""If you want to visit sensitive and non-sensitive websites at the same time, use two different computers," they said." Or just visit them one after the other, one tab at a time right?
Or use two different browsers.
This JavaScript can snoop on other browser tabs to work out what you're visiting
51–60 of 68 posts
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#52> The takeaway, they contend, is that anything short of running a single browser tab at any one point in time poses a privacy risk: if you open a second tab, JavaScript in it can snoop on the other tab. Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. Firefox Focus [1], my most used browser (single tab only), seems to be safe from t…
Firefox Focus does have multiple tabs - long press on a link, then select "Open link in new tab".
Tho if you switch between tabs, you'll see a full load of the tabbed page. I suspect it doesn't actually have "tabs" (i.e. running in the background like basically every other browser tab), just "saved URLs".
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#53What is the most intuitive Chrome extension that you've used to block JavaScript on every site and to create a whitelist as you went?
I recommend uMatrix. At first it will take a few minutes to understand how it works, though.
You can turn on and off images, css, scripts, XHR, etc, for individual sites or globally.
I use it in that manner, with scripting off by default. If I am visiting a new site that needs javascript, I gradually whitelist specific bits until it works and then "save" those settings for that domain.
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#54Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. All the more reason to not have JS on by default, and oppose the growing population of sites which unnecessarily use it. That's been my configuration for many years, and in my experience the vast majority of sites I visit do not require it; in fact, contrary to the frequent "please en…
I'm not sure what sites you're visiting but most sites i have attempted to use with JS disabled simply did not function and thought I was a robot. I was then presented with a human verification process that required javascript to run. But yes I can disable javascript on HN.
Even more irritating are sites that just appear as a blank page with javascript disabled. If your site requires javascript to load any content then you've done something wrong.
Fortunately these tend to be clickbait type sites which I am visiting against my better judgement. Not being able to load them without javascript is a good reminder to not load them at all.
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#55What is the most intuitive Chrome extension that you've used to block JavaScript on every site and to create a whitelist as you went?
I recommend uMatrix. At first it will take a few minutes to understand how it works, though. You can turn on and off images, css, scripts, XHR, etc, for individual sites or globally. I use it in that manner, with scripting off by default. If I am visiting a new site that needs javascript, I gradually whitelist specific bits until it works and then "save" those settings for that domain.
Once you start using uMatrix, be prepared to never view the internet the same way again. The sheer quantity of malicious clientside traffic is stunning.
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#56""If you want to visit sensitive and non-sensitive websites at the same time, use two different computers," they said." Or just visit them one after the other, one tab at a time right?
Or use two different browsers.
Wouldn't matter, if the attack works as described. It's already exfiltrating data cross-process due to the processes sharing a resource (the CPU cache). It doesn't matter whether the processes are the same browser or different browsers.
Now the actual "cache fingerprint" of a particular pageload might be different in different browsers, so it might not be possible to differentiate "site A loaded in Firefox" and "site B loaded in Chrome". Or it might be, and then you know not only what sites the user is visiting but what browser they're using to do it...
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#57Well, anyone using Tor won't have JavaScript enabled anyway.
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#58Finally, my lazy habit of ending up with several hundred open tabs may be considered a safety feature, diluting the cache fingerprints to a faint whisper
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#59From the paper [1]:
Each round of attack consists of three steps.
In the first step, the cache is primed, i.e.,
the attacker completely fills some of the
cache sets with its own data. The attacker
then waits some time to allow the
victim to execute. Finally, the attacker
probes the cache by measuring the time
it takes to access the previously-cached
data ...
[1] https://arxiv.org/abs/1811.07153 (thanks leni536)
Re: This JavaScript can snoop on other browser tabs to work out what you're visiting
#60All more joy that I took the plunge and went JS-off by default with a couple of exceptions. Majority of the web works just fine, if not better.