W3C home > Mailing lists > Public > www-style@w3.org > August 2015

Re: [css-fonts] "system" generic font name

From: Tab Atkins Jr. <jackalmage@gmail.com>
Date: Wed, 5 Aug 2015 14:11:34 -0700
Message-ID: <CAAWBYDAB+AOp6KX8jNZc3YxBfB+N-VN5KBh8X8gEcfSYj65aew@mail.gmail.com>
To: Henrik Andersson <henke@henke37.cjb.net>
Cc: Nick Doty <npdoty@w3.org>, www-style list <www-style@w3.org>
On Wed, Aug 5, 2015 at 12:09 PM, Henrik Andersson <henke@henke37.cjb.net> wrote:
> Tab Atkins Jr. skrev:
>> Installed-fonts detection in general is fairly trivial and already
>> offers a *ton* of entropy for fingerprinting. (You just have to have a
>> large list of fonts to test for, which is easy to assemble; the actual
>> tests can be done off-screen and in practically no time.) Exposing the
>> system font doesn't offer much, if any, beyond this.
>
> Or you could ask Flash for the actual list, no need to guess what fonts
> exists then.

Yeah, Flash and Silverlight expose them directly, but even users
without plugins turned on can be trivially fingerprinted.

~TJ
Received on Wednesday, 5 August 2015 21:12:21 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 5 August 2015 21:12:21 UTC