[tbb-bugs] #20842 [Applications/Tor Browser]: Proposal: Improve Tor Browser font whitelist / bundled fonts

[Tor Bug Tracker & Wiki]

#20842: Proposal: Improve Tor Browser font whitelist / bundled fonts
--------------------------------------+--------------------------
 Reporter:  arthuredelstein           |          Owner:  tbb-team
     Type:  defect                    |         Status:  assigned
 Priority:  Medium                    |      Milestone:
Component:  Applications/Tor Browser  |        Version:
 Severity:  Normal                    |     Resolution:
 Keywords:  tbb-usability, ux-team    |  Actual Points:
Parent ID:  #18097                    |         Points:
 Reviewer:                            |        Sponsor:
--------------------------------------+--------------------------

Comment (by ninavizz):

 Hi All: Sorry to be unclear in my request...

 I work on SecureDrop. We recommend users to only use SD with the Tor
 security-slider set to SAFEST, which eliminates use of webfonts as an
 option. I appreciate that the default answer to this, is "well then design
 an alternative version without the nice fonts, or design only with system
 fonts" but that's inadequate.

 Dotfont, as an example, is necessary for show/hide functionality on
 password fields—which is critical for supporting highly usable AND highly
 secure experiences. Noto is the most cross-charset legible font,
 available—and legibility matters a ton, in usability. Finally, for our
 Journalist client app, we're using SourceSans and Montserrat—and, again,
 for usability, we want the information design of our Web UI to have visual
 parity with the web experience... and most standard system fonts just
 aren't that legible/usable across sizes and use instances (sorry, they're
 just not—especially on Linux distributions, which rarely involve
 typography experts).

 Whitelisting a few non-standard fonts used often in support of usable,
 security-centric, and task-instensive UIs, is my ask. If there's a reason
 it's being punted for risk, I'd love to understand that reason more.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/20842#comment:21>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online