Re: [csswg-drafts] [css-fonts] incorporate mitigations for font based fingerprinting (#4055)

> The performance cost of the _fix_ is that people would end up downloading web fonts that they don't actually need (because they already have the font installed on their system).
> 
> E.g., I have most common Google Fonts installed, and one of the reasons I did that was to cut down on web font downloads. If we prevent browsers from using those custom installed fonts, there will be a performance cost to me (more data usage and slower page loading) when visiting sites that use these fonts.
> 
> How many people this will affect, and to what degree, I can't say. Some browsers give users the option to turn off web font downloads altogether, which would negate the performance impact but increase the impact on user experience. E.g., turning off web fonts might not be a good solution for people whose pre-installed system fonts don't offer a lot of choice for the languages/scripts they use.

I think it would be useful to know how many people have separately installed many web fonts onto their systems and would get this bandwidth-reduction benefit. It looks like SkyFonts provides a service for that (including citing bandwidth benefits), but it's not really emphasized on the Google Fonts site itself, for example.

But couldn't browsers provide that performance benefit by caching web fonts? It doesn't have to be system-installed, a site can refer to a web font and if the browser has it cached, then the user doesn't incur the bandwidth cost; Google Fonts are typically cached for one year. There are potential privacy implications regarding timing attacks on cached resources as well, but they're not nearly as easy or expansive as accessing the list of fonts, which (sorry to repeat the point) is one of the highest entropy fingerprinting sources available ([in the top 3 to 4](https://hal.inria.fr/hal-01718234v2/document), depending on some details like platform or the particular dataset).

-- 
GitHub Notification of comment by npdoty
Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/4055#issuecomment-532404147 using your GitHub account

Received on Tuesday, 17 September 2019 21:12:07 UTC