Hacker News Reader

Comment by Flimm | Hacker News Reader

My proposal:

1. Browsers should ship with a set of fonts used just in the web browser that web designers can count on. Right now, there isn't a font I can count on finding in Chrome on all platforms. This especially matters for non-English languages, where a different system font can lead to a website that looks very different.

2. Browsers should not load fonts installed in the operating system. It's a fingerprinting vulnerability. And it also causes issues where the system-installed font is unexpectedly different from platform to platform. For example, Arial is different across platforms, especially once you consider non-English languages.

View on HN

> Browsers should not load fonts installed in the operating system

Already in the works, and some browsers don’t today (eg Safari). They permit the default system fonts (eg Helvetica) but nothing more from user space.

In the future it will be a permission you grant a site: https://wicg.github.io/local-font-access/

It’s a great move. The benefits of local fonts are negligible and the downsides are clearly enormous

Crazy, in a way, that it wasn't already this way from the beginning.

imo it's more crazy that people thought of tracking users by using a font in the first place. The level of human ingenuity that has gone into spying on people is staggering.

Follow the money. It is always about the money. I was at a corporate security conference where one of the speakers stated that organized crime groups hire the top mathematicians and computer scientists from the top universities every year. They provide them with laboratories that you wish your company could afford.

Did the speaker have a source for that claim beyond their own word?

Surely there would be issues with such a scheme.

The web and ideas back then were different. It was so cool to choose wingdings as a font, and make it <blink>. The web would not have evolved the way it is now if we hadn’t had the freedom back then.

many years ago, too many fonts would cripple an average Windows install.

There weren’t any good permissibly-licenced fonts available back then, and browser fingerprinting only became a thing a decade or so later.

WebKit/Safari gets dunked on a lot for being slow to implement features (sometimes rightfully so), but for many features, this is exactly why. Check out this long list of APIs they're purposefully dragging their feet on out of privacy concerns: https://webkit.org/tracking-prevention/#table-of-contents-to...

Many of those are gated behind permissions in the browsers that have implemented them, and safari could gate the rest too. Or they could collaborate with the working groups to reduce the fingerprinting hazard.

Many other features that safari has been late with have basically no fingerprinting usefulness like web push.

I don't understand why they don't just ship a huge set of fonts by default. I'm probably missing some licensing bullshit, but look at Google Fonts and all the amazing fonts there. They're called open source fonts. Is there anything stopping firefox et al from just bundling them, or at least downloading them on-demand from a trusted server (not google)?

It would be lovely if all web developers could just assume that the entirety of google fonts is at their disposal in a native way without having to resort to webfonts and the overhead that brings.

I'd be happy to have many more resources this way, use a hash and some sort of frecency -- but we've moved away from sharing resources across sites, unfortunately.

The problem is not shipping alternative fonts, but blocking access to the system fonts. For compatibility reasons, there needs to be a mechanism to still allow access for specific websites. That’s what the planned feature linked by the parent is for.

> I don't understand why they don't just ship a huge set of fonts by default.

It takes a lot of work to draw a reasonable large set of all the Unicode characters for a given language. Time is money and fonts are ridiculously expensive.

That being said, Firefox has funded a few fonts over the years but they don’t bundle them with the browser. Google has a huge collection but doesn’t bundle them either. It makes more sense with Google as it can collect user data from its WebFont as a service system.

Right, but the Google Fonts are open source so the work has already been done. https://developers.google.com/fonts/faq

> I can count on finding in Chrome

Not like they have any ulterior motives to ensure your users have to ping Googles font service every time they open a page. None at all.

The page should provide a hash, no need to ping a server, just a local cache lookup (like per-site cache schemes now) then a user-selected choice of downloading from the first-party, or an ordered list of third-parties.

Browsers are all moving towards origin-isolation. So, even when you download a font from fonts.example.com from example.net; that downloaded font won’t be available to example.org.

The local cache is, unfortunately, also an unintended source of fingerprinting and cross-origin communication.

Google pushes Noto, which is a requirement on Arch for Firefox.

I ignore its updates, because they're large and quite frequent.

https://github.com/archlinux/svntogit-packages/commits/packa...

It is not a requirement. Packages that depend on it, like firefox, only depend on the virtual package ttf-font, which happens to be satisfied by noto-fonts: https://archlinux.org/packages/extra/x86_64/firefox/.

