Canvas Fingerprinting Is More Invasive Than Cookies. But Should You Worry About It?

The Citizen's Guide to the Future
July 24 2014 5:59 PM

Canvas Fingerprinting Is More Invasive Than Cookies. But Should You Worry About It?

cookies2
AddThis is lurking among the YouTubes and Pinterests of the cookie world.

Screencap from whitehouse.gov.

Cookies have been around since the ’90s Internet, so it’s not surprising that after all these years there’s a new game in town. But it’s concerning that the new tracking apparatus, canvas fingerprinting, was called “virtually impossible to block” by ProPublica's Julia Angwin. And now the Internet is responding.  

Lily Hay Newman Lily Hay Newman

Lily Hay Newman is lead blogger for Future Tense.

Canvas fingerprinting uses a script to render an extra and invisible part of a webpage along with the regular site you’re looking for. The extra piece is there specifically to evaluate minor things about your computer that your system reveals in the process of loading the site. They're little things like which browser you’re using and which version of it you're running, but when enough of them are put together, says Angwin, they can turn into a unique profile or fingerprint, and then companies can use this identifier to track your browsing.

Advertisement

A service called AddThis is primarily responsible for the advent of canvas fingerprinting, and according to ProPublica, certain high-traffic sites—even WhiteHouse.gov—use AddThis. Many of them probably didn't even really know what AddThis did before the ProPublica story. Since publication of the piece, YouPorn, another big site that used AddThis, has already said that it has discontinued using the tracking service. And the Electronic Frontier Foundation points out that AddThis's functionality violates the White House's own cookie-related privacy policy.

But maybe it’s not even worth fighting canvas fingerprinting. Internet filtering company AdBlock Plus, which was mentioned in the ProPublica article, posted a blog post by lead developer Wladimir Palant on Wednesday that argues that canvas fingerprinting is doomed to fail because sheer volume of users should stymie the approach. He explains that canvas fingerprinting uses available information about users' graphics drivers, browsers, operating systems, and other parameters to identify them on different sites based on their system's unique combination of attributes. But he notes that even if a tracker looks at tons of criteria, it’s pretty likely that groups of people will have the same combinations. Palant says,

All this taken into account, my guess is that canvas fingerprinting can work to identify users on smaller websites with a fairly stable community. However, as soon as you start talking about millions of users (e.g. if you want to track users across multiple websites), it is just too likely that different users will have exactly the same configuration and won’t be distinguishable by means of canvas fingerprinting.

Palant also cites problems with canvas fingerprinting that the ProPublica article itself brings up, like the fact that canvas fingerprinting doesn’t work so well for tracking mobile users. Even AddThis is skeptical  continuing to use the approach. But if that doesn’t satisfy your concerns about canvas fingerprinting, Palant suggests using AddBlock Plus (naturally) and its EasyPrivacy filter list as a way of ensuring anonymity. The Electronic Frontier Foundation says that its Privacy Badger plugin can also help you go off the canvas fingerprinting grid.

Angwin says that Palant isn’t quite getting the point. “I don't think you should dismiss every threat just because it doesn't seem effective,” she said. If companies are tracking you, it’s worthwhile to know how, and what you can do about it, instead of passively allowing it. But Angwin says she is heartened by the large response to her piece. “It reminded me that people still do care about this stuff,” she said.

Future Tense is a partnership of SlateNew America, and Arizona State University.

Lily Hay Newman is lead blogger for Future Tense.

TODAY IN SLATE

Sports Nut

Grandmaster Clash

One of the most amazing feats in chess history just happened, and no one noticed.

The Extraordinary Amicus Brief That Attempts to Explain the Wu-Tang Clan to the Supreme Court Justices

Amazon Is Officially a Gadget Company. Here Are Its Six New Devices.

Do the Celebrities Whose Nude Photos Were Stolen Have a Case Against Apple?

The NFL Explains How It Sees “the Role of the Female”

Future Tense

Amazon Is Now a Gadget Company

Food

How to Order Chinese Food

First, stop thinking of it as “Chinese food.”

Scotland Is Inspiring Secessionists Across America

The Country Where Women Aren’t Allowed to Work Once They’re 36 Weeks’ Pregnant

The XX Factor
Sept. 18 2014 11:40 AM The Country Where Women Aren’t Allowed to Work Once They’re 36 Weeks’ Pregnant
Moneybox
Sept. 17 2014 5:10 PM The Most Awkward Scenario in Which a Man Can Hold a Door for a Woman
  News & Politics
The World
Sept. 18 2014 1:34 PM Americans Fault Obama for Giving Them Exactly the Anti-ISIS Strategy They Want
  Business
Moneybox
Sept. 18 2014 2:18 PM The NFL Is Not a Nonprofit So why does it get to act like one?
  Life
Doonan
Sept. 18 2014 2:00 PM On the Death of My Homophobic Dog I named him Liberace, but I couldn’t have chosen a less appropriate namesake for this coarse, emotionally withholding Norwich terrier.
  Double X
The XX Factor
Sept. 18 2014 12:03 PM The NFL Opines on “the Role of the Female”
  Slate Plus
Behind the Scenes
Sept. 18 2014 1:23 PM “It’s Not Everyday That You Can Beat the World Champion” An exclusive interview with chess grandmaster Fabiano Caruana.
  Arts
Brow Beat
Sept. 18 2014 2:03 PM Ryan Adams’ New Song Is a Reminder That He’s One of His Generation’s Best Songwriters
  Technology
Future Tense
Sept. 18 2014 1:24 PM Can the Celebrities Whose Photos Were Stolen Really Sue Apple? It may be harder to prove “harm” than it seems.
  Health & Science
Bad Astronomy
Sept. 18 2014 7:30 AM Red and Green Ghosts Haunt the Stormy Night
  Sports
Sports Nut
Sept. 18 2014 11:42 AM Grandmaster Clash One of the most amazing feats in chess history just happened, and no one noticed.