Hacker News Reader

Comment by amelius | Hacker News Reader

> 30-40% of web pages have a <canvas> element

Yes, for fingerprinting /s

A legitimate point! Unfortunately from our end it's also impossible to tell what canvases are being used for. Somewhat reassuringly, the vast majority canvases that are being created are much larger than would be necessary for fingerprinting, so we have some reason to believe that most uses are legitimate. There's also the fact that the vast majority of canvases never perform `getImageData`, which is an essential part of every fingerprinting technique I've ever seen.

At this point it's possible to fingerprint with CSS alone, no javascript: https://css-tricks.com/css-based-fingerprinting/

So to say that canvas is an element "for fingerprinting" I think is an outdated notion that's the result of some bad PR the element got like 10 years ago.

So, yes, fingerprinting is an issue and we all wish it would go away. Unfortunately there is a ton of work to do. A lot of very smart people are working on this and I wish them the best of luck.

>At this point it's possible to fingerprint with CSS alone, no javascript: https://css-tricks.com/css-based-fing

Fingerprinting isn't a boolean state. The more fingerprinting vectors you have the more reliably you can identify users. Therefore having CSS fingerprinting (or any other fingerprinting vector) doesn't really make canvas fingerprinting less bad.

True. Any data the user leaks is data the user leaks and we should work to prevent this. However I don't think people realize just how easy it is to reliably fingerprint users who are blocking javascript and canvas and other web features.

Oh I realize. I also realize literally nobody is going to bite the hand that feeds and that this industry is never going to regulate itself.

In the future, everyone is using a 640x480 window into a browser that's completely software stack in a VM that runs at a regulated frequency with a specifically allocated amount of RAM and hard drive space, doesn't accept cookies, and clears cache after every page load.

>how easy it is to reliably fingerprint users who are blocking javascript and canvas and other web features.

The key difference is that most of the fingerprinting attributes listed in the article, most are very innocuous and/or easy to change (ie. unreliable for fingerprinting). That includes:

1. pointer type

2. prefers-color-scheme

3. window size

4. @supports

The only other one (local fonts) is interesting, but is still easily changeable and conceivably be mitigated by removing all non-default fonts. This is in contrast to canvas/webgl fingerprinting which fingerprints both the software and hardware parts of your rendering stack, and is nearly impossible to change.

> Unfortunately from our end it's also impossible to tell what canvases are being used for.

you mean trivial, right? calling getImageData toBlob toDataURL means fingerprinting.

I guess it didn't occur to you that retrieving and setting image data with getImageData()/putImageData() actually turn out to be indispensable features when generating complex multi-layer canvases. Your trivial heuristic would flag a lot of false positives.

I flat-out don’t believe feature usage statistics on the web for this kind of reason, because too many numbers are patently absurdly wrong as far as any kind of legitimate use is concerned, and so any time I see an element or attribute occurring more often than I’d expect, I just assume some widely-deployed script like Google Analytics that I almost certainly don’t want is using it, probably for fingerprinting.

I came here precisely to say 30-40% of websites seems remarkably high.

The number of actual canvas elements used as canvases I've noted in the wild is pretty small. I've been playing with the canvas element since it was a Safari exclusive they added to make building dashboard widgets more powerful, and I can probably say the number of times I've found them actually useful in building a site is on one hand.

I think you're right that most of them are probably for fingerprinting.

Why /s? You're right!

He's not completely right. Some of those sites have real reasons to use a canvas.

He's only ~99.9% right.

of which, /s serves us well.

Can you name a website that uses canvas for fingerprinting? I'm not doubting it's use for that, but would like to see a real example.

Google, Facebook, Reddit, Amazon, TikTok. I entered main pages of those websites, and they tried reading pixels of an invisible canvas for whatever reason.

Pardon my ignorance, but how do you do this with canvas? I heard of using a 1x1px image for tracking purposes, but not of canvas.

https://en.wikipedia.org/wiki/Canvas_fingerprinting

Thanks

The canvas element is great for basic fingerprinting because it's practically impossible to stop it without breaking legitimate use cases. Shortly explained, there's differences between text rendering in different operating systems, browsers, and between browser versions as well. A simple fingerprint would be then to render some text, convert the canvas to an image and then hash it. Modern fingerprinting approaches combine this with a number of other sources of data (such as WebGL, available fonts, etc) to uniquely identify users.

Reminds me of evercookie.

So stupid. You know what would be nice? If my processor didn't attempt to do a bunch of rendering and extra computation, costing more energy and wear, to spy on me. Without eliminating legitimate use cases.

For now, eliminating legitimate use cases will have to do.

This problem could also be solved by making the specs so rigid and implementations so constrained that none of these techniques could be used to differentiate one user agent from another.

For many reasons, the lesser of two evils is probably to make user agent differentiation possible. The number of apis one has to cut out to make it impossible basically rolls HTML back to the 1.0 with no JavaScript era.

Implementation details of the machine rendering a document leak through all over the place. The fact that they are allowed to vary while confirming to spec has historically been considered a feature of HTML rendering, not a bug.

How would you prevent use of canvas? Browser plugin? Proxy filter?

Fingerprinting not tracking pixel

1x1px is for sending data to a server (by passing info in the image request URL)

Canvas fingerprinting is done by generating unique(ish) strings based on slight variations in how Browsers/CPUs/GPUs render stuff.

Reply on news.ycombinator.com