Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Privacy Advertising

A New Form of Online Tracking: Canvas Fingerprinting 194

Posted by Unknown Lamer from the subverting-features-for-evil-and-profit dept.
New submitter bnortman (922608) was the first to write in with word of "a new research paper discussing a new form of user fingerprinting and tracking for the web using the HTML 5 <canvas> ." globaljustin adds more from an article at Pro Publica: Canvas fingerprinting works by instructing the visitor's Web browser to draw a hidden image. Because each computer draws the image slightly differently, the images can be used to assign each user's device a number that uniquely identifies it. ... The researchers found canvas fingerprinting computer code ... on 5 percent of the top 100,000 websites. Most of the code was on websites that use the AddThis social media sharing tools. Other fingerprinters include the German digital marketer Ligatus and the Canadian dating site Plentyoffish. ... Rich Harris, chief executive of AddThis, said that the company began testing canvas fingerprinting earlier this year as a possible way to replace cookies ...
This discussion has been archived. No new comments can be posted.

A New Form of Online Tracking: Canvas Fingerprinting More

A New Form of Online Tracking: Canvas Fingerprinting

Comments Filter:

  • Is that what it is come down to? (Score:3, Funny)

    by thieh ( 3654731 ) on Tuesday July 22, 2014 @07:12AM (#47506665)
    Skipping all images to avoid tracking? Back to ncurses it is then

  • I can see the privacy implications this has, but how in the world would such a method successfully discern between 2 identical devices?

    • Especially in corporate environments it's rather common to buy devices in bulk. They are often maintained by IT staff, ensuring the software stack installed on it is identical as well. Not to mention the external IP addresses.

    • It doesn't. It also has trouble detecting two identical versions of firefox. This is only really works as a few more bits to existing fingerprint frameworks.

    • Re:Identical devices (Score:5, Informative)

      by RKThoadan ( 89437 ) on Tuesday July 22, 2014 @07:31AM (#47506795)

      It looks like the technical details would be found in this link: http://cseweb.ucsd.edu/~hovav/... [ucsd.edu]

      In that first article the CEO of AddThis says that "Itâ(TM)s not uniquely identifying enough" and the guy who originally developed it says it's only 90% accurate.

    • Yeah, especially on tablets and laptops where people generally don't (or can't) update the hardware at all. I would have to say that it's just yet another piece of identifying information. Combine it with all the other pseudo identifiers like user agent strings and font lists and you can narrow down the number of collisions quite quickly. Also, it's probably another thing that varies from time to time, which allows you to double count people and drive up visitor counts to increase your worth to advertiser

    • It can't. But that doesn't make it useless. There's a lot of variety out there. In a test out of 200 and some samples, it comes up with over a hundred different fingerprints.

      It could be used if you want to differentiate when a known user (via account or other method) is using different devices. As a user is extremely unlikely to use 2 separate but identical computers.

      It could be used in combination with other fingerprinting techniques to get closer to cookie levels of ID.

      You might not care whether you get d

      • Re: (Score:2)

        by tepples ( 727027 )

        As a user is extremely unlikely to use 2 separate but identical computers.

        Not even two iPads in a household?

    • Re:Identical devices (Score:5, Interesting)

      by Charliemopps ( 1157495 ) on Tuesday July 22, 2014 @08:05AM (#47507039)

      I can see the privacy implications this has, but how in the world would such a method successfully discern between 2 identical devices?

      I work with marketing software on and off. There are thousands of data points collected when you visit a site that cares enough to ID you. This would be just one. If this ID narrows the device down to 10 or so... and they also have date stamps, general location data based on your IP, browser type, etc? They can ID you specifically, pretty easily. I've not seen this particular method come up myself... in fact, most of the time the ways the marketing software ID's you is irrelevant to the site owner. They just buy the software and install it. Done. The general doesn't care that there's 1 new landmine in his arsenal when he's already blanketed the field with thousands of them.

      Also, you need to understand that goal here... they don't care who you are. They just want to know that you are visitor 52467, and all the other times you were here you looked at products X, P and Q so they can display more information on those products. They also salt the site with "Free" offers that all you need to claim them is to input your contact information. Once you do that they link that contact information to your browsing history and shoot it over to a salesman and/or send you a personally designed advertisement to your email.

      This may all sound dumb and horribly invasive... but it's amazingly successful. There is absolutely no way these companies would give it up voluntarily. Many of them wouldn't be in business without that sort of data... I'm not even sure you'd like it if it were gone. Getting ads is annoying, getting ads for African American hair styling products when you're a redhead is infuriating. Targeted ads are a good thing, it's the completely unaddressed side affects of that data collection that's a problem.

