Font fingerprinting is just a small part of browser fingerprinting.
Blocking it totally is almost impossible to do if the purpose is to leave the
browser still functional.
The best general fingerprint protection is said to be found in the Tor Browser.
In practical tests it was found that trying to block font fingerprinting
actually increases the uniqueness of the computer fingerprint,
since most users don't do that.
The best way to avoid fingerprinting is to do nothing special and blend-in with
thousands of other users.
First step against font fingerprinting is to have a test for the effectiveness of
any defensive measure that you will take.
A good tool here is https://browserleaks.com/fonts.
A good tool for the uniqueness of the general fingerprinting is
https://panopticlick.eff.org/ (my own browser came up as
unique among the 199,984 tested in the past 45 days) or
Am I Unique.
For protection in Chrome, measures you may take are:
- Install instead a hardened Chromium build
- Use an extension (I have not tested their effectiveness):
For protection in Firefox
Mozilla is currently working on the Tor Uplift project, whose goal is to build up
in Firefox the same level of fingerprinting resistance as in the Tor Browser.
This project is in progress and described in the article
You could try the Firefox-hardening script in
although by all reports it may be too much and actually harm browsing.
As far as add-ons go, there is a list of useful add-ons and other advice
maintained in the page
For the moment, the measures I know of specifically for Font Fingerprinting are in
Right-click and select New > String, creating the new parameter
An example valid value is
Helvetica, Courier, Verdana.
The change takes effect immediately.
In my case, this has reduced my own
from 266 fonts and 238 unique metrics found in a list of 512 fonts,
to "only" 28 fonts and 9 unique metrics.
(I have no idea how this would impact browsing.)
privacy.resistFingerprinting=true is a general switch to enable privacy
measures from the Tor Uplift project as they are implemented.
It enables a uniform font list to be distributed.
Mozilla does not recommend enabling it since it will break some websites.
Disabling the options of "Allow websites to use their own fonts" and the
CSS Font Loading API by changing these values:
browser.display.use_document_fonts = 0
layout.css.font-loading-api.enabled = false
font.blacklist.underline_offset = (empty string)
gfx.downloadable_fonts.enabled = true
gfx.font_rendering.opentype_svg.enabled = false
gfx.font_rendering.graphite.enabled = false
(This will most likely degrade browsing.)
Just to remark that I have seen methods discussed for sophisticated
Font Fingerprinting and drawing that could even identify the display card
and the graphical driver.
My opinion : It is impossible to avoid fingerprinting - fonts are not everything.
Even if you:
- Use a VPN
- Do the browsing from a vanilla Windows virtual machine
- Install no fonts or other software
- Install the most widely-used browser - Chrome, with no extensions
- Do browsing in Incognito mode that disables all cookies and extensions
then most likely these unique protection methods, together with hardware
elements still detectable in the virtual machine, will still make for a
unique or almost-unique fingerprint.
Not to mention that this environment will be quite hard to use.
For discussions of some known fingerprinting methods, see the following articles: