I recently read this article, about how a journalist was hacked. She describes how they used a 'fingerprinting' technique to identify her OS. The way they use a one pixel image, it sounds like the canvas fingerprinting technique.

My understanding from what I have read about this is that canvas fingerprinting gives your OS a unique fingerprint from you can be identified, and followed around the web. I don't even recall it being able to identify your OS. Or have I missed this important detail? +


The two other answers are good but don't explicitly address a (what I find to be) critical point: What the article mentions is not canvas fingerprinting (nor does the author state that it is canvas fingerprinting)!

Canvas fingerprinting is described in this paper. From the abstract:

We exhibit a new system fingerprint based on browser font and WebGL rendering. To obtain this fingerprint, a website renders text and WebGL scenes to a <canvas> element, then examines the pixels produced. Different systems produce different output, and therefore different fingerprints. Even very simple tests — such as rendering a single sentence in a widely distributed system font — produce surprising variation.

I think you have a misconception about canvas fingerprinting given your statement:

My understanding from what I have read about this is that canvas fingerprinting gives your OS a unique fingerprint from you can be identified, and followed around the web.

The OS does play a factor in determining the a canvas fingerprint, but with so many other factors, including graphics card, graphics drivers, display, etc. it would probably not be possible to infer the OS from the canvas fingerprint (nor is that the point).

The technique used in the article, as stated is:

Normally, when an email contains an image, the receiver's email client has to contact the sender's email server in order to 'fetch' the image.

A 'fetch' being a GET request, which has useragent as a header, and useragent does indicate the operating system of the client.


To cite the relevant part from the article:

Nonetheless, I later found out that the email contained a tiny image (just one pixel by one pixel). This was the hackers' first attempt to 'fingerprint' my computer.

This looks like simply embedding an image located at the attackers server into a mail in the hope that the mail client will do a HTTP request to retrieve this image. Inside the HTTP request the client will send a User-Agent header which usually contains lots of information, including the used browser and operating system and maybe also information about installed plugins. My guess is that fingerprinting was simply done by looking at this User-Agent header.

Here are some example User-Agent headers contained in the request, so that you can see how much details are found in a simple HTTP request and that no complex canvas fingerprinting is necessary:

Chrome on Linux:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.107 Safari/537.36

Chrome on Windows:

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36

Firefox on Windows:

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0

Internet Explorer 11 on Windows:

Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko

Safari on Mac OS X:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/536.26.17 (KHTML, like Gecko) Version/6.0.2 Safari/536.26.17

For more information you might have a look at https://msdn.microsoft.com/en-us/library/ms537503(v=vs.85).aspx


Canvas fingerprinting identifies the OS?

The technique is based on the fact that the same canvas image may be rendered differently in different machines depending on the available hardware and operating system.

To display text and images, the browser draws them on the host operating system and hardware. For images, canvas fingerprinting uses measures graphics driver and GPU model for 3D graphics and 2D graphics positioning. For text, The browser uses the operating system's font-rendering code to display it.

My understanding from what I have read about this is that canvas fingerprinting gives your OS a unique fingerprint from you can be identified

When you visit a website it renders website renders text and WebGL scenes to a unique <canvas> element that identifies your machine.

The charateristis mentioned above can be used for nefarious goals:

enter image description here

  1. Web fonts can be used to perform a remote code execution as you can read from here:

This security update resolves a publicly disclosed vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted document or visits a malicious Web page that embeds TrueType font files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.