Hacker News Reader

Comment by upbeat_general | Hacker News Reader

One thing I don’t see mentioned here is the possibility of additional profiling by disabling web fonts. Doesn’t this make you more more unique as a user since very few people disable web fonts?

I suppose you could argue that many users can be uniquely identified either way but it’s no doubt a strong additional piece of info.

View on HN

The point is not to access third party tracking hosts (including web fonts and JS library servers) at all. The number of sites that implement first party server-side tracking to exchange data with other systems (like Imgur) is much lower than the number of sites that “simply added” fonts, libraries or counters from popular delivery networks.

Unless, of course, we talk about any site that uses Cloudflare, which is a first party tracking service built into into the web server itself.

The absence of info can’t be “additional” info. It’s a differentiating factor, but at best it’s on par with any other single info you would have sent through the font fetching request.

Arguably that single boolean characteristic (“fonts disabled”) is way less info than the dozens of characteristics you expose when fetching a font.

Disallowing font loading would be trivially used in fingerprinting. The non-boolean cascade of font fallbacks is too, but knowing that a user has a browsing context which should trigger one or more of those fallbacks, but doesn’t, is far more information than knowing that their browser behaves as expected.

How do you distinguish between passive failure and active disruption of your signal source? Unless you have yet another signal that can provide that information, then you cannot know that you have gained information by lack of original signal.

The assumption that the internet was working at the time of the original request so that the following font requests (a few milliseconds later) should also go through. There will be a few edge cases missed by this but I think it holds for such a large percentage of cases that they can just assume it.

The server where the font is being loaded from would have no record of your activity. That's the but that improves privacy. I think there's an expectation that if you're concerned to this extent you'd have JS disabled as well, which would make it hard to detect whether you're displaying the font. Probably not impossible with CSS though.

The best middle-ground would be to spoof the most common set of fonts (probably Windows X default fonts?) as that would surely increase the number of probablistic matches over custom fonts / no fonts I can't imagine a large percentage of users (probably no browsers) completely disable web fonts and web font fingerprinting.

Is it possible to spoof information like that in a browser without reprecussions though? I don't think I've seen any extensions to spoof things like this, just settings to block the gathering of data in the first place.

Reply on news.ycombinator.com