HTML5 Canvas Fingerprinting

Test with Mobile Browsers.
Android Marshmallow:

Chrome:



Opera Mini:



Firefox + CanvasBlocker



Uniqueness:

Chrome = 1294/176794

Opera Mini = 4/176794

Firefox + CanvasBlocker = 0/176794

 

http://www.ghacks.net/2017/02/14/researchers-develop-cross-browser-fingerprinting-technique/

 

The web site makes use of Canvas Fingerprint + Battery Fingerprint.
In the specific case,Canvas Fingerprint,is blocked by UBO.
Not Battery Fingerprint.

__________________________________



___________________________________



Audio Fingerprint.

 

CanvasBlocker 0.3.7 Released (March 3, 2017)
https://addons.mozilla.org/en-US/firefox/addon/canvasblocker
Changelog

 

Fluxfonts available for Windows 10:

https://ctrl.blog/entry/fluxfonts

_________________________________

Test

https://browserleaks.com/fonts

_________________________________

Firefox 52:

http://www.ghacks.net/2016/12/28/firefox-52-better-font-fingerprinting-protection/

 

Added to Firefox the new parameter:

font.system.whitelist.

and inserted into the string fonts present in the Tor Browser:

Available for Windows.

 

Is there any tweak in Sandboxie to avoid such fingerprinting techniques ?

 

I don't think so. Sandboxie is only sandboxing applications, it doesn't modify the behavior or is adding "tweaks".
So visiting a test site for testing fingerprinting (browserleaks,etc.) should give the same result for a sandboxed and unsandboxed browser.

 

It has some cool features such as restricting file and registry access, so I thought it could be useful in this case

 

Of course
In this case Sandboxie is indeed useful. And all changes from the browser are contained within the sandbox. If something happens, just delete the contents of the sandbox and all is gone.

 

Test Battery Status API:

https://pazguille.github.io/demo-battery-api/

Chrome no ScriptSafe:



Chrome + ScriptSafe:



The web site below uses the Battery Fingerprint:

http://www.androidcentral.com/

 

CanvasBlocker 0.3.8 Released (May 23, 2017)
https://addons.mozilla.org/en-US/firefox/addon/canvasblocker
Changelog

 

https://www.ghacks.net/2017/05/29/chrome-sites-may-record-audiovideo-without-indication/

https://browserleaks.com/webrtc

 

New version:
Canvas Defender v1.1.0 (July 11, 2017)
https://chrome.google.com/webstore/detail/canvas-defender/obdbgnebcljmgkoljcdddaopadkifnpm

There are "interesting" changes:

• The fingerprint can be changed in a specific interval:

After clicking on the icon the Scheduled change can be seen (the time interval has been set to "Every 24 hours")

• Domains can be whitelisted:

• After visiting a website with a possible fingerprint attempt an alert can be seen:

 

Any idea when this update is coming to the Firefox extension?

 

Canvas Defender v1.1.0 for Firefox is available:

 

Thanks mood. As my FF had not updated from 1.0.9, I assumed that it was not available yet. Lazy on my part, I know! Anyway, up and running with 1.1.0 now. Just wondering what sort of domains might be worth whitelisting. Banking sites perhaps?

 

Not asking which is 'better', but can someone give some insights into respective features of Canvas Defender and Canvas Blocker?

 

Are they developer by the same team?

 

If a website is using fingerprint techniques and Canvas Defender cause some issues, then the website should be added to the whitelist.
If there are no issues then it is not really necessary to add websites to the whitelist

It is not a "complete" overview, maybe i have overlooked some options...

 

Canvas Defender 1.1.0 does not protect you from "Battery Fingerprint":

http://www.pittarosso.com/it




Even the "AudioContext Fingerprint Test Page" is not passed.

https://audiofingerprint.openwpm.com/

 

What's the best way to prevent all canvas fingerprinting including battery, audio etc. Does the browser slow down when you block everything?

 

That depends on which browser you use.

 

In Chrome/Chromium-based browsers you can use ScriptSafe + Canvas Defender + CanvasFingerprintBlock

In Mozilla-based browsers you can use Secret Agent + Canvas Defender + Privacy Settings + Random Agent Spoofer