Hacker News Reader

Comment by NVRM | Hacker News Reader

Heys guys complaining. This is cross framing. 98% of the websites you are using use google fonts, youtube videos, external libraries and «serverless» telemetry. So please, don't act as little virgins, we had warn you in loops since years and years.

View on HN

Agree, I think most web devs should already know this, I am just surprised it's not a popular topic of discussion.

Also, the common argument for this technique that CDN lets you cache content so that users don't have to re download it every time. But I think it could also be done at the HTML level by precising a hash value of the file that we want to integrate (I stopped web dev for a few years I don't know if that has been added to HTML ?)

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

The property is used to ensure the CDN is serving legit content that has not been tampered with.

What about your internet provider and belongers. Also sorry but nothing is free in our world. Mostly if it involve servers.

Google fonts only requests CSS.

Yeah but look at the url that download the fonts. They contains trackers. These are hash keys, exchanging crafted informations about your browser and your current «position» on the Internet. These informations alone are enough to track everything in an unique manner. Our browser are leaking many things, the fonts installed, the screen size, the external and local ip first, but also: nothing is perfect in our world. Including machines, the same tests on identical machines doesn't match exactly, and there is many possible tests. All this informations makes you absolutely unique on the Internet, and a single call to a server is enough. And I am not talking about cookies there.

it can only request css. but most common implementation is js

The wizardry is server side. See the css. You won't get the same hash. When called one time + ip + client browser hash, it is enough. Next website visited with a google font, you are tracked.

/* latin */ @font-face { font-family: 'Tangerine'; font-style: normal; font-weight: 400; src: local('Tangerine Regular'), local('Tangerine-Regular'), url(https://fonts.gstatic.com/s/tangerine/v9/IurY6Y5j_oScZZ784Ox...) format('woff2'); unicode-range: U+0000-(...) }

https://fonts.googleapis.com/css?family=Tangerine

That's sneaky, I didn't know about it. Thanks for pointing it out.

Reply on news.ycombinator.com