Hacker News Reader

Comment by adrian_b | Hacker News Reader

When for displaying Web pages a browser uses beautiful locally installed fonts instead of ugly widely available fonts, such as Arial, that is not a fingerprinting vulnerability.

It becomes a fingerprinting vulnerability only after the browser (or a script with the permission of the browser) sends information to a 3rd party about which fonts are used on your computer to display text.

The efforts to prevent vulnerabilities must focus on preventing undesirable communication between browsers/scripts and other parties, and not on how the Web pages are displayed, which should be done according to the user preferences.

View on HN

> The efforts to prevent vulnerabilities must focus on preventing undesirable communication between browsers/scripts and other parties, and not on how the Web pages are displayed, which should be done according to the user preferences.

And how would you do so? Probably I lack in fantasy, but I really don't see a way to distinguish _necessary_ traffic from traffic that is useful only for exfiltrating data.

The problem is you have to be willing to define a scope for what a web page should and shouldn't do. The largest developer of web browsers though happens to be obsessed with injecting support for crud like MIDI devices and serial ports to the web platform though, which makes it hard to define a good boundary for behavior.

Unpopular opinion: Arial is fine.

I think I could happily live with say half a dozen fonts on the web (plus variations of bold/italic, if we want to count those as multipliers) for the rest of my life. Sarif, SansSarif, Mono, Weird - that's really my ability or care to tell fonts apart, when I'm there for the interesting article or funny video.

But it's that tension:

I, as a consumer, am happy with simplicity

They, as producers, want branding and differentiation (not to mention tracking and all sorts of other things)

Ultimately, and we mustn't forget this, they the producers are the ones investing effort they need a return on; and we the consumers are lousy when it comes to voting with our feet, dollars, scrolling thumbs and back buttons.

We're talking about system fonts here, not webfonts, so they can differentiate as much as they like with webfonts. Webfonts would still be available. Although they'd also have to go into the per-site cache to prevent sites from fingerprinting by whether or not you already had the font loaded via some other site.

(Web fonts can be quite space-effective, if the site can serve a trimmed-down version that doesn't have the whole unicode space in them. CSS even has support for breaking the font into pieces so if a bit of unicode does slip through on some page you can still go get "the rest" of the font.)

> support for breaking the font into pieces

And in the future, Incremental Font Transfer will make this even easier: https://www.w3.org/TR/IFT/

Arial Nova, not installed by default, is better. Free download in the Microsoft Store. Like Helvetica Neue, it’s slightly more readable by increasing the size of some punctuation marks, lengthening horizontal strokes (e.g. t), and greatly improving kerning.

I never had a problem reading a text on a web-page in the default fonts. Web-pages with some ultra-uber-kewl-modern font? Yep, I had.

Arial fails the Il test. If you can't tell the difference between these two characters, then the font sucks.

And how do you define if something is undesirable? Is sending the width of an element ok? Then you can encode any message you want by putting text into an element and sending its size. Is lazy-loaded image ok? Then you can construct a font with different heights so that displaying a letter will / won't put the following image in the visible area.

You can't derive the intention from the page behaviour.

Reply on news.ycombinator.com