>>14667I appreciate where you're coming from on this, but that really probably isn't malicious.
A website can probably fingerprint your browser pretty good anyway – this depends on the particulars of what browser and computer you're using, but it is totally reasonable to figure out what GPU you have (based on how WebGL renders) and what your screen resolution is, and narrow your device down to a specific phone or range of phones. Now, if I know what kind of phone you're using and what your IP address is, I might be able to nab another detail to guess pretty well when you switch IPs. Maybe you set the font size on your device to a non-default setting, for instance. Maybe you're the only person in your town with that particular font size on that particular phone model. A website is allowed to query the DOM and see how big text renders. I'm not saying we should allow more data to leak just because some already is, but plugging this one hole won't solve the problem. The problem is in how we expect browsers to check on how things have rendered. This is really useful if you're developing websites that need to work across platforms (as you can adjust what you render based on what features are available in a browser, reposition elements based on how long the content is after rendering text at a desired level, etc.), but bad for security. There are solutions being worked on, projects that allow rendering and no DOM queries, but we haven't settled on one yet and most people don't care. It will emerge.
It's useful to be able to see if you have a given browser extension. If I'm making a website that uses Metamask, I need to display one thing if that extension is available and another if it
isn't. Obviously that turns into a fingerprint when you add enough extensions, but there is a legit use case for the website being able to tell what extensions are present.
Mozilla has made a nominal effort to stop fingerprinting via a deny-list:
https://blog.mozilla.org/security/2020/01/07/firefox-72-fingerprinting/ This could be seen as too little too late, but I hope the above couple of points have explained the tough situation they're in with regard to blocking this behavior altogether. The internet as you know it relies on this. If Firefox seriously stopped letting browsers do all activity that can be used for fingerprinting, it would break so many websites that you'd probably switch to something else. Hell, just turn off JavaScript and nobody will be able to fingerprint you based on extensions, problem solved ;)