      What needs to happen is laws governing how long the data can be kept need to be passed. As of now, it's kept forever as far as I know... because... well, why not? And who the data is shared with needs to be regulated. The intercooperation of these companies is pretty scary. Amazon should not know what I'm searching for on WebMD, and the fact of the matter is, as of now, pretty much every major site you visit is sharing data with every other site you visit for mutual profit. This likely includes government websites. I've seen the marketing companies brag about their government contracts so that's a tad scary. Lastly, pretty much all regulation is not-so-cleverly avoided by simply changing the tech. The regulation needs to be broad and easy to understand. As of now they do things like "Well, that's not a person, that's a device!" or "Is that really data?" etc... Bill Clinton word style play shouldn't absolve you of negligence.

      • "Getting ads is annoying, getting ads for African American hair styling products when you're a redhead is infuriating"

        No it isn't for most people, because we got used a LOT for this with TV. TV nearly never showed us advertising targeted for us specifically but more to a watcher class. But you know to whom it is infuriating to not target ads ? Marketing people. Because targeted ads means a better probability to transform an ad into a sale. In fact if marketing people could totally break our privacy and pu

      • Targeted ads are a good thing

        So says you.

        I don't give a shit about someone's ads, targeted or not. I'm not interested in them, and I will block them at every chance I get, as well as the ability to collect enough information to target me.

        You want to let them give you targeted ads, fine, no problem. That's your choice.

        I trust neither regulators to get this right (because so far their ability to regulate anything technology related is abysmal), nor do I trust the corporations to not try to ignore it.

        If they

        • I think you're missing the point.
          The targeted ads may or may not be a problem. Fine...

          But there is a very clear and obvious bad side to this, even if you want targeted ads, I doubt you want geocities to be still retaining the data on how you trafficked that Herpes treatment site site back in 1997. The company has no financial interest in keeping that data, but why delete it? They've no cause to...

          So often we get so caught up in "the principle" of an issue we completely miss easy opportunities to remedy 99%

          • Re: (Score:2, Insightful)

            by Anonymous Coward

            Well, the other real issue here, is that such fingerprinting is in place specifically to work around the "limitations" of cookies.

            Which are those "limitations"? That users can delete them. Honestly, most of the people I've dealt with when they ask for "better" fingerprinting cite that very cause. Not that cookies are per-browser and not per-user (which is what they want to track and what would be understandable at least). Not that cookies don't work with embedded devices. Not all those real limitations, but

      • Re: (Score:2)

        by sjames ( 1099 )

        they don't care who you are.........They also salt the site with "Free" offers that all you need to claim them is to input your contact information. Once you do that they link that contact information to your browsing history and shoot it over to a salesman and/or send you a personally designed advertisement to your email.

        So in other words, they very much care who I am.

        Getting targeted ads is creepy. It's like having my own 24/7 personal stalker. I notice the advertisers often aren't that anxious to share their own details with me. Too often, they can't even manage to be honest about the products they're advertising.

        I would rather get ads for irrelevant products and services. Or just ads that are relevant in a generic sort of way based on a few demographic observations.

      • There is absolutely no way these companies would give it up voluntarily.

        Well, the easier solution is not to give them the option. It's also a lot more failsafe, since people *will* break a law, but *will not* do things that are impossible/too difficult/too expensive.

        Getting ads is annoying, getting ads for African American hair styling products when you're a redhead is infuriating. Targeted ads are a good thing, it's the completely unaddressed side affects of that data collection that's a problem.

        Targeted

      • Getting ads is annoying, getting ads for African American hair styling products when you're a redhead is infuriating.

        Well, lots of things infuriate them; after all, you know, redheads. Maybe they should be targeted for anger management advertising instead?

      • I think you're overestimating the effect of marketing software. Oh, yes, it's extremely effective at figuring out who you are over many sites, but then the offers are absolutely atrocious. To wit [adage.com]:

        There is no time in my life I am less likely to buy some white pants, a toaster or a flight to Los Angeles than after I've just bought these items, yet that's precisely the time I see ads for these products or services.

        In other words, digital marketing is a con. It's conning business into paying for technology.

    • Re: (Score:2)

      by gl4ss ( 559668 )

      it doesn't need to.

      they only need to be able to claim it does to the chaps buying the service.

      so except some unexpected spam any day now!

  • Privacy Badger (Score:5, Informative)

    by cmdr_tofu ( 826352 ) on Tuesday July 22, 2014 @07:15AM (#47506695) Homepage

    I guess this is probably the best place to plug privacy badger https://www.eff.org/privacybad... [eff.org] (although I'm not sure if it would defeat this... noscript + privacy badger?)

