I’m not convinced a script-less element protects privacy: recall that subtle differences in how different machines (running the same browser) render certain <ca

I’m not convinced a script-less element protects privacy: recall that subtle differences in how different machines (running the same browser) render certain <canvas> operations, it’s a given that the same underlying hardware differences will lead to subtle 3D model rendering differences (e.g. subpixel antialiasing, measuring shader render time, etc) and thus add another way for unscrupulous websites to fingerprint users. Another issue is that it’s inevitable that support for fragment and vertex shaders will be added, which is another huge issue (MS put-off supporting WebGL for years out of plausibly legitimate concerns about possible vulnerabilities in WebGL shaders). …of course that’s all fine on Apple’s uniform hardware: fingerprinting MacBook users with their identical GPUs will be harder compared to PC users with their huge matrix of possible GPU chipsets, GPU drivers, and GPU performance/quality settings - which all affect how simple 3D models are rendered.