Telling a Fingerprinting Script Apart From a Page Saving Its Own Chart

Reading back a canvas is the classic first step of a device fingerprint. It’s also how a page turns a chart into an image you can download. So a canvas read on its own proves nothing. What matters is who made it.

This quiz page draws a bar chart of your answers and offers it as an image, which takes one canvas read by the page’s own code. It also loads a script from a fingerprinting vendor.

The made-up quiz page. Two canvas reads, from two different sites.

Reading the Lines

The panel shows four fingerprinting lines. “canvas by quiz.example” is the chart. The other three are all by fp-vendor.example: a canvas with text drawn for no visible reason, the graphics card’s name through WebGL, and an offline audio context. Three different signals from one script, followed by a beacon to the vendor’s server, is what a fingerprint looks like.

Watchkeeper names the site of the script that was running when each read happened, and only credits another site when the engine shows that site’s script was really loaded. It’s a strong hint, not proof of intent: a page can pass a reading function to a library it loads, and the library then gets the credit. The reference covers the cases where it can’t tell.

Try It

The quiz is one of Watchkeeper’s case study pages.