Can HTML5 canvas image data reveal the users IP?

Question

I read a little bit about the HTML5 canvas image data here but I'm still not sure if it can reveal the IP when using Tor or not? My knowledge with this is quite limited since I'm new to all of this. Can the data "only" fingerprint my browser and identify it later with image information or can it also fully identify me by my true IP? I'm sorry for my bad english. I hope you could understand me. Thank you.

Answer 1

Quoting from a previous answer;

Tor Project design docs (under 4.6, than 2.HTML5 Canvas Image Extraction) "The HTML5 Canvas is a feature that has been added to major browsers after the EFF developed their Panopticlick study. After plugins and plugin-provided information, we believe that the HTML5 Canvas is the single largest fingerprinting threat browsers face today. Initial studies show that the Canvas can provide an easy-access fingerprinting target: The adversary simply renders WebGL, font, and named color data to a Canvas element, extracts the image buffer, and computes a hash of that image data. Subtle differences in the video card, font packs, and even font and graphics library versions allow the adversary to produce a stable, simple, high-entropy fingerprint of a computer. In fact, the hash of the rendered image can be used almost identically to a tracking cookie by the web server."

Also, "To reduce the threat from this vector, we have patched Firefox to prompt before returning valid image data to the Canvas APIs. If the user hasn't previously allowed the site in the URL bar to access Canvas image data, pure white image data is returned to the Javascript APIs."

Answer 2

ELI5 No. It is never enough to uniquely identify you.

HOWEVER, it does narrow it down somewhat, and when used with other data collection, could all be pieced together to uniquely identify you.

Of course, this is unlikely. It means someone has to get all these pieces in the first place, all from different sources, willing to give up their piece.

But if the someone who is looking for all the pieces is quite powerful, well, it is possible.

Answer 3

Simply yes it in theory can be used to create a partial print, that print can still match a large number of machines out there but it's like dropping the field from billions of possibilities to thousands, if in theory a close match were to join and their canvas got enough collective data it would be enough for a sysadmin to make an "educated guess" and monitor you.

I note this from my own tooling around with my own webhost where I introduced ideal parameters for a short test. My team was able to identify 12 out of 50 users between their tor accounts and regular accounts. The IP wasn't logged but the browser api, windows revision (not all cases) java revision, flash revision, and some common extensions. Again this was an internal test where our backend was targeted to sniff specific identifiers not the full possible gamut, and it proved valuable enough.

Ideally you'd be best running an emulated OS or using an alt OS with TOR to make as much different as possible... or just remoting with a vpn though that's a whole world of bleh.

Answer 4

Yes. An adversary, especial a big one could fingerprint you using the HTML5 Canvas when you are using Tor. They can know detect you again using the canvas. Currently they don't know your IP Address. As soon as you use use normal Firefox or any other browser, they can detect it's you using the canvas and the information they collect earlier. Thus finding your IP Address.

Please note that this is purely speculation on my part.