11–20 of 124 posts
It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.
I used to think that privacy was a technical problem, then I thought it was a legal problem, now I think it is a reaction problem. We are not disgusted enough. I do wonder if that will change.
Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much. It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.
I used to think that privacy was a technical problem, then I thought it was a legal problem, now I think it is a reaction problem. We are not disgusted enough. I do wonder if that will change.
No, it's a legal problem. There are countries where groping women is not a big deal for example. Even in the most "ideal" EU countries, casual racism is an afterthought. Reaction is a problem because there is no adverse consequence to the perpetrator. I don't need a browser extension, I need CEOs in prison. Then reactions will catch up.
Things are or are not a problem in certain places because that’s just how things have been done. You pick it up when you grow up in that culture.
Which leads to the problem of determining what is actually right or wrong.
For example, I naturally believe that racism is wrong because of the culture I grew up in (multicultural California) tells me that it’s wrong. But I also believe it is wrong because it undermines society and adds unnecessary friction to interactions, so it’s simply more productive if it didn’t exist.
I believe that privacy is important because I believe humans work best when they feel free to think and act freely. I believe society (and myself as a result) benefits far more in that scenario.
Would it be possible to mitigate the CSS based fingerprinting using URLs, by having the client forcibly cache the fonts / urls? I think then on return to the site, there would be client cache hits, and no request to the server on return visits. I imagine this would be a pain for browsing in general, but could help browsers in a privacy mode
In addition to making browsing slower you’d also consume more of your data, if you’re on a capped plan. These days I have a 70 GB plan with data rollover, which leaves me with plenty of data to spare. But for the longest time I used to be on a plan with only a couple of GB of data per month, and it was a real pain in general. In that situation, downloading all resources instead of only the ones I need would have made…
Also, your argument assumes everyone is browsing on a phone, and with a "plan". Is there no other way to access the web these days?
I think simply disabling JS spares a lot more battery. Hell, with noScript you can block font manipulation.
> your fingerprint stays the same even if your browser is in incognito mode. OK, I tried the demo with Firefox Focus, and it worked. But it doesn't tell you how unique your fingerprint is. If multiple users have the same fingerprint, then its effectiveness will be limited.
ETAG fingerprinting is perhaps the most reliable non JS approach.
I used to think that privacy was a technical problem, then I thought it was a legal problem, now I think it is a reaction problem. We are not disgusted enough. I do wonder if that will change.
Well, the real problem is advertising. It is far too profitable. If we want to live in a less distorted world, start taxing digital advertising heavily. Give people the real choice to pay for services (like we do in every other area in life) instead of paying with their privacy.