Running into canvas fingerprinting

Block early, block often

Recently there was some canvas fingerprinting concerns versus DuckDuckGo going viral (https://forums.whonix.org/t/duckduckgo-now-fingerprinting-visitors/6497)

After reading some more about it I noticed another forum post from 2013 where DDG was accused of the same thing, and DDG replied. So I thought it was looking slightly lame to blow up the same thing again after years.

Just being curious, I tried the canvasblocker add-on (https://addons.mozilla.org/en-US/firefox/addon/canvasblocker/) and noticed that several websites got a red flag with it, not just DDG but also Protonmail and Tutanota.

With the native Tor browser (Which I should use more often, Tor is not that slow at anymore nowadays) there were totally different results.

DDG gets a green light, just like Protonmail and Tutanota, but others get a warning.

By now I have probably checked more than 150 websites (Unfortunately I forgot that Tor browser had no browsing history otherwise I could have shared the whole list). Some results were surprising. Here are some websites that triggered Tor browser to give a warning.

Canvas warning for puri.sm

Canvas warning for wordpress.org

Canvas warning for blog.xs4all.nl

Canvas warning for drupal.org

Canvas warning for friendi.ca

Canvas warning for facebook.com

Canvas warning for US embassy

Canvas warning for edwardsnowden.com

Canvas warning for vimeo.com

Canvas warning for linkedin.com

Canvas warning for matrix.org

Canvas warning for discourse.org

Canvas warning for pine64.org

What did not surprise me was Facebook and LinkedIn.

Surprises were Purism, Pine64, Friendi.ca, Drupal, Matrix and Riot.im, as well as the Edward Snowden support site.

Perhaps worth mentioning is that the Israeli gov website blocked Tor with an extensive error message, almost a long poem, while the Turkish gov, Russian gov and CIA website did not bother about Tor usage.

For more info on canvas fingerprinting, see :

https://browserleaks.com/canvas