1

Tor Browser settings

  • Security slider is on "Safest"
  • JavaScript is enabled (otherwise no Canvas fingerprint possible by site)
  • "Extract Canvas Data" is blocked:
    enter image description here

Issue

amiunique.org still shows me a unique Canvas fingerprint:

enter image description here

Question

Do I need to assume, that a website with modern, advanced tracking techniques (e.g. Google) will be able to create a unique Canvas fingerprint by enabled JavaScript, therefore mitigating anonymity of Tor Browser?

As a consequence, this would mean, disabling JavaScript is essential (more than I thought) for "sufficient" anonymity.

Optional: How is amiunique.org able to do this despite having blocked "Extract Canvas Data" ?

Related

This question is not a duplicate of following answers:

, as HTML5 Canvas data extraction is blocked and it is about the "Canvas" attribute calculation on amiunique.org.

Note: I am not affiliated with this site in any way - just thought, this is an interesting case to discuss.

Improve this question
5
  • If you haven't allowed access to the canvas, my guess is that it's saying you're unique simply because your browser is blocking access, not because of a fingerprint.
    – Steve
    Jan 27, 2021 at 15:05
  • Hm that would be weird user experience - with JavaScript disabled, at least it directly responds with the info, that no measure can be taken. Following your hint, I temporarily granted Canvas extraction + safer security level. The results are the same: unique fingerprint for Canvas. Therefore, I would assume, the site seems to be able to do canvas calculations in either case.
    – cane_xmx3
    Jan 27, 2021 at 15:52
  • what exactly is "fingerprinting"? Is it the capture of a visitor's IP address? what else does fingerprinting entail
    – user610620
    Jan 27, 2021 at 15:59
  • @user610620 No, in a Tor Browser standard installation, a website can only see the Tor exit node IP. But IP is only one of several properties to create a profile from. By fingerprint I mean all the attributes a website can collect (user agent, JavaScript properties, etc.), which in its entirety can be used to identify you. If amiunique is correct, the Canvas data alone here is enough for a unique identity.
    – cane_xmx3
    Jan 27, 2021 at 16:23
  • why would the attributes user agent and JavaScript properties identify a visitor? what do they have to do with their geolocation or home address
    – user610620
    Jan 27, 2021 at 16:44

1 Answer 1

Reset to default
1

Last year Tor enabled a feature which returns randomized image data when a website attempts to extract an image from the canvas. This is better seen by looking at the image on https://browserleaks.com/canvas. Each time you refresh the webpage, the image should change. So the canvas is intentionally unique, but changes so that you cannot be tracked by it.

Added in: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/d66dab82a7b9ae8012158aa1d78023a53f4b26f8

Bug 1621433 - In RFP mode, turn canvas image extraction into a random 'poison pill' for fingerprinters r=tjr,jrmuizel

In RFP mode, canvas image extraction leads to an all-white image, replace that with a random (sample 32 bytes of randomness and fill the buffer with that) 'poison pill'. This helps defeat naive fingerprinters by producing a random image on every try. This feature is toggled using a new, default on, pref privacy.resistFingerprinting.randomDataOnCanvasExtract.

Improve this answer
3
  • Thank you very much! This explains everything.
    – cane_xmx3
    Jan 27, 2021 at 19:48
  • PS: Would have liked to give you an upvote, unfortunately my reputation is currently too low. Will do that later on.
    – cane_xmx3
    Jan 27, 2021 at 19:49
  • @cane_xmx3: Don't worry about it, just glad to help :)
    – Steve
    Jan 27, 2021 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.