They're watching you

[Bob Of Burleson]

Stealthy new online
tracking software puts
your privacy at risk

Shane Dingman
The Globe and Mail

A growing number of websites are employing a stealthy new form of hard-to-block Internet tracking software that may pose increasing privacy risks for customers.

Canvas fingerprinting, which can command your browser to draw a unique identifier and then log your online behaviour, is nearly impossible to detect, does not fall under “do not track” voluntary systems and evades most conventional ad-blocking software. It is already tracking users on 5 per cent of the biggest sites on the Internet, including The White House, Starbucks, Re/Max Canada, Canadian retailers Metro and Home Hardware, Postmedia website Canada.com, as well as a number of pornography sites.

A team of academics from Princeton University and Belgium’s KU Leuven University released a study Tuesday that says canvas fingerprinting has spread to at least 5,542 of the Web’s top 100,000 sites, largely thanks to software from a Virginia-based company called AddThis.

A search of the researchers’ database shows the trackers are being employed in Canada by organizations and companies such as the Ontario Universities’ Application Centre, Rogers TV station City News and Transcontinental’s Canadian Living and immigration consultancy Canadavisa.com.

AddThis had the largest reach, with 5,232 sites, but was not the the only firm using canvas fingerprinting. The researchers found 20 fingerprinting providers: Nine built their own (including one written by the Canadian dating site Plentyoffish.com) and there were 11 from third parties such as Ligatus and Admicro.

Customer tracking through browser cookies is commonly used by Web advertiser networks, such as Google’s DoubleClick, to target users; sites that host tracking software typically gain a small portion of those revenues. But for years, savvy online consumers have been aware of methods to evade browser cookies, either by installing ad-blocking software or by clearing cookies manually.

“What’s scary about this is it takes the control away from the users,” said Gunes Acar, a PhD student with KU Leuven’s Computer Security and Industrial Cryptography department and the lead researcher on the project. “In Europe, it is kind of our right to have a controllable browsing experience. This is a way to circumvent user preferences.”

MORE