Item — HN Reader

I'm with you, I don't cookie up any of my websites and have no intention of doing so. (Right now, my sites are super-primitive; my main one I've had for 22 years or so, but I'll be doing more).

But I do need to say that third-party fonts are not the problem here, or shouldn't be. Neither Google Fonts[1] nor Typekit[2] sets cookies. I don't know off the top of my hand if any of the other services do, but if so I would agree it's a good reason not to use them.

Disclosure: I helped launch Google Fonts and was involved in the decisions to make it privacy-friendly.

[1] https://developers.google.com/fonts/faq#what_does_using_the_...

[2] https://www.adobe.com/privacy/policies/typekit.html

1 comments

I'm certainly not going to rail against third party fonts. The web is a mess and this is just a small part of the mess and certainly not the worst offender.

That being said, however, it's certainly possible to fingerprint traffic if you serve fonts as a third party; even if you don't use cookies. Most third party font suppliers use JS, and even if they didn't, let's not pretend that cookies is the only thing we have to worry about. One of the issues I have with the web is that I want technical guarantees when the answer is often "just trust us" even if we shouldn't need to.

Take fonts, for example. There is zero reason that fonts need to be served third party. All we should need to do is to specify a URL-based UUID for a font in our HTML and provide a cryptographic signature from the font owner that authorizes its use at this URL. Complex licensing is completely pushed to a different layer. The only tricky part is keeping ownership keys secure.

No judgements—I get that people are lazy and use the tools they have, so JS wins.

But for me, and my lowly personal website, we shall use secure headers. We shall host our fonts and images ourselves; and as the monks of yesteryear, our austereness advances an end unto itself.

> There is zero reason that fonts need to be served third party.

I use the service Icomoon[0] in production. It's been immensely helpful for generating a custom icon font. Our designers upload icons they create, and Icomoon bundles them all in one font file. Easier than multiple SVGs and only one HTTP request. I wouldn't want to manage that myself — so there's one reason for fonts to be served third party.

[0] https://icomoon.io

I personally don't like sites that bundle icons into fonts. I got sick of reading a different font on every website, some being very hard to read, so I override the font on every website with stylus. All the icons, which should be images, become square boxes.

Right but you shouldn't need to. In my proposed solution the browser could just make a separate, non-third party request for the font to icomoon.io and on load, if browser needs that font and doesn't already have it. It should get it from your OS provisioner (Google / Mozilla / Apple / Microsoft) directly and if they don't have it (or Icomoons public key) they could request it from Icomoon on your behalf. Or, if Icomoon is up to shady tactics, refuse the request.

You said there's zero reason for fonts to be served by a third party.

And then you're saying that part of your proposed solution is for the user (party 1) to download the font not from your site (party 2) but from Icomoon (party 3, i.e. literally a third party).

Did I miss something?

The point is that copying or hosting the font shouldn't be what is copyrightable. It should be use. Most commonly used fonts should be pre-installed. Only for the very weird situations should the browser resort to downloading the font and, in my opinion, should do it in a way that is not trackable.

The way we currently download third-party fonts exposes the content that we're viewing to the font hoster. That's really stupid. If we need to download from a third party it shouldn't be in the same browser context. I.e., the party shouldn't be able to execute arbitrary JS or see the document Origin.

"There is zero reason that fonts need to be served third party."

Except for caching. If you use the same font as another web site I've visited recently, I'd rather my browser re-use the already-downloaded font file, rather than downloading the (probably) same file from you. Especially if it's a large font file with Chinese characters.