2

Even after disabling Java Script Fonts are indirectly readable. Is there any patch for this issue?

This is a warning I get from a test site.

Your installed fonts are indirectly readable by this website. A website may force loading web fonts, if the respective font is not installed on your local computer. If the site forbids font caching, the font will be reloaded on any access.

The page may try to load hundreds of different font names using the "@font-face" attribute. If the respective font is installed on your system, the website notices that it is not loaded from the server."

3
  • 2
    Please explain a bit more in detail what you are trying, what you expect and what fails. Right now it is hard to understand what your problem is.
    – Jens Kubieziel
    Jan 26, 2014 at 20:33
  • This is a warning I get from a test site. "Your installed fonts are indirectly readable by this website. A website may force loading web fonts, if the respective font is not installed on your local computer. If the site forbids font caching, the font will be reloaded on any access." and "The page may try to load hundreds of different font names using the "@font-face" attribute. If the respective font is installed on your system, the website notices that it is not loaded from the server."
    – Roya
    Jan 26, 2014 at 21:00
  • I copied your comment into your question. This might help others who have the same question. You might delete your comment if you want.
    – Jens Kubieziel
    Jan 26, 2014 at 22:01

2 Answers 2

2

This has nothing to do with JavaScript, this font loading is done by CSS (the stylesheets). Technically it is no different than loading of images, except that fonts you already have on your system may not be loaded, allowing for some guessing what OS you run.

There is already a patch in Tor Browser that mitigates some of the worst risks with this way to load fonts, while still not disabling the font loading completely (as that would render some sites useless). The test site you visit maybe does not know about this patch, and falsely believes you are open to a serious fingerprinting issue because font loading is still allowed.

The patch in question (which prefer webfonts to prevent loading of system fonts when fingerprintable, and limit total number of system fonts, I believe):

https://gitweb.torproject.org/tor-browser.git/commit/217c0d2cdb8d884dc5c3fd638189dd7dd80ff8d5

2
  • Dear Rhin; Thanks, I am just curious, how come TBB version 2.3.25-2 which made use of Firefox version 10.0.12 does not show this issue? (I know it has other issues)
    – Roya
    Jan 28, 2014 at 17:02
  • Firefox 10esr is old. TBB used Firefox 17esr before it switched to 24esr recently. We are talking over a year old here, right? It is very much possible that particular patch didn't exist back then, or didn't do it the same way it does today. But I do not know.
    – Rhin
    Jan 28, 2014 at 17:15
0

There is the ticket #9451 in Tor's trac. It describes what to change to disable this feature. Go to the Preferences page of Firefox (see also this BBC page on how to change the fonts in Firefox), select Contents and in the Fonts section click on Advanced. Now a subwindow open and you'll find a checkbox with the text "Allow pages to choose their own fonts, instead of my selections above". Uncheck it and you're done. When you reload http://ip-check.info/ the message should now disappear.

5
  • Dear Jens; Thanks, I read the ticket #9451. But, what preferences does it refering to? Is it refering to Torbuttom preferences or something else?
    – Roya
    Jan 26, 2014 at 22:51
  • It means the preferences page of Mozilla Firefox/Tor Browser.
    – Jens Kubieziel
    Jan 26, 2014 at 23:00
  • Dear Jens, Thanks again, but the problem is still persisting. I have observed several points. I list them numerically.
    – Roya
    Jan 27, 2014 at 0:05
  • 1. My OS is window XP and the process is slightly different than what is explanied in ticket #9451 (Tool--options--content--advanced--Allow pages to choose their own fonts, instead of my selections above. -- 2. After applying No.1 problem persist. -- 3. The last version of TBB that did not show this issue was version 2.3.25-2 which made use of Firefox version 10.0.12 -- 4. The problem started with TBB version 2.3.25-4 which made use of Firefox version 17.0.3 -- 5. I believe ticket #9451 may apply to Linux
    – Roya
    Jan 27, 2014 at 0:37
  • There is one important point that I did not mention. The last TBB version which did not show this problem, Namely TBB version 2.3.25-2 which made use of Firefox version 10.0.12, has the "Allow pages to choose their own fonts, instead of my selections above" checkbox ON . Thus, it was NOT Unchecked.
    – Roya
    Jan 27, 2014 at 0:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .