Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #25541 > unrolled thread

Canvas Fingerprinting

Back to article view | Back to comp.lang.javascript

Contents

  Canvas Fingerprinting Andrew Poulos <ap_prog@hotmail.com> - 2014-07-23 13:33 +1000
    Re: Canvas Fingerprinting Andrew Poulos <ap_prog@hotmail.com> - 2014-07-23 15:23 +1000
      Re: Canvas Fingerprinting Andrew Poulos <ap_prog@hotmail.com> - 2014-07-23 17:48 +1000
        Re: Canvas Fingerprinting Eli the Bearded <*@eli.users.panix.com> - 2014-07-23 18:43 +0000
          Re: Canvas Fingerprinting Andrew Poulos <ap_prog@hotmail.com> - 2014-07-24 08:39 +1000

#25541 — Canvas Fingerprinting

As I understand it, advertisers can use js to draw a canvas graphic that 
is read as a "token" and sent to the server ie canvas fingerprinting. It 
uses data it gets from the browser, OS... to create the not quite unique 
fingerprint.

Why bother with using canvas why not just use js to send the data 
directly to the server?

Andrew Poulos

[toc] | [next] | [standalone]

#25543

On 23/07/2014 2:30 PM, Stefan Ram wrote:
> Andrew Poulos <ap_prog@hotmail.com> writes:
>> Why bother with using canvas why not just use js to send the data
>> directly to the server?
>
>    Canvas fingerprinting exploits subtle differences in the
>    rendering of a text /on a canvas/. (But, AFAIK, it only
>    applies to users who have enable JavaScript in their
>    browser, so there's no need to worry.)
>
Sorry if my question was unclear. What advantage does using js with 
canvas give over using js without canvas?

Andrew Poulos

[toc] | [prev] | [next] | [standalone]

#25545

On 23/07/2014 4:26 PM, Stefan Ram wrote:
> Andrew Poulos <ap_prog@hotmail.com> writes:
>> On 23/07/2014 2:30 PM, Stefan Ram wrote:
>>> Andrew Poulos <ap_prog@hotmail.com> writes:
>>>> Why bother with using canvas why not just use js to send the data
>>>> directly to the server?
>>> Canvas fingerprinting exploits subtle differences in the
>>> rendering of a text /on a canvas/. (But, AFAIK, it only
>>> applies to users who have enable JavaScript in their
>>> browser, so there's no need to worry.)
>> Sorry if my question was unclear. What advantage does using js with
>> canvas give over using js without canvas?
>
>    Did you know what it means to »render a text on a canvas«
>    (canvas = a raster graphics image) when you read my answer?

Not precisely but
<https://developer.mozilla.org/en/docs/Drawing_text_using_a_canvas>
implies that everything is done using js.

>    How would you detect in browser-JavaScript how a text is
>    rendered on a bitmap without a canvas?

If you "know" the canvas element already and the canvas is "filled" 
using js why can't you just send the js to the server?

Andrew Poulos

[toc] | [prev] | [next] | [standalone]

#25549

In comp.lang.javascript, Andrew Poulos  <ap_prog@hotmail.com> wrote:
> If you "know" the canvas element already and the canvas is "filled" 
> using js why can't you just send the js to the server?

Let's use an analogy. The "canvas" is a sheet of paper (hardware), drawn
on by a pen (hardware) in the user's hand (software). The "javascript"
is the directions for what to do.

If you just send the directions back, they look a whole lot like what
they did when they were first sent out.

If the user follows the directions to write some text on the sheet of
paper and then sends a photo of the results back, that's a lot closer
to the canvas fingerprinting scenario. The results in our example show
pen choice, paper choice, handwriting choice, etc. 

In the real canvas fingerprint, the image itself is not sent to the
site, only some information (a "fingerprint") of the image. But it still
relies detecting on software and hardware variations in following
directions exactly. In this case the directions are specifically
selected to be likely to produce variations, things like blending
colored text on top of other colored text.

Elijah
------
http://www.browserleaks.com/ has a sample of the canvas test

[toc] | [prev] | [next] | [standalone]

#25550

On 24/07/2014 4:43 AM, Eli the Bearded wrote:
> In comp.lang.javascript, Andrew Poulos  <ap_prog@hotmail.com> wrote:
>> If you "know" the canvas element already and the canvas is "filled"
>> using js why can't you just send the js to the server?
>
> Let's use an analogy. The "canvas" is a sheet of paper (hardware), drawn
> on by a pen (hardware) in the user's hand (software). The "javascript"
> is the directions for what to do.
>
> If you just send the directions back, they look a whole lot like what
> they did when they were first sent out.
>
> If the user follows the directions to write some text on the sheet of
> paper and then sends a photo of the results back, that's a lot closer
> to the canvas fingerprinting scenario. The results in our example show
> pen choice, paper choice, handwriting choice, etc.
>
> In the real canvas fingerprint, the image itself is not sent to the
> site, only some information (a "fingerprint") of the image. But it still
> relies detecting on software and hardware variations in following
> directions exactly. In this case the directions are specifically
> selected to be likely to produce variations, things like blending
> colored text on top of other colored text.

Ah I think I get it now - there'll be more information than just what 
can be generated with js.

Andrew Poulos

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web