They can fix most of this. Tor Browser has addressed some of the easier problems and makes fingerprinting more difficult. If you read the bug reports of major browsers, you'll see the maintainers will usually value compatibility and features over privacy. It would be especially nice if they'd fix the issues with fonts because that's one fingerprinting aspect that's really only solved by modifying the core browser code (unless you remove/add fonts system-wide from your machine to match Tor Browser).
There's a long tail to fingerprinting that's pretty daunting. E.g., you can detect OS by looking for idiosyncrasies of the low level networking stack. One project did attempt to solve this but hasn't been touched in years: http://ippersonality.sourceforge.net/
You can test whether a font is installed with any number of tricks. For example, render white text on a white background with "sans". Then, change the font to the candidate font, with a fallback of sans. If the width of the text changes, the font must be installed.
Maybe browsers shouldn't have access to system fonts except a specific set. Websites can't assume fancy fonts are installed anyway, I don't think it would be a problem?
Yeah, all we'd have to do is convince every manufacturer of operating systems and/or browsers to agree on a common set of fonts, work out licensing/font rendering technology issues etc., then convince all web developers across the world (or at least a sizable portion) to redevelop their websites to work with this list, then enforce the font restriction, and then convince users that this is somehow a good idea because invariably a bunch of the websites they use are going to break. We also need to do it within a few years, otherwise it's too late, and our main argument is going to be 'but maybe websites can use fonts as part of a fingerprint to track what websites we are visiting'.
You're both wrong; most people at the point of browsing don't care that much for privacy. Most users would hand out their passwords for a chocolate bar! [0] How much less would they care about their privacy let alone understand how one browser is better than another.
Very interesting, but it still seems like browsers would be able to prevent that: simply restrict the font list to a generic set when in incognito mode. Similarly for any other fingerprint thing. Of course, in the most general case this might be hard (or impossible) to prevent fully, but a browser developer should be able to at least get close to minimizing it... I would think?
Regular presentation are only controlled by the author. I made a special case for the demo. Yes, there should be a unique-sync code for each visitor to the demo. I though the universal sync would be collaborative. Might have been my mistake.
The feature is that it allows you take payments from anyone by having them enter their CC, and deposit the funds as directed by your Stripe acct. Clearly not in-app purchases. The functionality is similar to Square, without the swipe.
