HTML5 Canvas Fingerprinting

http://www.ghacks.net/2014/07/21/companies-use-canvas-fingerprinting-track-online/

Test:

http://www.browserleaks.com/canvas


Two websites that make use of this technique:

https://blog.malwarebytes.org/

https://github.com/

 

https://multiloginapp.com/canvasdefender-browser-extension/

https://chrome.google.com/webstore/detail/canvas-defender/obdbgnebcljmgkoljcdddaopadkifnpm

https://addons.mozilla.org/en-US/firefox/addon/no-canvas-fingerprinting/

 

I have the Canvas Blocker addon but I still get this on the test page:

Canvas (basic support) ✔ True
Text API for Canvas ✔ True
Canvas toDataURL ✔ True

Signature ✔ A7501341
Found in DB × False

? Your Canvas Fingerprint appears to be unique for our database.

Does this mean that Canvas Blocker is not working?

 

I was using the Canvas Block found in the FF addon, Random Agent Spoofer. But FF v45 borked its script injection. So while the developer is reworking the code to get it compliant with >=v45, I've resorted to the Canvas Blocker addon.

Spoiler

Canvas Support in Your Browser
Canvas (basic support) False
Text API for Canvas False
Canvas toDataURL False
Database Summary
Unique User-Agents 84558
Unique Fingerprints 4161
Your Fingerprint
Signature N/A
Found in DB N/A

@caspian you might want to check the settings in the addon. I have my Block Mode set to "only allow whitelist", and my whitelist section only has one entry in it at the moment. Even though I use Windows, I make it look like I use Linux, so not sure if that borks the results in any way.

 

Cool! I'm trying both the FF and Chrome extensions now.

 

With CanvasBlocker you can view the Web Page that use the technique "HTML5 Canvas Fingerprinting":

 

An alternative approach to Canvas Fingerprint Protection...

How Canvas Fingerprint Blockers make you easily trackable

Canvas Defender

 

Nice

So it seems to be binary. After you install it, you have a new fingerprint. If you disable it, you have your old one back. If you enable it again, you have the same altered one that you had before. Also, if you remove and reinstall it, you still get the same altered fingerprint. So the change isn't exactly "random".

 

Mentioned above - https://www.wilderssecurity.com/threads/html5-canvas-fingerprinting.386179/#post-2591724

 

Whoops... my bad, sorry bloke.

So manually clicking on it at browser bootup should cover the "random" loophole?

 

Not all extensions act alike:

CanvasFingerprintBlock

1) (Failed) https://blog.malwarebytes.org/
2) (OK) https://github.com/
3) (Failed) http://film-stream.cc/

 

Brave has initial support for Fingerprinting (inbuilt into the browser - no addon), with its latest beta version released couple of days ago.

More info. about it here..

It successfully blocks thwarts fingerprinting at above mentioned sites.

 

What I meant to say is that it's a canvas changer. In any given browser install, you have two canvas possibilities: 1) with CanvasDefender off; and 2) with it on. And the on one seems to be generated in some deterministic way. And that jives, I think, with the cite from @JRViejo.

 

Then it isn't working on my machines because I get the same noise each time I launch my browser.

 

That's what I see too.

 

Hmm. I haven't checked what happens after a restart yet. I know you can manually generate a new noise but that isn't a very user friendly option.

 

I'm using Firefox 46.0.1 on Lubuntu. I have a bunch of add-ons. Including CanvasBlocker, but it's disabled. I also have WebGL blocked in NoScript.

 

Here's my extensions in Cyberfox 46.0.3.


Thanks.

 

After running CCleaner and restarting it looks like a new noise was generated.

Edit: Scratch that! I just checked again and that is not the case. What happened is before I restarted last time I manually generated a new noise, then when Cyberfox was launched it changed from the newly generated noise. I just went through a restart without generating a new noise and next Cyberfox start showed the same noise as before the restart.

I hope that makes sense.

 

I find CanvasFingerprintBlock better than Canvas Defender. It lets me know when it's blocking canvas on a page. - In Chrome.

In Firefox i use CanvasBlocker - https://addons.mozilla.org/en-us/firefox/addon/canvasblocker/