Googlebot’s JavaScript random() function is deterministic

Re:Googlebot’s JavaScript random() function is deterministic by nordsieck on Wednesday February 07, 2018 @11:42AM (#16325715)

IMO, one of the most difficult fingerprinting attacks to defend against is the installed fonts list. I wish incognito mode only made a standardized list of fonts available.

[ Parent | on HN ]

Re:Googlebot’s JavaScript random() function is deterministic by cpeterso on Wednesday February 07, 2018 @12:36PM (#16326292)

Firefox is experimenting with a font whitelist as part of upstreaming of Tor features into Firefox trunk. These features are controlled by the privacy.resistFingerprinting pref. resistFingerprinting has some webcompat issues, but Mozilla is considering a subset of the protections for Privacy Browsing mode, similar to Tracking Protection. Here is the work-in-progress bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=1336208

[ Parent | on HN ]

Re:Googlebot’s JavaScript random() function is deterministic by cosmie on Wednesday February 07, 2018 @12:27PM (#16326205)

I wonder if the fontSettings section of the Chrome extensions API[1] can be used to defend against that. By randomly and deliberately poisoning that info for when in Incognito mode (or even regular browsing).

[1] https://developer.chrome.com/extensions/fontSettings

[ Parent | on HN ]

Re:Googlebot’s JavaScript random() function is deterministic by blattimwind on Wednesday February 07, 2018 @01:39PM (#16326871)

Why does that feature even exist?

[ Parent | on HN ]

Re:Googlebot’s JavaScript random() function is deterministic by fbdjskajxb on Wednesday February 07, 2018 @02:28PM (#16327273)

So dessigners can make adjustments depending on what fonts are available.

[ Parent | on HN ]

Re:Googlebot’s JavaScript random() function is deterministic by blattimwind on Thursday February 08, 2018 @09:28AM (#16332183)

Is there any website actually using it for that purpose? Usual CI policies would be "actively disinterested" in it.

[ Parent | on HN ]

Re:Googlebot’s JavaScript random() function is deterministic by aarongolliver on Friday February 09, 2018 @11:12AM (#16341330)

Any website with a rich text editor would use it.

[ Parent | on HN ]

Re:Googlebot’s JavaScript random() function is deterministic by fenwick67 on Wednesday February 07, 2018 @05:17PM (#16328515)

AFAIK it's not really a feature it's more of an exploit.

Ultimately, the sizing of a font can effect element widths, and element widths can be queried.

[ Parent | on HN ]