1

Tor Browser settings

  • Security slider is on "Safest"
  • JavaScript is enabled (otherwise no Canvas fingerprint possible by site)
  • "Extract Canvas Data" is blocked:
    enter image description here

Issue

amiunique.org still shows me a unique Canvas fingerprint:

enter image description here

Question

Do I need to assume, that a website with modern, advanced tracking techniques (e.g. Google) will be able to create a unique Canvas fingerprint by enabled JavaScript, therefore mitigating anonymity of Tor Browser?

As a consequence, this would mean, disabling JavaScript is essential (more than I thought) for "sufficient" anonymity.

Optional: How is amiunique.org able to do this despite having blocked "Extract Canvas Data" ?

Related

This question is not a duplicate of following answers:

, as HTML5 Canvas data extraction is blocked and it is about the "Canvas" attribute calculation on amiunique.org.

Note: I am not affiliated with this site in any way - just thought, this is an interesting case to discuss.

Improve this question
5
  • If you haven't allowed access to the canvas, my guess is that it's saying you're unique simply because your browser is blocking access, not because of a fingerprint.
    – Steve
    Commented Jan 27, 2021 at 15:05
  • Hm that would be weird user experience - with JavaScript disabled, at least it directly responds with the info, that no measure can be taken. Following your hint, I temporarily granted Canvas extraction + safer security level. The results are the same: unique fingerprint for Canvas. Therefore, I would assume, the site seems to be able to do canvas calculations in either case.
    – cane_xmx3
    Commented Jan 27, 2021 at 15:52
  • what exactly is "fingerprinting"? Is it the capture of a visitor's IP address? what else does fingerprinting entail
    – user610620
    Commented Jan 27, 2021 at 15:59
  • @user610620 No, in a Tor Browser standard installation, a website can only see the Tor exit node IP. But IP is only one of several properties to create a profile from. By fingerprint I mean all the attributes a website can collect (user agent, JavaScript properties, etc.), which in its entirety can be used to identify you. If amiunique is correct, the Canvas data alone here is enough for a unique identity.
    – cane_xmx3
    Commented Jan 27, 2021 at 16:23
  • why would the attributes user agent and JavaScript properties identify a visitor? what do they have to do with their geolocation or home address
    – user610620
    Commented Jan 27, 2021 at 16:44

1 Answer 1

Reset to default
1

Last year Tor enabled a feature which returns randomized image data when a website attempts to extract an image from the canvas. This is better seen by looking at the image on https://browserleaks.com/canvas. Each time you refresh the webpage, the image should change. So the canvas is intentionally unique, but changes so that you cannot be tracked by it.

Added in: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d66dab82a7b9ae8012158aa1d78023a53f4b26f8

Bug 1621433 - In RFP mode, turn canvas image extraction into a random 'poison pill' for fingerprinters r=tjr,jrmuizel

In RFP mode, canvas image extraction leads to an all-white image, replace that with a random (sample 32 bytes of randomness and fill the buffer with that) 'poison pill'. This helps defeat naive fingerprinters by producing a random image on every try. This feature is toggled using a new, default on, pref privacy.resistFingerprinting.randomDataOnCanvasExtract.

Improve this answer
3
  • Thank you very much! This explains everything.
    – cane_xmx3
    Commented Jan 27, 2021 at 19:48
  • PS: Would have liked to give you an upvote, unfortunately my reputation is currently too low. Will do that later on.
    – cane_xmx3
    Commented Jan 27, 2021 at 19:49
  • @cane_xmx3: Don't worry about it, just glad to help :)
    – Steve
    Commented Jan 27, 2021 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .