Hardware: WebGL

Updated 9 months ago by Alesja Tsernoseva

WebGL is a Javascript browser API for rendering 3D graphics on a web page. Websites may exploit WebGL to fingerprint your device. Generally, there are two methods by which websites are able to do it:

  • WebGL Report - the entire WebGL Browser Report table is retrieved and examined. In some cases, it’s converted into a hash for faster analysis.
  • WebGL Image - a hidden 3D image is rendered and hashed. Because the end result depends on a hardware device that makes calculations, this method yields unique values for different combinations of devices and their drivers.

You can check what information the websites can retrieve through this API from  Browserleaks test

WebGL image Noise function

When you set WebGL mode to Noise, Multilogin will intercept WebGL readout requested by a website and add a unique noise to it. This noise will be persistent for that browser profile. This means all WebGL readouts within this profile will be altered the same way. For example, the same WebGL image on different pages will be altered in the same way. The same image in two different browser sessions will also be altered the same way.

This allows creating a unique fingerprint that persists for a certain browser profile. 

Since random noise is applied to the WebGL image readout, websites may perceive the fingerprint as being 100% unique, if statistical analysis is applied.

WebGL metadata masking

WebGL metadata is being masked in Multilogin every time you set WebGL mode to Noise. This is a legacy mechanism which will be improved soon by making it possible to mask WebGL metadata and image separately. 

When metadata masking is on, Multilogin will alter WebGL Vendor and Renderer parameters with values retrieved from a fingerprint database. 

You can see altered WebGL metadata parameters in "Other WebGL parameters".

Off Mode

When WebGL masking is set to Off, websites will see the real WebGL Report and Image hashes.

Setting the mode to Off can be advantageous in some cases, where websites react badly to 100% unique WebGL readouts.  

Remember! In the real world, WebGL fingerprint hashes are not unique,  since multiple copies of your machine and graphics cards setup exist elsewhere in the world.  So by revealing your real WebGL fingerprint, you only fall within the same segment of users who have the same hardware setup.  Furthermore, by altering other fingerprints, you increase the entropy by which websites will be able to see your browser profiles as separate identities.

A way to further decrease the entropy of your browser profiles, and thus, make them better blend-in within the normal distribution of users is to run Multilogin on Mac computers. Because Macs are very similar in their build nature, their WebGL fingerprints are very similar. In most cases, the same models will have identical hashes.

Opening browser profiles on multiple machines

Don't forget! If you've created a browser profile with WebGL set to Noise and open it on various machines with different hardware installed, the website will see that the WebGL image hash is not persistent across multiple launches.

The added noise is persistent. However, it is added as a filter on top of the existing machine fingerprint. So, if the machine has changed, then the readouts also change.

Below is a screenshot example. The same browser profile is opened on 2 different machines. Although the noise is persistent for that profile,  the WebGL readouts are still different.

If non-changing readouts are required on multiple devices, then there are few solutions:

  1. Run Multilogin on identically configured Virtual Machines (VM) or Virtual Private Servers (VPS) with Hardware fingerprints set to Noise mode. Since these machines will be set up the same way, the masked WebGL fingerprints will remain consistent on multiple machines.
  2. Run Multilogin on identical PC models with the same hardware, driver and OS setup. Since these machines have the same hardware setup, the masked hardware prints will remain consistent on multiple machines.
  3. Run Multilogin on the same Mac computers. The same logic applies, but also help better blend in as it’s described in above.

Was this article helpful?