3 ms·

Most of the things you've listed here don't actually seem all that reasonable to me. User agents as a concept are rather poorly thought out across the board an

Most of the things you've listed here don't actually seem all that reasonable to me. User agents as a concept are rather poorly thought out across the board and not all that useful but persist because that's just how technical cruft is. Fonts should be provided by the website; if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. There's little to no excuse for the current font situation IMO beyond poor design decisions that became heavily entrenched. Timezone and other obviously private metadata should never be shared without the user explicitly granting permission on a case by case basis. The status quo here is completely inexcusable as is the continued failure to fix the problem. Size of the physical screen should never be exposed under any circumstances. The current size of the browser window is reasonable on its face but now that fingerprinting is understood to be an issue should always be heavily letterboxed unless the user consents to sharing the exact value. Video formats should be provided by the website as a list of offerings and the browser should respond with a choice; the user could optionally intervene. There's no reason to expose the full capabilities to a remote service. Querying the current time should be gated behind an explicit permission. There's almost never a need for it. However from a fingerprinting perspective you also have to worry about correlating the rate of clock skew across clients. That can be solved by gating access to high resolution time counters behind an explicit permission as (once again) the vast majority of services have no legitimate use for such functionality.

db48x 6mo ago
> Fonts should be provided by the website No way! I don’t ever use any font provided by the website. I don’t even let websites choose which fonts get used. Instead I choose a set of fonts (monospaced and proportional) that are readable and everything uses those. If you want to see what that looks like, go into the Firefox settings, find the Fonts section, click Advanced, and then uncheck “Allow pages to choose their own fonts, instead of your selections above”. Be sure to adjust the “Minimum font size” while you’re here so that nobody uses text sizes that you cannot read.
BizarroLand 6mo ago
> fonts should be provided by the website Yeah, because I love it when every website I go to downloads 10 megs of fonts to my computer before it starts rendering the page. Fonts should be suggested by the website, and a bog-standard "every computer has this" font should be listed as the fallback. > Timezone and other obviously private metadata should never be shared without the user explicitly granting permission on a case by case basis 100% agree. > Size of the physical screen should never be exposed under any circumstances I mostly agree, but with the understanding that this would cause issues with "modern" web pages having very difficult to format layouts. Responsive design requires a response, after all. > Video formats should be provided by the website as a list of offerings and the browser should respond with a choice You're still getting the same feedback with this, that the browser chose to use X format, so you're not increasing privacy with this, only difficulty. > Querying the current time should be gated behind an explicit permission 100% agree. If there is no active local processing of information that the server relies on, in the format of a game or some other interactivity, then there is no reason why the server needs to know your local time.
- fc417fc802 6mo ago
  > fonts That's why I said that a spec mechanism should also be provided. The issue is that sites can perform measurements regarding the layout that change based on the font used. So the browser should only ever provide a few fallbacks, nothing more, and anything else needs to come from the site itself. > screen size I think maybe you're confusing the physical screen with the current size of the browser window? > video formats The issue at present is that a site can programatically test a long list of formats against your setup to see what happens. What I'm describing increases privacy because the site can no longer directly query for the entire list of supported formats and the user can optionally control the process. Obviously it's still possible to botch the implementation on the browser's end but the point is to make it possible to do the right thing.
Izkata 6mo ago
> if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. Width of individual characters would still reveal the browser's choice to some extent. Stick them in an inline-block element and check its width. > Video formats should be provided by the website as a list of offerings and the browser should respond with a choice The server still controls what's offered and can see what's supported by offering different combinations. Besides, isn't this how it works now?
- fc417fc802 6mo ago
  > character width That is a fair point but it would presumably still be a step in the right direction. > video formats True, a malicious streaming site could still work to fingerprint your client if you watched multiple different videos. However that would require active work on the part of the server and could be mitigated by the client which is already miles better than the status quo. I suppose my proposed solution would also introduce a new constraint that a stream couldn't switch codecs from one chunk to the next but I doubt that would be much of an issue in practice. I don't believe that's how it works now. At present the server would typically send code that queries for codec support prior to sending video chunks. These days there's the low level WebCodecs API; [0] previously you would have used MediaSource.isTypeSupported( ... ). [1] The issue is that at present the code sent by the server handles any queries and makes the selection. That leaves the door open to run arbitrary queries for the purpose of characterizing the underlying platform. [0] https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_API https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_A... [1] https://developer.mozilla.org/en-US/docs/Web/API/Media_Source_Extensions_API https://developer.mozilla.org/en-US/docs/Web/API/Media_Sourc...
  - Izkata 6mo ago
    ..I'm thinking of the <video> <source> elements: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/source https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... > If the type attribute is specified, the browser immediately compares it with the media types it can display. If the type is not supported, the browser skips querying the server and directly checks the next <source> element.

