Re: [w3c/permissions] A new permission for canvas data (#165)

> Inspecting what code points the browser can find a glyph for basically has the same privacy implications. Though given that you can determine it through rendering perhaps we should offer some kind of more straightforward API around that (and make it async so it can be blocked more easily)...
>
> @tabatkins has the CSS WG been thinking about such a thing?

More or less - Houdini is planning on including a much more robust font-metrics API, so you can do complicated font-specific rendering on your own (like what the 'initial-letter' property does, for example).

Privacy implications are minimal, since the horse has already left the barn - as you say, it's quite trivial to probe the list of a user's installed fonts today by just inspecting layout (and this apparently gives quite a few bits of entropy when fingerprinting).

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/permissions/issues/165#issuecomment-355417860