-
-
Notifications
You must be signed in to change notification settings - Fork 380
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Investigate blocking or mitigating fingerprintjs #1418
Comments
I think you want fingerprintjs2 for the more recent github repo, too. |
If they do canvas fingerprinting, they should trigger existing canvas fingerprinting detection. |
I suggest we confirm that we do indeed catch it via canvas, and then replace this issue with more specific feature suggestions. This to me reads like "Privacy Badger should detect browser fingerprinting", which isn't so helpful. |
I set a breakpoint in the Looking at fingerprintjs2's current canvas fingerprinting approach, it should definitely be detecting more instances of canvas-related functions. I'm not super familiar with |
I am not sure what you mean by "instances". What happens if you take the Fingerprintjs2 script, make a demo page using it, and visit the page with Privacy Badger? Does Privacy Badger report tracking by the script's domain? You could also try to find these scripts in the wild via |
We detect canvas fingerprinting using a simple behavioral heuristic: If we have a canvas "write" ( |
A couple of add-ons for ideas. ScriptSafe for Chrome (fingerprinting) github |
@ghostwords Sorry, "instances" above turned out to be a red herring. Took another look and on the fingerprintjs2 page I'm not sure why @cowlicks As far as blocking is concerned, I wonder what we might be able to use from Brave. |
|
It is interesting that there is a duplication of effort here. Maybe we can work together with brave to move Fingerprint blocking/detection into its own library to make collaboration and development easier. |
Check out #1505 if you are interested, it will close this issue. |
This issue should already be close-able. As I wrote above, "If they do canvas fingerprinting, they should trigger existing canvas fingerprinting detection." |
@ghostwords fingerprintjs2, augur.io, and likely other fingerprinting tools, use numerous vectors for fingerprinting. They are configurable so that users can choose which types of fingerprinting they want. Some sites might not use canvas fingerprinting detection, especially if they want to avoid detection by Privacy Badger. Both fingerprintjs2 and augur.io aggregate results from fingerprinting vectors. I reckon this is because the more vectors that get used, the more unique the fingerprint is likely to be. The technique used #1505 leverages this by monitoring many fingerprinting vectors. So as a fingerprinter tries to make its results more unique, the more likely it is to be detected. |
I added a basic canvas fingerprinting test using Fingerprintjs2 as part of #1678. While it's true that you could configure Fingerprintjs2 to exclude canvas fingerprinting ( |
#1505 is an interesting approach for heuristically detecting suspicious JS activity for us to explore in the future. #1527 to me presents the more urgent issue of figuring out what exactly we should learn to block when we detect non-cookie-based tracking ( I don't think we need to keep this issue open at this time, as per my previous comment. |
Their github: https://github.com/Valve/fingerprintjs
//cdn.jsdelivr.net/fingerprintjs2/<VERSION>/fingerprint2.min.js
The text was updated successfully, but these errors were encountered: