Google CTR-Rocket

Canvas fingerprinting works by exploiting the HTML5 canvas element: when a user visits a website their browser is instructed to ‘draw’ a hidden line of text or other graphic.

The resulting image is rendered into an array of data, which can have small differences across different browsers and platforms. This difference makes image data rather unique and thus can be used to track users without any actual identifier persistence on the machine.

WebGL fingerprinting works by exploiting the HTML5 canvas element: when a user visits a website their browser is instructed to ‘draw’ a custom 3D graphic.
The resulting image is rendered into an array of data, which can have small differences across different browsers and platforms. This difference makes image data rather unique and thus can be used to track users without any actual identifier persistence on the machine.

WebGL API has methods, which expose properties of your real hardware. Any site, that you visit can inspect it without asking user permission.
This information is often different for different machines and can be used to generate a unique fingerprint by itself or in combination with other methods.
It contains; real video card name and vendor, supported shader extensions, hardware capabilities, etc.

By utilizing the AudioContext API in modern browsers, sites can exploit the subtle differences in the rendering of a fixed audio waveform, for example, a sine or triangle wave, to extract a consistent fingerprint.
This technique does not imply collecting sound played or recorded on a machine but rather harvesting the audio signature of the individual machine and using that as an identifier to track a web user.

Audio API has methods, which expose the properties of your real hardware. Any site, that you visit can inspect it without asking user permission. Unlike WebGL, this information is often the same for different machines and therefore is not very dangerous.
It can be used to generate a unique fingerprint only in combination with other methods.
This information contains; audio card sample rate, latency, max channel count.

Using javascript site can enumerate fonts installed on user machine. Font list depends on installed software and therefore may be a unique identifier used to track users especially when it’s combined with other fingerprinting methods.
Using a small number of fonts is not dangerous and is a thing, which happens on every site, but if the number of fonts is big, it means that fingerprinting technique is used.

With help of the Webrtc API site can obtain your real IP. Originally this information is exposed to facilitate a direct connection between two browsers, but it is also a big security threat.
It means that even if you are using VPN or proxy, a site can still obtain your real IP without asking permission. This technique is very dangerous.

navigator.language and navigator.languages properties hold information about system language. This technique by itself is not dangerous and is often used to detect settings for localization.
However, this API also may be used to detect discrepancies between proxy IP and browser language.

There are several ways in which a site can detect system timezone. These techniques by themselves are not dangerous and are often used to detect settings for localization. However, these APIs also may be used to detect discrepancies between proxy IP and browser timezone.

navigator.plugins and navigator.mimeTypes properties hold information about browser plugins. The list of plugins may be different for different machines and thus can be a part of the browser fingerprint.
Most of the time this technique is used to collect information about user machines, but it is not always true, for example, a site may check if flash is installed on your pc and is possible to display flash content.

There are several methods for obtaining information about screen properties, like resolution, color depth, position, etc. These properties depend on user hardware and thus may be used to identify users among others.
Each of these properties can be used for fingerprinting or for harmless purposes like rendering improvements or generating a mobile interface. It is hard to distinguish between those cases, so this technique is a marker as not dangerous.

User-agent is browser identifier, it contains information about application type, operating system, browser type, vendor, and version. This property is often accessed by different libraries and frameworks and is not considered dangerous.