Basically, Canvas Fingerprinting works by creating a canvas element, then converting the canvas element into a unique, identifying data URL which can be used to fingerprint users. This is why the Tor browser makes you have to give permission for websites to use Canvas API (if JavaScript is enabled).

Here is my question. The function that allows you to convert the Canvas element to a data URL is HTMLCanvasElement.toDataURL(). Note: the actual function is toDataURL(), but it uses the HTMLCanvasElement interface. You can read more about it here: https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasElement/toDataURL.

So why doesn't the Tor browser block this function or at least make you have to give permission for websites to use it, instead? This would allow Canvas API to still be used by websites, but either the Tor browser would remove support for this function, or make you have to give permission to let it be used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.