I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
At some point, I wanted to know what else was out there. I had an idea: What if I crawled the web and intercepted fingerprinting-related browser API calls and mapped it all?
To do this, I used the Tranco Top Sites list and began crawling using Playwright. I would hook canvas toDataURL calls and common fingerprinting/anti-bot properties like navigator.webdriver to filter out benign canvases.
For those unfamiliar, canvas fingerprinting generally involves drawing text, shapes, or other graphics onto an HTML <canvas> and extracting the resulting pixel data. Subtle differences in how browsers, operating systems, graphics drivers, and hardware render those graphics can help distinguish one browser environment from another.
