HTML5 Canvas Fingerprinting

Discussion in 'privacy general' started by Sampei Nihira, May 30, 2016.

  1. andryou

    andryou Registered Member

    Joined:
    Nov 15, 2011
    Posts:
    21
    ScriptSafe creator here: each fingerprint protection option will still be separate; the background code has just been optimized :)
     
  2. Sampei Nihira

    Sampei Nihira Registered Member

    Joined:
    Apr 7, 2013
    Posts:
    3,367
    Location:
    Italy
    Hi Andryou.
    Not working also in the ver.15.
    The protection "Reduce Keyboard Fingerprinting " it is impossible to use.
    Excessive latency.


     
  3. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
    Hi,

    Thanks, and thanks also for a great extension. :thumb:

    Feature Requests:
    • Change the Canvas Fingerprint Protection to a persistent noise for the session, only changing to a new random fingerprint with each browser start.
    • A Reset All button.
     
    Last edited: Jun 23, 2016
  4. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,062
    Location:
    U.S.A.
    FYI. Canvas Defender 1.0.7 released!
     
  5. Sampei Nihira

    Sampei Nihira Registered Member

    Joined:
    Apr 7, 2013
    Posts:
    3,367
    Location:
    Italy
  6. liba

    liba Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    344
  7. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,062
    Location:
    U.S.A.
    Look at my Post. The only change I see is DenMLA's comment.

    Now, if you are talking about Release Notes, I can't find any.
     
  8. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
  9. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,062
    Location:
    U.S.A.
    Thanks for posting that! Their Canvas Defender page should list Release Notes IMO.
     
  10. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
    Yep, I agree. Chrome's version updated first and I couldn't find anything about it until FF's version updated.
     
  11. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    98,062
    Location:
    U.S.A.
    Hopefully, DenMLA can suggest the inclusion of Release Notes in one single source: their own site! :isay: Keeping fingers crossed. ;)
     
  12. TomAZ

    TomAZ Registered Member

    Joined:
    Feb 27, 2010
    Posts:
    1,131
    Location:
    USA
    Does 'Canvas Defender' interfere with or prevent you from logging into sites (like most online banking sites) that use some form of Browser Authentication?
     
    Last edited: Jun 25, 2016
  13. liba

    liba Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    344
    Canvas-Defender_v1.0.7 there is no any changes
     
  14. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
  15. liba

    liba Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    344
  16. TomAZ

    TomAZ Registered Member

    Joined:
    Feb 27, 2010
    Posts:
    1,131
    Location:
    USA
    At one point, I had heard that the EasyPrivacy filter list used in conjunction with uBlock, Adblock Plus, etc. would mitigate the the issue(s) of Canvas Fingerprinting. Does that still hold true?
     
  17. liba

    liba Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    344
    ScriptSafe v1.0.7.16 BETA 2

    What's changed from v1.0.7.16 Beta 1 to aid in beta testing:

    Added Remove Possible Hash Tracking
    - remove possible tracking tokens passed using hash, where there is an attribute and value (e.g. #xtor=RSS-1) (disabled by default)

    Added Block Client Rectangles
    - prevent fingerprinting through calculating element rectangles. May interfere with some dropdowns. (disabled by default)

    Update Remove Google Analytics (UTM) Tracking
    to also sanitize URLs using the hash method

    Revamped Update and Options pages

    Incorporated feedback from Beta 1 testing
    (mainly notes and warnings on the options page about the various Fingerprinting options)

    Address ScriptSafe Panel not opening completely on Mac OS X

    What's changed from v1.0.7.15 to aid in beta testing:
    Added Spoof Timezone
    - spoof or randomize your timezone; useful if you use VPN (disabled by default)

    Added Remove Google Analytics (UTM) Tracking option (under Privacy Settings) - remove Google Analytics (UTM) tracking tokens before they're actually passed to the server (disabled by default)

    Added option under User-Agent Spoof to apply spoofing to whitelisted domains as well (default behavior: bypass spoofing on whitelisted domains to avoid issues)