    I just learned about privacy badger 2 days ago at HOPE.

    • Re:Privacy Badger (Score:4, Informative)

      by just_another_sean ( 919159 ) on Tuesday July 22, 2014 @07:30AM (#47506787) Journal

      Yes, Privacy Badger is a great tool. It's a little tedious when loading content from CDN's, can make pages look pretty bad unless you let a little tracking in... So I also keep my privacy set to delete everything when I close the browser. I also follow the guidelines here [debian.org] ( Scroll down to the Web Browser section ). It's Debian specific but easily translated to whatever mozilla based browsing experience you're using.

      As mentioned in the HowTo you can check your "fingerprint" here: https://panopticlick.eff.org/ [eff.org].

      And all that said, I have no idea at the moment if any of the above defeats the technique from TFA.

    • It doesn't solve the problem as yet. From the FAQ:

      "Currently, Privacy Badger does not prevent browser fingerprinting, of the sort we demonstrated with the Panopticlick project. But we will be adding fingerprinting countermeasures in a future update!"

      Also it only supports Firefox and Chrome.

      Torbrowser however does prevent canvas fingerprinting.

    • I am an online advertising / tracking company. How do I stop Privacy Badger from blocking me? ...
      If copies of Privacy Badger have already blocked your domain, you can unblock yourself by promising to respect the Do Not Track header in a way that conforms with the user's privacy policy.

      Riiight, because the kind of scumbags who actively develop techniques to get around user preferences are the kind who would never "promise to behave this time, honest!".

      If the EFF is that naive, I don't have much faith that I can count on their tool.

  • Not like another was needed, but there you go.

    • You'll do precious litte on the internet without Javascript.

      • But being able to selectively disable it and block certain sites definitely helps.

        You don't need to run the scripts for each of the 15 or so trackers in every page, just the ones which actually are needed.

        Admittedly, in a few cases, they've made it more or less impossible to do anything unless you allow the 3rd parties.

        In that case, the back button works just fine.

    • People who have Javascript disabled are the Amish of the internet.

      • Re:Yet another reason to turn off Ecmascript (Score:4, Insightful)

        by ArcadeMan ( 2766669 ) on Tuesday July 22, 2014 @07:54AM (#47506945)

        Yeah, but the Amish also don't receive telemarketing calls or email spam.

      • Re: (Score:2)

        by Arker ( 91948 )
        Not really. The Amish reject technology across the board, whether useful or not. People that are on the internet are obviously not rejecting technology across the board - javascript-in-the-browser is a single, very problematic technology, which is responsible for the vast majority of computer infections.

        So no, people that do not allow javascript are not much like the Amish of the internet. We are more like the 'people who know how to use condoms' of the internet.

        • But the Amish *do* use technology: hammers, nails, rakes, plows, et cetera are all technology.

          We are more like the 'people who know how to use condoms' of the internet.

          The most effective way of spreading your beliefs is to preach *not* to use condoms.
          This can be confirmed by many religious leaders.
          Just sayin.

        • Re: (Score:2)

          by Junta ( 36770 )

          Not really. The Amish reject technology across the board, whether useful or not.

          Actually, at least for a lot of Amish this isn't the case. For example, many Amish communities will have phones. They may relegate them to emergency and/or communal space use because they don't think it's good for private family time to be disrupted by a phone call. They reject grid power but do use batteries and generators. They use LED flashlights and buggy lights rather than burning lamps in many cases. They use cash registers, alarm clocks, and even power tools to some extent.

          Sure, they are a lot m

          • Re: (Score:2)

            by Lumpy ( 12016 )

            Michigan Amish also have TV sets and Dish TV. I see the dishes cleverly mounted to try and hide them.... The amish are not as pure as they want you to believe.

        • Re: (Score:2)

          by chihowa ( 366380 ) *

          The Amish don't reject technology so much as they reject being dependent on outsiders. This has historically meant a limited use of technology, but the main beef isn't with technology itself.

        • "The Amish reject technology across the board, whether useful or not."
          Clearly, cell phones are not technology.

  • There's just no way it could identify particular device. A particular kind of device at most. And even then it wouldn't be very reliable.

  • And this is why my browsers have as many privacy extensions as I can find.

    AddThis is definitely one of the sites which are blocked.

    If you let your browser load all of this crap, you are more or less asking for this garbage.

    I don't care about your business model, I'm simply not going to allow your crap to load.

