Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Fingerprinting Without JavaScript

fingerprintjs.com

Post reply on HN
Print view View original

71–80 of 124 posts

Re: Browser Fingerprinting Without JavaScript

#71

Post by sva_ »

onion2k wrote: post #57
wbobeirne wrote: post #13

Earlier quoted context omitted.

This feels like it's targeted at a very narrow view of what a browser is for. How would a site like fonts.google.com work?

Giving up resources like Google Fonts in order to increase privacy for the entire web seems like a fair trade off to me. Besides, it'd still work fine, but you'd only be able to view two or three fonts at a time.

> Besides, it'd still work fine, but you'd only be able to view two or three fonts at a time.

That would be trivial to break over a few requests, I think

Re: Browser Fingerprinting Without JavaScript

#72

Post by tomthe »

noduerme wrote: post #52
onion2k wrote: post #11

Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much. It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.

That's just insane. Sites and apps I build these days usually include FontAwesome and/or another icon library, frequently along with a custom dingbat font for the company's unique logos and iconography (we bundle all relevant vector art as a font). Then you have primary and secondary brand fonts, along with sometimes readability fonts. Not to mention iframed forms coming off credit card gateways. I have no idea how a…

I could live with that and I think many users would agree.

Re: Browser Fingerprinting Without JavaScript

#73

Post by noduerme »

tomthe wrote: post #72
noduerme wrote: post #52

Earlier quoted context omitted.

That's just insane. Sites and apps I build these days usually include FontAwesome and/or another icon library, frequently along with a custom dingbat font for the company's unique logos and iconography (we bundle all relevant vector art as a font). Then you have primary and secondary brand fonts, along with sometimes readability fonts. Not to mention iframed forms coming off credit card gateways. I have no idea how a…

I could live with that and I think many users would agree.

Live with a 2 font maximum and popups every time a site chose to load another font? It would break every icon on the web. You'd either only load the icons or only load the text fonts. If you want to avoid fingerprinting, and actually think this method remotely works, by all means block those requests. If you actually care about privacy a better place to start would be the fact that chrome logs you in on the browser level whenever you login to anything with a Google password. Some random fingerprinting is not worth shutting down all design for. On that idea we should just go back to dialup because everything is too dangerous for idiots to handle.

Re: Browser Fingerprinting Without JavaScript

#74

Post by judge2020 »

ranger_danger wrote: post #66
judge2020 wrote: post #35

Earlier quoted context omitted.

Obviously the browser must prompt users before displaying non-ascii characters as well. Who wants to do anything other than read mailing lists in their browser?

Not everyone on Earth uses an ascii-compatible language, though.

I made the comment in jest, primarily to illustrate how restrictions like limiting pages to 2 fonts are completely arbitrary and likely wouldn't even solve the problems presented in the original comment ("make the web look a lot nicer", "stop this sort of privacy attack").

Re: Browser Fingerprinting Without JavaScript

#75

Post by noduerme »

onion2k wrote: post #60
noduerme wrote: post #53

Earlier quoted context omitted.

You don't seem to realize that the fingerprinting has nothing to do with what fonts you load from a page. It's what fonts you have installed on your machine.

The font-face attack in the article requires loading the font from a remote location. A JS font numeration attack works with local fonts. That would need a different mitigation in the browser, but browsers could, for example, have an array limited to three elements that JS gets when it asks for a font list, or just return the system default fonts, or just say no. A permission to get the full list would be necessary f…

I think icon fonts and custom icon fonts (like I build) are a huge win for web designers, a giant leap over embedded SVG or images as they can be scaled with CSS and without any SVG embedding or code; and they're tiny and don't need progressively larger files (like images). Yeah obviously there are workarounds but it's such a good tool that blowing it up because someone could use it for nefarious tracking purposes is equivalent to blowing up images. Hey how about we limit all Ajax calls until a user confirms. Or make them confirm every HTTP header one by one. You want to go after fonts? Shit, we've really fucked up civilization if we have to make everything in Arial or Times New Roman just to protect people from being tracked.

Re: Browser Fingerprinting Without JavaScript

#76

Post by noduerme »

onion2k wrote: post #60
noduerme wrote: post #53

Earlier quoted context omitted.

