Canvas fingerprint new technique

[lowkeypal]

Recently, I've come across an interesting canvas fingerprinting evasion method designed to trick browsers into generating distinct fingerprints by deliberately adding redundant or seemingly "useless" canvas drawing operations. Essentially, the method works by repeatedly resetting the canvas width and redrawing very similar content, adding subtle variations to confuse fingerprinting algorithms.

Here are two JavaScript code snippets illustrating this approach:

Snippet 1:

;(async function(){
   var canvas = document.createElement("canvas");
   canvas.width = 96;
   canvas.height = 96;
   var context = canvas.getContext('2d', {willReadFrequently: true});
   context.font = "94px sans-serif";
   context.fillStyle = "#000";
   context.fillText("👨‍🚀",-1.0,96.0);
   canvas.width = canvas.width;
   canvas.width = canvas.width;
   context.font = "94px sans-serif";
   context.fillStyle = "#000";
   context.fillText("👨‍🚀",-1.0,96.0);
   canvas.width = canvas.width;
   canvas.width = canvas.width;
   context.font = "94px sans-serif";
   context.fillStyle = "#000";
   context.fillText("🚵",-1.0,96.0);
   var str = context.getImageData(0,0,96,96).data;
   // Convert pixel data to hex fingerprint...
})();

Snippet 2 (variation):

;(async function(){
   var canvas = document.createElement("canvas");
   canvas.width = 96;
   canvas.height = 96;
   var context = canvas.getContext('2d', {willReadFrequently: true});
   context.font = "94px sans-serif";
   context.fillStyle = "#000";
   context.fillText("👨‍🚀",-1.0,96.0);
   canvas.width = canvas.width;
   canvas.width = canvas.width;
   context.font = "94px sans-serif";
   context.fillStyle = "#000";
   context.fillText("👨‍🚀",-1.0,96.0);
   canvas.width = canvas.width;
   canvas.width = canvas.width;
   context.font = "94px sans-serif";
   context.fillStyle = "#000";
   context.fillText("🚵",-1.0,96.0);
   canvas.width = canvas.width;
   canvas.width = canvas.width;
   context.font = "94px sans-serif";
   context.fillStyle = "#000";
   context.fillText("🚵‍",-1.0,96.0); // subtle addition
   var str = context.getImageData(0,0,96,96).data;
   // Convert pixel data to hex fingerprint...
})();

This technique leverages small differences in the final canvas rendering—particularly using emojis and invisible Unicode modifications—to create distinct fingerprints, effectively confusing fingerprint trackers. By repeatedly clearing the canvas (e.g., canvas.width = canvas.width), browsers often register each redrawing as a different canvas output, thus complicating attempts at reliably fingerprinting.

So with Perfect Canvas, we only get precomputed canvas request, then how are you gonna deal with this ?

[Михаил96]

@lowkeypal Можете указать пример страницы, на которой используется такая техника?

[lowkeypal]

https://new88bi.com/
here's an example, you'd need to do some actions like register ... to trigger more canvas requesting but same code like I said above.
I can't redo the canvas inspector flow for now, but you can check easily

[FastSpace]

@lowkeypal разработчик знает об этом.

[lowkeypal]

@FastSpace do you mean they knows but they don't do anything?

[sergerdn]

@lowkeypal said in Canvas fingerprint new technique:

So with Perfect Canvas, we only get precomputed canvas request, then how are you gonna deal with this ?

Well, we have a very different way to make it work.You could just not hide your real video card. But that's not the only option - just the easiest one, I think

[lowkeypal]

@sergerdn can you help me know more about this approach?

[sergerdn]

@lowkeypal said in Canvas fingerprint new technique:

@sergerdn can you help me know more about this approach?

I clearly wrote what you need to make this work. What exactly do you need more info on? How can it be done in BAS?

[lowkeypal]

@sergerdn yes, how can it be done in BAS?

[sergerdn]

@lowkeypal said in Canvas fingerprint new technique:

@sergerdn yes, how can it be done in BAS?

If you are a premium user, you may contact support. However, since the version 28.7.1, that feature has been removed by the developer of the BAS for some unknown reason.

https://community.bablosoft.com/topic/30888/обновление-28-7-1/8?_=1748959031537

[Михаил96]

@lowkeypal Я не проверял как это работает на сайте. Подскажите, Вы проверили, что сайт после вычислений hex canvas получает результат отличный от того, который вы подставляете? Или проблема только в том, что в Canvas Inspector отображаются лишние canvas?

[lowkeypal]

@Михаил96 I checked and found that it request a new canvas but with different code, so the Fingerprint Switcher (or Perfect Canvas) identified it as a different canvas request which not precomputed in the fingerprint, then it output different hex (with or without noise added I'm not sure) when It should be the same hex with previous canvas request. .
I think you understand the point here

[Михаил96]

@lowkeypal Я правильно Вас понял, что вы нашли на самом сайте https://new88bi.com/ место в обфусцированном коде, где сайт получает результат отрисовки и этот результат не подменяется, сайт получает результаты с шумом или с устройства, на котором запущен BAS?