4

I am something of a layperson, and have two questions regarding HTML5 Canvas fingerprinting.

As I understand it, it allows the site to extract certain hardware and software information about the visiting computer, which can be used to uniquely identify that machine. So if I were to visit site A, get finger-printed, then visit site B, and get finger-printed, my activities on sites A and B could be associated. If some identifying information (i.e. IP address) leaked on site B, my activities on site A could also be associated with that information. Or if I visited site A twice, it could tell that I was the same person. etc...

However, as I understand it, by itself, it does not reveal any identifying information. So if for some reason I didn't care about being identified as the same person on multiple occasions, I could allow it, and maintain my anonymity.

My questions are;

  1. Am I correct in my understanding?

  2. How would this be affected by running tor in a VM?

Improve this question
1
  • 2
    "if for some reason I didn't care about being identified as the same person...I could allow it, and maintain my anonymity" is somewhat of a contradiction. Yuriko is right however in that as a single point of data, it may not uniquely identify you but in conjunction with other things it may, used in conjunction with other methods like the recently disclosed Audio API fingerprinting which works through a similar method, it may vastly reduce your "anonymity set": audiofingerprint.openwpm.com
    – cacahuatl
    May 30, 2016 at 13:43

1 Answer 1

Reset to default
4

Yes, A and B could collude and identify the two users as being the same person with a substantial certitude1. If one of them has access to identifying information (IP address, name, email, etc.), the other would have access to them too (as they are colluding).

The most important part is, even if they don't have any identifying information, tracking your activity could be enough to deanonymize you. Let's say that you're visiting your school, football club, and bank's websites, and that they're all colluding. How many people are in your school, playing in your club, and customer of your bank? Making a map of the websites visited by a user narrows the possibility drastically.

Running Tor in a VM won't protect you as long as they can still fingerprint you.

1 I am not sure about how unique the fingerprint is. I took a look at the paper Pixel Perfect: Fingerprinting Canvas in HTML5 (PDF) by Keaton Mowery and Hovav Shacham, where they present the concept; it is said that the fingerprint is high-entropy, with 5.73 bits, but it doesn't seem a lot to me, not against a thousand of users. But anyway it can always be used with other fingerprinting techniques.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .