen.getContext("2d")).toDataURL; Object.defineProperty(CanvasRenderingContext2D.prototype, "toDataURL", { value: nativeToDataURL, writable: true, configurable: true }); Or: const iframe = document.createElement("iframe"); document.body.appendChild(iframe); const nativeToDataURL = iframe.contentWindow.CanvasRenderingContext2D.prototype.toDataURL; document.body.removeChild(iframe); CanvasRenderingContext2D.prototype.toDataURL = nativeToDataURL; I beg your pardon if my question is full of innocence.

41 points by avastel 2y ago

While this field is always interesting to read about, I absolutely refuse to give any technical input on how to improve fingerprinting, even if it's to fight bots. If you work on tracking, my opinion of you as a person is well summarized by apenwarr [0]: > Can I work for a bad company and still be a good person? > No. [0] https://apenwarr.ca/log/20201121 https://apenwarr.ca/log/20201121

AndrewThrowaway 2y ago
What is "a bad company"? Google? Amazon? Facebook? Tesla? Tinder? Boeing? Rheinmetall? Lockheed Martin? Pfizer?
- a-french-anon 2y ago
  "Would the world be better without it (inb4 it'll be replaced in all but name)?" Google? Amazon? Facebook? Tinder? Yes. Boeing? Lockheed Martin? No. Tesla? Pfizer? Unknown. You're welcome.
  - internetter 2y ago
    Under what criterion were your answers decided? To play the devil's advocate: Google has vastly improved access to information. Facebook has allowed hundreds of millions of people to remain in each other's lives even while separated by oceans. Amazon made it much easier to acquire very specific items. Tinder has helped people find love.
    - vlovich123 2y ago
      Almost feels like a viewpoint that changes depending on how old you are & what your life experiences have been. I’m glad OP is so certain in his judgement though, especially ranking war machine companies as good for the world.
      - a-french-anon 2y ago
        People would go to war even with sticks and rocks, but the technological advances made by those companies probably trickled down to general aviation and produced generally interesting "things".
        vlovich123 2y ago
        The amount of damage you can do and how quickly you can do it with sticks and rocks is a lot more contained and your ability to force project gets exponentially more expensive exponentially more quickly. Well researchers employed by Google are where transformers were presented which is how all modern AI companies build their models. I'd categorize generative AI as generally interesting things. Or a massively useful search platform, they solved email (until they stopped really paying attention to it). They also promulgated Android which has a lot of fans. And that's just the very visible stuff you'll see as someone not in the field. They've also contributed to storage & distributed systems research in very tangible ways. Or the research they've been doing into protein folding with AI via AlphaFold. Amazon pioneered modern cloud computing in such a way that they were the only game in town for a long time before Google and Microsoft attempted to compete. But sure, it sounds like your bias is against any company that's a "virtual" company and for companies that produce "real" things. However, you may want to ask yourself whether those companies would be able to build those "real" things as efficiently without all the virtual technology supporting them & letting them offload that complexity.
        a-french-anon 2y ago
        No, you're jumping to conclusions. if I put Google or Amazon in the "bad" bin, it's because I don't think all those technological advances (everything considered) make the world a better or more interesting place. I mean: AI? Cloud? Is this really the future you wanted? In my eyes, advances in FEM simulation is what you can really argue for when talking about "support for builders of meatspace things".
        vlovich123 2y ago
  - immibis 2y ago
    Why is making planes that drop bombs on brown people not bad?
    - deleted 2y ago
      [deleted]
batch12 2y ago
The quote is throwaway nonsense. No argument is made. I counter it with my own- Yes. By what standard are bad companies or good people measured? Do you define that? Religion? The current popular opinion?
- Etheryte 2y ago
  By your own moral compass of course. There is no such thing as objective good or objective bad, it's all in the eye of the beholder. Surely you would've covered this in literature class in your youth? Likewise, me thinking someone is a bad person doesn't mean it's some objective and universal truth. It's literally, like, my opinion, man.
  - deleted 2y ago
    [deleted]
  - jgalt212 2y ago
    Don't be so cynical. There are universal truths.
    - Trasmatta 2y ago
      Such as?
      - jgalt212 2y ago
        Muggers are bad people.
        lcnPylGDnU4H9OF 2y ago
        Muggers disagree.
        jgalt212 2y ago
        You must be a fan of the Barber Paradox.
hugodellinger 2y ago
To be honest, they are focusing here on detecting tweaks used by scrappers to bypass bot protection, not on building an unique and stable fingerprint of a browser.
- genewitch 2y ago
  I scrape sites from time to time to back them up. I am kind of annoyed that this is going to get more difficult as time goes on thanks to societal leeches that have more rights than everyone (read "at least facebook, but probably X, and any other AI company not attached to a bookstore or book archival project") pirating content in 1998-2003. I know i have "no right" to archive content, but it comes in handy.
immibis 2y ago
Bad people win, as evidenced by almost everything. If you want to be good later you probably have to be bad now. Good on you if you don't, though.

xnx 2y ago

Fingerprinting is terrifying. That a device (and therefore a specific person) can be reliably identified across all sites and across time is a major failure of browser design.

Klaster_1 2y ago
While I agree that browser vendors could potentially have handled this better, I am more incline to view this as a regulation failure - that fingerprinting is permitted in the first place. By acting in this manner, ad companies offload the cost of to browser vendors, general public and reduce overall societal trust. This is especially concerning when Google exploits its positions as an ad company and browser vendor, see the Menifest V3 situation for an example.
- Tade0 2y ago
  > I am more incline to view this as a regulation failure - that fingerprinting is permitted in the first place. In the EU it's not without explicit consent outside of a few, clearly defined cases. Of course compliance is not 100%.
- dale_glass 2y ago
  Regulation isn't universal, so it won't fix the issue. A company wanting to work around that can just contract with another running out of a country without such regulations. Browsers should do their best to make fingerprinting a non-viable approach.
  - StilesCrisis 2y ago
    I don't think fingerprinting can be stopped as long as JavaScript exists. There will always be some minor difference you can exploit or some cache you can misuse.
    - didntcheck 2y ago
      There is also the fact that there can be legitimate uses for APIs which expose information by design One of the few good ideas Google proposed is Privacy Budget [1], which now appears to be abandoned. In short the browser estimates how much information each risky API call discloses, and blocks further calls if the sum exceeds some threshold [1] https://developers.google.com/privacy-sandbox/protections/privacy-budget# https://developers.google.com/privacy-sandbox/protections/pr...

AndrewThrowaway 2y ago

I feel conflicted about this. On one hand canvas being client side will always lead to cat and mouse game where fraudsters can always generate required "answer". On the other hand innocent users will always be fingerprinted by ad networks and similar.

jonatron 2y ago
The purpose is important, if my fingerprint is used to detect fraud (eg my browser has just tried 100 other credit cards), I'm less bothered than if cloudflare are reading my fingerprint then blocking me viewing a web page for no good reason.
- Ukv 2y ago
  Castle.io's customers seem to include marketing platforms, and their listed use-cases include preventing account sharing and alt accounts. Can understand why a company would want to be able to uniquely identify users, but also from a user/privacy perspective it's something I'd very much like my browser/extensions to block.
  - jgalt212 2y ago
    Detecting account sharing is a tricky business. It's pretty easy to detect if one account is using two different machines. But it's quite hard to unambiguously say it's one person using both machines or two different people each using one machine each.

nprateem 2y ago

According to this post the only people who care about not being tracked are running bots and fraudsters.

hoseja 2y ago

"fraudsters" and "bots" Sure, Jan. Whatever lets you sleep at night.

jgalt212 2y ago

I've never heard of Castle before. Do any current Castle clients care to share opinions of their service as compared to Cloudflare Turnstile or Google ReCaptcha?

EfficientDude 2y ago

Wow I didn't realize that Canvas Fingerprinting was exclusively used to detect fraudsters! Especially the wily ones who figured out how to delete their cookies! That's really cool - like how they scan everybody's files now to detect pedophiles (exclusively!).

Bengalilol 2y ago

What if I do: delete CanvasRenderingContext2D.prototype.toDataURL; Shouldn’t delete set the function back to native code? Same with: const offscreen = new OffscreenCanvas(1, 1); const nativeToDataURL = Object.getPrototypeOf(offscreen.getContext("2d")).toDataURL; Object.defineProperty(CanvasRenderingContext2D.prototype, "toDataURL", { value: nativeToDataURL, writable: true, configurable: true }); Or: const iframe = document.createElement("iframe"); document.body.appendChild(iframe); const nativeToDataURL = iframe.contentWindow.CanvasRenderingContext2D.prototype.toDataURL; document.body.removeChild(iframe); CanvasRenderingContext2D.prototype.toDataURL = nativeToDataURL; I beg your pardon if my question is full of innocence.