Hacker News Reader

Comment by red_admiral | Hacker News Reader

It's about time browsers shipped with an option to lock down a standard set of fonts.

I agree, although you can install Random Agent Spoofer on Firefox, which among other things, has am option to limit fonts.

I don't see many incentives for browser vendors to do it. Google sells ads so they could be benefitting of fingerprinting. Maybe Mozilla could default to not loading webfonts, but there is the risk of people feeling that the browser is broken because it doesn't show the fonts that any other browser does.

I'm using NoScripts on FF which stops webfonts by default. I seldom enable them, almost only when I have to check the real formatting of a web page I'm working on. Anything else is perfectly fine even with the default fonts.

But fonts are only a drop in the ocean of fingerprinting.

That you're one of the few assholes who don't accept custom fonts is potentially useful tracking information. Forbidding any custom fonts is a non-option; the Web belongs to designers now, and they will certainly raise a fuss if they are not allowed fine-grained control over typography.

If they want to show a web font, that's fine by me (leaving aside the security considerations with web fonts for another thread). But why does there need to be an API for querying the set of installed fonts?

I suspect that as long as getComputedStyle() exists, there will be ways for it to leak identifying information. Browsers already break getComputedStyle for some things (i.e., to close the history leak of being able to query whether the "visited" styling is applied to a link), but it may end up that this API just has to disappear completely.

True. I always feel like we are at the point where we shouldn't think about which APIs to add to our browsers, but about which APIs to remove. Browser vendors frequently deprecate SSL versions and ciphers, and in the same vein, we should sacrifice at least some backwards compatibility for more privacy.

I block custom fonts. Some 'designed' typography gives me zero benefits. Page takes forever to load, and entire page is refreshed once font is downloaded.

>Forbidding any custom fonts is a non-option;

Actually it's a very valid option, works well for 99.9% of the websites, and fuck designers.

That's not a very inclusive or productive thing to say, please don't do that.

We can debate about who the web belongs to, but the browser belongs to users.

Reply on news.ycombinator.com