Hacker News Reader

That sounds like it'd be very easily abused for browser fingerprinting and DRM-ish things (do you have font X installed? Are you using custom CSS? Any extra things added by particular extensions?)

Another one that comes to mind is "Are you blocking ads?", although I should probably stop before I give them any more ideas...

Sites already appear to be able to detect that.

Most of those types of things can be used for fingerprinting currently with JavaScript w/o need for screenshot rendering. Anything that injects into the page DOM can be detected and some timing attacks are possible.

The main issues that I think are important to consider are revealing browser history (visited links) and cross-frame information (like <iframe>). Modern browsers already have protection in these areas.

Non-standard:

https://developer.mozilla.org/en-US/docs/Web/API/CanvasRende...

https://www.npmjs.com/package/rasterizehtml renders HTML into the browser's canvas.

For now maybe this is good enough: https://github.com/niklasvh/html2canvas

Oh yeah, me too...

We have to rely on JS based rendering into a Canvas element for http://insite-feedback.com - and I would love to improve that process with a direct API :/

Well, maybe sometime soon. What would you use the direct API access for?