Canvas fin­ger­print­ing: the cookie successor

The idea of fin­ger­print-based online tracking was first thought up by Keaton Mowery and Hovav Shacham, employees at the Uni­ver­si­ty of Cal­i­for­nia, in their 2012 work ‘Pixel Perfect: Fin­ger­print­ing Canvas in HTML5’. In the pub­li­ca­tion, they present their idea: that in­di­vid­ual fin­ger­prints based on the system con­fig­u­ra­tions of a web user can be easily generated with help from HTML5 imported canvas elements. Inspired by the work of these two re­searchers, the Russian pro­gram­mer Valentin Vasilyev developed and released a first example of a Canvas fin­ger­print code under an open source license on GitHub. His code served as the basis for companies like AddThis and Ligatus to finally realize this tracking tech­nol­o­gy.

The canvas elements mentioned above are actually defined areas (height and width) which can be drawn in using JavaScript to create graphics, logos, and buttons with text. But com­bi­na­tions of the following hardware/software are often unique:

• Operating system
• Browser
• Graphics card
• Graphics card driver
• Installed client fonts

These com­po­nents ensure that each text will turn out slightly dif­fer­ent­ly, which is what enables canvas fin­ger­print­ing. All that a website operator needs to carry out this internet tracking is the specific canvas fin­ger­print code, which then causes the browser to display a hidden text in the back­ground via JavaScript as the page is loading. This hidden text is then forwarded on to the website’s web server. Due to the many features involved, the digital fin­ger­print created in this way is unique in over 80% of cases, meaning it can be rec­og­nized every time – as long as the user doesn’t make changes to their enu­mer­at­ed system con­fig­u­ra­tions.

A canvas fin­ger­print basically only contains in­for­ma­tion about systems and browsers. But this is already enough to identify website visitors as in­di­vid­u­als and so to track their surfing behavior from then on. This could simply mean tracking a user’s activity on your own website, but it’s also possible to track them on several websites, provided the script is im­ple­ment­ed on different webpages. This form of online tracking is useful for website op­ti­miza­tion and es­pe­cial­ly in­ter­est­ing for con­cep­tu­al­iz­ing targeted ad­ver­tis­ing. A big plus point of this modern user tracking method is that it doesn’t involve col­lect­ing personal data from users, making fin­ger­print tracking a serious al­ter­na­tive to cookies for web analysts. Cookies are con­sid­ered legally ques­tion­able and are de­lib­er­ate­ly blocked or regularly deleted by lots of users.

But digital fin­ger­prints do differ from human fin­ger­prints in that they’re not 100% unique, meaning that results from canvas fin­ger­print­ing aren’t always trust­wor­thy. For example, two website visitors with the same con­fig­u­ra­tions will receive the same user ID, creating problems for visitor analysis. Since the chances of this happening increase with the amount of users visiting a website, canvas fin­ger­print­ing is naturally less effective for larger sites with higher traffic. Users of mobile devices create a further problem for fin­ger­print internet tracking: the hardware and software used by tablets and smart­phones are usually too stan­dard­ized for canvas fin­ger­print­ing, with too few dis­tin­guish­ing features to generate enough unique fin­ger­prints. 

Unlike cookies, canvas fin­ger­prints can’t simply be deleted because the data is shared directly to the server – there isn’t any storing on the client side. Using an incognito mode on your browser won’t stop this tracking technique either, as the canvas script and system/browser in­for­ma­tion is still shared. But users aren’t com­plete­ly helpless to stop this tracking method. It’s possible for you to prevent the scripts from running in advance. This can be achieved using the following measures:

• De­ac­ti­va­tion of your JavaScript: without a JavaScript, the canvas elements can’t load and so no client in­for­ma­tion can be loaded either. But un­for­tu­nate­ly this can affect your browser per­for­mance: since many websites contain JavaScript, you may find that these are no longer displayed correctly with the JavaScript disabled.
  
  
• Adblock Plus: Adblock Plus is best known as a browser extension used to block ads, par­tic­u­lar­ly pop-ups. But by combining this free tool with the filter list EasyPri­va­cy, you can protect yourself against advanced fin­ger­print tracking online.
  
  
• Can­vas­Block­er: Firefox users can download the free add-on Can­vas­Block­er and receive advanced settings and options for blocking canvas fin­ger­print­ing. For example, it’s possible to either simply ignore all canvas requests, or to ma­nip­u­late the data trans­mit­ted in order to make sure that every fin­ger­print given is different. 

When the 2014 list of websites using canvas fin­ger­print­ing scripts was published, there were even some website operators who were surprised that they fell into the category of companies using canvas fin­ger­print­ing – as they hadn’t im­ple­ment­ed the tracking technique them­selves. One notable case in Europe centered on Ligatus, a German company operating out of Cologne. This digital marketing firm had failed to properly clarify what canvas fin­ger­print­ing was and how it worked to their numerous clients, including popular German websites like kicker.de, golem.de, and n-tv.de. According to a statement from the per­for­mance agency, they had been running a limited trial of the technique, for which they were only col­lect­ing anonymous in­for­ma­tion from pre-de­ter­mined users and ensured that this in­for­ma­tion wasn’t being shared anywhere else. But the majority of websites involved – again, some un­know­ing­ly – were using the tracking code of the US firm AddThis, famous for its embedding of social media buttons for websites.

But a more pressing and serious issue than the ignorance of website operators is the lack of in­for­ma­tion made available to website visitors. For internet users, we strongly recommend that you fa­mil­iar­ize yourself with what canvas fin­ger­print­ing is, before deciding whether or not you wish to block it (see above). And if you’re con­sid­er­ing im­ple­ment­ing the canvas fin­ger­print­ing technique for your company web presence, be sure to research the rules for your country and inform your site visitors that you’re using this method of online tracking, so they have the option to leave your site or hide their canvasses if they wish.