Clicky

Hardware: WebGL

Updated 4 months ago by Yana Shch

Related articles

WebGL is a Javascript browser API for rendering 3D graphics on a web page. Websites may exploit WebGL to fingerprint your device. Generally, there are two methods by which websites are able to do it:

  • WebGL Report — the entire WebGL Browser Report table is retrieved and examined. In some cases, it’s converted into a hash for faster analysis.
  • WebGL Image — a hidden 3D image is rendered and hashed. Because the end result depends on a hardware device that makes calculations, this method yields unique values for different combinations of devices and their drivers.

Fingerprints test

You can check what information the websites can retrieve through this API from Browserleaks' test.

WebGL modes

In Multilogin, you are able to control your WebGL readouts by either adding a persistent random noise to the readout or allowing the website to see the real fingerprint of your device.

WebGL image Noise mode (default)

When you set WebGL mode to Noise, Multilogin will intercept WebGL readout requested by a website and add a unique noise to it. This noise will be persistent for that browser profile. This means all WebGL readouts within this profile will be altered the same way. For example, the same WebGL image on different pages will be altered in the same way. The same image in two different browser sessions will also be altered the same way.

This allows creating a unique fingerprint that persists for a certain browser profile. 

Since random noise is applied to the WebGL image readout, websites may perceive the fingerprint as being 100% unique, if statistical analysis is applied.

WebGL metadata Masking mode (default)

When metadata masking is on, Multilogin will alter WebGL Vendor and Renderer parameters with values retrieved from a fingerprint database. 

You can see altered WebGL metadata parameters in "Other WebGL parameters":

WebGL Off mode

There's no confirmed evidence about websites actually utilizing WebGL parameter for browser fingerprinting.

When WebGL masking is set to Off, websites will see the real WebGL Report and Image hashes.

Setting the mode to Off can be advantageous in some cases, where websites react badly to 100% unique WebGL readouts.  

Remember! In the real world, WebGL fingerprint hashes are not unique, as multiple copies of your machine and graphics cards set-up exist elsewhere in the world. So by revealing your real WebGL fingerprint, you only fall within the same segment of users who have the same hardware setup.  Furthermore, by altering other fingerprints, you increase the entropy by which websites will be able to see your browser profiles as separate identities.

Opening browser profiles on multiple machines

Don't forget! If you've created a browser profile with WebGL set to Noise and you open it on various machines with different hardware installed, the website will see that the WebGL image hash is not persistent across multiple launches.

The added noise is persistent. However, it is added as a filter on top of the existing machine fingerprint. So, if the machine has changed, then the readouts also change.

The WebGL hash with added Noise is not persistent

Below is a screenshot example. The same browser profile is opened on 2 different machines. Although the noise is persistent for that profile, the WebGL readouts are still different.

Solutions if non-changing readouts are required on multiple devices

  1. Run Multilogin on identically configured Virtual Machines (VM) or Virtual Private Servers (VPS) with Hardware fingerprints set to Noise mode. Since these machines will be set up the same way, the masked WebGL fingerprints will remain consistent on multiple machines.
  2. Run Multilogin on identical PC models with the same hardware, driver and OS setup. Since these machines have the same hardware setup, the masked hardware prints will remain consistent on multiple machines.
  3. Run Multilogin on the same Mac computers. The same logic applies, but also helps with blending in better, as described above.
Video on the topic

Check out our latest news, research and tutorials

Has your issue been resolved?