Flipping "privacy.resistFingerprinting" in about:config to true should be sufficient in recent versions (also realize that this will change your default UTC prefs, some timing prefs, default window size, and a bunch of other stuff ...etc).

The TOR browser simply blocks access to the canvas itself. Seems like a good addition to the "would you like to grant access to" list.

The patch for that has been already uplifted to Firefox and is behind the pref "privacy.resistFingerprinting": https://bugzilla.mozilla.org/show_bug.cgi?id=967895

By the way it's spelled "Tor" ;)

Tangentially, that's bothered me since it's "The Onion Router", and such abbreviations are typically capitalized.