News for hackers. Stuff that matters.
Re:Crooked Style Sheeding – Webpage tracking using only CSS by gsnedders on Tuesday January 16, 2018 @08:41AM (#16158047)
> * Media query - So what, user agent gives this away mostly anyways

It doesn't; without media queries you can't detect thing like browser window size or screen pixel density.

> * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most)

There's a lot of trade-offs here. Plenty of people have fonts installed for various reasons (some because none of the system fonts cover a script they want, some because they're using fonts designed to mitigate some issues caused by dyslexia, etc.), and breaking it for those people would not be good.

Re:Crooked Style Sheeding – Webpage tracking using only CSS by kodablah on Tuesday January 16, 2018 @08:47AM (#16158080)
> It doesn't; without media queries you can't detect thing like browser window size or screen pixel density.

Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess.

> There's a lot of trade-offs here [...]

I'll take it as an option to have a strict subset (though would prefer it as opt-out to discourage font-list-based fingerprinting as a practice, though metric-based may never leave). With downloadable fonts, I don't really like the "script they want" excuse. For accessibility reasons, I am admittedly naive, but I would assume it would be a substitute for an existing font name. Unique font names per user seem unnecessary.

Re:Crooked Style Sheeding – Webpage tracking using only CSS by talmand on Tuesday January 16, 2018 @10:39AM (#16158910)
>> Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess.

>> Unique font names per user seem unnecessary.

As a dev that has worked in CSS for over a decade, I have no idea what either of those mean.

EDIT: I see the unique font names part now, totally missed that while focusing on the other parts.

Re:Crooked Style Sheeding – Webpage tracking using only CSS by kodablah on Tuesday January 16, 2018 @01:51PM (#16160948)
By "CSS property queries" I mean the technique in TFA using @supports + before/after-content URLs to query whether certain CSS properties are supported.
Re:Crooked Style Sheeding – Webpage tracking using only CSS by talmand on Tuesday January 16, 2018 @02:27PM (#16161389)
I see my problem now, I don't see @supports as a query like in terms of media queries.
Re:Crooked Style Sheeding – Webpage tracking using only CSS by mrob on Tuesday January 16, 2018 @09:51AM (#16158543)
If somebody has fonts installed for specific reasons then presumably they don't want web pages changing them. Web pages shouldn't need any more control than selecting from "serif", "sans-serif", or "monospace". The most legible font is the font you're most familiar with. I don't want web pages to use different fonts just because some marketing drone thought it was good for branding. It's disappointing that we allowed websites to abuse fonts for vector icons.
Re:Crooked Style Sheeding – Webpage tracking using only CSS by kmbriedis on Tuesday January 16, 2018 @12:06PM (#16159761)
Have you heard a term 'design'? + sometimes you can't adjust the website to work well with all (or even the popular ones) sans-serif fonts
Re:Crooked Style Sheeding – Webpage tracking using only CSS by goialoq on Tuesday January 16, 2018 @02:13PM (#16161234)
Give one example where users benefit from the website forcing a special font. And even if that happens, the website can provide the font to the user. None of this requires the user telling the website host which fonts are installed.