privacytools / privacytools.io

🛡🛠 You are being watched. Protect your privacy against global mass surveillance.
https://www.privacyguides.org
Creative Commons Zero v1.0 Universal
3.12k stars 384 forks source link

❌ Software Removal | Remove CanvasBlocker from Firefox Addon under Browser Fingerprint. #1877

Closed cryptocat8 closed 4 years ago

cryptocat8 commented 4 years ago

Let it be short, I guess Firefox already have Canvas Blocking inbuilt, so why do we need any extension like that?

dngray commented 4 years ago

It could be useful for people who want to allow canvases for some sites but not all.

ph00lt0 commented 4 years ago

i agree with @dngray. Either way I might be good to emphasis that with the right settings this is already been blocked.

cryptocat8 commented 4 years ago

I guess, Firefox already give full control that you want to block canvas fingerprinting or not.

ThracianKnight1907 commented 4 years ago

CanvasBlocker can do much more than just block canvas fingerprinting, like, for example, spoofing that info. It also supports more APIs than just canvas.

Also, Firefox's fingerprinter protection is a blocklist for tracking domains which are known to use fingerprinting (i think). This is different than CanvasBlocker's approach

Thorin-Oakenpants commented 4 years ago

Firefox's fingerprinter protection is a blocklist for tracking domains which are known to use fingerprinting (i think)

Just FYI: ETP's "fingerprinters" is a curated list from OpenWMP crawls and some other sources/partners. OpenWMP crawls only gets 3rd party scripts, and the crawls (last time I checked) only checked the landing page (Alexa top 1M or something: but they can change the number). And the detection is somewhat limited. That said, the list is growing and nailing the most common 5-10% of FP scripts probably accounts for 80% of the damage in the wild :)


as @ThracianKnight1907 points out... CanvasBlocker does MOAR stuff

technically, it has solutions that others don't, and @kkapsner is very thorough and knowledgeable, including not leaking the application of the spoof, and covering all the API methods and all sources (all types of workers including from blobs and nested, iframes including nested, etc). Note: sometimes it depends on the web ext apis

None of these (except canvas, edit: and screen) is covered by RFP. audio has some RFP but not in the areas CB is spoofing. If anything, this is about the only anti-FPing extension you should be promoting - probably under an "advanced" section: because it can break sites (but you can whitelist per site, per api) - edit: e.g. I would pair it with uMatrix