    Anti-Fingerprinting code consolidation (this means all fingerprinting options should also be tested)



    Instructions on how to Beta Test:
    Download the v1.0.7.16 BETA2:

    https://github.com/andryou/scriptsafe/archive/v1.0.7.16_beta2.zip

    Extract the ZIP file to its own folder anywhere on your computer
    Copy and paste chrome://extensions into your browser address bar and press Enter
    Make sure you have disabled the Chrome Web Store version of ScriptSafe (ID: oiigbmnaadbkfbmpbfijlflahbdbdgdf)
    Note: you may want to save a copy of your existing ScriptSafe settings at this point (seehttps://www.andryou.com/scriptsafe/frequently-asked-questions/#backup)
    Enable “Developer Mode“
    Click on Load unpacked extension, navigate to the folder you extracted ScriptSafe to in step #2and click on OK
    Restore your existing ScriptSafe settings: https://www.andryou.com/scriptsafe/frequently-asked-questions/#restore




    https://github.com/andryou/scriptsafe/issues/57
     
  18. summerheat

    summerheat Registered Member

    Joined:
    May 16, 2015
    Posts:
    2,199
    Yes. Fingerprinting is primarily done by 3rd party trackers, IMHO. So blocking them via EasyPrivacy makes it less relevant.
     
  19. liba

    liba Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    344
    ScriptSafe v1.0.8.0

    • Revamped the design of this page and the Options page: wider layout, larger/more readable words, and intuitive buttons. On the new Options page you are able to toggle between Grouped and List views by clicking on the button in the top-right corner.
    • Added a new Fingerprinting Protection section with the following options (all disabled by default):
      • Canvas Fingerprint Protection - protect against fingerprinting attempts through <canvas> elements, with the following options:
        • Disabled
        • Blank Readout (serve an empty canvas with the original dimensions)
        • Random Readout (serve an empty canvas with random dimensions)
        • Completely Block Readout (refuse to serve any data)
      • Block Audio Fingerprinting - prevent fingerprinting via the AudioContext API
      • Block WebGL Fingerprinting - prevent fingerprinting via the WebGL API
      • Block Battery Fingerprinting - prevent fingerprinting via the Battery API
      • Block Device Enumeration - prevent having hardware devices detected via the WebRTC API
      • Block Gamepad Enumeration - prevent having hardware devices detected via the Gamepad API
      • Block Canvas Font Access - prevent system fonts from being enumerated through <canvas> elements
      • Block Client Rectangles Fingerprinting - prevent fingerprinting through calculating element client rectangles)
      • Reduce Keyboard Fingerprinting (for advanced users) - make keypress timings more random to increase anonymity (note: adds a random delay between keypresses))
      • I recommend enabling all of the above options (except the last two) for increased privacy, and based on your needs disable the options that interfere with your usage.
    • Added Remove Google Analytics (UTM) Tracking option (under Privacy Settings) - remove Google Analytics (UTM) tracking tokens before they're actually passed to the server (disabled by default)
    • Added Remove Possible Hash Tracking option (under Privacy Settings) - remove possible tracking tokens passed using hash, where there is an attribute and value (e.g. #xtor=RSS-1) (disabled by default)
    • Added Spoof Timezone option (under Privacy Settings) - spoof or randomize your timezone; useful if you use VPN (disabled by default)
    • Added Prevent Clipboard Interference option (under Behavior Settings) - prevent pages from interfering with clipboard actions (disabled by default)
    • Added option to apply user-agent spoofing on whitelisted domains as well (default behaviour is to disable spoofing on whitelisted domains to avoid issues, but enabling this option will spoof the user-agent regardless)
    • Added Save as Text File functionality to the Export Settings portion in the Options page
    • Fix Panel expand issue for Mac OS X users
    • Updated unwanted content providers list
    • Created a beta testing signup form. If you sign up to become a beta tester, you will be emailed when there is a new version ready to be tested before being pushed to the Chrome Web Store. Sign up to be a beta tester!
    • I now have a Bitcoin address due to inquiries from people wary of PayPal but wanted to still donate!
      • 39VJ5L9Yd6WocG6r88uE7ZZnM5J2M5bW92
        (also found at the top of this and the Options page)
    https://github.com/andryou/scriptsafe/issues



    Install from the Chrome Web Store:https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf
     
  20. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
    :thumb: Thanks!
     
