Fix canvas fingerprinting

[yipoduyoy]

PLEASE REMOVE WEBRTC AND CANVAS

http://www.browserleaks.com/webrtc
https://www.perfect-privacy.com/webrtc-leaktest/

http://www.browserleaks.com/canvas
http://venturebeat.com/2014/07/30/canvas-fingerprinting-is-tracking-you-and-you-dont-even-know-what-it-is/

[diracdeltas]

Duplicate of #260 #242

[diracdeltas]

Actually the canvas fingerprinting issue would be a huge win and is not duplicated in the other issues above. Changing the title to reflect that.

[diracdeltas]

Proposal:

• Don't allow canvas fingerprinting by third parties (perhaps tied to the third party cookies pref), a la Privacy Badger.
• Show a permissions prompt for canvas fingerprinting by the first party, a la https://trac.torproject.org/projects/tor/ticket/6253.

[jussihuotari]

fwiw, I've enabled "Block HTML canvas and WebGL fingerprinting" on v0.9.6

However, both https://www.browserleaks.com/canvas and https://panopticlick.eff.org/ show a unique canvas fingerprint for me.

Hash of WebGL fingerprint is undetermined, as expected.

[diracdeltas]

@jussihuotari The panopticlick canvas fingerprinting value should be 891f3debe00dbd3d1f0457a70d2f5213 (same for all Brave users). With fingerprinting defense turned off, panopticlick says that 1/20,000 browsers have my canvas hash value. With fingerprinting defense on, only 1/800 browsers have this value, which is a great improvement.

[diracdeltas]

I think you're right that we are missing some of the canvas methods in https://www.browserleaks.com/canvas#how-does-it-work though. I'll fix; thanks!

[diracdeltas]

Looks like the problem is that browserleaks creates a canvas element in an iframe and somehow we are properly stubbing canvas.toDataURL in the page but not in child frames:

var a = document.createElement('canvas')
> undefined
a
> <canvas>​
a.toDataURL
> function () {
            console.log('trapping', item.propName)
            var script_url = getOriginatingScriptUrl()
            var msg = {
              obj: item.objName,
              prop: ite…
var a = document.getElementById("iframe").contentDocument.createElement("canvas")
> undefined
a.toDataURL
> function toDataURL() { [native code] }

[HLFH]

@diracdeltas hi. so maybe we should reopen the issue for this moment.

[diracdeltas]

i'll open a new one