You don't seem to realize that the fingerprinting has nothing to do with what fonts you load from a page. It's what fonts you have installed on your machine.

The font-face attack in the article requires loading the font from a remote location. A JS font numeration attack works with local fonts. That would need a different mitigation in the browser, but browsers could, for example, have an array limited to three elements that JS gets when it asks for a font list, or just return the system default fonts, or just say no. A permission to get the full list would be necessary f…

Also, fingerprinting is not necessarily an attack at all. I use it frequently to see whether a user is logging in from an unknown box, in which case we'll require secondary authentication. It's actually not a bad thing if you're using it as one part of a verification process to secure user accounts. It only gets bad if you track people around with it or share those prints with other sites to aggregate behavioral data. I use it regularly to keep my own customers safe.

Re: Browser Fingerprinting Without JavaScript

#77

Post by onion2k »

noduerme wrote: post #73
tomthe wrote: post #72

Earlier quoted context omitted.

I could live with that and I think many users would agree.

Live with a 2 font maximum and popups every time a site chose to load another font? It would break every icon on the web. You'd either only load the icons or only load the text fonts. If you want to avoid fingerprinting, and actually think this method remotely works, by all means block those requests. If you actually care about privacy a better place to start would be the fact that chrome logs you in on the browser l…

If you actually care about privacy a better place to start would be the fact that chrome logs you in on the browser level whenever you login to anything with a Google password.

Google is not the only company that has no respect for privacy. Privacy protection needs to go further, and stop privacy invasion completely.

There is a reasonable balance to strike between privacy, design and usability though. That's why I said 2 or 3 fonts. Maybe 4 at a push. If a site is using more than that then either the developers aren't very good, or the designers aren't very good, or it's trying to attack the user's privacy. Whichever one it is, it should be stopped.

Re: Browser Fingerprinting Without JavaScript

#78

Post by onion2k »

noduerme wrote: post #75
onion2k wrote: post #60

Earlier quoted context omitted.

The font-face attack in the article requires loading the font from a remote location. A JS font numeration attack works with local fonts. That would need a different mitigation in the browser, but browsers could, for example, have an array limited to three elements that JS gets when it asks for a font list, or just return the system default fonts, or just say no. A permission to get the full list would be necessary f…

I think icon fonts and custom icon fonts (like I build) are a huge win for web designers, a giant leap over embedded SVG or images as they can be scaled with CSS and without any SVG embedding or code; and they're tiny and don't need progressively larger files (like images). Yeah obviously there are workarounds but it's such a good tool that blowing it up because someone could use it for nefarious tracking purposes is…

don't need progressively larger files (like images)

SVGs are vectors so they aren't larger at larger sizes, and they can be responsive so you don't always have to display the same image at every size.

Re: Browser Fingerprinting Without JavaScript

#79

Post by onion2k »

onion2k wrote: post #11

Browsers should limit every webpage to displaying a maximum of two fonts, and should silently ignore any font face rules after the first two. Maybe three if you're feeling generous. With variable fonts available in every browser it wouldn't impact typography much. It would stop this sort of privacy attack, and it'd have the additional benefit of making the web look a lot nicer.

I can't edit my post now unfortunately, but I have had an idea where websites could use as many fonts as they want - font bundling. If there was a format that could contain any number of fonts, browsers would only need to make one request for specific bundled resource, and then browsers could limit the number of requests and designers could pepper their websites with as many fonts as they want.

In essence, do what we do with JS code, but with fonts.

You'd lose the parallel request benefits of HTTP2 but nevermind.

Re: Browser Fingerprinting Without JavaScript

#80

Post by oshiar53-0 »

southerntofu wrote: post #21

Being a fervent Tor Browser user, i just tried with it and of course the fingerprinting failed. Several copies of it give me the same fingerprints: e56952dba176a47af3c051b626b64ff3 (Safer mode) 632e305f8a939e5ba6afd24eced586f0 (Safest mode) That's because the Tor Browser, contrary to urban legend, is not just a browser that routes trafic through the tor network, but a firefox reworked (most of which is being upstream…

> window cutting

The term you're looking for is letterboxing.

https://www.zdnet.com/article/firefox-to-add-tor-browser-ant...

Post reply on HN