  21. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
    This issue is resolved with v1.0.8.0. Enabling Battery Fingerprinting Protection no longer stops youtube videos.
     
  22. hogndog

    hogndog Registered Member

    Joined:
    Jun 9, 2007
    Posts:
    632
    Location:
    In His Service
  23. Sampei Nihira

    Sampei Nihira Registered Member

    Joined:
    Apr 7, 2013
    Posts:
    3,367
    Location:
    Italy
    Immagine.jpg
     

    Attached Files:

  24. liba

    liba Registered Member

    Joined:
    Jan 21, 2016
    Posts:
    344
      • Canvas Fingerprint Protection - protect against fingerprinting attempts through <canvas> elements, with the following options:
        • Disabled
        • Blank Readout (serve an empty canvas with the original dimensions)
        • Random Readout (serve an empty canvas with random dimensions)
        • Completely Block Readout (refuse to serve any data)
      • Block Audio Fingerprinting - prevent fingerprinting via the AudioContext API
      • Block WebGL Fingerprinting - prevent fingerprinting via the WebGL API
      • Block Battery Fingerprinting - prevent fingerprinting via the Battery API
      • Block Device Enumeration - prevent having hardware devices detected via the WebRTC API
      • Block Gamepad Enumeration - prevent having hardware devices detected via the Gamepad API
      • Block Canvas Font Access - prevent system fonts from being enumerated through <canvas> elements
      • Block Client Rectangles Fingerprinting - prevent fingerprinting through calculating element client rectangles)
      • Reduce Keyboard Fingerprinting (for advanced users) - make keypress timings more random to increase anonymity (note: adds a random delay between keypresses))
      • I recommend enabling all of the above options (except the last two) for increased privacy, and based on your needs disable the options that interfere with your usage.
    • Added Remove Google Analytics (UTM) Tracking option (under Privacy Settings) - remove Google Analytics (UTM) tracking tokens before they're actually passed to the server (disabled by default)
    • Added Remove Possible Hash Tracking option (under Privacy Settings) - remove possible tracking tokens passed using hash, where there is an attribute and value (e.g. #xtor=RSS-1) (disabled by default)
    • Added Spoof Timezone option (under Privacy Settings) - spoof or randomize your timezone; useful if you use VPN (disabled by default)
    • Added Prevent Clipboard Interference option (under Behavior Settings) - prevent pages from interfering with clipboard actions (disabled by default)


    https://github.com/andryou/scriptsafe/issues



    ScriptSafe 1.0.8.4



    • I've translated ScriptSafe into 46 languages! These translations are not perfect or complete, so I welcome anyone to take a look and help translate. You
    • can either create a new issue on Github or email me: andryou@gmail.com
    • Updated the panel to better adjust to translations that have long phrases (e.g. changed "Rating" button to a star icon with a description on hover)
    • Added ability on the Options page to quickly move whitelist/blacklist entries to the other list (e.g. move a whitelist entry to the blacklist)
    • Enhance "Prevent Clipboard Interference" feature to protect against execCommand('copy') and execCommand ('cut') calls
    • Fix issue where some elements were not being listed under "Blocked Items"
    • Updated unwanted content providers list


    Install from the Chrome Web Store:https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf

    More information (quick start, feature list, domain expressions/examples, and more) here:https://www.andryou.com/scriptsafe/

    Bitcoin: 39VJ5L9Yd6WocG6r88uE7ZZnM5J2M5bW9
     
  25. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
    Last edited: Jul 15, 2016
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.