1957427 - Image Comparison (as on wpt.fyi) is a worst-case scenario for canvas noising

Status: NEW

(Core :: Privacy: Anti-Tracking, defect, P5)

Description

[Tom Ritter [:tjr]]

[wpt.fyi] is trying to diff two images by drawing them to a canvas, using getImageData to get the underlying pixel values and then comparing the two data sets. I can imagine it being something that could be used in image editing apps or games, but I don't have any direct evidence of this pattern elsewhere on the web.

This is a worst-case scenario for canvas noising because you're going to get two noise injections, one in each of the original images. And then each of those pixels is going to be extra-highlighted by the image diffing feature.

To fix this for wpt.fyi we're going to exempt it because it's (a) hella broken and (b) trusted to not be tracking people.

Generally speaking, this pattern is a candidate for a "specialized API for this use case" type design for canvas noising.

Comment 1

[Tom Ritter [:tjr]]

Did we do this? Can we close this?

Comment 2

[Tim Huang[:timhuang]]

We have deployed the fingerprinting overrides. We can close this bug once the fix is verified.