Browser Fingerprinting (Canvas)

[tingv001]

Originally Posted by MLADen

Canvas Defender doesn't block Canvas request. It creates 'noise', which masks you real canvas fingerprint. Nothing happens on websites, which don't try to read canvas function output. Howeer, if some website tries to do that, Canvas Defender feeds it a modified version of the fingerprint.

This would be a red flag then. The browser that I use allows me to change the Canvas fingerprint to a static unique one, so every browser would show a fingerprint, but it's own, which is what you want.

If yours feeds a "modified" version which would defeat the purpose and set a huge red flag. It would be like "WTF... this guys fingerprint changes every time he accesses the site? Riiiiiiiight".

By having a static set canvas and browser fingerprint you're saying, hey it's me, the same guy, and my other accounts? What other accounts? They're unique and static too" - which is what you want; smashcut - you want static browser fingerprint, not dynamic.

[Play]

Originally Posted by JavierAlonsoMartin

Would you say canvas defender is the only thing needed to stop canvas fingerprint tracking in case eB/PP implements it?

Nice question.

I would say Canvas Defender + WebRTC Leak Prevent + ... anyone else can think of anything to add?

Incase you didn't know, WebRTC leaks your actual IP addresses from behind your VPN, by default.

P.S. tingv001 does make an interesting point.

[JavierAlonsoMartin]

Originally Posted by Play

Nice question.

I would say Canvas Defender + WebRTC Leak Prevent + ... anyone else can think of anything to add?

Incase you didn't know, WebRTC leaks your actual IP addresses from behind your VPN, by default.

P.S. tingv001 does make an interesting point.

Interesting, I did not know anything about WebRTC before, thanks for the share.

I also change useragents for every account, since I use firefox for all of them. This can be done by going to about:config in your browser, then adding a "general.useragent.override" entry and as a value putting random useragent (just google popular user agents).

I am not sure eBay / PP track them but they might as well do so if they aren't doing it now.

Also Mozilla has something called prefetching where it loads data from the links behind the scenes. For example read this one aspect of Firefox:

To improve the loading speed, Firefox will open predictive connections to sites when the user hovers their mouse over thumbnails on the New Tab Page or the user starts to search in the Search Bar, or in the search field on the Home or the New Tab Page. In case the user follows through with the action, the page can begin loading faster since some of the work was already started in advance.

I figured it's best to disable this too. Here's a guide on how to do it: https://support.mozilla.org/en-US/kb...ic-connections

[JavierAlonsoMartin]

Originally Posted by tingv001

This would be a red flag then. The browser that I use allows me to change the Canvas fingerprint to a static unique one, so every browser would show a fingerprint, but it's own, which is what you want.

If yours feeds a "modified" version which would defeat the purpose and set a huge red flag. It would be like "WTF... this guys fingerprint changes every time he accesses the site? Riiiiiiiight".

By having a static set canvas and browser fingerprint you're saying, hey it's me, the same guy, and my other accounts? What other accounts? They're unique and static too" - which is what you want; smashcut - you want static browser fingerprint, not dynamic.

Hey tingv001,

I just tried Canvas Defender and this is exactly what it does.

It gives you a unique noise and unique canvas fingerprint per browser. This noise & fingerprint remains static even if you restart the browser.

If you want to change your fingerprint, you go to the plugin, and generate a new noise. Then the noise & fingerprint change, and again, they remain static unless you press the generate new noise button.

Seems like a really useful plugin.

[MLADen]

Originally Posted by tingv001

This would be a red flag then. The browser that I use allows me to change the Canvas fingerprint to a static unique one, so every browser would show a fingerprint, but it's own, which is what you want.

If yours feeds a "modified" version which would defeat the purpose and set a huge red flag. It would be like "WTF... this guys fingerprint changes every time he accesses the site? Riiiiiiiight".

By having a static set canvas and browser fingerprint you're saying, hey it's me, the same guy, and my other accounts? What other accounts? They're unique and static too" - which is what you want; smashcut - you want static browser fingerprint, not dynamic.

I see that ideas from "How Canvas Fingerprint Blockers Make You Easily Trackable" article shine through your words. Don't really have to explain them to me

Of course, you want to have a different canvas fingerprint in every browser session. It's up to you however how you implement sessions. There are many ways like virtual boxes, portable browsers, different browsers, Multiloginapp.

Canvas Defender doesn't make your fingerprint dynamic. It does exactly what you need: static fingerprint, which masks your real fingerprint.

[MLADen]

Originally Posted by JavierAlonsoMartin

Would you say canvas defender is the only thing needed to stop canvas fingerprint tracking in case eB/PP implements it?

Currently yes.

I should note here that there are ways to circumvent browser add-ons like Canvas Defender. As far as I am aware, Amazon and Ebay are not using them. PayPal does. So Canvas Defender wouldn't save you from being fingerprinted by Canvas function readout if PayPal decided to employ this technique.

