Re: [tor-talk] noscript on youtube

[<dewaj@xxxxxxxxxx>]

thus spake krishna e bera:
> > When trying to login to Youtube from TBB, NoScript blocks a bunch
> > of stuff seemingly related to fonts (see screenshot at 
> > https://postimg.org/image/c0sfrf2kh/41fa1875/ ), and i cannot
> > proceed (the Sign In button doesnt work.  Otherwise Youtube works
> > fine with HTML5 videos.

This is done only when using Tor???

On Sat, 30 Jul 2016 20:07:22 -0700
cube@xxxxxxxxxxxxxxxxx wrote:
> The CSS @font-face rule that is being blocked by NoScript can be used
> to fingerprint you, specifically can be used to detect what fonts you
> have installed. How this works is that you define a set of fonts and
> tell the client ``if you need to use these fonts but don't have them
> you can download them from me''. The client then requests the fonts
> it doesn't have. From this the server knows what fonts the client
> doesn't have and by process of elimination what fonts it does have.
> 


Then this can be got around by either downloading all the fonts,
whether used or not or by not downloading any fonts and using existing
fonts or substiutions, by default.

This obviously works best when *everyone* does one or the other.

How can this be done in the browser? I'd like to see a config option in
firefox if there isn't one already. (Yes! Let's heap even MORE
COMPLEXITY upon complexity!!!)

--

-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk