11

I got the following when reaching github.com 

This website (github.com) attempted to extract HTML5 canvas image data, which may be used to uniquely identify your computer.

Should Tor browser allow this website to extract HTML5 canvas image data ?

Now I read quite a few threads on the tor stackexchange site but none of them explain what actually is "HTML 5 canvas image data" can somebody explain it without being too technical (using layman terms as and when possible).

Looking forward to know more.

Improve this question
3
  • 1
    how do you turn off the notification nagger for this?
    – user7736
    Commented Jun 24, 2015 at 18:14
  • tor.stackexchange.com/questions/1891/…
    – Gerold Meisinger
    Commented May 22, 2017 at 8:26
  • When the icon appears in the address bar, does that mean the extraction started and the user can choose to stop it? Or does it mean it's off and the user can choose to start it? (This may sound silly, but I ask because the dropdown with the choices has the Allow side in blue.)
    – Mauricio
    Commented Jan 21, 2020 at 19:52

3 Answers 3

Reset to default
10

Websites can request several configuration settings from your browser in order to help them printing the best page format for you.

But by requesting your browser's specific abilities (here canvas is used for graphical rendering), websites could fingerprint your browser (if you have a unique configuration) across multiple sites. This is related to the Panopticlick (https://panopticlick.eff.org) method the EFF exposed, using other information sent by your browser to uniquely identify you, even without access to your IP address. The vast array of information sent makes it easy to end up with a very unique, thus identifiable, signature.

Tails (https://tails.boum.org/), for example, can help you to make yourself look more like other users. And disable JavaScript which would allow a lot more info to be sent. Do the Panopticlick test with and without JavaScript (erase the cookie between tests). If you must use JavaScript or plug-ins such as Flash, you must use a more secure set up, such as Whonix.

Also, you have to bear in mind that against a very large and capable adversary that listen to all Internet traffic, it can easily follow that type of trace if it exists; it's not only the individual websites requesting this information (which 99% is legitimate, just needed to improve rendering) that you should be wary of but the global big brother that is always looking over your shoulder. Also....I noticed when I went to my https://recoveryfarmhouse.net website the same pop up came up on Tor. One of the plugins that I use on the site shows me "live visits" which are listed by IP. It's a security plugin just so I know the activity on my website. Since I don't know a whole hell of alot about coding and security all I get from an IP is usually your ISP's main location that your using. iT DOESN'T narrow down to absolute location. Idk, not really sure what I could do with just an IP address if I tried. Wish I knew more. I do know this...I had one wordpress plugin in the past that actually saved wrong passwords. The implications behind that are pretty steep. Forget which one it was. Not all info gathering is innocent that is for sure.

Improve this answer
4

I think the easiest is to quote the wikipedia entry:

Canvas consists of a drawable region defined in HTML code with height and width attributes. JavaScript code may access the area through a full set of drawing functions similar to those of other common 2D APIs, thus allowing for dynamically generated graphics. Some anticipated uses of canvas include building graphs, animations, games, and image composition.

https://en.wikipedia.org/wiki/Canvas_element

The latest tor browser bundle has some new bugfixes related to this.

Bug 12684: Improve Canvas image extraction permissions prompt Bug 7265: Only prompt for first party canvas access. Log all scripts that attempt to extract canvas images to Browser console.

Improve this answer
2
  • This is correct as to "What is canvas image data" but it does not explain why allowing "extraction" of it is something to be concerned about. Does it provide a way to fingerprint and track your browser across sites? Or worse? (I'd post an answer if I knew.)
    – Jobiwan
    Commented Sep 6, 2014 at 22:01
  • 1
    It can be used for that yes, See here: en.wikipedia.org/wiki/Canvas_fingerprinting and more info about it related to tor browser here (see last post): trac.torproject.org/projects/tor/ticket/7084
    – IAmNoone
    Commented Sep 6, 2014 at 22:07
3

I came across this and think that best describes the situation

https://www.propublica.org/article/meet-the-online-tracking-device-that-is-virtually-impossible-to-block

This was from https://lists.torproject.org/pipermail/tor-talk/2014-July/033969.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .