The Electronic Frontier Foundation (EFF) studied the White House site for the new type of online tracking system after a new report byProPublica found that the website contained the secretive spyware.
As RT previously reported, at least five percent of the internet’s top 100,000 websites are using canvas fingerprinting, a new kind tracking technology that is nearly impossible to block using conventional privacy tools.
Although there is more than one type of canvas fingerprinting, the most widely used software – and the type used by the White House – is developed by AddThis, and is reportedly employed on popular websites like online dating site PlentyOfFish, CBS, PerezHilton.com and even YouPorn. (A list of known sites using the software can be found here.)
Here’s how it works: When you visit a website that features such tracking technology, the site asks your browser to “draw a hidden image.” Since every computer renders the image in a different way, that drawing is used to label your device with a unique number that allows trackers to keep an eye on your browsing activity across the internet.
An AddThis spokesperson said that the company did not inform the websites in question when it put its tracking technology in place. After ProPublica’s original article was published, a YouPorn spokesperson said the website was unaware the app was tracking its users and has since removed the AddThis functionality.
AddThis chief executive Rich Harris stressed that the company does not use canvas fingerprinting for anything other than ad targeting and personalization, and that users can stop their data from being used for advertising or marketing by installing a specific opt-out cookie on their computers. However, this would not stop AddThis from collecting data; it would simply stop them from using it to custom-tailor ads for you.
WhiteHouse.gov’s cookie policy promises, “We do not knowingly use third-party tools that place a multi-session cookie prior to the user interacting with the tool.” However, EFF found that the site lists AddThis as being present on some of its pages (but does not identify which ones). “We have yet to find one without AddThis, whether open or hidden,” EFF wrote on its Deeplinks blog.
Since canvas fingerprinting can’t be blocked by normal cookie management techniques or erased when users delete other cookies, the White House use of AddThis “is inconsistent with the White House’s promise that ‘Visitors can control aspects of website measurement and customization technologies used on WhiteHouse.gov’,” EFF wrote.
Tracking users in this way is nothing new. In October 2000, a congressional review found that, despite a prohibition against the practice, 13 government agencies were secretly using technology that tracks the internet habits of people visiting their websites, and in at least one case providing the information to a private company, the Associated Press reported. In August 2009, President Barack Obama announced plans to reverse a nine-year-old federal policy banning the use of web technologies to track and compile personal information of online visitors to federal internet sites, according to Judicial Watch.
AddThis said it does not use any data it gathers from government websites. So far, it claims to have only used data for “internal research and development.”
But relying on the promise from AddThis “is not the best privacy assurance,” said Princeton computer science professor Arvind Narayanan, who helped lead the research team responsible for uncovering the system.
To prevent canvas fingerprinting from being effective, EFF recommends using its Privacy Badger add-on, saying it “blocks spying ads and invisible trackers.” Other options include downloading theTor browser, which helps users avoid numerous types of online tracking, or blocking JavaScript from loading in your browser, which ProPublica notes could make many websites not work properly.
There’s also a browser in the works calledChameleon, which is specifically designed to block fingerprinting – but at this stage is only recommended for “tech-savvy users.”