New to Typophile? Accounts are free, and easy to set up.
Why does iPhone/iPad/iTouch only supports SVG @font-face, and not TTF or WOFF?
Posted by Chris Roberts in
8 Jun 2010 — 10:38am
8 Jun 2010 — 10:38am
Does anyone know why iPhone/iPad/iTouch only supports SVG @font-face implementation, and not TTF or WOFF? Seems strange to me since Apple® Safari® (Webkit) supports TTF from version 3.1 and later. Thanks!
User login
Support our Sponsors
8 Jun 2010 — 10:42am
Because thousands of iPhone users downloading fonts in addition to the rest of web content would finally push AT&T’s entire network into a catastrophic hardware meltdown.
8 Jun 2010 — 10:59am
LOL! NetFlix has already got that one figured out.
8 Jun 2010 — 10:16pm
My guess would be to remove a possible attack vector and limit the attack surface area for malicious Web content.
9 Jun 2010 — 1:18am
Which was my guess except that Apple has enabled PDF viewing in iOS 4, so unless they've disabled embedded PDF fonts the same attack vector is available.
9 Jun 2010 — 5:32am
I was thinking the same Simon. I suspect that they are not intentionally adding this limitation to @font-face, but rather just blocking the download of TTF file type globally on the device.
9 Jun 2010 — 6:58am
You don't need iOS 4 to view PDFs on an iPad. It can already do that. All they've done is added PDFs as a content source to iBooks in the next version.
You can view PDFs in all sorts of ways--Mail, Safari, special reader apps, etc. If there are fonts embedded in a PDF, they are displayed. Same with the iPhone going all the way back to the first one.
My guess as to why they haven't enabled @font-face for TTF and OTF: to reduce the amount of data needed for downloading a web page, both for speed and to conserve the limited amount of RAM in the devices.
9 Jun 2010 — 9:07am
>Which was my guess except that Apple has enabled PDF viewing in iOS 4, so unless they've disabled embedded PDF fonts the same attack vector is available.
Probably right, but they've had years to "harden" their PDF viewer against this type of attack (perhaps is uses a standalone rasterizer too?) but they are relative newcomers to the web-delivered-font attack vector.
Mark may have something - they are obsessive about Safari performance esp. on these devices.
14 Jun 2010 — 8:33am
@mark, sii, and all:
My guess as to why they haven't enabled @font-face for TTF and OTF: to reduce the amount of data needed for downloading a web page, both for speed and to conserve the limited amount of RAM in the devices.
All the more reason for them to add a compressed format like WOFF at the earliest.
But, conservation as motivation doesn't make a lot of sense to me in that SVG data is bloated compared to the equivalent data sent as an OTF or TTF. And since the Apple rasterizer throws away the TrueType hints, the most sensical thing would have been for them to, at least, have allowed OTF CFF files if file size was the concern.
I think the decision was more akin to a coin toss.
12 Aug 2010 — 1:32pm
Resurrecting this thread - it's funny how fonts ended up being the iPhone attack-vector getting all the press and how I over-estimated Apple's security "they've had years to "harden" their PDF viewer against this type of attack" oops, oh well. Goes to prove even I'm not immune.
12 Aug 2010 — 3:31pm
Lucky us.
Cheers!
12 Aug 2010 — 3:47pm
>Lucky us.
Says the Palm Pre user
13 Aug 2010 — 5:04am
>Says the Palm Pre user
Not I, said the iPhoner, (who has yet to come across a pdf in 3 years of iPhone use). I meant how lucky we are that you, MSNBC and people who normally write about MS issues (and Richard) are watching over us to prevent this vicious attack vector from disturbing our computing... and how lucky we are to have WOFF that would never allow such a thing to be possible.
Cheers!
13 Aug 2010 — 7:48am
>Says the Palm Pre user
>>Not I, said the iPhoner,
Better fonts.
14 Aug 2010 — 12:30pm
Here's an amusing font attack vector for IE:
1) Take a weird looking font. The weirder the better.
2) Rename it "inherit"
3) Install it in Windows
4) Go to wachovia.com (and many other sites, too. It's just a matter of time)
See you in LA!
14 Aug 2010 — 12:53pm
2) Rename it "inherit"
BWAHAHAHAHHAHA!