Experimental API for Font Settings – Coming Soon on Chrome

Written on February 21, 2012 in news

Google Chrome will be getting a new API for Font Settings. This will make font settings available for developers to build extensions on. The overview states “Expose Chrome/WebKit font preferences to extensions, much like the Proxy Settings API.”

Here is some useful info from the documentation for this.

“We want to add a more advanced font settings UI than is currently available, and it might be decided that it should be an extension in interest of keeping the Chrome UI simple.” That sums up the intention behind this API.

How could this API be abused?
Describe any concerns you have with exposing this API. Particular attention should be given to issues of security, privacy and performance.

Since Chrome observes font settings changes and propagates them to WebKit, which redraws as necessary, maybe an extension can cause performance disruptions.

Imagine you’re Dr. Evil Extension Writer, list the three worst evil deeds you could commit with your API (if you’ve got good ones, feel free to add more):
1) An extension that trashes the font settings. We can counteract this with an extension or button like “reset to defaults”. Also, uninstalling the extension should undo the damage.

2) An extension that rapidly keeps changing the fonts. It could conceivably be a DOS attack as WebKit tries to keep up. 3) An extension that reads font settings and uploads to a server to try to build a database fingerprinting users by the font settings. Also, if the API exposes a list of fonts installed on the system, it can also be a source of information for fingerprinting.http://trac.webkit.org/wiki/Fingerprinting

Alright Doctor, one last challenge: Could a consumer of your API cause any permanent change to the user’s system using your API that would not be reversed when that consumer is removed from the system?

No. It just uses the standard extension-controlled preferences feature which handles cleanup when the extension is uninstalled.