As of now I don't know any free solutions that could or would work with PayPal.

Originally Posted by Play

Nice question.

I would say Canvas Defender + WebRTC Leak Prevent + ... anyone else can think of anything to add?

Incase you didn't know, WebRTC leaks your actual IP addresses from behind your VPN, by default.

P.S. tingv001 does make an interesting point.

Flash plugin is also critical and should be disabled. It leaks enormous amount of data.

Besides that, everything depends on how advanced website protection system is. All vanilla browsers leak tons of information. The question is what websites actually analyze it and how.

[NigelLikesCheesecake]

Originally Posted by Play

Incase you didn't know, WebRTC leaks your actual IP addresses from behind your VPN, by default.

I think WebRTC leaks your DNS, But, I don't think this the case with all browsers, Chrome browser certainly leaks but I think you should be ok with Firefox, Best place to test it whoer.net

[JavierAlonsoMartin]

Originally Posted by MLADen

Currently yes.

I should note here that there are ways to circumvent browser add-ons like Canvas Defender. As far as I am aware, Amazon and Ebay are not using them. PayPal does. So Canvas Defender wouldn't save you from being fingerprinted by Canvas function readout if PayPal decided to employ this technique.

As of now I don't know any free solutions that could or would work with PayPal.

Interesting, and how can PayPal do this?

[MLADen]

Originally Posted by JavierAlonsoMartin

Interesting, and how can PayPal do this?

In short: they prevent browser add-ons from modifying page code.

[RR2]

Originally Posted by MLADen

In short: they prevent browser add-ons from modifying page code.

Really? I did not know that. Do you have more info on this topic?

[tingv001]

Originally Posted by MLADen

I see that ideas from "How Canvas Fingerprint Blockers Make You Easily Trackable" article shine through your words. Don't really have to explain them to me

Of course, you want to have a different canvas fingerprint in every browser session. It's up to you however how you implement sessions. There are many ways like virtual boxes, portable browsers, different browsers, Multiloginapp.

Canvas Defender doesn't make your fingerprint dynamic. It does exactly what you need: static fingerprint, which masks your real fingerprint.

Thanks for the read, never seen that but looks pretty decent.

Anyways I was just saying - I do other things that require a ton more stealth than ebay and paypal, I think ebay and paypal for now don't use canvas yet, if they did everyone would have been tagged already.

[MLADen]

Originally Posted by RR2

Really? I did not know that. Do you have more info on this topic?

https://developer.mozilla.org/en-US/...b/Security/CSP

[JavierAlonsoMartin]

Originally Posted by MLADen

https://developer.mozilla.org/en-US/...b/Security/CSP

What if we disable "security.csp.enable" value in about:config?

[Derdo99]

Guys, you are missing one very very important thing.
WebGL fingerprint.

And canvas defender will not change this value...

[feadup]

Originally Posted by Derdo99

Guys, you are missing one very very important thing.
WebGL fingerprint.

And canvas defender will not change this value...

very true, but easly it can be disabled

[Themav]

https://www.youtube.com/watch?v=GF30fInDCAo

https://www.youtube.com/watch?v=GF30fInDCAo

This tells you how to remove the WebGL in Firefox and Chrome

[JavierAlonsoMartin]

Guys, don't you find it alarming that PayPal bypassess the canvas fingerprint modifying addons?

I.e. no matter how hard you try to spoof your fingerprints, PayPal will have your authentic canvas fingerprint which is unique and will link you

[nate]

cheap laptop or phone for each account... problem solved... (for most of us)

[jeffweico]

I don't think there is any sense is getting worked up over one method of tracking or one company putting it out. Because any one of these tools could disappear tomorrow and others would just take their place. I am sure that there are dozens, or even hundreds of tracking devices being worked on right how. And more to come every day.

You can count on the fact that the companies who develop these tools, as well as the companies that use them, will be VERY QUIET about their operations. I very much doubt they will be making public announcements about them or offering any real ways to opt-out.

The only way to deal with this is to have a law enacted making it illegal to track any user for any purpose without obtaining the user's permission first. And I don't see this happening anytime soon.

Until then, all we can do is try to stay ahead and share information, like Aspkin has just done.

[rsot]

Originally Posted by nate

cheap laptop or phone for each account... problem solved... (for most of us)

Old school tactics

[kik]

Originally Posted by Play

Nice question.

I would say Canvas Defender + WebRTC Leak Prevent + ... anyone else can think of anything to add?

Incase you didn't know, WebRTC leaks your actual IP addresses from behind your VPN, by default.

P.S. tingv001 does make an interesting point.

Hi, if I use a dongle, do I need to still disable WebRTC or is it just for those using VPN?

[rsot]

Originally Posted by kik

Hi, if I use a dongle, do I need to still disable WebRTC or is it just for those using VPN?

I would say not needed when using dongle or regular IP