Fonts Fingerprinting

[Kraxys]

There are currently 2 workarounds to deal with the fonts fingerprinting problem: 1) Set the FF preference browser.display.use_document_fonts to 0 ; In this case, the browsers shows only 10/11 fonts, and some pages aren't well displayed. 2) Adjust the preference font.system.whitelist to a list of fonts many people have chosen to use, in this case, the fonts list used by TBB. For now, this list is containing 60 fonts.

The problem with the 1st solution is the browsers will always show the same list of 10/11 fonts, from a browsing session to another. And as using only 10 fonts is very uncommon, this specific set of 10 fonts may become a fingerprint, permitting the user to be traced.

The 2nd solution is better in terms of readability, and because the group of users using these 60 fonts is large. But the vast majority of these peoples are Tor network user. So if someone is using these 60 fonts without browsing through the Tor network, his behavior is very unusual, and these list of 60 fonts may become a fingerprint for him, again.

So, why not to make the browser shows (eg for each browsing session) a slightly different set of fonts? In doing that, the "fonts correlations" affecting the users in the 2 previous workaround will not happen, and the user will remain non traceable (at least non traceable through fonts)

In the Pre-Quantum era, an addon dit that (https://addons.mozilla.org/en-US/firefox/addon/stop-fingerprinting). But it was a XUL... Could this interesting feature be ported to Chameleon??

[sereneblue]

It looks like that addon is doing something similar to the client rects spoofing but for HTML elements. I'll look into spoofing font detection.

[WPFilmmaker]

@sereneblue Don't know if this can be useful for reference: dillbyrne/random-agent-spoofer#119

[sereneblue]

Thanks for that link. I'll take a look at FireGloves.

[WPFilmmaker]

@sereneblue Any news? Any chance we can get this in chameleon v0.20.0?

[sereneblue]

@WPFilmmaker It's in the roadmap for v0.20.0. I've mentioned it a few times here.