Canvas Fingerprinting – Internet Tracking Just Became Sneakier

By Tom Ledford | The Practical Computer

Everyone knows, when an ad displays for running shoes at Zappos and they are on a completely unrelated website, but they recently viewed running shoes on Zappos’ website, their Internet whereabouts are being tracked. 

Not everyone minds being tracked, especially if they understand how and why they are. Ads are a fact of life on the Internet. Why would you object to seeing only those that are relevant to you? Still, others may have good reasons they don’t want their online activity tracked.

Tracking with Third Party Cookies

Until now, tracking your whereabouts on the Web was done by storing “cookies” on your computer. Cookies are small files that contain information about websites you have visited or interacted with. You can tell your browser to block all of these tracking, or “third party” cookies, or to block cookies from particular sites. You can also delete cookies. In other words, you have a great deal of control over how cookies are used to track you on the Internet.

Canvas Fingerprinting

Canvas fingerprinting gathers information like installed software, versions, model, memory, and several other characteristics from your computer, that all together can be used to create a unique profile, or “fingerprint.” Companies can use this fingerprint to track your online activity.

Canvas fingerprinting gets its name from the HTML5 canvas element. The canvas element can be used to draw images on a web page. The element is scriptable with a full set of drawing functions. A unique “fingerprint” or “token” can be represented by an invisible (same color as background) image.

A very popular service called AddThis is the primary instigator of canvas fingerprinting. They provide a widget that is an easy way to add social media sharing to websites, but it also fingerprints computers that download web pages that use it. AddThis admits they ran a five month test of fingerprinting, but after a lot of media coverage and privacy concerns, they disabled the fingerprinting part of their widget.

Unlike cookies, canvas fingerprinting is difficult to block. Using “incognito” or “private” browsing won’t prevent fingerprinting. AdBlock, a popular browser add on, won’t block fingerprinting either. Disabling javascript in your browser will prevent canvas fingerprinting, but that will also cripple the functionality of most websites.  

Preventing Canvas Fingerprinting

An opt out cookie is available from AddThis that will prevent their widget from using fingerprinting. However, they aren’t the only ones using canvas fingerprinting. DoNotTrackMe can block the AddThis widget and other tracking scripts. So can AdBlock Plus, but you will need to add its EasyPrivacy filter. Privacy Badger can also be used to block canvas fingerprinting.

Should you be worried?

Even AddThis has not committed to using canvas fingerprinting. It isn’t accurate enough at identifying users now, and its accuracy will only get worse if millions and millions of users are being fingerprinted. 

Poor accuracy and the ability to block it, should keep canvas fingerprinting off your worry radar for a while.

No Comments

Please join the discussion! Tell us what you think.

%d bloggers like this: