4 ms·

I think Google might have better ways to track people. Fonts are also cached by CDNs and the local browser so I’m not sure if they provide good tracking data (t

I think Google might have better ways to track people. Fonts are also cached by CDNs and the local browser so I’m not sure if they provide good tracking data (they get loaded only for the first page visit for example and popular fonts like Open Sans are probably already in your cache when you open a page). If you’re concerned about tracking as a website operator you can simply load the fonts from your own server, most of them can be found on Github and have liberal licenses (I think all fonts on fonts.google.com)

WorldMaker 7y ago
You can even install the fonts locally to your machine and your browser will favor the local copy. There are some tools like Skyfonts that let you install the top X from Google Fonts and it can be a fun way to speed up a lot of the web; with the tradeoff that not a lot of people have the top X installed for useful large versions of X and that becomes its own fingerprint for surveillance software (testing how long text takes to render in an off screen canvas, for instance). It's been suggested that Browsers or Operating Systems choose a useful X value and install the top fonts everywhere like they used to install the classic "core web fonts".
- smichel17 7y ago
  Also there's a addon called "decentraleyes" that will cache fonts, amongst other things. It's one of 3 extensions I install in every browser I'm allowed to. The others are uBlock origin and https everywhere. All 3 have good privacy/security/performance benefits with effectively no breakage, in their default configurations.
  - commoner 7y ago
    Decentraleyes is an excellent add-on that improves browsing speed and privacy with no negative side effects. Currently, the only font cached by Decentraleyes is Noto Sans. It also caches Google's Web Font Loader script and many major JavaScript frameworks. https://decentraleyes.org https://decentraleyes.org https://git.synz.io/Synzvato/decentraleyes https://git.synz.io/Synzvato/decentraleyes Web developers who are concerned about privacy exposure from Google Fonts can use google-webfonts-helper to extract the font files and self-host them. https://google-webfonts-helper.herokuapp.com/fonts https://google-webfonts-helper.herokuapp.com/fonts https://github.com/majodev/google-webfonts-helper https://github.com/majodev/google-webfonts-helper
    - commoner 7y ago
      Correction: Decentraleyes doesn't actually cache any fonts. Noto Sans is just used for the add-on interface. Font caching would make an interesting feature if the add-on developer is willing to implement it, especially if it bypasses fingerprinting.
      - smichel17 7y ago
        I stand corrected!
- saagarjha 7y ago
  > You can even install the fonts locally to your machine and your browser will favor the local copy. Note that some browsers are going in the opposite direction and actively hiding installed fonts from websites due to the potential for fingerprinting.
dt3ft 7y ago
I am slightly concerned, yes. This is why I chose to host the fonts for my 20-things.com sideproject for as long as I can afford that luxury.
inetknght 7y ago
Delivery of fonts aren't what's used to track people. Rendering of fonts is. Different machines render fonts in a unique way. Consider different GPUs (hardware differences), different drivers (kernel/driver differences), browsers (user-land differences), and sizes (user settings) can all contribute to a font being rendered differently per-user and increasing entropy of a particular unique font id.

WorldMaker 7y ago

You can even install the fonts locally to your machine and your browser will favor the local copy. There are some tools like Skyfonts that let you install the top X from Google Fonts and it can be a fun way to speed up a lot of the web; with the tradeoff that not a lot of people have the top X installed for useful large versions of X and that becomes its own fingerprint for surveillance software (testing how long text takes to render in an off screen canvas, for instance). It's been suggested that Browsers or Operating Systems choose a useful X value and install the top fonts everywhere like they used to install the classic "core web fonts".

smichel17 7y ago
Also there's a addon called "decentraleyes" that will cache fonts, amongst other things. It's one of 3 extensions I install in every browser I'm allowed to. The others are uBlock origin and https everywhere. All 3 have good privacy/security/performance benefits with effectively no breakage, in their default configurations.
- commoner 7y ago
  Decentraleyes is an excellent add-on that improves browsing speed and privacy with no negative side effects. Currently, the only font cached by Decentraleyes is Noto Sans. It also caches Google's Web Font Loader script and many major JavaScript frameworks. https://decentraleyes.org https://decentraleyes.org https://git.synz.io/Synzvato/decentraleyes https://git.synz.io/Synzvato/decentraleyes Web developers who are concerned about privacy exposure from Google Fonts can use google-webfonts-helper to extract the font files and self-host them. https://google-webfonts-helper.herokuapp.com/fonts https://google-webfonts-helper.herokuapp.com/fonts https://github.com/majodev/google-webfonts-helper https://github.com/majodev/google-webfonts-helper
  - commoner 7y ago
    Correction: Decentraleyes doesn't actually cache any fonts. Noto Sans is just used for the add-on interface. Font caching would make an interesting feature if the add-on developer is willing to implement it, especially if it bypasses fingerprinting.
    - smichel17 7y ago
      I stand corrected!
saagarjha 7y ago
> You can even install the fonts locally to your machine and your browser will favor the local copy. Note that some browsers are going in the opposite direction and actively hiding installed fonts from websites due to the potential for fingerprinting.

dt3ft 7y ago

I am slightly concerned, yes. This is why I chose to host the fonts for my 20-things.com sideproject for as long as I can afford that luxury.

inetknght 7y ago

Delivery of fonts aren't what's used to track people. Rendering of fonts is. Different machines render fonts in a unique way. Consider different GPUs (hardware differences), different drivers (kernel/driver differences), browsers (user-land differences), and sizes (user settings) can all contribute to a font being rendered differently per-user and increasing entropy of a particular unique font id.