[tbb-dev] Canvas Breakage Ideas

David Fifield david at bamsoftware.com
Fri Jun 12 19:35:51 UTC 2020


On Fri, Jun 12, 2020 at 06:56:22PM +0000, Tom Ritter wrote:
> On Tue, 2 Jun 2020 at 02:20, Sanketh Menda <sgmenda at uwaterloo.ca> wrote:
> > > We also tested the impact of compressing a canvas rendering to the JPEG
> > > format. It should be noted that the JPEG compression comes directly from the
> > > Canvas API and is not applied after collection. Due to the lossy compression,
> > > it should come as no surprise that the entropy from JPEG images is lower than
> > > the PNG one usually used by canvas fingerprinting tests (from 0.407 to 0.391)
> >
> > Is there an easy way for us to do a study on this? Specifically, fix a random
> > image, and then on a bunch of different computers, read the image and then do
> > a `toDataURL('image/xxx')` for each of the formats.
> 
> That's typically the first tact to take to test fingerprinting; but it
> can only prove a positive difference, it can't prove a negative.
> 
> >From your description, if JPEG compression is deterministic then
> toDataURL is deterministic. I bountied
> https://stackoverflow.com/questions/25303201/does-lossy-decompression-always-generate-same-output
> to try to figure out.

With toDataURL("image/jpeg"), you can also specify the quality level.
DIfferent quality levels do result in different compressed outputs, even
with a blank canvas. I did a quick test of this in 2018 (probably using
whatever Firefox ESR was at the time) and saved partial results:
	>> c = document.createElement("canvas")
	>> c.width = 100
	>> c.height = 100
	>> urls = [0.0, 0.25, 0.5, 0.75, 1.0].map(q => c.toDataURL("image/jpeg", q))
	>> urls.map(x => x.length)
	Array [ 1119, 1119, 1123, 1123, 1255 ]
	>> urls.map(x => x.substr(-10))
	Array [ "ACiiigD//Z", "oAKKKKAP/Z", "iigD//2Q==", "oooA//2Q==", "CgAoAKAP/Z" ]

Running the same console commands today in Firefox 68.9.0esr produces
the same output.


More information about the tbb-dev mailing list