Canvas fingerprinting: default to never for all websites

Question

Since it is clear that one does not want canvas fingerprinting, is it possible to set this as the default and avoid the popup?

Answer 1

"Since it is clear that one does not want canvas fingerprinting..."

Actually, it's not. The canvas fingerprinting warning happens when a site tries to read the contents of a <canvas> element.

Since the <canvas> element and it's functionality wasn't designed for fingerprinting, there are infact plenty of legitimate use cases for sites reading the content of a <canvas> tag. For example, if you update your Twitter avatar it lets you resize the image after uploading it, this is done through a <canvas> element and to take a copy of the image with the users changes, they need to read the content of the <canvas> element.

From the perspective of possible fingerprinting, it's impossible to determine what purpose it's reading it for, so a generic warning must be given if a site ever tries to read the content of the element. Users will want this popup warning available since most people are totally unaware that canvas fingerprinting exists and that Tor Browser protects against it but there are plenty of reasons they may want to allow a specific site to read from a <canvas>.

As such, the pop-up must be used to avoid user frustration at "some site doesn't work with Tor Browser" and the user, instead, opting to not use Tor Browser. There is currently no way to avoid the prompt but if you feel an option to manually remove it through about:config should be added then you should open a ticket to request the feature.

Answer 2

By default Tor Browser Bundle does not send your canvas fingerprint (or to be precise sends the same canvas data for all Tor Browser users, so it looks the same) despite the popup. I would argue that the popup should still appear to inform the user.

You can test this by going to panopticlick.eff.org and comparing your canvas fingerprint with others.