5 ms·

If you cant directly measure the size, you can do it indirectly, put a character into a fixed size box with overflow scroll on and if scroll bars appear its les

by plopz 7y ago

If you cant directly measure the size, you can do it indirectly, put a character into a fixed size box with overflow scroll on and if scroll bars appear its less than the fixed size. Do you now want to remove the ability to set sizes on elements or to detect when scroll bars appear? I think this is a rabbit hole that only ends with removing javascript from the browser, which I certainly would be against. I think a much more reasonable solution would be to enact and enforce laws that protect private information.

wlesieutre 7y ago
Or even just draw the text in a canvas and check pixel colors. Which feature do you take away? Drawing text in canvas? Or inspecting the current content you’ve drawn in it? This sort of thing is used for even deeper GPU fingerprinting because the exact results of graphics commands can vary slightly. I’m not sure what browsers can/are doing to prevent that.
- na85 7y ago
  Why does the site need to check pixel colours and inspect content that's been drawn? Why can't that be whitelisted per domain by the user?
  - wlesieutre 7y ago
    It would break sites that use canvas drawing for actual features like image editors, but it doesn't seem unreasonable to me. Browsers probably don't like breaking essential functionality of sites like that though, and permission prompt spam for every web feature might end up training users to just click "yes" on everything like Vista's UAC did. Still, an interesting middle ground between "JS can do whatever it wants" and "JS is disabled entirely" might be "JS can send data and styling to the DOM but has very limited access to read anything back." Maybe include some very basic functionality like ability to read the content inside a tag, but nothing more detailed about how an object is styled, how large it is, where it's positioned on the page, whether its hover or visited state is active, whether there's scroll overflow, etc. Related - a quick search suggests that Brave's tracking protection feature does kill the getImageData() function. https://community.brave.com/t/getimagedata-does-not-work-in-brave/43292 https://community.brave.com/t/getimagedata-does-not-work-in-...
na85 7y ago
Why does the site need to know if scroll bars appear?

by plopz 7y ago

wlesieutre 7y ago

Or even just draw the text in a canvas and check pixel colors. Which feature do you take away? Drawing text in canvas? Or inspecting the current content you’ve drawn in it? This sort of thing is used for even deeper GPU fingerprinting because the exact results of graphics commands can vary slightly. I’m not sure what browsers can/are doing to prevent that.

na85 7y ago
Why does the site need to check pixel colours and inspect content that's been drawn? Why can't that be whitelisted per domain by the user?
- wlesieutre 7y ago
  It would break sites that use canvas drawing for actual features like image editors, but it doesn't seem unreasonable to me. Browsers probably don't like breaking essential functionality of sites like that though, and permission prompt spam for every web feature might end up training users to just click "yes" on everything like Vista's UAC did. Still, an interesting middle ground between "JS can do whatever it wants" and "JS is disabled entirely" might be "JS can send data and styling to the DOM but has very limited access to read anything back." Maybe include some very basic functionality like ability to read the content inside a tag, but nothing more detailed about how an object is styled, how large it is, where it's positioned on the page, whether its hover or visited state is active, whether there's scroll overflow, etc. Related - a quick search suggests that Brave's tracking protection feature does kill the getImageData() function. https://community.brave.com/t/getimagedata-does-not-work-in-brave/43292 https://community.brave.com/t/getimagedata-does-not-work-in-...

na85 7y ago

Why does the site need to know if scroll bars appear?