db48x 6mo ago

> Fonts should be provided by the website No way! I don’t ever use any font provided by the website. I don’t even let websites choose which fonts get used. Instead I choose a set of fonts (monospaced and proportional) that are readable and everything uses those. If you want to see what that looks like, go into the Firefox settings, find the Fonts section, click Advanced, and then uncheck “Allow pages to choose their own fonts, instead of your selections above”. Be sure to adjust the “Minimum font size” while you’re here so that nobody uses text sizes that you cannot read.

BizarroLand 6mo ago

> fonts should be provided by the website Yeah, because I love it when every website I go to downloads 10 megs of fonts to my computer before it starts rendering the page. Fonts should be suggested by the website, and a bog-standard "every computer has this" font should be listed as the fallback. > Timezone and other obviously private metadata should never be shared without the user explicitly granting permission on a case by case basis 100% agree. > Size of the physical screen should never be exposed under any circumstances I mostly agree, but with the understanding that this would cause issues with "modern" web pages having very difficult to format layouts. Responsive design requires a response, after all. > Video formats should be provided by the website as a list of offerings and the browser should respond with a choice You're still getting the same feedback with this, that the browser chose to use X format, so you're not increasing privacy with this, only difficulty. > Querying the current time should be gated behind an explicit permission 100% agree. If there is no active local processing of information that the server relies on, in the format of a game or some other interactivity, then there is no reason why the server needs to know your local time.

fc417fc802 6mo ago
> fonts That's why I said that a spec mechanism should also be provided. The issue is that sites can perform measurements regarding the layout that change based on the font used. So the browser should only ever provide a few fallbacks, nothing more, and anything else needs to come from the site itself. > screen size I think maybe you're confusing the physical screen with the current size of the browser window? > video formats The issue at present is that a site can programatically test a long list of formats against your setup to see what happens. What I'm describing increases privacy because the site can no longer directly query for the entire list of supported formats and the user can optionally control the process. Obviously it's still possible to botch the implementation on the browser's end but the point is to make it possible to do the right thing.

Izkata 6mo ago

> if not provided the choice should take the form of a spec sent by the website including line height, sarifs or not, monospace or not, etc. Width of individual characters would still reveal the browser's choice to some extent. Stick them in an inline-block element and check its width. > Video formats should be provided by the website as a list of offerings and the browser should respond with a choice The server still controls what's offered and can see what's supported by offering different combinations. Besides, isn't this how it works now?

fc417fc802 6mo ago
> character width That is a fair point but it would presumably still be a step in the right direction. > video formats True, a malicious streaming site could still work to fingerprint your client if you watched multiple different videos. However that would require active work on the part of the server and could be mitigated by the client which is already miles better than the status quo. I suppose my proposed solution would also introduce a new constraint that a stream couldn't switch codecs from one chunk to the next but I doubt that would be much of an issue in practice. I don't believe that's how it works now. At present the server would typically send code that queries for codec support prior to sending video chunks. These days there's the low level WebCodecs API; [0] previously you would have used MediaSource.isTypeSupported( ... ). [1] The issue is that at present the code sent by the server handles any queries and makes the selection. That leaves the door open to run arbitrary queries for the purpose of characterizing the underlying platform. [0] https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_API https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_A... [1] https://developer.mozilla.org/en-US/docs/Web/API/Media_Source_Extensions_API https://developer.mozilla.org/en-US/docs/Web/API/Media_Sourc...
- Izkata 6mo ago
  ..I'm thinking of the <video> <source> elements: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/source https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... > If the type attribute is specified, the browser immediately compares it with the media types it can display. If the type is not supported, the browser skips querying the server and directly checks the next <source> element.