This article seems to have a threat model where a website is “compromised” into sending user data to a third party, but I don’t really see anything that protects users from a website whose owner actively wants to track them. This is an odd threat model to have.<p>Also, as an aside:<p>> For example, by detecting whether the browser supports the Calibri font family, we can assume that the browser is running in Windows<p>I’m pretty sure that Safari has stopped allowing the use of third party fonts for exactly this reason, and now reports a standard set of fonts as being available.