This means that you get to choose from ttf-liberation, ttf-bitstream-vera, ttf-droid, gnu-free-fonts, noto-fonts, ttf-croscore, ttf-ibm-plex, ttf-dejavu or even all the stuff in the AUR.

Wow, thanks. I was wrong. I will check out the other TTF fonts.

Noto is also the default KDE font family.

When for displaying Web pages a browser uses beautiful locally installed fonts instead of ugly widely available fonts, such as Arial, that is not a fingerprinting vulnerability.

It becomes a fingerprinting vulnerability only after the browser (or a script with the permission of the browser) sends information to a 3rd party about which fonts are used on your computer to display text.

The efforts to prevent vulnerabilities must focus on preventing undesirable communication between browsers/scripts and other parties, and not on how the Web pages are displayed, which should be done according to the user preferences.

> The efforts to prevent vulnerabilities must focus on preventing undesirable communication between browsers/scripts and other parties, and not on how the Web pages are displayed, which should be done according to the user preferences.

And how would you do so? Probably I lack in fantasy, but I really don't see a way to distinguish _necessary_ traffic from traffic that is useful only for exfiltrating data.

The problem is you have to be willing to define a scope for what a web page should and shouldn't do. The largest developer of web browsers though happens to be obsessed with injecting support for crud like MIDI devices and serial ports to the web platform though, which makes it hard to define a good boundary for behavior.

Unpopular opinion: Arial is fine.

I think I could happily live with say half a dozen fonts on the web (plus variations of bold/italic, if we want to count those as multipliers) for the rest of my life. Sarif, SansSarif, Mono, Weird - that's really my ability or care to tell fonts apart, when I'm there for the interesting article or funny video.

But it's that tension:

I, as a consumer, am happy with simplicity

They, as producers, want branding and differentiation (not to mention tracking and all sorts of other things)

Ultimately, and we mustn't forget this, they the producers are the ones investing effort they need a return on; and we the consumers are lousy when it comes to voting with our feet, dollars, scrolling thumbs and back buttons.

We're talking about system fonts here, not webfonts, so they can differentiate as much as they like with webfonts. Webfonts would still be available. Although they'd also have to go into the per-site cache to prevent sites from fingerprinting by whether or not you already had the font loaded via some other site.

(Web fonts can be quite space-effective, if the site can serve a trimmed-down version that doesn't have the whole unicode space in them. CSS even has support for breaking the font into pieces so if a bit of unicode does slip through on some page you can still go get "the rest" of the font.)

> support for breaking the font into pieces

And in the future, Incremental Font Transfer will make this even easier: https://www.w3.org/TR/IFT/

Arial Nova, not installed by default, is better. Free download in the Microsoft Store. Like Helvetica Neue, it’s slightly more readable by increasing the size of some punctuation marks, lengthening horizontal strokes (e.g. t), and greatly improving kerning.

I never had a problem reading a text on a web-page in the default fonts. Web-pages with some ultra-uber-kewl-modern font? Yep, I had.

Arial fails the Il test. If you can't tell the difference between these two characters, then the font sucks.

And how do you define if something is undesirable? Is sending the width of an element ok? Then you can encode any message you want by putting text into an element and sending its size. Is lazy-loaded image ok? Then you can construct a font with different heights so that displaying a letter will / won't put the following image in the visible area.

You can't derive the intention from the page behaviour.

It’s amazing how fingerprinting is making the browser worse on every possible front and the best we can do is propose making it even worse.

fingerprinting is a vulnerability that didn't exist previously (when browsers were designed).

it's now difficult to remove that capability without affecting sites (display-wise, not fingerprinting-wise). reality sucks.

The "vulnerability" has always existed, it was just not as widely exploited (or at least not known to be).

As for how to fix it: When the cost for technical measures to ensure security gets too high we need legal measures to ensure a higher-trust society where such technical measures are not needed. We don't all live in locked down fortresses with bullet proof windows and filtered air and water supplies either even though technically that makes us more vulnerable.

On this point, I would like to put some of the major libraries (like jQuery) just wrapped into the browser and developers have to deal with it. Common graphics like the loading spinner could be included as well. Do we really need to be constantly redownloading all of this? It seems like a waste.

Agreed.

In the meantime, there is a Firefox addon called Font Fingerprinting Defender that attempt to mitigate this attack: https://mybrowseraddon.com/font-defender.html

Reply on news.ycombinator.com