Hello everyone!
I would like to present a topic about Canvas and WebGL issue inside VMs. So I have recently been playing with different VirtualBox VMs to test its reliability in changing your fingerprint. While VMs do give you a lot of flexibility to change many of the known fingerprints and it's only second to buying a new PC in terms of being natural, Canvas and WebGL do remain the most notable issues.
As far as the WebGL goes, it turns out that VirtualBox does not supply a graphic card to your virtual machine, and even if it did, the unmasked renderer would have the name "VirtualBox" in it, which would instantly detect your usage of a VM. As long as your VM does not have a GPU, the browser will use CPU to render WebGL. If you use Chrome, the unmasked renderer will show as "Google SwiftShader", and if you use Microsoft Edge or FireFox, the unmasked renderer will have the name "Microsoft" in it because Windows will handle the WebGL.
If everyone who runs a VM now checks their WebGL fingerprint on the same browser, everyone will have the same exact hash. And this is not good. The good news however is that real PCs that do not have GPUs will also act exactly the same, producing the same exact WebGL hash. But let's be honest, there are not so many of those computers around any more.
And as far as the Canvas goes, I always seemed to get the same exact hash on the same browser even on different versions of Windows. Using different browsers will indeed change the Canvas hash, but that's only a finite option. I tested both Windows 10 and Windows 8.1 and they both gave me the same exact Canvas hash when checked on the same browser.
I also need to mention that you have to allocate some good resources to your VM to decrease the chance of being detected. Allocating 2 CPU cores and 4GB of RAM would be good enough. Set the network adaptor to "Bridged mode" to give you natural local IPs. Use common screen resolutions and don't change it after that. Don't use it in full-screen mode because you will expose your real screen resolution. These are just some recommendations to appear more natural.
I will present my findings below and I encourage everyone else to do some tests of their own and share the results with us here. The point is to understand how likely will we be detected to be using VM based on Canvas and WebGL alone. If we can find enough number of normal PCs having the same Canvas and WebGL hashes as our VMs, then we would have some reassurance not to be very worried.
You can check your Canvas fingerprint here:
https://browserleaks.com/canvas
You can check your WebGL fingerprint here:
https://browserleaks.com/webgl
These were my findings:
Real PC (having GPU) running Windows 10 and Chrome:
Canvas: EAC99711
WebGL Unmasked Renderer: ANGLE (Intel HD Graphics ....)
Real PC (lacking GPU) running Windows 8.1 and Chrome:
Canvas: AF64A685
WebGL Unmasked Renderer: Google SwiftShader
WebGL Report Hash: F5FD97558E305AB07E7939E109183DC6
WebGL Image Hash: 15C2CD008A6BFD6DD3D02FD2B7EB3F14
VirtualBox running Windows 10 and Chrome:
Canvas: 0F5265AA
WebGL Unmasked Renderer: Google SwiftShader
WebGL Report Hash: F5FD97558E305AB07E7939E109183DC6
WebGL Image Hash: 15C2CD008A6BFD6DD3D02FD2B7EB3F14
VirtualBox running Windows 8.1 and Chrome:
Canvas: 0F5265AA
WebGL Unmasked Renderer: Google SwiftShader
WebGL Report Hash: F5FD97558E305AB07E7939E109183DC6
WebGL Image Hash: 15C2CD008A6BFD6DD3D02FD2B7EB3F14
Does anyone have a real PC with the same Canvas and WebGL hashes as a virtual machine? Please present your findings in this thread. Thank you!