search

whotracksme / whotracks.me

Data from the largest and longest measurement of online tracking.
https://www.ghostery.com/whotracksme
MIT License
413 stars 73 forks source link

Canvas fingerprinting warning. #54

Open konark-cliqz opened 6 years ago

konark-cliqz commented 6 years ago

When whotracks.me is opened with privacy.resistFingerprinting or in Tor browser (with JS allowed), it throws a warning related to canvas fingerprinting.

cliqz-warning

tor-warning

ecnmst commented 6 years ago

@konark-cliqz We use the html canvas to generate the tag cloud on a tracker's profile, which is the only kind of page you will get the warning in. Everything is done on the client, I can't see any privacy implications of this. Here's the implementation: https://github.com/cliqz-oss/whotracks.me/blob/master/templates/components/tag_cloud.html

I'm afraid there is not much we can do here except exploring different ways for generating something similar to what we have. Temporarily leaving the issue open for suggestions or PRs.

acatarineu commented 6 years ago

Just for reference, according to https://github.com/mozilla/pdf.js/issues/7026 this gets triggered when one of these canvas APIs get used (potentially allowing fingerprinting):

It seems there is usage in d3.layout.cloud.js and plotly.js, not sure how feasible/worth is it to avoid using these functions.