The idea of fingerprint-based online tracking was first thought up by Keaton Mowery and Hovav Shacham, employees at the University of California, in their 2012 work ‘Pixel Perfect: Fingerprinting Canvas in HTML5’. In the publication, they present their idea: that individual fingerprints based on the system configurations of a web user can be easily generated with help from HTML5 imported canvas elements. Inspired by the work of these two researchers, the Russian programmer Valentin Vasilyev developed and released a first example of a Canvas fingerprint code under an open source license on GitHub. His code served as the basis for companies like AddThis and Ligatus to finally realize this tracking technology.
The canvas elements mentioned above are actually defined areas (height and width) which can be drawn in using JavaScript to create graphics, logos, and buttons with text. But combinations of the following hardware/software are often unique:
- Operating system
- Browser
- Graphics card
- Graphics card driver
- Installed client fonts
These components ensure that each text will turn out slightly differently, which is what enables canvas fingerprinting. All that a website operator needs to carry out this internet tracking is the specific canvas fingerprint code, which then causes the browser to display a hidden text in the background via JavaScript as the page is loading. This hidden text is then forwarded on to the website’s web server. Due to the many features involved, the digital fingerprint created in this way is unique in over 80% of cases, meaning it can be recognized every time – as long as the user doesn’t make changes to their enumerated system configurations.