How to stop Canvas fingerprinting

[Tomminger]

Hello,

I want to stop canvas fingerprinting.

For this I have to inject some Javascript before all other javascripts are loading.

Are there any solutions for prevent canvas fingerprinting?

Regards Tom

[dilfich]

--disable-reading-from-canvas

[salvadordf]

Thank you Dilfich!

I just added a new property called GlobalCEFApp.DisableReadingFromCanvas that uses that switch.

If you find any other switch to avoid fingerprinting just let me know!

[Tomminger]

Hello,
ok "--disable-reading-from-canvas" is one way.
But the better way ist to modify the result of canvas.toDataURL.
First I want to know if a Page takes a canvas Fingerprint.
if that's the case I want to display and modify the image.
For this I have to overwrite the Javascript API.
Unfortunately, overriding these Canvas functions is not sufficient, since most canvas fingerprints are generated within iframe elements, which have their own scope and thus are not affected by the modifications to the JavaScript API. Fortunately, to execute JavaScript within these frames, their sandbox attribute needs to be set to “allow-scripts” in order to generate the canvas fingerprints.

Later I want to check the results here:

https://browserleaks.com/canvas


Or is it possible to install canvas-defender plugin?

https://chrome.google.com/webstore/deta ... opadkifnpm

Regards Tom

[salvadordf]

ok "--disable-reading-from-canvas" is one way.
But the better way ist to modify the result of canvas.toDataURL.
First I want to know if a Page takes a canvas Fingerprint.
if that's the case I want to display and modify the image.
For this I have to overwrite the Javascript API.
Unfortunately, overriding these Canvas functions is not sufficient, since most canvas fingerprints are generated within iframe elements, which have their own scope and thus are not affected by the modifications to the JavaScript API. Fortunately, to execute JavaScript within these frames, their sandbox attribute needs to be set to “allow-scripts” in order to generate the canvas fingerprints.
Later I want to check the results here:
https://browserleaks.com/canvas

I'm afraid I don't have enough JavaScript experience or deep V8 knowledge to answer that question.

Or is it possible to install canvas-defender plugin?
https://chrome.google.com/webstore/deta ... opadkifnpm

CEF only has partial browser extension support. It's still in development as you can see here :
https://bitbucket.org/chromiumembedded/ ... extensions

CEF4Delphi has all the classes and functions to load extensions but it probably needs some new component to show the extensions. I still haven't created a demo that loads extensions :
https://github.com/salvadordf/CEF4Delphi/issues/208

If you load "chrome://extensions-support/" in MiniBrowser you will see the APIs currently supported :
Supported Chrome Extensions APIs

• alarms
  • alarms.create
  • alarms.get
  • alarms.getAll
  • alarms.clear
  • alarms.clearAll
• contentSettings
  • contentSettings.clear
  • contentSettings.get
  • contentSettings.set
  • contentSettings.getResourceIdentifiers
• storage
  • storage.get
  • storage.set
  • storage.remove
  • storage.clear
  • storage.getBytesInUse
• tabs
  • tabs.get
  • tabs.create
  • tabs.executeScript
  • tabs.insertCSS
  • tabs.setZoom
  • tabs.getZoom
  • tabs.setZoomSettings
  • tabs.getZoomSettings

[dilfich]

https://github.com/joue-quroi/canvas-fi ... nt-blocker
https://raw.githubusercontent.com/joue- ... /inject.js

This script from the extension adds noise, surely there is a way to modify the script to use it for its intended purpose? I do not understand scripts, I can not load it.

[Tomminger]

Hello,

uhh, that are not good news to hear that cfe3 can not be protected for canvas fingerprinting.

More and more Websites use canvas fingerprinting to identify 100% Users/Browsers without Cookies. (Google,.....)

So I can not use my programs anymore.


OK on

https://github.com/joue-quroi/canvas-fi ... nt-blocker

I downloaded the plugin and in the manifest file stands:

"content_scripts": [{
"all_frames": true,
"matches": ["*://*/*"],
"match_about_blank": true,
"run_at": "document_start",
"js": [
"data/inject.js"
]
}],


This means that have to run the

data/inject.js"

Script at -> document_start

"run_at": "document_start",


Is there a way to do that with CEF4Delphi?


Regards Tom

[thefunkyjoint]

Thank you Dilfich!

I just added a new property called GlobalCEFApp.DisableReadingFromCanvas that uses that switch.

If you find any other switch to avoid fingerprinting just let me know!

Is this new option available on the current branch ?

[salvadordf]

Thank you Dilfich!

I just added a new property called GlobalCEFApp.DisableReadingFromCanvas that uses that switch.

If you find any other switch to avoid fingerprinting just let me know!

Is this new option available on the current branch ?

Yes. It's on the main branch at GitHub but if you use a previous release you can add this code before the GlobalCEFApp.StartMainProcess call in the DPR file :

Code: Select all

GlobalCEFApp.AddCustomCommandLine('--disable-reading-from-canvas');

[salvadordf]

OK on
https://github.com/joue-quroi/canvas-fi ... nt-blocker
I downloaded the plugin and in the manifest file stands:

"content_scripts": [{
"all_frames": true,
"matches": ["*://*/*"],
"match_about_blank": true,
"run_at": "document_start",
"js": [
"data/inject.js"
]
}],

This means that have to run the
data/inject.js"
Script at -> document_start
"run_at": "document_start",
Is there a way to do that with CEF4Delphi?

You can inject anything to the document using a "filter".

Read this thread for more information :
https://www.briskbard.com/forum/viewtop ... f=8&t=1006