4 ms·

It bothers me that browsers leak info like a font list and extensions. Specify the font you want to display, and if my browser doesn't have that font it should

by na85 7y ago

It bothers me that browsers leak info like a font list and extensions. Specify the font you want to display, and if my browser doesn't have that font it should fall back gracefully, perhaps with a warning.

wlesieutre 7y ago
If you allow a page to specify a font, the page can tell whether you displayed that font or the fallback by looking at things like the size of a div containing a particular character. Preventing font fingerprinting means limiting font use to default system fonts and web fonts only. If a page can use user installed fonts, they can tell whether or not those fonts were installed. Safari’s fingerprint protection does this already, I don’t know if other browsers do.
- na85 7y ago
  >If you allow a page to specify a font, the page can tell whether you displayed that font or the fallback by looking at things like the size of a div containing a particular character. Only because the relevant APIs choose to allow this. Javascript served from the website should not be able to read this kind of data including element sizes. My browser should report a minimum of info such as viewport size and rendering engine, and if you (by this I mean the general "you") require more info then either you're a bad developer or your design needs to be rationalized. Edit: and to the guy whose comment got flagkilled asking about how I want to solve the "problem" of breaking sites that rely on crutches like knowing the rendered size of an element, I say this: I don't propose to fix the problem because it isn't a problem for anyone but advertisers, and fuck those people.
  - LASR 7y ago
    You’re proposing to not report the correct sizes for elements? I agree with you. But the reality is that there are a lot of bad developers and badly designed sites. Now if you enforce this, you’ll break those sites. So how do you propose to solve that problem?
  - plopz 7y ago
    If you cant directly measure the size, you can do it indirectly, put a character into a fixed size box with overflow scroll on and if scroll bars appear its less than the fixed size. Do you now want to remove the ability to set sizes on elements or to detect when scroll bars appear? I think this is a rabbit hole that only ends with removing javascript from the browser, which I certainly would be against. I think a much more reasonable solution would be to enact and enforce laws that protect private information.
    - wlesieutre 7y ago
      Or even just draw the text in a canvas and check pixel colors. Which feature do you take away? Drawing text in canvas? Or inspecting the current content you’ve drawn in it? This sort of thing is used for even deeper GPU fingerprinting because the exact results of graphics commands can vary slightly. I’m not sure what browsers can/are doing to prevent that.
      - na85 7y ago
        Why does the site need to check pixel colours and inspect content that's been drawn? Why can't that be whitelisted per domain by the user?
        wlesieutre 7y ago
        It would break sites that use canvas drawing for actual features like image editors, but it doesn't seem unreasonable to me. Browsers probably don't like breaking essential functionality of sites like that though, and permission prompt spam for every web feature might end up training users to just click "yes" on everything like Vista's UAC did. Still, an interesting middle ground between "JS can do whatever it wants" and "JS is disabled entirely" might be "JS can send data and styling to the DOM but has very limited access to read anything back." Maybe include some very basic functionality like ability to read the content inside a tag, but nothing more detailed about how an object is styled, how large it is, where it's positioned on the page, whether its hover or visited state is active, whether there's scroll overflow, etc. Related - a quick search suggests that Brave's tracking protection feature does kill the getImageData() function. https://community.brave.com/t/getimagedata-does-not-work-in-brave/43292 https://community.brave.com/t/getimagedata-does-not-work-in-...
  - meowface 7y ago
    As long as JavaScript is enabled in the browser, there will always be some clever way to use it for fingerprinting, even if you effectively have to use side channels to get information like installed fonts. There's no avoiding it.
    - na85 7y ago
      I disagree with the assumption that there will always be a way to fingerprint with it, and I reject the notion that we should just give up the arms race. If what you assert is true then JavaScript needs to die. Now.
      - meowface 7y ago
        You could try to prove me wrong, but from everything I've seen, I think the consensus is that it will always be possible unless there's a complete overhaul of how browser scripting works. JavaScript has almost complete control of your browser, and if you try to sandbox it or mitigate certain fingerprinting techniques (by disabling/nullifying/randomizing things), people will almost always find some workaround. And the more restrictive you get, the more websites you'll break, since many legitimate code relies on those features (like screen resolution, device type, browser language, browser timezone, what formats and features the browser supports).

