I got the following when reaching github.com

This website (github.com) attempted to extract HTML5 canvas image data, which may be used to uniquely identify your computer.

Should Tor browser allow this website to extract HTML5 canvas image data ? 

Now I read quite a few threads on the tor stackexchange site but none of them explain what actually is "HTML 5 canvas image data" can somebody explain it without being too technical (using layman terms as and when possible).

Looking forward to know more.


Websites can request several configuration settings from your browser in order to help them printing the best page format for you.

But by requesting your browser's specific abilities (here canvas is used for graphical rendering), websites could fingerprint your browser (if you have a unique configuration) across multiple sites. This is related to the Panopticlick (https://panopticlick.eff.org) method the EFF exposed, using other information sent by your browser to uniquely identify you, even without access to your IP address. The vast array of information sent makes it easy to end up with a very unique, thus identifiable, signature.

Tails (https://tails.boum.org/), for example, can help you to make yourself look more like other users. And disable JavaScript which would allow a lot more info to be sent. Do the Panopticlick test with and without JavaScript (erase the cookie between tests). If you must use JavaScript or plug-ins such as Flash, you must use a more secure set up, such as Whonix.

Also, you have to bear in mind that against a very large and capable adversary that listen to all Internet traffic, it can easily follow that type of trace if it exists; it's not only the individual websites requesting this information (which 99% is legitimate, just needed to improve rendering) that you should be wary of but the global big brother that is always looking over your shoulder. Also....I noticed when I went to my https://recoveryfarmhouse.net website the same pop up came up on Tor. One of the plugins that I use on the site shows me "live visits" which are listed by IP. It's a security plugin just so I know the activity on my website. Since I don't know a whole hell of alot about coding and security all I get from an IP is usually your ISP's main location that your using. iT DOESN'T narrow down to absolute location. Idk, not really sure what I could do with just an IP address if I tried. Wish I knew more. I do know this...I had one wordpress plugin in the past that actually saved wrong passwords. The implications behind that are pretty steep. Forget which one it was. Not all info gathering is innocent that is for sure.


I think the easiest is to quote the wikipedia entry:

Canvas consists of a drawable region defined in HTML code with height and width attributes. JavaScript code may access the area through a full set of drawing functions similar to those of other common 2D APIs, thus allowing for dynamically generated graphics. Some anticipated uses of canvas include building graphs, animations, games, and image composition.


The latest tor browser bundle has some new bugfixes related to this.

Bug 12684: Improve Canvas image extraction permissions prompt Bug 7265: Only prompt for first party canvas access. Log all scripts that attempt to extract canvas images to Browser console.


I came across this and think that best describes the situation


This was from https://lists.torproject.org/pipermail/tor-talk/2014-July/033969.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.