How canvas fingerprint blockers make you easily trackable

Thought your canvas fingerprint blocker made you incognito? Think again.

As many know, canvas fingerprinting is the most recent development in web tracking. In the past, the easiest way to prevent web tracking was to block out the tracking method entirely. For example, you could disable cookies in your browser to prevent cookie tracking. But when it comes to canvas fingerprinting, things are not so cut-and-dry.

Believe it or not, using a canvas fingerprint blocker can make you more trackable. That statement defies common sense, but it’s true. By disabling the functionality of the HTML5 canvas element, it can inadvertently make you stand out instead of ensuring anonymity.

In this article we will explore canvas fingerprinting and how it operates. Additionally, you will understand what canvas fingerprint blockers are and see why they don’t work. In conclusion, we will introduce the only modern and effective method to combat canvas fingerprint tracking: utilizing a hashing function to generate a unique hash code for the user's browser.

The essence of fingerprinting

Browser fingerprinting involves extracting and using your browser's attributes to construct a unique tracking profile for you, or more accurately, for your computer. This technique aims to distinguish individuals by gathering and analyzing data from their browsers.

Let's consider a scenario where we have a total of 1,000,000 visitors.

60% of these visitors use Chrome and 40% use Firefox, resulting in two distinct groups within our audience.

Within these groups, each visitor will be using a different browser version – and that is another fingerprint. If we exist in an alternate universe with only three versions of Firefox, our 40% group is now split into three groups of 13.3% each.

Fingerprints continue to build on one another until visitors are categorized into very specific groups. The 1,000,000 visitors may be grouped into hundreds or thousands of smaller categories. Once you are in a group, website owners can easily track you.

However, a drawback of traditional fingerprinting is that it might not give websites dealing with enormous volumes of data enough granularity. There are only so many possible fingerprints, and when dealing with heavy traffic, categorized groups frequently grow too big to be of any real use.

That’s when canvas fingerprinting comes into play.

Like fingerprinting, but infinitely more powerful

Canvas fingerprinting relies on the Canvas HTML5 element, which allows the browser to “draw” an image onto a web page.

Computers generate different images based on particular browser and operating system attributes. For example, different browsers will use different image-processing engines. Different operating systems will use different sub-pixel rendering engines. Et cetera, et cetera.

Many factors influence browser and operating system levels when generating a canvas image. They all work together to create a specific image and put you into a very small group.

When the image you generate is combined with ordinary fingerprint tracking, canvas fingerprinting can put you into an even smaller group. Sometimes, it can separate groups so effectively that each “group” becomes an individual. That’s the ultimate goal.

Hence, it is understandable why many users are particularly concerned about preventing canvas fingerprinting. Unlike traditional tracking methods such as cookies, canvas fingerprinting goes beyond mere tracking and can actually identify you as an individual.

But stopping it is harder than meets the eye.

Canvas fingerprint blocking tactics – and why they don’t work

There are two primary ways to block canvas fingerprinting. Each one is equally ineffective.

Preventing canvas fingerprinting entirely

Your first instinct is probably to grab a browser extension that prevents the canvas image from loading. If it doesn’t load, they can’t track you – right?

Wrong. Preventing the canvas image from loading is an identifier in itself. Although the canvas fingerprint will not be sent, the fact that you did not load the canvas image will be.

So, you will be sorted into a very small group of tech-savvy users who also block fingerprints. From there, sometimes, your ordinary fingerprints will be enough to identify you.

To visualize how this works, imagine you are standing in a crowd. Not caring about canvas fingerprinting is like you’re just standing there smiling.

Having a canvas fingerprint blocker is like standing there with a mask. No one is sure who you are exactly, but you’re the only one wearing a mask. Even if a few other people wear them too, all of you still will be grouped as “the people wearing masks.”

This approach would be effective if everyone used canvas fingerprint blockers (or wore masks, as in our example). But as it stands, almost no one uses them. Heck, it’s estimated that only 5 to 10% of web users utilize an ad blocker. The percentage of canvas fingerprint blockers must be a small fraction of that, and that’s not a big enough group to blend into – far from it.

Submitting random canvas fingerprints

Using different fingerprints for every request doesn’t work for the same reason as submitting no fingerprint. Regular visitors typically do not alter their fingerprints within a session. Therefore, if you deviate from this pattern, it becomes an unusual behavior that can classify you into an atypical group.

In our example, submitting a random canvas fingerprint is like changing your outfit every 10 seconds. On the first request, you look normal. But if you change your outfit 10 seconds later, even though you’re not wearing a mask, you will stand out. Similar to how people typically don't change their outfits multiple times within a day, regular users do not commonly switch between different canvas fingerprint identities within a single browsing session.

The only viable solution that exists

While it's true that most web users may not feel the need to go through the effort of blocking canvas fingerprinting, experienced users who prioritize their privacy have found a solution – and that is Multilogin.

With Multilogin you can:

• Make canvas fingerprinting available on the websites you visit (so it’s not clear you are wearing a mask).

• Use a canvas identity with consistency (so it’s not clear you are trying to avoid detection).

• Switch up the identity when necessary (to erase your tracks).

You are still being tracked – that’s unavoidable. But you control the tracking. When you change your fingerprint, you destroy any evidence of your browsing history on the other fingerprint.

You wipe the slate clean. And because you consistently used the old fingerprint, you have not been sorted into an irregular group and tracked like that. No one can recognize that you wiped the slate clean in the first place.

Whew! We hope you stuck with us through that lengthy explanation. Canvas fingerprinting is rising, and “blockers” or “random submitters” will not keep you safe. They will make you more easily trackable.

And now you know why.