What security flaw with the HTML5 canvas is Tor Browser Bundle protecting you from when it pops up a notification about the canvas.
Add a comment
|
1 Answer
Using the HTML Canvas a malicious website can perform various tests to learn a large array of information, in relation to graphics, which can be used to fingerprint users.
Tor Project design docs (under 4.6, section 2. HTML5 Canvas Image Extraction)
After plugins and plugin-provided information, we believe that the HTML5 Canvas is the single largest fingerprinting threat browsers face today. Initial studies show that the Canvas can provide an easy-access fingerprinting target: The adversary simply renders WebGL, font, and named color data to a Canvas element, extracts the image buffer, and computes a hash of that image data. Subtle differences in the video card, font packs, and even font and graphics library versions allow the adversary to produce a stable, simple, high-entropy fingerprint of a computer. In fact, the hash of the rendered image can be used almost identically to a tracking cookie by the web server.
Also,
To reduce the threat from this vector, we have patched Firefox to prompt before returning valid image data to the Canvas APIs. If the user hasn't previously allowed the site in the URL bar to access Canvas image data, pure white image data is returned to the Javascript APIs.
Basically, the HTML Canvas if allowed to be used, by either clicking not now or just using a not patched Firefox (or just another browser), allows for scary, anonymity ruining fingerprinting. On the bright side, if your accidentally allowed it, Tor Browser Bundle will forget when you close it.