<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.26.3">
</HEAD>
<BODY>
On Tue, 2010-05-11 at 12:32 +0300, Eitan Adler wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
> Please note there's a rather strong privacy issue here. I don't want a
> web page to be able - without my prior consent - to query the list of
> fonts available in my system.
You already have this problem if a website were to create a list of
elements with a list of different fonts and use Javascript to
determine which font is being displayed. [1]
I'm not advocating opening another hole just because one already
exists - I'm just pointing this out.
[1] <A HREF="http://www.lalit.org/lab/javascript-css-font-detect">http://www.lalit.org/lab/javascript-css-font-detect</A>
</PRE>
</BLOCKQUOTE>
<BR>
It's not as clear cut as you make it sound. That script works on the basis that the glyphs within a font have different widths compared to the same glyph of another font. What happens when two fonts have exactly the same dimensions for their glyphs? The script will register a false positive. As such, I don't think its a security flaw or anything to overly worry about.<BR>
<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
Thanks,<BR>
Ash<BR>
<A HREF="http://www.ashleysheridan.co.uk">http://www.ashleysheridan.co.uk</A><BR>
<BR>
<BR>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>