Canvas Deceiver - A New Defense Mechanism Against Canvas Fingerprinting

Muath Obaidat, Suhaib Obeidat, Jennifer Holst, Taeho Lee

Browser fingerprinting refers to a collection of techniques used to gather information about a user’s browser attributes. The information gained from a browser fingerprint can be used to partially or fully identify a user without using any other technique, e.g., cookies. One type of browser fingerprinting is canvas fingerprinting which utilizes HTML-canvas elements to identify users. Various defense algorithms against canvas fingerprinting have been developed, but unfortunately, have been shown to be penetrable and detectable.

In this paper, we present Canvas Deceiver, a new countermeasure against canvas fingerprint. Canvas Deceiver is a browser extension that uses a new algorithm that is different from existing problem-possessing algorithms. Canvas Deceiver does not rely on randomness, does not provide a unique identity, and is not detectable. To show its functionality and effectiveness, we tested Canvas Deceiver using different tools that provide browser fingerprint tests. According to the test results, Canvas Deceiver outperforms current countermeasures in detectability while providing sufficient anonymity to its users. For instance, in Browserleaks, the user originally was put into a group with 634 people. After using Canvas Deceiver, he is put into a group with 7847 people.

Full Text