Flipping "privacy.resistFingerprinting" in about:config to true should be sufficient in recent versions (also realize that this will change your default UTC prefs, some timing prefs, default window size, and a bunch of other stuff ...etc).

The TOR browser simply blocks access to the canvas itself. Seems like a good addition to the "would you like to grant access to" list.