4

I have heard there is a fingerprinting method that traces internet users based on browser data. I believe it is called "canvas HTML hash".

  1. This hash is unique, as I understand? Or does it change depending on what?

  2. Imagine someone uses one VPN server for "googling", a different VPN server for "amazon-buying", etc...

    Obviously when on Amazon her real-life name/ID is known. Does that mean that she would also be identified when she is on YouTube with a different VPN server (but the same web browser)? Does canvas fingerprinting destroy anonymity?

Can someone clarify how this canvas fingerprint hash works?

8

Canvas Fingerprinting

The technique you are referring to is Canvas Fingerprinting. It is one of many possible methods available for website operators to try to identify and track users without cookies. The reason for this, of course, is because cookies can be cleared, or even "tricked" by things as simple as switching to a private (aka incognito) window. The idea here is that the website uses javascript to try to look at something more permanent than cookies.

For a very short summary, Canvas Fingerprinting asks your browser to draw a standard picture, and then takes a hash of the results. Different operating systems, browsers, hardware, etc... will result in slightly different images. As a result the hope is that one particular user will always have the same hash (even if, for instance, switching to an incognito window) while different users will have slightly different hashes, allowing the website to continue to track users even if they clear all their cookies.

Can you be tracked?

In practice canvas fingerprinting isn't perfect, and there probably aren't enough different combinations of "things" to uniquely identify users based on canvas fingerprinting alone. However, canvas fingerprinting is only one possible avenue to uniquely identify users, and more intelligent browser fingerprinting can be very successful in identifying users. Here is a website that actually measures how "unique" your browser configuration is, and therefore whether or not you can be tracked without cookies: https://amiunique.org/fp. You'll notice that canvas fingerprinting is something they check, but it is only one of literally dozens of data points they use to determine uniqueness.

In all likelihood you can be reliably identified and tracked without cookies. This doesn't mean that YouTube knows who you are just because Amazon does. However, (to use them as an example), it does mean that if YouTube wanted to, they could continue to track you even if you log out, clear your cookies, and switch to Incognito Mode. Note that I only use this as an example: I have no idea if YouTube or any particular service provider attempts to perform such tracking.

VPNs

Finally it's worth a mention that a VPN has little bearing on this conversation. A VPN just changes your IP address, which isn't something that is typically used for tracking anyway - for many users an IP address changes frequently. Also, switching to a VPN doesn't provide you any anonymity for services you were already using, since they can continue to track you easily if you don't clear your cookies.

  • thx! Is there any way a user can affect this canvas hash , a way to make it change regularly? (by staying on the same browser). playing around with browser settings , cookie policies, could help right? What good methods are there – johnsmiththelird Oct 24 at 20:24
  • In general you probably can't change your canvas fingerprint - it is largely a function of your browser, OS, graphics card, and drivers. Most of those don't change very often. However, even that wouldn't be very helpful because Canvas Fingerprinting is only one of many data points used to identify users without cookies. It can be difficult to make this impossible. Here's an article that goes into a good amount of detail about this though: pixelprivacy.com/resources/browser-fingerprinting – Conor Mancone Oct 24 at 20:28
  • ok, but what is a "hash"? a hash needs input right. So if we know what parameters are included in the "input" data which is then hashed, we could play around with those input parameters, correct? Do you know where to find the input data which goes into the canvas hash? timezone, cookies, etc. those are inputs. and if you just change one single input variable, the resulting canvas hash should be totally different. this is the function of a hash. to deliver random strings if input changes... or how do you see it? – johnsmiththelird Oct 24 at 20:34
  • 1
    @johnsmiththelird I mentioned that in my answer. Javascript generates a canvas element (developer.mozilla.org/en-US/docs/Web/API/Canvas_API), draws a picture with it, extracts the picture as data, and then hashes that. As I said, the only real inputs into it are your OS, Browser, graphics card, and drivers. Those are (largely) hard to change, and certainly can't be changed between browser sessions as needed. Many of the other elements of full browser fingerprinting are even harder to change, although some are easy. Walk through amiunique.org to see what they track. – Conor Mancone Oct 24 at 20:38
  • 1
    @johnsmiththelird I don't think any browser settings are relevant. I literally meant the browser and version (i.e. Chrome 77, Firefox 66). The version might not even always matter. – Conor Mancone Oct 24 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.