Firefox @lemmy.ml heavyboots @lemmy.ml 8mo ago

ProTip: If you enabled resistFingerprinting, you have to manually allow HTML5 canvas usage per website

mastodon.social heavyboots (@heavyboots@mastodon.social)

Attached: 2 images Since I’m the idiot learning this by filing bug reports, I thought I’d pass it on to all other #FireFox users on here. If you enable resistFingerprinting in about:config, the web site will start showing you weird stripy graphics anywhere an HTML5 canvas graphic would be generated...

My apologies to the Bugzilla team for wasting their time holding my hand on this one. Would have honestly never noticed the little "HTML5" info icon to the left of the URL bar though without their help.

28 comments

Surely this is a user experience that could be improved, no? Awesome feature but confusing solution.
- The resist fingerprinting mode scrambles canvas read out to prevent sites from using it to create a fingerprint. Because of that, any site that needs to read the canvas back for legitimate purposes will also receive scrambled data. You get more privacy for the minor inconvenience of having to manually allow canvas usage for the sites that actually need it.
  
  Yes I’m aware, but the user interface doesn’t make it easy to understand A) why the canvas looks scrambled, and B) how to permit it on a per-site basis.
  
  The technical implementation is fine, it’s just the user workflow that needs fixed.
  
  And very few sites actually need it.
- Not really, because doing this will make you more fingerprintable (see my other comment). That's why the default settings are striking a balance between making all users look similar and not breaking too many things (that would cause users to use user-specific overrides that make them more unique), and why resistFingerprinting is in about:config rather than a user-facing setting or enabled by default.
  
  Or use something like Chameleon and mess with about:config which makes every unique fingerprint, different as your data is scrambled. Firefox still has webRTC leakage, font fingerprinting, audio fingerprinting... That's the reason why people use arkenfox's user.js !
- On librewolf I just get a popup asking to allow canvas
  
  A popup sounds like an annoyance you must deal with on every webpage. Not just the ones that use the canvas for useful things
And when you do this, you are now more fingerprintable than you were with resistFingerprinting off, as the specific combination of anti-fingerprinting measures and canvas-enablement makes you more unique. Which is why it's hidden in about:config.
- Yeah, as stated, only for sites you trust.
  
  I was enabling it on at a cycling site that uses HTML5 Canvas to make their charts of how long chain lubricants last zoomable, haha.
- If you're fingerprintable and your fingerprint changes every 60 seconds then it doesn't really matter
  
  You're still better off hardening these settings
  
  Why would you assume your fingerprint would change every 60 seconds? Are you flipping all the settings every minute or so?
I've actually seen that had no idea what it was!
How do u do fingerprinting with a canvas
- https://en.m.wikipedia.org/wiki/Canvas_fingerprinting
  
  When a user visits a page, the fingerprinting script first draws text with the font and size of its choice and adds background colors (1). Next, the script calls Canvas API’s ToDataURL method to get the canvas pixel data in dataURL format (2), which is basically a Base64 encoded representation of the binary pixel data. Finally, the script takes the hash of the text-encoded pixel data (3), which serves as the fingerprint ...
  
  Variations in which the graphics processing unit (GPU), or the graphics driver, is installed may cause the fingerprint variation. The fingerprint can be stored and shared with advertising partners to identify users when they visit affiliated websites. A profile can be created from the user's browsing activity, allowing advertisers to target advertise to the user's inferred demographics and preferences.
  
  By January 2022, the concept was extended to fingerprinting performance characteristics of the graphics hardware, called DrawnApart by the researchers.
  
  Hmm seems like their would be ways to mitigate this. Why not just introduce some random human undetectable changes to every pixel ie change breightness color alpha etc by 1 or something so every time u call the ToDataURL it returns different data? Might break some things but since canvases dont seem to be predictable systems anyway whats the harm?
Yeah if it even drew something like “Canvas approval needed to see this image” or just the dang icon in the location bar that would be a start.
- I suspect the assumption is that if you are okay digging into about:config to turn on the feature, you're okay with all further interactions veins similarly hidden.
  
  Yeah, I guess to a degree? This all came about because I went to fingerprint.com and realized they could track across VPN etc. was trying to figure out how to block it and that came up. And since not many sites use HTML5 canvas, I had long forgotten I enabled it by the time I hit a corrupted looking graphics site.
  
  I think in the end it shows they really need a better way to inform you what is going in than striped lines instead of a canvas graphic. Something that prompts you to either allow HTML5 canvas or that at least has a message/image you can google for further info in the issue easily.
Or email those admins and tell them to fix their website
- HTML5 is a perfectly valid technology when used for good purposes though? Their zoomable charts are fine as long as it is enabled. I don’t think they’re using them for tracking, just to make it easier to enable certain technologies.
  
  The company I work for does all our interactive lessons in HTML5 Canvas via Animate CC. When Flash was EOL’d it saved us from having to redo literally thousands of lessons completely.
OHHHHHHHHHHHHHHHH

That's why Champ'd Up doesn't work properly in Mull Browser! Thanks for this!
Yarp I've had this also.

28 comments