As a marketer I like the technique. It is difficult to allocate funds to different advertising buckets if you can't track sales. To all those using the internet, Caveat Emptor! You best use a proxy service if you don't want to be tracked. Using the Internet is not anonymous. It never was, for the average user.

As a marketer I like the technique. It is difficult to allocate funds to different advertising buckets if you can't track sales. To all those using the internet, Caveat Emptor! You best use a proxy service if you don't want to be tracked. Using the Internet is not anonymous. It never was, for the average user.

Other viewpoints, please.

Does this mean that MSIE<9 has now vanished off the face of the earth?

:: detour to caniuse dot com ::

83% US, 88.5% world (figures for support of "canvas" element).

They can’t be prevented by using standard web browser privacy settings or using anti-tracking tools such as AdBlock Plus.

Right. Canvas-based methods can only be prevented by the obscure, little-used mechanism of turning off javascript.

>Other viewpoints

You might be relieved to know that there's effort involved by some browsers to detect this kind of thing and prevent fingerprinting.

Tor Browser can manage to reduce your uniqueness to 1 in 10,000 people. This is just one of many ways to uniquely identify people. I don't think the problem will go away any time soon.

In case you're wondering how and why this works, roughly, the <canvas> element allows you, via javascript, to render a "picture" on the browser side by rendering some text in a specific font.

Because of the wide range of operating systems, browsers, installed fonts, installed video cards, local settings, etc...that picture has a high level of uniqueness. Enough that it can serve as a "fingerprint" of that specific device.

More detail here: [cseweb.ucsd.edu...]

If you really want to see tracking, install Google Earth (not maps) and then turn on the "traffic" layer, click on one of the green dots on a major highway and then click on the resultant dot explosion to see the real time speed (actually probably the velocity) of the individual automobiles. Google only shows data on major highways, but it's reasonable to believe Google can track all those vehicles to their "home" location and destination. And since, many, many, people have cable modems with static IP's, think of the information Google can extrapolate. Smartphone connects to modem through wifi, and then, let the correlations begin!
All because Google maps is installed in so many smartphones! I told a buddy about this who drives a good distance to work and he immediately deleted Google maps from his phone.

You best use a proxy service

I believe this canvas technique would defeat a proxy.

I think it has been mentioned a few times above, but it doesn't hurt to say it once again: No javascipt, no canvas. All browsers (even the old ones) allow turning JS off. And a growing number of folks out there are getting a clue in this regard.

Canvas doesn't care what your IP is. It's essentially a javascript-based process.

Question:

Wouldn't it then be easy to have a browser based plugin that draws a new image with randomizations to the image on each page reload?

Would that not defeat the canvas tracker while still allowing the user to keep javascript enabled?

Has anyone tried disabling javascript for any length of time? Does the internet still work?

Notice none of the stories (which the majority are reprints) don't detail the technology. This is a classic fear monger story that works on peoples privacy fears.

The "images" are all server from the same js from an ad or widget server. Block that server in adblock or other adblocking software and it is gone:

'Canvas fingerprinting' online tracking is sneaky but easy to halt
“As soon as you start talking about millions of users (e.g. if you want to track users across multiple websites) it is just too likely that different users will have exactly the same configuration and won’t be distinguishable by means of canvas fingerprinting,” he wrote.

Widgets such as AddThis can be entirely blocked with tools such as AdBlock Plus or DoNotTrackMe from Abine, both extensions that can block web trackers.

[pcworld.com...]

Has anyone tried disabling javascript for any length of time? Does the internet still work?

About nine years, most recently with NoScript. Works fine! Web that is. On sites that demand JS I take a look. Most usually I do a gentle piss off and go elsewhere. That said...

I am NOT the average user. But I am the guy who is educating 10 to 15 every day. I suspect that two or three are enlightened by each of those and they are doing the same, multiplying... growing_.

Only time JS is really needed is to work a cart these days. For that to happen your product has got to be singular and compelling.

For me, the best part is the web is quiet... not targeted ads, no tracking, no canvas (see other here at WW in that regard)... Nice and clean, the way it SHOULD be...

YMMV