Wow, CSS system color keywords seem like a massive privacy leak. I just tested setting the property:
background: Background;
on an element, and then changing my Windows desktop background. The element immediately changes color to match my desktop. Then if I call getComputedStyle on the element, I get my desktop background color in javascript. This is in Firefox private mode, and apparently every website can read all my system colors. Why in the world is this enabled by default?
I mean, not to be defeatist but... once you’ve got JS turned on you’ve already handed out such a massive amount of entropy I’m not sure this one extra item makes a huge difference.
If it's the OS default, it's probably worthless. But if it isn't, I would imagine it could be quite unique, no? Presuming it's an RGB color, that's 16M possibilities. And there are multiple system colors, meaning even more chance you're a snowflake if you customized them. If you chose a random color on just 2 of them, that's probably enough to make you unique among the entire world. (But it is, of course, likely that you might choose something common, like #ff00ff.)
If you turn of JavaScript, that's also probably a pretty good signal, no? (I'm just hearing someone shouting "There are dozens of us! Dozens!")
If you turn Javascript off, the only information the website can get is user agent and IP, which would narrow it down much less than using Javascript even just among the pool of non-javascript users.
Keep in mind that there are a lot of services that load sites without Javascript enabled (scrapers, mail, preloading).
Pretty sure you can get some extra information through CSS media queries that only trigger a server hit when active (allowing you to add, say, screen size and color range to the fingerprint even without javascript).
i'd imagine most of the background colors are the same as most people set an image as their background.
ive not really thought about (or even know to be honest) what my desktop background color is these days. its not something ive throught about since windows 95. once XP came along with that pretty background I think i've used a photo ever since
but oh well 1 more bit is one more bit for the people that do still set a background
I set my background to a solid color. Mostly so compression on screenshots and screen captures is more effective. Though, I’d consider me an edge case here.
https://www.w3.org/wiki/CSS/Properties/color/keywords#System...