Internet tracking has moved beyond cookies | Hacker News Reader

Internet tracking has moved beyond cookies

fivethirtyeight.com

55 pointspeteretep18 comments

It's about time browsers shipped with an option to lock down a standard set of fonts.

I agree, although you can install Random Agent Spoofer on Firefox, which among other things, has am option to limit fonts.

I don't see many incentives for browser vendors to do it. Google sells ads so they could be benefitting of fingerprinting. Maybe Mozilla could default to not loading webfonts, but there is the risk of people feeling that the browser is broken because it doesn't show the fonts that any other browser does.

I'm using NoScripts on FF which stops webfonts by default. I seldom enable them, almost only when I have to check the real formatting of a web page I'm working on. Anything else is perfectly fine even with the default fonts.

But fonts are only a drop in the ocean of fingerprinting.

That you're one of the few assholes who don't accept custom fonts is potentially useful tracking information. Forbidding any custom fonts is a non-option; the Web belongs to designers now, and they will certainly raise a fuss if they are not allowed fine-grained control over typography.

>Forbidding any custom fonts is a non-option;

Actually it's a very valid option, works well for 99.9% of the websites, and fuck designers.

That's not a very inclusive or productive thing to say, please don't do that.

If they want to show a web font, that's fine by me (leaving aside the security considerations with web fonts for another thread). But why does there need to be an API for querying the set of installed fonts?

I suspect that as long as getComputedStyle() exists, there will be ways for it to leak identifying information. Browsers already break getComputedStyle for some things (i.e., to close the history leak of being able to query whether the "visited" styling is applied to a link), but it may end up that this API just has to disappear completely.

True. I always feel like we are at the point where we shouldn't think about which APIs to add to our browsers, but about which APIs to remove. Browser vendors frequently deprecate SSL versions and ciphers, and in the same vein, we should sacrifice at least some backwards compatibility for more privacy.

I block custom fonts. Some 'designed' typography gives me zero benefits. Page takes forever to load, and entire page is refreshed once font is downloaded.

We can debate about who the web belongs to, but the browser belongs to users.

Any good firefox plugins that can spoof installed fonts and other trackable info?

As per else-where on this thread, Random Agent Spoofer will.

Far more fundamentally, if you don't have Self-Destructing Cookies installed, it's all for nothing, so grab that too.

An NoScript. And Privacy Badger. And HTTPS Everywhere. And uBlock Origin. And nuke history and cache every time you shut down the browser for evercookies. Also flash should be disabled by default.

HTTPS Everywhere will actually leak that you have it. Due to huge demand for JavaScript, NoScript quickly becomes hard to use or nearly worthless for privacy.

Also you just missed Tor Browser and Tor itself. IP address is usually trivial to track.

privacytools.io imo has the best documentation of which add-ons and about config settings you should use while using Firefox for better privacy.

They list the battery API in Firefox, but that is actually whitened exactly to prevent user tracking.

Thanks, I will take a look.

or you could just not spend your entire life connected on the internet.

Reply on news.ycombinator.com