    • Re: And this ... (Score:3, Funny)

      by Anonymous Coward

      NSA Guy 1: Hey, there's that one guy that shows up as a black hole on the Internet.
      NSA Guy 2: He is up a little early, isn't he?
      NSA Guy 1: Yeah, he usually doesn't post his slashdot privacy rants until after browsing those "furry" sites for a half hour or so.
      NSA Guy 2: He must not be in the mood.

      • NSA Guy 1: Hey, there's that one guy that shows up as a black hole on the Internet.

        Oh, I very much doubt I'm anywhere near as successful as that.

        NSA Guy 1: Yeah, he usually doesn't post his slashdot privacy rants until after browsing those "furry" sites for a half hour or so.

        Only on weekends or when the wife is out of town.

        Seriously though, it's your privacy. Nobody else is gonna protect it for you.

      • I recently saw an article that said, basically, by installing privacy software you make your machine more unique versus the other machines on the Internet and therefore make it EASIER to uniquely identify your machine. You may not be loading the cookies they try to ram down your browser's throat, and all the other persistent ways to track, but they can tell you DON'T load certain images, or keep certain cookies, and that too can be a clue for them.

  • Giorgio Maone says NoScript blocks "canvas" tracking:

    https://twitter.com/ma1/status... [twitter.com]

  • Why does this work (Score:3)

    by Cley Faye ( 1123605 ) on Tuesday July 22, 2014 @07:56AM (#47506967) Homepage
    Instead of focusing on the privacy issue, I'm more curious about why "different computer draws the image slightly differently". Browsers are supposed to provide abstraction from the machine, and the same scripts run on different computers is supposed to behave in the same way. At most, it could tap into things like the user id, but shouldn't have access to more than that.
    • Different drivers, OS's, web browsers, GPU's etc all have slight effects when asked to render something onto the canvas. The trick is that the raw resultant bits can then be captured trivially using getImageData() and then sent back to the tracker site (after hashing or what have you to reduce the size). It'll render the same way every time on your machine, but will differ to someone else's. (Showing my age here), kind of like how you could easily see the difference between the old Voodoo and TNT2 graphics

      • yes, but, there is so much layers that are supposed to smooth the hardware difference:

        • canvas operations are raster-based and lossless
        • browser scripts (either ecmascript or another) should provide consistent execution: whatever the underlying hardware, if I ask JavaScript to draw a circle with (x,y) center and r radius, the result should be predictable, and not hardware dependant
        • even considering that browsers use "hardware acceleration" as a way to speed things up, there is still at least one layer between t
        • Well, if all factors are equal it doesn't vary, otherwise every run on the same machine would vary and it would be useless. The point is that there enough differing variables between machines that it becomes useful for finger printing (and also for identifying specific hardware/driver/os/browser signatures). It would be used in conjunction with other techniques in practise I am sure.

        • if I ask JavaScript to draw a circle with (x,y) center and r radius

          This is impossible to do exactly on a square grid of pixels. All a raster device can do is approximate a circle. Edge anti-aliasing is underspecified, I believe deliberately, to allow devices to implement the most appropriate AA method for the platform.

          But I still think that software results that are independant of external input should not vary from one hardware to another. There is only one good output for a deterministic software function when always providing the same input.

          And then we're back to the slowness and increased battery consumption of software rendering. Should all browsers default to a bit-perfect reference renderer and require the use of obscure configuration interfaces to enable hardware acceleration?

          Imagine the horror if different processors would return different values when computing 1/0.999 just because they have different hardware

          Before the sta

      • Different drivers, OS's, web browsers, GPU's etc all have slight effects when asked to render something onto the canvas.

        So what you are telling me, is the best way to be anonymous on the internet is to install a new video card each week? Perfect!

      • (Showing my age here), kind of like how you could easily see the difference between the old Voodoo and TNT2 graphics card by how they rendered.

        Hell, there are even bugs* that have 100% different failure states on ATI vs. NVidia cards. All ATI cards default to white, NVidia cards to black**

        *For example, rendering a NULL texture

        ** May be backwards

    • I agree--I just don't see how this is the case. Sure, one person's Cleartype settings would be different from another's, so are we saying that the exact subpixel rendering is calculated? The article also mentions fonts installed... So, if I add a font, or a font like Arial Unicode gets updated (e.g. install a new version of MS-Office), my CANVAS fingerprint is now different/broken?

      The claim of 90% accuracy for PCs is shockingly, quite high... But if tablets & mobile devices have problems with this

    • I'm more curious about why "different computer draws the image slightly differently".

      Slight rounding differences, shape edge antialiasing behavior, font antialiasing behavior, installed fonts, and the like are the big ones I can think of. HTML5 Canvas behavior isn't specified down to the bit level.

