Crooked Style Sheeding – Webpage tracking using only CSS

Re:Crooked Style Sheeding – Webpage tracking using only CSS by rollcat on Tuesday January 16, 2018 @01:29PM (#16160657)

> * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most)

Oh my. I wish this madness ended. Quoth tedu:

> I don’t know a whole lot about typography and fonts, but there’s two things I know about font files. They’re ridiculously complex and their parsers have only just begun to experience life with hostile inputs. In short, I’d put fonts second on my list of files likely to pwn your browser, after Flash [...].

[ Parent | on HN ]

Re:Crooked Style Sheeding – Webpage tracking using only CSS by jandrese on Tuesday January 16, 2018 @02:40PM (#16161532)

I've thought for some time that the only reason people have not exploited fonts to take over browsers is because even hackers don't understand how they work.

[ Parent | on HN ]

Re:Crooked Style Sheeding – Webpage tracking using only CSS by bzbarsky on Tuesday January 16, 2018 @09:44PM (#16165056)

Note that browsers pass downloadable fonts through a sanitizer before they even consider handing them off to anything else that might need to parse the font. And browser security teams have spent years now fuzzing both those sanitizers and various font libraries...

There's still a lot of attack surface here, but "only just begun to experience life with hostile inputs" isn't quite true either.

[ Parent | on HN ]