BriskBard, CEF4Delphi, WebView4Delphi, WebUI4Delphi and WebUI4CSharp

The forum for BriskBard users and CEF4Delphi / WebView4Delphi / WebUI4Delphi / WebUI4CSharp developers
http://www.briskbard.com/forum/

How to stop Canvas fingerprinting

http://www.briskbard.com/forum/viewtopic.php?t=1007

Page 1 of 1

How to stop Canvas fingerprinting

Posted: Sun Oct 27, 2019 10:02 pm
by Tomminger
Hello,

I want to stop canvas fingerprinting.

For this I have to inject some Javascript before all other javascripts are loading.

Are there any solutions for prevent canvas fingerprinting?

Regards Tom

Re: How to stop Canvas fingerprinting

Posted: Mon Oct 28, 2019 5:50 am
by dilfich
--disable-reading-from-canvas

Re: How to stop Canvas fingerprinting

Posted: Mon Oct 28, 2019 8:59 am
by salvadordf
Thank you Dilfich!

I just added a new property called GlobalCEFApp.DisableReadingFromCanvas that uses that switch.

If you find any other switch to avoid fingerprinting just let me know! :D

Re: How to stop Canvas fingerprinting

Posted: Mon Oct 28, 2019 9:53 am
by Tomminger
Hello,
ok "--disable-reading-from-canvas" is one way.
But the better way ist to modify the result of canvas.toDataURL.
First I want to know if a Page takes a canvas Fingerprint.
if that's the case I want to display and modify the image.
For this I have to overwrite the Javascript API.
Unfortunately, overriding these Canvas functions is not sufficient, since most canvas fingerprints are generated within iframe elements, which have their own scope and thus are not affected by the modifications to the JavaScript API. Fortunately, to execute JavaScript within these frames, their sandbox attribute needs to be set to “allow-scripts” in order to generate the canvas fingerprints.

Later I want to check the results here:

https://browserleaks.com/canvas


Or is it possible to install canvas-defender plugin?

https://chrome.google.com/webstore/deta ... opadkifnpm

Regards Tom

Re: How to stop Canvas fingerprinting

Posted: Mon Oct 28, 2019 1:40 pm
by salvadordf
Tomminger wrote: Mon Oct 28, 2019 9:53 am ok "--disable-reading-from-canvas" is one way.
But the better way ist to modify the result of canvas.toDataURL.
First I want to know if a Page takes a canvas Fingerprint.
if that's the case I want to display and modify the image.
For this I have to overwrite the Javascript API.
Unfortunately, overriding these Canvas functions is not sufficient, since most canvas fingerprints are generated within iframe elements, which have their own scope and thus are not affected by the modifications to the JavaScript API. Fortunately, to execute JavaScript within these frames, their sandbox attribute needs to be set to “allow-scripts” in order to generate the canvas fingerprints.
Later I want to check the results here:
https://browserleaks.com/canvas
I'm afraid I don't have enough JavaScript experience or deep V8 knowledge to answer that question.
Tomminger wrote: Mon Oct 28, 2019 9:53 am Or is it possible to install canvas-defender plugin?
https://chrome.google.com/webstore/deta ... opadkifnpm
CEF only has partial browser extension support. It's still in development as you can see here :
https://bitbucket.org/chromiumembedded/ ... extensions

CEF4Delphi has all the classes and functions to load extensions but it probably needs some new component to show the extensions. I still haven't created a demo that loads extensions :
https://github.com/salvadordf/CEF4Delphi/issues/208

If you load "chrome://extensions-support/" in MiniBrowser you will see the APIs currently supported :
Supported Chrome Extensions APIs
  • alarms
    • alarms.create
    • alarms.get
    • alarms.getAll
    • alarms.clear
    • alarms.clearAll
  • contentSettings
    • contentSettings.clear
    • contentSettings.get
    • contentSettings.set
    • contentSettings.getResourceIdentifiers
  • storage
    • storage.get
    • storage.set
    • storage.remove
    • storage.clear
    • storage.getBytesInUse
  • tabs
    • tabs.get
    • tabs.create
    • tabs.executeScript
    • tabs.insertCSS
    • tabs.setZoom
    • tabs.getZoom
    • tabs.setZoomSettings
    • tabs.getZoomSettings

Re: How to stop Canvas fingerprinting

Posted: Tue Oct 29, 2019 9:02 am
by dilfich
https://github.com/joue-quroi/canvas-fi ... nt-blocker
https://raw.githubusercontent.com/joue- ... /inject.js

This script from the extension adds noise, surely there is a way to modify the script to use it for its intended purpose? I do not understand scripts, I can not load it. :(

Re: How to stop Canvas fingerprinting

Posted: Tue Oct 29, 2019 11:47 am
by Tomminger
Hello,

uhh, that are not good news to hear that cfe3 can not be protected for canvas fingerprinting.

More and more Websites use canvas fingerprinting to identify 100% Users/Browsers without Cookies. (Google,.....)

So I can not use my programs anymore. :o


OK on

https://github.com/joue-quroi/canvas-fi ... nt-blocker

I downloaded the plugin and in the manifest file stands:

"content_scripts": [{
"all_frames": true,
"matches": ["*://*/*"],
"match_about_blank": true,
"run_at": "document_start",
"js": [
"data/inject.js"
]
}],


This means that have to run the

data/inject.js"

Script at -> document_start

"run_at": "document_start",


Is there a way to do that with CEF4Delphi?


Regards Tom

Re: How to stop Canvas fingerprinting

Posted: Tue Oct 29, 2019 11:57 am
by thefunkyjoint
salvadordf wrote: Mon Oct 28, 2019 8:59 am Thank you Dilfich!

I just added a new property called GlobalCEFApp.DisableReadingFromCanvas that uses that switch.

If you find any other switch to avoid fingerprinting just let me know! :D
Is this new option available on the current branch ?

Re: How to stop Canvas fingerprinting

Posted: Tue Oct 29, 2019 1:11 pm
by salvadordf
thefunkyjoint wrote: Tue Oct 29, 2019 11:57 am
salvadordf wrote: Mon Oct 28, 2019 8:59 am Thank you Dilfich!

I just added a new property called GlobalCEFApp.DisableReadingFromCanvas that uses that switch.

If you find any other switch to avoid fingerprinting just let me know! :D
Is this new option available on the current branch ?
Yes. It's on the main branch at GitHub but if you use a previous release you can add this code before the GlobalCEFApp.StartMainProcess call in the DPR file :

Code: Select all

GlobalCEFApp.AddCustomCommandLine('--disable-reading-from-canvas');

Re: How to stop Canvas fingerprinting

Posted: Tue Oct 29, 2019 1:29 pm
by salvadordf
Tomminger wrote: Tue Oct 29, 2019 11:47 am OK on
https://github.com/joue-quroi/canvas-fi ... nt-blocker
I downloaded the plugin and in the manifest file stands:

"content_scripts": [{
"all_frames": true,
"matches": ["*://*/*"],
"match_about_blank": true,
"run_at": "document_start",
"js": [
"data/inject.js"
]
}],

This means that have to run the
data/inject.js"
Script at -> document_start
"run_at": "document_start",
Is there a way to do that with CEF4Delphi?
You can inject anything to the document using a "filter".

Read this thread for more information :
https://www.briskbard.com/forum/viewtop ... f=8&t=1006
All times are UTC
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited