So... what we need is a browser, which says it supports these things but blocks or provides false data on request and looks as ordinary as possible for "regular" browser fingerprinting.
Is anyone aware of the existence of one?
Is anyone aware of the existence of one?
How do you prevent that, apart from working on 'fixing' browsers to create pixel-perfect renders across different browsers/platforms/configurations. Would that even be possible?
Edit:
> Tor Browser notifies the user for canvas read attempts and provides the option to return blank image data to prevent fingerprinting.
Huh. I guess that's one attempt, but being able to read pixel data out of a canvas is completely reasonable.
Not for every website. Most websites don't need canvas at all. One option would be to ask users to activate canvas support for a website that does need it, so users can judge for themselves if the request is legitimate. This is how the geo-location API works after all.
I am not convinced that this will work very well though.
> apart from working on 'fixing' browsers to create pixel-
> perfect renders
For Firefox and Chrome there are canvas fingerprint blockers [1] and [2]. These are heuristic based, so you'll likely see a bit of false positives. uBlock Origin includes an option to prevent the leakage of local IP addresses [3].
[1] https://addons.mozilla.org/en-US/firefox/addon/canvasblocker...
[2]https://chrome.google.com/webstore/detail/canvasfingerprintb...
[3]https://github.com/gorhill/uBlock/wiki/Prevent-WebRTC-from-l...
No, it doesn't. TB sends all kinds of misinformation, from the user agent string (always reports itself as being its base version of Firefox running on 32-bit Windows 7) to rounding javascript timing functions to reduce the precision.
> A solution would probably be a browser where every version, on every platform reports the exact same things, always the same way.
That's exactly what Tor Browser does.