[lnkForumImage]
TotalShareware - Download Free Software
Confronta i prezzi di migliaia di prodotti.
Asp Forum
 Home | Login | Register | Search 


 

Forums >

comp.lang.javascript

Canvas Fingerprinting

Andrew Poulos

7/23/2014 3:34:00 AM

As I understand it, advertisers can use js to draw a canvas graphic that
is read as a "token" and sent to the server ie canvas fingerprinting. It
uses data it gets from the browser, OS... to create the not quite unique
fingerprint.

Why bother with using canvas why not just use js to send the data
directly to the server?

Andrew Poulos
6 Answers

ram

7/23/2014 4:30:00 AM

0

Andrew Poulos <ap_prog@hotmail.com> writes:
>Why bother with using canvas why not just use js to send the data
>directly to the server?

Canvas fingerprinting exploits subtle differences in the
rendering of a text /on a canvas/. (But, AFAIK, it only
applies to users who have enable JavaScript in their
browser, so there's no need to worry.)

Andrew Poulos

7/23/2014 5:23:00 AM

0

On 23/07/2014 2:30 PM, Stefan Ram wrote:
> Andrew Poulos <ap_prog@hotmail.com> writes:
>> Why bother with using canvas why not just use js to send the data
>> directly to the server?
>
> Canvas fingerprinting exploits subtle differences in the
> rendering of a text /on a canvas/. (But, AFAIK, it only
> applies to users who have enable JavaScript in their
> browser, so there's no need to worry.)
>
Sorry if my question was unclear. What advantage does using js with
canvas give over using js without canvas?

Andrew Poulos

ram

7/23/2014 6:27:00 AM

0

Andrew Poulos <ap_prog@hotmail.com> writes:
>On 23/07/2014 2:30 PM, Stefan Ram wrote:
>>Andrew Poulos <ap_prog@hotmail.com> writes:
>>>Why bother with using canvas why not just use js to send the data
>>>directly to the server?
>>Canvas fingerprinting exploits subtle differences in the
>>rendering of a text /on a canvas/. (But, AFAIK, it only
>>applies to users who have enable JavaScript in their
>>browser, so there's no need to worry.)
>Sorry if my question was unclear. What advantage does using js with
>canvas give over using js without canvas?

Did you know what it means to »render a text on a canvas«
(canvas = a raster graphics image) when you read my answer?

How would you detect in browser-JavaScript how a text is
rendered on a bitmap without a canvas?

Andrew Poulos

7/23/2014 7:48:00 AM

0

On 23/07/2014 4:26 PM, Stefan Ram wrote:
> Andrew Poulos <ap_prog@hotmail.com> writes:
>> On 23/07/2014 2:30 PM, Stefan Ram wrote:
>>> Andrew Poulos <ap_prog@hotmail.com> writes:
>>>> Why bother with using canvas why not just use js to send the data
>>>> directly to the server?
>>> Canvas fingerprinting exploits subtle differences in the
>>> rendering of a text /on a canvas/. (But, AFAIK, it only
>>> applies to users who have enable JavaScript in their
>>> browser, so there's no need to worry.)
>> Sorry if my question was unclear. What advantage does using js with
>> canvas give over using js without canvas?
>
> Did you know what it means to »render a text on a canvas«
> (canvas = a raster graphics image) when you read my answer?

Not precisely but
<https://developer.mozilla.org/en/docs/Drawing_text_using_a_...
implies that everything is done using js.

> How would you detect in browser-JavaScript how a text is
> rendered on a bitmap without a canvas?

If you "know" the canvas element already and the canvas is "filled"
using js why can't you just send the js to the server?

Andrew Poulos

Eli the Bearded

7/23/2014 6:43:00 PM

0

In comp.lang.javascript, Andrew Poulos <ap_prog@hotmail.com> wrote:
> If you "know" the canvas element already and the canvas is "filled"
> using js why can't you just send the js to the server?

Let's use an analogy. The "canvas" is a sheet of paper (hardware), drawn
on by a pen (hardware) in the user's hand (software). The "javascript"
is the directions for what to do.

If you just send the directions back, they look a whole lot like what
they did when they were first sent out.

If the user follows the directions to write some text on the sheet of
paper and then sends a photo of the results back, that's a lot closer
to the canvas fingerprinting scenario. The results in our example show
pen choice, paper choice, handwriting choice, etc.

In the real canvas fingerprint, the image itself is not sent to the
site, only some information (a "fingerprint") of the image. But it still
relies detecting on software and hardware variations in following
directions exactly. In this case the directions are specifically
selected to be likely to produce variations, things like blending
colored text on top of other colored text.

Elijah
------
http://www.browser... has a sample of the canvas test

Andrew Poulos

7/23/2014 10:39:00 PM

0

On 24/07/2014 4:43 AM, Eli the Bearded wrote:
> In comp.lang.javascript, Andrew Poulos <ap_prog@hotmail.com> wrote:
>> If you "know" the canvas element already and the canvas is "filled"
>> using js why can't you just send the js to the server?
>
> Let's use an analogy. The "canvas" is a sheet of paper (hardware), drawn
> on by a pen (hardware) in the user's hand (software). The "javascript"
> is the directions for what to do.
>
> If you just send the directions back, they look a whole lot like what
> they did when they were first sent out.
>
> If the user follows the directions to write some text on the sheet of
> paper and then sends a photo of the results back, that's a lot closer
> to the canvas fingerprinting scenario. The results in our example show
> pen choice, paper choice, handwriting choice, etc.
>
> In the real canvas fingerprint, the image itself is not sent to the
> site, only some information (a "fingerprint") of the image. But it still
> relies detecting on software and hardware variations in following
> directions exactly. In this case the directions are specifically
> selected to be likely to produce variations, things like blending
> colored text on top of other colored text.

Ah I think I get it now - there'll be more information than just what
can be generated with js.

Andrew Poulos