ProTip: If you enabled resistFingerprinting, you have to manually allow HTML5 canvas usage per website
ProTip: If you enabled resistFingerprinting, you have to manually allow HTML5 canvas usage per website
Attached: 2 images Since I’m the idiot learning this by filing bug reports, I thought I’d pass it on to all other #FireFox users on here. If you enable resistFingerprinting in about:config, the web site will start showing you weird stripy graphics anywhere an HTML5 canvas graphic would be generated...
My apologies to the Bugzilla team for wasting their time holding my hand on this one. Would have honestly never noticed the little "HTML5" info icon to the left of the URL bar though without their help.
Surely this is a user experience that could be improved, no? Awesome feature but confusing solution.
The resist fingerprinting mode scrambles canvas read out to prevent sites from using it to create a fingerprint. Because of that, any site that needs to read the canvas back for legitimate purposes will also receive scrambled data. You get more privacy for the minor inconvenience of having to manually allow canvas usage for the sites that actually need it.
Yes I’m aware, but the user interface doesn’t make it easy to understand A) why the canvas looks scrambled, and B) how to permit it on a per-site basis.
The technical implementation is fine, it’s just the user workflow that needs fixed.
And very few sites actually need it.
Not really, because doing this will make you more fingerprintable (see my other comment). That's why the default settings are striking a balance between making all users look similar and not breaking too many things (that would cause users to use user-specific overrides that make them more unique), and why
resistFingerprintingis inabout:configrather than a user-facing setting or enabled by default.
And when you do this, you are now more fingerprintable than you were with
resistFingerprintingoff, as the specific combination of anti-fingerprinting measures and canvas-enablement makes you more unique. Which is why it's hidden inabout:config.Yeah, as stated, only for sites you trust.
I was enabling it on at a cycling site that uses HTML5 Canvas to make their charts of how long chain lubricants last zoomable, haha.
I've actually seen that had no idea what it was!
Yeah if it even drew something like “Canvas approval needed to see this image” or just the dang icon in the location bar that would be a start.
I suspect the assumption is that if you are okay digging into
about:configto turn on the feature, you're okay with all further interactions veins similarly hidden.Yeah, I guess to a degree? This all came about because I went to fingerprint.com and realized they could track across VPN etc. was trying to figure out how to block it and that came up. And since not many sites use HTML5 canvas, I had long forgotten I enabled it by the time I hit a corrupted looking graphics site.
I think in the end it shows they really need a better way to inform you what is going in than striped lines instead of a canvas graphic. Something that prompts you to either allow HTML5 canvas or that at least has a message/image you can google for further info in the issue easily.
Or email those admins and tell them to fix their website
HTML5 is a perfectly valid technology when used for good purposes though? Their zoomable charts are fine as long as it is enabled. I don’t think they’re using them for tracking, just to make it easier to enable certain technologies.
The company I work for does all our interactive lessons in HTML5 Canvas via Animate CC. When Flash was EOL’d it saved us from having to redo literally thousands of lessons completely.
OHHHHHHHHHHHHHHHH
That's why Champ'd Up doesn't work properly in Mull Browser! Thanks for this!