I ran a Canvas fingerprinting browser test and noticed that I am susceptible to Canvas fingerprinting in Firefox 66. This was a surprise to me, as I had read several announcements declaring that Firefox 58 introduced a prompt when sites attempt to read Canvas Fingerprint data. Has this feature been removed?

How can I change Firefox settings so that it will prompt me to request permission before providing read access to the HTML Canvas?

I see several Firefox addons which can impede Canvas fingerprinting. CanvasBlocker alters the Javascript APIs. Canvas Defender adds some random noise to prevent an enduring fingerprint. However, I would rather change a permission to prevent code from being run, rather than installing an addon which will run additional code.

This Superuser answer describes how Firefox stores site-specific Canvas permissions settings, and may be helpful. However, I am interested in changing the permission for all websites.

  • Uniqueness: 100% (0 of 425093 user agents have the same signature) - Is this good or bad..? – DxTx Mar 22 '19 at 18:57
  • @DxTx. It means you are 100% unique, no other browser tested has the same identifiers as you, and so you can be tracked without being confused with anyone else. – sondra.kinsey Mar 22 '19 at 19:53
  • Awesome. I have installed CanvasBlocker and still, I'm 100% unique. So, the addon doesn't seem to be working, then. (Also, tried with Canvas Defender. Same result). You can disable privacy.resistFingerprinting. But if you do, there are some issues that you have to face. For example, the Firefox browser won't start in full size. Some addon doesn't work, etc. – DxTx Mar 22 '19 at 20:04
  • @DxTx That is not how those are supposed to work. In the default setting, CanvasBlocker (and, presumably, Canvas Defender) will spoof a new fingerprint every time a page loads. This means that you can be identified as a unique visitor, but not tracked across multiple visits, because your fingerprint will be unique each time. – Entropy0 Mar 25 '19 at 18:37
  • @DxTx: Entropy0 is right. It's not uniqueness that's the problem so much as persistent uniqueness. It's okay to be a the only person on the block in a tiger suit as long as you don't wear the same tiger suit next time you return. – sondra.kinsey Mar 25 '19 at 18:43

The setting you are looking for is privacy.resistFingerprinting.

Though be aware that setting this to true also renders some websites that heavily utilize the canvas defunct (in my experience this mainly affects browser games, but YMMV). If you run into any trouble with this, CanvasBlocker set to block mode "fake" is probably your best bet.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.