Comment by commandlinefan | Hacker News Reader

Comment by commandlinefan | Hacker News Reader

> Websites can see what fonts your computer has installed

They can? I looked into this once - I was putting together a demo site for a friend who does graphic design (like physical signs) and he had a lot of unusual fonts installed on his computer that he would have liked to use from the website. He wanted a dynamic drop-down of all installed fonts so he could select the one to use in the demo, but as far as I could tell, Javascript doesn't allow that specifically because it could lead to browser fingerprinting/security problems.

You can throw a big list at

    document.fonts.check()

and it will tell you if it's on that system. For instance, try:

    console.log(document.fonts.check("12pt Apple Color Emoji"));

Ah... so you can tell if a specific font is loaded, but not list which fonts there are. That makes sense, thanks.

Fingerprinting with fonts is done by measuring the size of especially selected glyphs at large font sizes.

Just spitballing but even if you can’t enumerate the fonts, you could draw text with the targeted font on a hidden canvas element and check if the resulting pixels roughly resemble what would be expected versus a “fallback” font?

I guess we need a "load fonts" opt-in flag for the Canvas API that sets the "no readback" flag that also gets tripped when loading non-same-origin images?

Reply on news.ycombinator.com