Re: [csswg-drafts] [css-fonts] incorporate mitigations for font based fingerprinting (#4055)

I don't think a **must** is viable here without a better solution for addressing language support.

Many languages aren't supported in the default fonts installed on a given operating system.  In many cases users can then install fonts that support more languages by choosing to install support for those languages.  Presumably the requirement being proposed here would allow web use of all of the default fonts for all languages -- which in turn still exposes a good bit of fingerprinting data (which languages the user has installed fonts for) -- but I think there are still significant languages that those defaults don't cover (with significant variation between operating systems).  (It also wouldn't surprise me if the fonts installed on Android devices vary based on carrier/market and aren't consistent within a language, though I'd be happy to be wrong.)

So there's a tradeoff here between one of *many* active fingerprinting vectors and support for significant numbers of the world's languages.  Without clear data that fixing just a part of this active fingerprinting vector (still allowing fingerprinting of which languages are supported by fonts on the system) would make a real dent in ability to do active fingerprinting on the web (which is much easier than passive fingerprinting) -- data that would probably require a project to gather a list of fingerprinting vectors available on the web (with entropy for each item) -- I don't think there's a very clear case for degrading the support for many minority languages on the Web.

-- 
GitHub Notification of comment by dbaron
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/4055#issuecomment-505232667 using your GitHub account

Received on Tuesday, 25 June 2019 00:43:13 UTC