canvas fingerprinting alone still identifies my browser after months of degoogling everything
Months of work. Firefox with uBlock Origin, private DNS resolver, paid VPN, Google account removed from everything. I genuinely thought I was done.
Then I decided to actually verify instead of assuming. Found an open source fingerprint scanner called Leakish on GitHub, read through the source to make sure it wasn't doing anything shady, and ran it. My score came back in the low 30s out of 100.
First surprise: the VPN was handling my IP fine on the network egress check. But WebRTC was leaking my local network address through a STUN probe the entire time. My VPN provider plasters "military grade encryption" across their site but somehow can't be bothered to mention the most widely known VPN bypass in existence.
Canvas was the real problem. The way my browser renders a specific 2D element produces a hash that is basically unique to my machine. Couple that with an unusual set of installed fonts, and my browser was essentially wearing a nametag across every site I visited. No cookies, no Google account, nothing. Just render a hidden canvas, hash the output, done. You're tracked.
I verified in DevTools that the fingerprint checks (canvas, fonts, all of it) ran locally in my browser and the only actual server call was the egress IP probe. Small detail but it matters when you're trusting a tool with this kind of data about your setup.
Went down a rabbit hole after seeing the canvas result. Englehardt and Narayanan's 2016 Princeton study ("Online Tracking: A 1 Million Site Measurement and Analysis") found canvas fingerprinting scripts deployed on roughly 5% of the top 100,000 sites. That was nearly a decade ago, and the technique is more widespread now. Here's the part that makes me genuinely furious about the degoogling project: Google's ad network partners use these exact fingerprinting techniques. You can spend months ripping Google out of your life, and their ad ecosystem still follows you across the web with a canvas hash. The Google account was always just the convenient door. Fingerprinting was the fallback they never needed you to know about.
Enabled resistFingerprinting in about:config and rescanned. Jumped from the low 30s to the mid 70s. Not an absolute privacy grade by any stretch, just a relative comparison, but the shift was undeniable. The cost: timezone spoofing broke a banking login within minutes. Some pages started rendering wrong. I now keep a second Firefox profile without it for those specific sites. Functional, but absurd that this is where we are in 2026.
Mozilla knows Canvas is a problem. resistFingerprinting exists as proof. But they refuse to ship it as default because compatibility suffers, so every Firefox user stays fingerprintable out of the box. Google will never address it in Chromium because their ad infrastructure IS the fingerprinting infrastructure. The distance between "I degoogled" and "I'm actually harder to track" is wider than most of us realize.