Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JavaScript can snoop on other browser tabs to work out what you're visiting

theregister.co.uk

Post reply on HN
Print view View original

21–30 of 68 posts

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#21

Post by m00dy »

mettamage wrote: post #16

It's always the cache. Caches are evil! (security) No! Caches are amazing (speed). Fun fact: I never understood caches that well, until I learned about geo-caching and learned what caches were used for back in the day of yore! Inclusive caches are a huge culprit security wise. If you can perform any variation on the clflush instruction by building eviction sets [1] then you are good to go to perform somekind of opera…

Everytime I hear about a cache, I imagine a hash table with O(1) access to read and possibly write

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#22

Post by userbinator »

Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work.

All the more reason to not have JS on by default, and oppose the growing population of sites which unnecessarily use it. That's been my configuration for many years, and in my experience the vast majority of sites I visit do not require it; in fact, contrary to the frequent "please enable JavaScript for a better experience" banners I see, they're better off without. I'm not against JS in general because there are useful "appsites" that can't serve their purpose without it; just against the practice of allowing your machine to run arbitrary untrusted code by default.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#23

Post by detritus »

ccnafr wrote: post #19
leni536 wrote: post #3

I think it would be more appropriate to link the paper[1] and use its title (as it's much more descriptive). [1] https://arxiv.org/abs/1811.07153 Robust Website Fingerprinting Through the Cache Occupancy Channel

Leave it to The Register to clickbait the research. This is nothing new btw. Side-channel attacks on other tabs have been known for more than a decade, and is one of the legitimate reasons why the NoScript plugin was developed, among others.

It's not ‘clickbait’, it's a headline. It's meant to attract attention and engage the user. See the red top header The Register uses? That's a nod to British tabloid newspaper mastheads going back decades, and The Register likens itself to similar hovels of deplorable journalist talent-waste.

Not everything is some clinically cynical attempt to con the contemporary reader — sometimes such effort is intentionally tongue-in-cheek for a knowing readership.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#24

Post by cyphar »

alceta wrote: post #12
newscracker wrote: post #10

> The takeaway, they contend, is that anything short of running a single browser tab at any one point in time poses a privacy risk: if you open a second tab, JavaScript in it can snoop on the other tab. Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. Firefox Focus [1], my most used browser (single tab only), seems to be safe from t…

My Firefox Klar (Focus in German market) does have multiple tabs. But since the entire application is shorter-lived, I never tend to have many tabs open.

From my usage the "tabs" appear to be more like temporary bookmarks. When you switch between them, the page loads from scratch. So even when using tabs it might be protected against.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#25

Post by ic4l »

userbinator wrote: post #22

Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. All the more reason to not have JS on by default, and oppose the growing population of sites which unnecessarily use it. That's been my configuration for many years, and in my experience the vast majority of sites I visit do not require it; in fact, contrary to the frequent "please en…

I'm not sure what sites you're visiting but most sites i have attempted to use with JS disabled simply did not function and thought I was a robot. I was then presented with a human verification process that required javascript to run.

But yes I can disable javascript on HN.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#26

Post by tannhaeuser »

Just another reason to use noscript or other blockers. Why was it a good idea to turn browsers into receivers for arbitrary script code again? I guess we should at least endorse GNU's LibreJS [1] and enforce subresource integrity to check the script executed by your browser is verifiable, even though LibreJS aims for OSS principles. As a bonus, you'll find that web sites sending crap script aren't worth visiting anyway ;)

[1]: https://www.gnu.org/software/librejs/

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#27

Post by efdee »

detritus wrote: post #23
ccnafr wrote: post #19

Earlier quoted context omitted.

Leave it to The Register to clickbait the research. This is nothing new btw. Side-channel attacks on other tabs have been known for more than a decade, and is one of the legitimate reasons why the NoScript plugin was developed, among others.

It's not ‘clickbait’, it's a headline. It's meant to attract attention and engage the user. See the red top header The Register uses? That's a nod to British tabloid newspaper mastheads going back decades, and The Register likens itself to similar hovels of deplorable journalist talent-waste. Not everything is some clinically cynical attempt to con the contemporary reader — sometimes such effort is intentionally tong…

I can't be the only one who feels The Register _IS_ a tabloid. Not tongue-in-cheek.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#28

Post by cm2187 »

userbinator wrote: post #22

Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. All the more reason to not have JS on by default, and oppose the growing population of sites which unnecessarily use it. That's been my configuration for many years, and in my experience the vast majority of sites I visit do not require it; in fact, contrary to the frequent "please en…

I agree on the unnecessary use of javascript and the madness of inviting anyone to run code on your own machine, but not on the browsing experience with js off. I used to do that but stopped given the high number of websites that are dysfunctional or simply show a blank page with js off. Why some developers think they need js to display a blog article is beyond me (well, web "developers") but the web is now pretty unusable without javascript. Even adblockers break many websites.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#29

Post by ccnafr »

detritus wrote: post #23
ccnafr wrote: post #19

Earlier quoted context omitted.

Leave it to The Register to clickbait the research. This is nothing new btw. Side-channel attacks on other tabs have been known for more than a decade, and is one of the legitimate reasons why the NoScript plugin was developed, among others.

It's not ‘clickbait’, it's a headline. It's meant to attract attention and engage the user. See the red top header The Register uses? That's a nod to British tabloid newspaper mastheads going back decades, and The Register likens itself to similar hovels of deplorable journalist talent-waste. Not everything is some clinically cynical attempt to con the contemporary reader — sometimes such effort is intentionally tong…

It's still clickbait, dear The Register employee.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#30

Post by detritus »

ccnafr wrote: post #29
detritus wrote: post #23

Earlier quoted context omitted.

It's not ‘clickbait’, it's a headline. It's meant to attract attention and engage the user. See the red top header The Register uses? That's a nod to British tabloid newspaper mastheads going back decades, and The Register likens itself to similar hovels of deplorable journalist talent-waste. Not everything is some clinically cynical attempt to con the contemporary reader — sometimes such effort is intentionally tong…

It's still clickbait, dear The Register employee.

hahaha, brilliant — that's possibly the kindest accusation I've had levelled at me this year! Thank you.

As for your earnest insistence — I'd perhaps loosen literality a touch ;)

Post reply on HN