by na85 7y ago

wlesieutre 7y ago

If you allow a page to specify a font, the page can tell whether you displayed that font or the fallback by looking at things like the size of a div containing a particular character. Preventing font fingerprinting means limiting font use to default system fonts and web fonts only. If a page can use user installed fonts, they can tell whether or not those fonts were installed. Safari’s fingerprint protection does this already, I don’t know if other browsers do.

na85 7y ago
>If you allow a page to specify a font, the page can tell whether you displayed that font or the fallback by looking at things like the size of a div containing a particular character. Only because the relevant APIs choose to allow this. Javascript served from the website should not be able to read this kind of data including element sizes. My browser should report a minimum of info such as viewport size and rendering engine, and if you (by this I mean the general "you") require more info then either you're a bad developer or your design needs to be rationalized. Edit: and to the guy whose comment got flagkilled asking about how I want to solve the "problem" of breaking sites that rely on crutches like knowing the rendered size of an element, I say this: I don't propose to fix the problem because it isn't a problem for anyone but advertisers, and fuck those people.
- LASR 7y ago
  You’re proposing to not report the correct sizes for elements? I agree with you. But the reality is that there are a lot of bad developers and badly designed sites. Now if you enforce this, you’ll break those sites. So how do you propose to solve that problem?
- plopz 7y ago
  If you cant directly measure the size, you can do it indirectly, put a character into a fixed size box with overflow scroll on and if scroll bars appear its less than the fixed size. Do you now want to remove the ability to set sizes on elements or to detect when scroll bars appear? I think this is a rabbit hole that only ends with removing javascript from the browser, which I certainly would be against. I think a much more reasonable solution would be to enact and enforce laws that protect private information.
  - wlesieutre 7y ago
    Or even just draw the text in a canvas and check pixel colors. Which feature do you take away? Drawing text in canvas? Or inspecting the current content you’ve drawn in it? This sort of thing is used for even deeper GPU fingerprinting because the exact results of graphics commands can vary slightly. I’m not sure what browsers can/are doing to prevent that.
    - na85 7y ago
      Why does the site need to check pixel colours and inspect content that's been drawn? Why can't that be whitelisted per domain by the user?
      - wlesieutre 7y ago
        It would break sites that use canvas drawing for actual features like image editors, but it doesn't seem unreasonable to me. Browsers probably don't like breaking essential functionality of sites like that though, and permission prompt spam for every web feature might end up training users to just click "yes" on everything like Vista's UAC did. Still, an interesting middle ground between "JS can do whatever it wants" and "JS is disabled entirely" might be "JS can send data and styling to the DOM but has very limited access to read anything back." Maybe include some very basic functionality like ability to read the content inside a tag, but nothing more detailed about how an object is styled, how large it is, where it's positioned on the page, whether its hover or visited state is active, whether there's scroll overflow, etc. Related - a quick search suggests that Brave's tracking protection feature does kill the getImageData() function. https://community.brave.com/t/getimagedata-does-not-work-in-brave/43292 https://community.brave.com/t/getimagedata-does-not-work-in-...
- meowface 7y ago
  As long as JavaScript is enabled in the browser, there will always be some clever way to use it for fingerprinting, even if you effectively have to use side channels to get information like installed fonts. There's no avoiding it.
  - na85 7y ago
    I disagree with the assumption that there will always be a way to fingerprint with it, and I reject the notion that we should just give up the arms race. If what you assert is true then JavaScript needs to die. Now.
    - meowface 7y ago
      You could try to prove me wrong, but from everything I've seen, I think the consensus is that it will always be possible unless there's a complete overhaul of how browser scripting works. JavaScript has almost complete control of your browser, and if you try to sandbox it or mitigate certain fingerprinting techniques (by disabling/nullifying/randomizing things), people will almost always find some workaround. And the more restrictive you get, the more websites you'll break, since many legitimate code relies on those features (like screen resolution, device type, browser language, browser timezone, what formats and features the browser supports).