Canvas fingerprinting

Canvas fingerprinting works by exploiting the HTML5 canvas element. As described by Acar et al. in: Uniqueness Since the fingerprint is primarily based on the browser, operating system, and installed graphics hardware, it does not, on its own, uniquely identify users. In a small-scale study with 294 participants from Amazon's Mechanical Turk, an experimental entropy of 5.7 bits was observed. The authors of the study suggest more entropy could likely be observed in the wild and with more patterns used in the fingerprint. While not sufficient to identify individual users by itself, this fingerprint could be combined with other entropy sources to provide a unique identifier. It is claimed that because the technique is effectively fingerprinting the GPU, the entropy is "orthogonal" to the entropy of previous browser fingerprint techniques such as screen resolution and browser JavaScript capabilities. Much more unique identification becomes possible with DrawnApart, published in 2022, which was shown to boost tracking duration of individual fingerprints by 67% when used to enhance other methods. ==History==

In May 2012, Keaton Mowery and Hovav Shacham, researchers at University of California, San Diego, wrote a paper Pixel Perfect: Fingerprinting Canvas in HTML5 describing how the HTML5 canvas could be used to create digital fingerprints of web users. In 2022, the capabilities of canvas fingerprinting were much deepened by taking minute differences between nominally identical units of the same GPU model into account. Those differences are rooted in the manufacturing process, making units more deterministic over time than between identical copies. ==Mitigation==

Tor Project reference documentation states, "After plugins and plugin-provided information, we believe that the HTML5 Canvas is the single largest fingerprinting threat browsers face today." Tor Browser notifies the user of canvas read attempts and provides the option to return blank image data to prevent fingerprinting. manually enhanced with EasyPrivacy list are able to block third-party ad network trackers and can be configured to block fingerprinting scripts that use canvas fingerprinting, provided that the tracker is served by a third party server (as opposed to being implemented by the visited website itself). ==See also==