4 ms·
Internet tracking has moved beyond cookies
- red_admiral 10y agoIt's about time browsers shipped with an option to lock down a standard set of fonts.
- bitwize 10y agoThat you're one of the few assholes who don't accept custom fonts is potentially useful tracking information. Forbidding any custom fonts is a non-option; the Web belongs to designers now, and they will certainly raise a fuss if they are not allowed fine-grained control over typography.
- majewsky 10y agoIf they want to show a web font, that's fine by me (leaving aside the security considerations with web fonts for another thread). But why does there need to be an API for querying the set of installed fonts?
- ubernostrum 10y agoI suspect that as long as getComputedStyle() exists, there will be ways for it to leak identifying information. Browsers already break getComputedStyle for some things (i.e., to close the history leak of being able to query whether the "visited" styling is applied to a link), but it may end up that this API just has to disappear completely.
- majewsky 10y agoTrue. I always feel like we are at the point where we shouldn't think about which APIs to add to our browsers, but about which APIs to remove. Browser vendors frequently deprecate SSL versions and ciphers, and in the same vein, we should sacrifice at least some backwards compatibility for more privacy.
- jkot 10y agoI block custom fonts. Some 'designed' typography gives me zero benefits. Page takes forever to load, and entire page is refreshed once font is downloaded.
- coldtea 10y ago>Forbidding any custom fonts is a non-option; Actually it's a very valid option, works well for 99.9% of the websites, and fuck designers.
- spdustin 10y agoThat's not a very inclusive or productive thing to say, please don't do that.
- pmontra 10y agoWe can debate about who the web belongs to, but the browser belongs to users.
- beardog 10y agoI agree, although you can install Random Agent Spoofer on Firefox, which among other things, has am option to limit fonts.
- pmontra 10y agoI don't see many incentives for browser vendors to do it. Google sells ads so they could be benefitting of fingerprinting. Maybe Mozilla could default to not loading webfonts, but there is the risk of people feeling that the browser is broken because it doesn't show the fonts that any other browser does. I'm using NoScripts on FF which stops webfonts by default. I seldom enable them, almost only when I have to check the real formatting of a web page I'm working on. Anything else is perfectly fine even with the default fonts. But fonts are only a drop in the ocean of fingerprinting.
- martinko 10y agoAny good firefox plugins that can spoof installed fonts and other trackable info?
- clydethefrog 10y agoprivacytools.io imo has the best documentation of which add-ons and about config settings you should use while using Firefox for better privacy.
- peteretep 10y agoAs per else-where on this thread, Random Agent Spoofer will. Far more fundamentally, if you don't have Self-Destructing Cookies installed, it's all for nothing, so grab that too. An NoScript. And Privacy Badger. And HTTPS Everywhere. And uBlock Origin. And nuke history and cache every time you shut down the browser for evercookies. Also flash should be disabled by default.
- AstralStorm 10y agoHTTPS Everywhere will actually leak that you have it. Due to huge demand for JavaScript, NoScript quickly becomes hard to use or nearly worthless for privacy. Also you just missed Tor Browser and Tor itself. IP address is usually trivial to track.
- VOYD 10y agoor you could just not spend your entire life connected on the internet.