3 ms·
IMO, one of the most difficult fingerprinting attacks to defend against is the installed fonts list. I wish incognito mode only made a standardized list of font
by nordsieck 9y ago
IMO, one of the most difficult fingerprinting attacks to defend against is the installed fonts list. I wish incognito mode only made a standardized list of fonts available.
- cosmie 9y agoI wonder if the fontSettings section of the Chrome extensions API[1] can be used to defend against that. By randomly and deliberately poisoning that info for when in Incognito mode (or even regular browsing). [1] https://developer.chrome.com/extensions/fontSettings https://developer.chrome.com/extensions/fontSettings
- cpeterso 9y agoFirefox is experimenting with a font whitelist as part of upstreaming of Tor features into Firefox trunk. These features are controlled by the privacy.resistFingerprinting pref. resistFingerprinting has some webcompat issues, but Mozilla is considering a subset of the protections for Privacy Browsing mode, similar to Tracking Protection. Here is the work-in-progress bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1336208 https://bugzilla.mozilla.org/show_bug.cgi?id=1336208
- blattimwind 9y agoWhy does that feature even exist?
- fbdjskajxb 9y agoSo dessigners can make adjustments depending on what fonts are available.
- blattimwind 9y agoIs there any website actually using it for that purpose? Usual CI policies would be "actively disinterested" in it.
- aarongolliver 9y agoAny website with a rich text editor would use it.
- fenwick67 9y agoAFAIK it's not really a feature it's more of an exploit. Ultimately, the sizing of a font can effect element widths, and element widths can be queried.