Fingerprint effect of changing TBB default font size

Question

I asked this on tor-talk (no answers) & through Tor email support (also no answer). Suggested trying here.

Does changing the default font names or sizes used by TBB (3.51 - 3.5.2) for Windows, affect fingerprinting of TBB? If so, how much & what all ways? Problem - if one uses default settings for font styles / sizes, then text on some pages is UNcomfortably small for a fair number of users with any sight problems.

I understand the fingerprinting issue - that's why I'm asking.

In Options > Content > Advanced, the default TBB settings are used (for Windows, English):

• For Proportional - Serif: Times New Roman - size16.

• Minimum size font: size "None" (meaning, some pages display tiny text.)

• Checked: "Allow pages to use their own fonts..." (if checked, some pages display tiny or less readable text, i.e., weird font.)

What effect on TBB fingerprinting does changing any of these DEFAULT settings have:

-The proportional font NAME or SIZE?. -The minimum font size? -UNchecking the option: "Allow pages to use their own fonts..."?

Note: more recent checking of browser (TBB 3,5,x) characteristics, on http://ip-check.info (JonDoNYM), http://browserspy.dk/ or Panopticlick don't show any difference in SCREEN size, whether using TBB default font & size, or not. AFAIK, No other (reported) characteristics are changed, either.

That doesn't mean changing the font settings won't affect some other "fingerprint" characteristic (NOT shown by these sites).

Seems * if * changing font settings increases fingerprinting, TBB should spoof ? the values, for everyone (maybe it does?).

Answer 1

Changing the default font size and family can make your fingerprint unique, so it's strongly discouraged.

Many sites use JavaScript based font probing to fingerprint users by printing invisible strings with different fonts and then comparing the dimensions to that of fallback fonts [1, 2, 3].

Tor Browser limits the number of fonts a page can use, but it doesn't spoof the dimensions of the printed strings.

So, a more advanced script may report the dimensions of the strings printed with different fonts. That would uniquely identify your browser, even the number of fonts available to the script is limited. Admittedly, that wouldn't be the most effective fingerprinting method, but I wouldn't bet my anonymity on this.