8

When using Canvas Fingerprint (like on this website) to distinguish users, does two smartphones (same model, same OS version, and no browser/plugin customization) will share the same fingerprint?

  • 2
    Great question. My understanding is that canvas fingerprinting can detect transistor-level manufacturing defects in your GPU, and therefore can distinguish otherwise "identical" devices. I'm not an expert though and would love to read a well-researched answer. – Mike Ounsworth Jan 16 at 16:54
7

This site describes the techniques used in canvas fingerprinting:

The technique is based on the fact that the same canvas image may be rendered differently in different computers. This happens for several reasons. At the image format level – web browsers uses different image processing engines, image export options, compression level, the final images may got different checksum even if they are pixel-identical. At the system level – operating systems have different fonts, they use different algorithms and settings for anti-aliasing and sub-pixel rendering.

So this sounds like it is fingerprinting the algorithms and config settings that your device uses to render a canvas.


It looks like wikipedia/Canvas_fingerprinting answers this question fairly directly, so I'll quote the relevant section in full (emphasis mine):

Uniqueness

Since the fingerprint is primarily based on the browser, operating system, and installed graphics hardware it does not uniquely identify users. In a small-scale study with 294 participants from Amazon's Mechanical Turk, an experimental entropy of 5.7 bits was observed, but the authors of the study suggest more entropy could likely be observed in the wild and with more patterns used in the fingerprint. While not sufficient to uniquely identify users by itself, this fingerprint could be combined with other sources of entropy to provide a unique identifier. It is claimed that because the technique is effectively fingerprinting the GPU, the entropy is "orthogonal" to the entropy of previous browser fingerprint techniques such as screen resolution and browser JavaScript capabilities.


Summary

It sounds like if two devices are running the identical hardware and software, then they will produce the identical canvas fingerprint. So it seems like canvas fingerprinting is not a unique identifier by itself, but rather is part of a healthy diet of data that websites collect about you.

  • I was under the impression that canvas fingerprinting can detect transistor-level manufacturing defects in your GPU, but I guess not. *shrug* – Mike Ounsworth Jan 16 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.