HTML5 Canvas Fingerprint — Widely Used Unstoppable Web Tracking Technology

Till Now we have seen many traditional way of tracking web users, such as using cookies that get saved on user’s system may not be available forever to many companies, but a new method of tracking users has emerged that worked without the use of cookies.

From last two years, many websites and tracking softwares are utilizing the fingerprinting power of HTML5 Canvas, which is a HTML element used to dynamically generated image in your browser’s web page.

EACH BROWSER GENERATES DIFFERENT IMAGE

Basically, web browsers uses different image processing engines, export options, compression level, so each computer draws the image slightly differently, the images can be used to assign each user’s device a number (a fingerprint) that uniquely identifies it i.e. Browser fingerprinting.

According to a research paper published by computer security experts from Princeton University and KU Leuven University in Belgium, the Canvas fingerprint tracking has made it more difficult for even the sophisticated computer users to protect their privacy.

Canvas takes advantage of HTML5 Canvas API and JavaScript to create any dynamically generated graphics you want. Like other tracking tools, canvas fingerprint method is being used by thousands of websites, from WhiteHouse.gov to YouPorn.com, to profile their website visitors from past two years.

The paper describes three recently developed online tracking mechanisms — “canvas fingerprinting,” “evercookies” and “cookie syncing" — that can be used to track and potentially identify users across the websites around the world without even their knowledge or consent.

CANVAS TRACKING IN WEB ADVERTISEMENTS 

These methods of tracking is most likely being used by online advertising companies, those want to understand consumer’s online behavior and they get to know this by building interest-based profiles of the individual visitors to their websites.

Generally, when people clear the cookie files that websites place on their computer systems or block them, advertisers may not realise about the visitors watching their advertisements, which makes advertising less effective and less profitable for online advertising companies. So, the companies have always been experimenting and trying to invent better ways to get information about website visitors.

A Few big advertising companies have already been migrated their Flash-based banners ads to HTML5 Canvas based animated graphics.

“Canvas fingerprinting, a recently developed form of browser fingerprinting, has not previously been reported in the wild; our results show that over 5% of the top 100,000 websites employ it,” wrote the researchers.

One of the biggest U.S based media web-tracking technology and Social sharing widget company, ‘AddThis’ is responsible for most of the canvas fingerprinting (95%).

HTML5 Canvas is not just limited to image processing, but also can respond to a user’s actions by listening for keyboard, mouse, or touch events. You can get detailed tutorial of HTML5 Canvas on the Mozilla’s website and Sample scripts are available on Github.

CANVAS FINGERPRINTING SUPPORTED BY ALL MAJOR BROWSERS

HTML5 Canvas is supported by all major browsers and can be accessed on a wide range of devices including desktops, tablets, and smart phones. Users can visit this link to check Canvas Support and fingerprint test for their web browsers.

There is no doubt, Canvas Fingerprint is a method that is apparently quite difficult to block, but if you're using Tor Browser, your track is clear.