Re:Crooked Style Sheeding – Webpage tracking using only CSS
by talmand on Tuesday January 16, 2018 @10:39AM
(#16158910)
>> Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess.
>> Unique font names per user seem unnecessary.
As a dev that has worked in CSS for over a decade, I have no idea what either of those mean.
EDIT: I see the unique font names part now, totally missed that while focusing on the other parts.
Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess.
> There's a lot of trade-offs here [...]
I'll take it as an option to have a strict subset (though would prefer it as opt-out to discourage font-list-based fingerprinting as a practice, though metric-based may never leave). With downloadable fonts, I don't really like the "script they want" excuse. For accessibility reasons, I am admittedly naive, but I would assume it would be a substitute for an existing font name. Unique font names per user seem unnecessary.