this post was submitted on 07 Feb 2024
29 points (96.8% liked)

Firefox

17587 readers
258 users here now

A place to discuss the news and latest developments on the open-source browser Firefox

founded 4 years ago
MODERATORS
k_o_t@lemmy.ml
29
Will allowing HTML5 Canvas data in RFP fallback to FPP? (lemmy.ml)
submitted 7 months ago* (last edited 7 months ago) by puffy@lemmy.ml to c/firefox@lemmy.ml
6 comments fedilink hide all child comments
 

Since version 118+, Firefox introduced FPP (Finger Printing Protection) which is in short water downed version of RFP (Resist Finger Printing).

FPP is enabled by default from version 119 onwards if you enable ETP (Enhanced Tracking Protection).

FPP randomizes canvas data subtly than RFP, which is why RFP breaks some sites. So, my question is, if we allow canvas data extraction for a broken site will it fallback to FPP's subtle canvas randomization, or allowing it will expose canvas data completely if we have ETP enabled?

Relevant link: https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting

Edit: More info about HTML5 canvas fingerprinting https://webbrowsertools.com/canvas-fingerprint/

top 6 comments
sorted by: hot top controversial new old
[–] UnRelatedBurner@sh.itjust.works 10 points 7 months ago (3 children)

I can't answer your question. But I'd like to know what these funny words mean. Can someone explain to me what is html5 canvas data and all the 3 letter words are?

[–] swayevenly@lemm.ee 2 points 7 months ago* (last edited 7 months ago)

https://coveryourtracks.eff.org/learn https://fingerprint.com/

RFP = I'm assuming he's referring to the about:config setting in Firefox called privacy.resistFingerprinting. This blocks fingerprinting or at least does its best.

OPP = Assuming he's referring to the other about:config setting privacy.resistFingerprinting.autoDeclineNoUserInput... It should work in coordination with the previous setting, overriding the previous restriction if you allow it.

Websites want to keep track of you without relying on cookies so they create an image with text in a canvas element, take the hash value of that and assign that as your unique id that will follow you every where you go on the internet.

[–] NorthWestWind@lemmy.world 1 points 7 months ago

I've only worked with canvas but not the security stuff, so I can only answer you partially.

Canvas is an element that you can create with HTML5, and the HTML5 canvas data just means what has been drawn on the canvas.

Now for the FPP, RFP stuff, I'm guessing they are some ways to encrypt the canvas. If the receiving end doesn't decrypt it, the canvas is gonna be random noise.

(This part I'm really unsure about) Due to each client having a different key to encrypt and decrypt, this essentially allows others to track a certain user.

[–] puffy@lemmy.ml 0 points 7 months ago

https://webbrowsertools.com/canvas-fingerprint/ has got everything you need to know about html5 canvas.

[–] racketlauncher831@lemmy.ml 3 points 7 months ago (1 children)

What is HTML5 canvas data, and how do websites track us, please?