6

How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it went up to 15 bits.

Are there any other ways to increase browser privacy by blocking canvas fingerprinting? Also how is WebGL hash different than hash of canvas fingerprint?

  • you can block canvas fingerprinting by subtly altering the canvas methods used by the script; scooting it over a half-pixel, change the font size slightly, etc. unlike raw blocking, this has the advantage of not sticking out. – dandavis Apr 26 '17 at 21:00
2

Panopticlick is looking for things that make you different to other visitors. In this case, fewer people use canvas blockers than don't, so you become more unique if you use one. However, this only means that it is easier to tell you apart from another user - not that they can tell who you are.

Think of it being like a security camera which can only see heights of people passing by (maybe shadows). Can say "tall person went past", but not "Celeritas, who is tall, went past". The Panopticlick increase means that they can suggest with greater confidence that this specific person visited - you've put a box on your head, so now the security camera can see a square shadow. You're the only square shadow, so someone looking at it can say "aha, the tall person with the square head went past" - they are a lot less common than just tall people!

As a result, in order to minimise this kind of tracking, you should try to blend in - no canvas blocking, default settings on your browser, no unusual fonts installed on your computer, always running in a common resolution.

This isn't the same as preventing specific tracking - it only works if no-one is specifically looking for your traces. If you're the only person in a region who visits a specific site, they can fingerprint you easily, even if you blend in perfectly with other visitors by more easily controllable factors. Essentially, it comes down to what you want privacy from:

  • Ad networks: block their cookies and adverts, never click on any unblocked adverts, avoid Google
  • People you share an office or computer with: incognito mode. It makes you more unique, but protects against local investigation to some extent
  • Law enforcement: anonymous VPNs, TOR. Both increase your uniqueness, but reduce the ease of tracking a specific request
  • I disagree with blending in. You should blend in "when they're going after you", but not doing anything (like the the target group of mass surveillance) makes you prone to mass surveillance. – Samuel Shifterovich Nov 26 '16 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.