Canvas fingerprinting

Questions about organisation, special technical questions, troll plain
frustrated
Posts: 35
Joined: Tue Nov 12, 2013 11:03

Canvas fingerprinting

Post by frustrated » Sun Sep 07, 2014 4:59

Does JonDoFox prevent canvas fingerprinting?

cane

Re: Canvas fingerprinting

Post by cane » Sun Sep 07, 2014 9:15

JonDoFox blocks Javascript by default (Canvas fingerprinting and much more tracking feautures are impossible without Javascript)

Additional JonDoFox blocks tracking services with AdBlock.

Canvas fingerprinting is not blocked explicit. Some browsers or extensions try to warn the user about canvas fingerprinting, but they only recognice an canvas-2-image conversation and don't analyze the usage of the image.

99% of canvas-2-image conversation I analyzed by hand over the last time were not for the purpose of tracking but used by web design for some (crude) effects. 1% was not definitely because of to complex scripts (I gave up). I never found a canvas-2-image conversation used for real fingerprinting "in the wild".

The university Leuven published a study about web tracking and found one tracking services who used canvas fingerprinting (AdThis). But it was used for an experiment and the usage was stopped by AdThis before publication of the study.

frustrated
Posts: 35
Joined: Tue Nov 12, 2013 11:03

Re: Canvas fingerprinting

Post by frustrated » Wed Sep 10, 2014 20:58

A recent article in Businessweek claims canvas fingerprinting is in use by thousands of sites:

http://www.businessweek.com/articles/20 ... dvertisers

Does anyone out there know if the Electronic Frontier Foundation's Privacy Badger is compatible with JonDoFox?

cane

Re: Canvas fingerprinting

Post by cane » Sat Sep 13, 2014 7:41

A recent article in Businessweek claims canvas fingerprinting is in use by thousands of sites:
I know the publication of university Leuven and Priceton, I will put in in our wiki next days.

They found 5.500 sites with canvas fingerprinting. 5.300 sites of this contains a tracking test script of AdThis which was used to run a test with canvas fingerprinting at the same time the universities were running the search robot.

AdThis is not using canvas fingerprinting any more and you can count out these 5.300 sites. There are 200-300 sites of the TOP 100k using canvas fingerprinting, 0.2-0.3%.

frustrated
Posts: 35
Joined: Tue Nov 12, 2013 11:03

Re: Canvas fingerprinting

Post by frustrated » Sat Jan 10, 2015 0:36

I understand that blocking JavaScript will prevent canvas fingerprinting. If I allow a script temporarily (to use a web site that requires it)canvas tracking may begin. But what happens if I then revoke permission for the script? Will the tracking be interrupted? Or will the tracking continue until I close the browser? Can it continue into a new browser session?

atoir
Posts: 7
Joined: Wed Apr 08, 2015 10:17

Re: Canvas fingerprinting

Post by atoir » Sun Jul 05, 2015 12:29

I've just tried the demo on https://www.browserleaks.com/canvas. I allow javascript to see if it works but I'm surprised there is no popup or something which alert me the site is using canvas. I thought the canvas block extension would do that.

Is it normal behavior ?


Thanks

cane

Re: Canvas fingerprinting

Post by cane » Sun Jul 05, 2015 17:55

I'm surprised there is no popup or something which alert me the site is using canvas.
JonDoFox is blocking silent.

Like cookies or other tracking features the read access on Canvas elements for fingerprintning is blocked silent in JonDoFox. (Other behavior than TorBrowser has implemented.)

Propagandapanda
Posts: 24
Joined: Sat Nov 29, 2014 0:55

Re: Canvas fingerprinting

Post by Propagandapanda » Sun Jul 05, 2015 19:11

cane wrote:JonDoFox is blocking silent.

Like cookies or other tracking features the read access on Canvas elements for fingerprintning is blocked silent in JonDoFox. (Other behavior than TorBrowser has implemented.)
---> Is really JonDoFox itself blocking Canvas, or do you mean the CanvasBlocker Add-On? Because I believe the
Add-On provides the option to notify you when a website tries to execute the Canvas API.

Greetings - P.

atoir
Posts: 7
Joined: Wed Apr 08, 2015 10:17

Re: Canvas fingerprinting

Post by atoir » Mon Jul 06, 2015 19:55

Just doing some tests:

Canvasblock add-on doesn't work on jondofox under linux. I can set block readout API or fake readout API or ...doesn't change the behavior
The demo https://www.browserleaks.com/canvas works so does jondofox block canvas ?

On windows with jondofox canvasblock works as expected. With block readout API nothing works (no fingerprint) on the demo url and fake readout give a random one each time I reload the page.

cane

Re: Canvas fingerprinting

Post by cane » Tue Jul 07, 2015 9:43

I don't have problems with blocking read access on canvas with Linux (tested with Debian 7/8 and Xubuntu). See attached screenshot.
---> Is really JonDoFox itself blocking Canvas, or do you mean the CanvasBlocker Add-On?
I was talking about the JonDoFox profil at all, not only the JonDoFox add-on. Canvas fingerprinting is blocked by the CanvasBlocker add-on in the JonDoFox profil.
Attachments
canvas-linux.png

Post Reply