Question

Is it possible to write a program that masks the set of fonts installed on the computer, so the font list would appear “plain vanilla” and would not be of much value in creating a ~unique fingerprint? https://panopticlick.eff.org/

Answer 1

There is probably some support for that in some browsers, but with any browser you could intercept the winapi calls for enumerating the font list.

Basically you write a dll that will be loaded into the browser process, and then it will intercept the calls the browser will make to the OS when it will enumerate fonts. Just lookup which functions in windows are used for enumerating fonts, and fake them in your dll. (that could be some work though, because you will have to rewrite the font enumerating logic).

Also, some of the browsers may very well just read the registry to enumerate fonts, and not use the specialized fontfunctions, in that case you will have to intercept the registry-winapi functions, and make sure they report the font list that you want.

For loading your dll into the target process you could use Windows hooks, or use a .exe file editor to add your dll to import table of the browser’s exe file. There is also a special place in the registry where if you add a dll there, it will be loaded to every process in the system. (then you’ll have to check for browser process, and only intercept api calls then, so that not every program on your system will get the bogus font list).

Also, it is possible that a browser will run some plugin, or activex control, or java, or something like that in another process (chrome runs every tab in different processes for example), so I would check every process’ parent, and if you see that it has been started by the browser, intercept the font list in that process also. That way, the target webpage won’t be able to get the real font list through flash, plugins, java, or anything.

A good start to intercepting winapi calls can be found here: http://www.codeproject.com/KB/system/InterceptWinAPICalls.aspx

So this is a reliable way to do this, and although it can’t be done in an hour, it’s not overly complicated either.

Of course, this will not only make your font list bogus, it will also make the browser not see and be able to display the fonts that are not in the list.

And this all is valid for Windows of course, but there are surely similair ways to do this on other OSes.

Also, worth to note, I don’t think a webpage can read the font list if you have disabled javascript and plugins(flash).