Wow, CSS system color keywords seem like a massive privacy leak. I just tested setting the property: background: Background; on an element, and then changing my Windows desktop background. The element immediately changes color to match my desktop. Then if I call getComputedStyle on the element, I get my desktop background color in javascript. This is in Firefox private mode, and apparently every website can read all…
It's already trivially easy to fingerprint a user in about a dozen other ways via: User Agent String (being fixed soon by the Chrome team) HTTP_ACCEPT headers Browser plugin metadata Time zone System fonts Supercookies Canvas and WebGL fingerprinting AudioContext Device CPU and memory What's one more bit of information?
Many of these should also not be exposed to websites without explicit authorization.