Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blocking web fonts for speed and privacy (2016)

collinmbarrett.com

Post reply on HN
Print view View original

121–130 of 146 posts

Re: Blocking web fonts for speed and privacy (2016)

#121

Post by weberer »

dngray wrote: post #67
cmeacham98 wrote: post #20

Earlier quoted context omitted.

LocalCDN provides no meaningful privacy gains over enabling Total Cookie Protection (i.e. dynamic FPI, already enabled by default in modern versions of Firefox) and disabling cross-site referers, which you should do anyways.

This, it's also why it's in the category of "don't bother" https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don... not only that it will make your browser easier to fingerprint as one of the Tor developers pointed out.

That guide keeps mentioning something called RFP, but never explains what that stands for or how to install it.

Re: Blocking web fonts for speed and privacy (2016)

#122

Post by lelandfe »

molticrystal wrote: post #12

In a similar vein, LocalCDN is an extension to serve the most common javascript libraries from your browser instead of going to 3rd party servers, while there are edge cases when you use a local copy, I've rarely had an issue. https://codeberg.org/nobody/LocalCDN/ Removes integrity and crossorigin tags from embedded script and style elements to replace even more frameworks Font Awesome Google Material Icons jQuery Bo…

With caches now partitioned in all browsers, and CDN-hosting your code now strictly a worse option overall, it's becoming rarer and rarer for this extension to activate in my browser. I'm likely to uninstall it soon, which is a good thing.

Re: Blocking web fonts for speed and privacy (2016)

#123

Post by bruce343434 »

checkyoursudo wrote: post #101
eyelidlessness wrote: post #64

Earlier quoted context omitted.

Disallowing font loading would be trivially used in fingerprinting. The non-boolean cascade of font fallbacks is too, but knowing that a user has a browsing context which should trigger one or more of those fallbacks, but doesn’t, is far more information than knowing that their browser behaves as expected.

How do you distinguish between passive failure and active disruption of your signal source? Unless you have yet another signal that can provide that information, then you cannot know that you have gained information by lack of original signal.

The assumption that the internet was working at the time of the original request so that the following font requests (a few milliseconds later) should also go through. There will be a few edge cases missed by this but I think it holds for such a large percentage of cases that they can just assume it.

Re: Blocking web fonts for speed and privacy (2016)

#124

Post by [deleted] »

checkyoursudo wrote: post #101
eyelidlessness wrote: post #64

Earlier quoted context omitted.

Disallowing font loading would be trivially used in fingerprinting. The non-boolean cascade of font fallbacks is too, but knowing that a user has a browsing context which should trigger one or more of those fallbacks, but doesn’t, is far more information than knowing that their browser behaves as expected.

How do you distinguish between passive failure and active disruption of your signal source? Unless you have yet another signal that can provide that information, then you cannot know that you have gained information by lack of original signal.

[deleted]

Re: Blocking web fonts for speed and privacy (2016)

#125

Post by cmeacham98 »

weberer wrote: post #121
dngray wrote: post #67

Earlier quoted context omitted.

This, it's also why it's in the category of "don't bother" https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don... not only that it will make your browser easier to fingerprint as one of the Tor developers pointed out.

That guide keeps mentioning something called RFP, but never explains what that stands for or how to install it.

RFP is Firefox's 'Resist Fingerprinting' setting: https://support.mozilla.org/en-US/kb/firefox-protection-agai...

The guide is meant to go along with the arkenfox user.js from that repo (previously known as ghacks user.js), and I highly recommend checking out the rest of the repo if you are privacy-conscious.

Re: Blocking web fonts for speed and privacy (2016)

#126

Post by Semaphor »

dngray wrote: post #106
cmeacham98 wrote: post #70

Earlier quoted context omitted.

+1, that guide is a beacon of light in the sea of misinformation about what extensions to use. I agree with almost everything on it.

Yes "we" (privacyguides.org) consult with the authors of that project as well as a few others. It was nice to see they quoted our blog article https://www.privacyguides.org/blog/2021/12/01/firefox-privac... We've been on a bit of a mission of trying to dissuade people from "old thinking" of installing a gazillion "privacy extensions".

Just a quick FYI:

> We also noticed that there isn’t an option for HTTPS-Only mode.

Firefox on Android does support that, nowadys.

Re: Blocking web fonts for speed and privacy (2016)

#127

Post by marssaxman »

phantomathkg wrote: post #31

This is a very shortsighted view from developer who forget a web page is not only a bunch of text. Designer also play an important role to provide the subtle design element that developers don't value. By blocking all web fonts and fallback to only system font, you may still be able to read the text, but will completely missed the design.

I "completely miss the design" as often as possible, stripping it all off via Reader Mode.

Re: Blocking web fonts for speed and privacy (2016)

#128

Post by termin4l »

charlieyu1 wrote: post #68
toastal wrote: post #30

Earlier quoted context omitted.

Agreed. It's been like 7 years since icon fonts were recommended and it's a real shame I still regularly see people do it today.

I mean the outdated tutorials still suggest icon fonts. What’s a good alternative?

Use graphics for icons.

For a11y reasons, include a text alternative, like the alt attribute on elements or adding a in your .

https://css-tricks.com/accessible-svgs/

Re: Blocking web fonts for speed and privacy (2016)

#129

Post by DavideNL »

qart wrote: post #25

I have been doing this since years but many sites become unusable with FontAwesome blocked. For the time being, I manually unblock fonts on absolutely necessary websites. Any hints on how I can unblock only fonts from FontAwesome, preferably from ublock origin?

Perhaps "LocalCDN" can use the local font cache? Not sure if it works (/for only FontAwesome...)

https://www.localcdn.org/test/fontawesome

Re: Blocking web fonts for speed and privacy (2016)

#130

Post by Dracophoenix »

dngray wrote: post #106
cmeacham98 wrote: post #70

Earlier quoted context omitted.

+1, that guide is a beacon of light in the sea of misinformation about what extensions to use. I agree with almost everything on it.

Yes "we" (privacyguides.org) consult with the authors of that project as well as a few others. It was nice to see they quoted our blog article https://www.privacyguides.org/blog/2021/12/01/firefox-privac... We've been on a bit of a mission of trying to dissuade people from "old thinking" of installing a gazillion "privacy extensions".

Why do "you" (as in PrivacyGuides) keep ProtonMail on the recommended list of email services after it was revealed the company disclosed IP information on a consumer to French authorities?

I would think this would be an important consideration in your assessment of the company.

https://www.theverge.com/2021/9/6/22659861/protonmail-swiss-...

At the very least mentioning this information would be beneficial to your readers.

Post reply on HN