1

I have read a lot lately about fonts being malicious, and as a website can just download its own custom font onto your machine so that it can use it, it could exploit something with this and do something bad.

So I was wondering if in Firefox there is any way to make it so that websites aren't allowed to download their own fonts for use, but instead websites are only allowed to demand to use fonts already installed on the machine, and so that websites that want to download their own font are just given the default fonts?

Because I could just get all sites to use the same default fonts, but I find that that just looks ugly, one font can look lovely on one website, but horrible on another, so I would like to give them some ability to choose, but just restricted choosing for security reasons.


OS Information:

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 15.04
Release:    15.04
Codename:   vivid
Flavour: GNOME
GNOME Version: 3.16

Package Information:

firefox:
  Installed: 40.0.3+build1-0ubuntu0.15.04.1
  Candidate: 40.0.3+build1-0ubuntu0.15.04.1
  Version table:
 *** 40.0.3+build1-0ubuntu0.15.04.1 0
        500 http://archive.ubuntu.com/ubuntu/ vivid-updates/main amd64 Packages
        500 http://archive.ubuntu.com/ubuntu/ vivid-security/main amd64 Packages
        100 /var/lib/dpkg/status
     37.0+build2-0ubuntu1 0
        500 http://archive.ubuntu.com/ubuntu/ vivid/main amd64 Packages
2

Given your username, I'm surprised you aren't using NoScript (emphasis mine):

While its primary aim is preventing malicious JavaScript from running, NoScript effectively blocks Java™, Silverlight™, Flash®, and other plugins and embeddings (such HTML video/audio elements and downloadable fonts) on sites you haven't explicitly whitelisted.

  • Oh, no I do use NoScript, I just didn't realise that it did that too! :D So why do I some times see that sites are downloading their own fonts in the browser logs? Is that because the sites are whitelisted (I have only ever seen it with really trusted sites)? – user364819 Sep 9 '15 at 20:49
  • @ParanoidPanda going by what I quoted above, I suppose so. I don't use NoScript and I don't know what settings you use, so I can't say for sure. – muru Sep 9 '15 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy