The canvas element is great for basic fingerprinting because it's practically impossible to stop it without breaking legitimate use cases. Shortly explained, there's differences between text rendering in different operating systems, browsers, and between browser versions as well. A simple fingerprint would be then to render some text, convert the canvas to an image and then hash it. Modern fingerprinting approaches combine this with a number of other sources of data (such as WebGL, available fonts, etc) to uniquely identify users.

So stupid. You know what would be nice? If my processor didn't attempt to do a bunch of rendering and extra computation, costing more energy and wear, to spy on me. Without eliminating legitimate use cases.

For now, eliminating legitimate use cases will have to do.

This problem could also be solved by making the specs so rigid and implementations so constrained that none of these techniques could be used to differentiate one user agent from another.

For many reasons, the lesser of two evils is probably to make user agent differentiation possible. The number of apis one has to cut out to make it impossible basically rolls HTML back to the 1.0 with no JavaScript era.

Implementation details of the machine rendering a document leak through all over the place. The fact that they are allowed to vary while confirming to spec has historically been considered a feature of HTML rendering, not a bug.

How would you prevent use of canvas? Browser plugin? Proxy filter?

Reminds me of evercookie.

Thanks

1x1px is for sending data to a server (by passing info in the image request URL)

Canvas fingerprinting is done by generating unique(ish) strings based on slight variations in how Browsers/CPUs/GPUs render stuff.

Fingerprinting not tracking pixel