      • I'm more curious about why "different computer draws the image slightly differently".

        Slight rounding differences, shape edge antialiasing behavior, font antialiasing behavior, installed fonts, and the like are the big ones I can think of. HTML5 Canvas behavior isn't specified down to the bit level.

        Maybe it should. Providing an API and saying "it kinda work like this, most of the time, your mileage may vary" doesn't sound very good.

        • Re: (Score:2)

          by tepples ( 727027 )
          If Canvas were bit-specified, rendering would in many (or perhaps most) cases have to be done in software, which is slow and battery-consuming on mobile and on low-end laptops. There's a reason that native computer games have been requiring a GPU for the past decade and a half.

        • Re: (Score:3)

          by tlhIngan ( 30335 )

          Maybe it should. Providing an API and saying "it kinda work like this, most of the time, your mileage may vary" doesn't sound very good.

          That already exists already - many formats specify practically subpixel accurate designs. E.g., PDF.

          The thing is, HTML was never designed that way - it's a content-plus-format standard that says the content is marked up, and to provide some hints as to how to display it as the creator intended. But the user is free to override such choices as they see fit in case they don't

  • The following passage is found in the paper:

    The easiest effective defense, then, is to simply require user approval whenever a script requests pixel data. Modern browsers already implement this type of security | for ex- ample, user approval is required for the HTML5 geolocation APIs. This approach continues the existing functionality of <canvas> while disallowing illegitimate uses, at the cost of yet another user-facing permissions dialog.

    Does that sounds like lack of common sense or...? I would imagine that the user is the most vulnerable link of the entire system. Permission dialogs never work as a security sanity check because people simply click ok/yes/agree most of the time. Or the web site can witheld data until the user agrees to pixel extraction.

  • It's not "new" (Score:3)

    by Crayon Kid ( 700279 ) on Tuesday July 22, 2014 @08:05AM (#47507043)

    The paper "Pixel Perfect: Fingerprinting Canvas in HTML5" [ucsd.edu] by Keaton Mowery and Hovav Shacham is from 2012.

    • Were you trying to hide it from us? Or did you think we all read the same things you do?

      For the future, what's the cutoff for new? 6 months? 1 month? What percentage of people can know something before it stops being new?

      Oh, sod it. Quit yer bitchin.

  • Confusing things together (Score:5, Informative)

    by Dan East ( 318230 ) on Tuesday July 22, 2014 @08:16AM (#47507099) Journal

    The research paper discusses two entirely different things: Canvas fingerprinting, and "Evercookies & Respawning", which are two entirely different things. Canvas fingerprinting is just another method of trying to determine which browser the user is running, by looking at differences in the way the canvas renders text and the like. "fingerprinting doesn’t work well on mobile" because of the homogeneous nature of mobile devices - 90% of iOS devices are running version 7.1, for example, so they are all using the same web browser version and rendering code, thus they are going to draw canvas fingerprints exactly the same. Nothing in the research article says anything about canvas fingerprinting being used to track people.

    Now the other topic "Evercookies & Respawning" is about tracking users. That is using multiple storage vectors to try and keep users from deleting cookies. For example, using tiny hidden Flash apps which have their own caching, actual cookies, HTML5 persistent storage, embedding unique identifiers directly in the HTML so when the cached page is pulled up the identifier is once again active.

    So at this point canvas fingerprinting isn't about tracking, but browser identification. The leap to "A New Form of Online Tracking: Canvas Fingerprinting", as described in the Pro Publica article:

    A new, extremely persistent type of online tracking is shadowing visitors to thousands of top websites, from WhiteHouse.gov to YouPorn.com.

    First documented in a forthcoming paper by researchers at Princeton University and KU Leuven University in Belgium, this type of tracking, called canvas fingerprinting, works by instructing the visitor’s Web browser to draw a hidden image. Because each computer draws the image slightly differently, the images can be used to assign each user’s device a number that uniquely identifies it.

    Well that's completely wrong - the bold text should read "this type of tracking, called Evercookies & Respawning". The persistent tracking has nothing to do with the canvas fingerprinting. It's mainly due to Flash (which also explains why it too is ineffective on mobile devices).

  • what about a linux "live key" ? don't people use those to avoid cookies?
    would it help in this situation?

    • No, it wouldn't.

      This takes advantage of driver/hardware differences, and settings for graphics.

      Therefore, unless you update the drivers/change your settings/change your hardware it will not block this.

      That said, it shouldn't be that difficult to block; I mean, who uses the Canvas anyway?

Slashdot Top Deals

Don't tell me how hard you work. Tell me how much you get done. -- James J. Ling

Close