The good thing about web-site cookies is that they are blockable. Cookies are the devil-you-know and web browsers are set up to deal with/delete them.
Now there’s a new insidious devil in town called canvas fingerprinting.
A new, extremely persistent type of online tracking is shadowing visitors to thousands of top websites, from WhiteHouse.gov to YouPorn.com.
First documented in a forthcoming paper by researchers at Princeton University and KU Leuven University in Belgium, this type of tracking, called canvas fingerprinting, works by instructing the visitor’s Web browser to draw a hidden image. Because each computer draws the image slightly differently, the images can be used to assign each user’s device a number that uniquely identifies it.
Like other tracking tools, canvas fingerprints are used to build profiles of users based on the websites they visit — profiles that shape which ads, news articles, or other types of content are displayed to them.
But fingerprints are unusually hard to block: They can’t be prevented by using standard Web browser privacy settings or using anti-tracking tools such as AdBlock Plus.
In a nutshell, canvas fingerprinting detects subtle variations in the way your specific browser renders a requested image to create a fingerprint for your specific computer.
The researchers found canvas fingerprinting computer code, primarily written by a company called AddThis, on 5 percent of the top 100,000 websites.
Here’s a link to the AddThis site, and another to their opt out page (which uses cookies as an opt out mechanism!).
Heh, their opt out is worthless. It’s a cookie, which you’re probably blocking/deleting on a regular basis anyway. So either let them track you, or enable cookies and let every other site on the planet track you.
Great point. Updated to reflect the cookiness of the opt out.
Dave, I’ve been getting canvas warnings from The Loop itself. Seeing as there’s nothing in sight using canvas that I see, it may be coming from the ad. I haven’t checked the source within the site, but it’s the site. Maybe worth investigating.
Can you be more specific? What is giving you canvas warnings? Are you in Safari? Using an add-in like Ghostery?
I’d be interested to know what Mantrax is using to detect canvas fingerprinting too.
So, it’s non-identifying and non-unique.
Am I supposed to be in a tizzy over it?
Maybe I am misunderstanding something, but if the browser can’t draw to the canvas, doesn’t that mean that canvas fingerprinting is disabled? It is really, really easy to prevent the browser from drawing to the canvas:
1) users can disable JavaScript in their browsers, which is a standard Web browser privacy/security setting — this disables the browser’s ability to draw to the canvas because drawing to the canvas is done with JavaScript — the tag itself only creates the drawing area — the drawings are actually contained in JavaScript code that has to be executed by the browser
2) developers of browser extensions could create a very simple extension that simply removes the tag from every page you load — or, the extension could be smarter and only remove tags that are hidden — developer time: 10 minutes
3) developers of Web browsers can update their browsers so that the browser is prevented from ever drawing to a hidden canvas — these kinds of updates happen all the time — newer browsers often have their rendering and execution abilities modified for security purposes — an example would be browsers refusing to render embedded objects that are below a certain width and height, because they are likely to be nefarious — developer time: a couple of hours
I appreciate that the author of this article may be trying to do good, but a browser is just technology. To say that is is virtually impossible to disable some kind of browser hack that is done in the rendered content is technically absurd. What is amazing is when a browser actually works. Crippling it is easy. The day after this kind of hack is discovered, patches will be submitted to WebKit and other browser rendering engines that disable the hack. And in the meantime, concerned users turn off JavaScript. This has happened dozens if not hundreds of times already in the history of the Web.
Also common in the history of the Web: Chicken Little stories about how the sky is falling through your Web browser.