{"id":26601,"date":"2019-09-13T15:57:36","date_gmt":"2019-09-13T19:57:36","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=26601"},"modified":"2019-09-13T20:33:10","modified_gmt":"2019-09-14T00:33:10","slug":"user-tracking-via-custom-fonts","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2019\/09\/13\/user-tracking-via-custom-fonts\/","title":{"rendered":"User Tracking via Custom Fonts"},"content":{"rendered":"<p><a href=\"https:\/\/twitter.com\/steipete\/status\/1171935904811773952\">Peter Steinberger<\/a>:<\/p>\n<blockquote cite=\"https:\/\/twitter.com\/steipete\/status\/1171935904811773952\">\n<p>Firebase Crashlytics installs its own font?<\/p>\n<\/blockquote>\n\n<p><a href=\"https:\/\/twitter.com\/crashlytics\/status\/1172195462989959169\">Crashlytics<\/a>:<\/p>\n<blockquote cite=\"https:\/\/twitter.com\/crashlytics\/status\/1172195462989959169\">\n<p>Crashlytics will <em>only<\/em> install the font for users who have registered to install pre-release apps via the Beta by Crashlytics product. The font includes a unique identifier that allows us to determine that a crash has come from an app distributed via our Beta product.<\/p>\n<\/blockquote>\n\n<p><a href=\"https:\/\/twitter.com\/sandofsky\/status\/1172200578207772672\">Ben Sandofsky<\/a>:<\/p>\n<blockquote cite=\"https:\/\/twitter.com\/sandofsky\/status\/1172200578207772672\">\n<p>Turns out custom fonts can be abused for tracking users.<\/p>\n<\/blockquote>\n\n<p><a href=\"https:\/\/twitter.com\/jjgod\/status\/1172213687781711872\">Jiang Jiang<\/a>:<\/p>\n<blockquote cite=\"https:\/\/twitter.com\/jjgod\/status\/1172213687781711872\">\n<p>Yes, that is why Safari is not allowing user installed font access, and the new iOS 13 font installation feature always require user consent to access any user install font.<\/p>\n<\/blockquote>\n\n<p><a href=\"https:\/\/daringfireball.net\/linked\/2019\/09\/12\/crashlytics-font-tracking\">John Gruber<\/a> (<a href=\"https:\/\/twitter.com\/gruber\/status\/1172211456273788928\">tweet<\/a>):<\/p>\n<blockquote cite=\"https:\/\/daringfireball.net\/linked\/2019\/09\/12\/crashlytics-font-tracking\">\n<p>Most users, I suspect, would just allow this, thinking fonts are harmless&#x2009;&mdash;&#x2009;but at least those of you reading this are forewarned.<\/p>\n<\/blockquote>","protected":false},"excerpt":{"rendered":"<p>Peter Steinberger: Firebase Crashlytics installs its own font? Crashlytics: Crashlytics will only install the font for users who have registered to install pre-release apps via the Beta by Crashlytics product. The font includes a unique identifier that allows us to determine that a crash has come from an app distributed via our Beta product. Ben [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2019-09-13T19:57:39Z","apple_news_api_id":"7e11ae4d-a86c-4bef-9470-3011b98bd36a","apple_news_api_modified_at":"2019-09-14T00:33:15Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAA==","apple_news_api_share_url":"https:\/\/apple.news\/AfhGuTahsS--UcDARuYvTag","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[1875,75,133,31,1610,1667,355],"class_list":["post-26601","post","type-post","status-publish","format-standard","hentry","category-technology","tag-crashlytics","tag-developertool","tag-font","tag-ios","tag-ios-12","tag-ios-13","tag-privacy"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/26601","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=26601"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/26601\/revisions"}],"predecessor-version":[{"id":26602,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/26601\/revisions\/26602"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=26601"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=26601"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=26601"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}