Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JavaScript can snoop on other browser tabs to work out what you're visiting

theregister.co.uk

Post reply on HN
Print view View original

61–68 of 68 posts

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#61

Post by eeZah7Ux »

gowld wrote: post #49
eeZah7Ux wrote: post #47

Browsers and javascript has been security disasters for decades and yet the web crowd perpetuates this model and even plans for webassembly. Large webassembly applications will make it extremely difficult to inspect suspicious code for this kind of attacks. Dodgy ad providers will exploit similar vulnerabilities to better track user behavior or worse. Yet, there isn't an ongoing discussion on limiting the resources a…

This isn't a language problem, it's a computers and networking problem.

I didn't say it's a language problem. The problem is having to run arbitrary, not vetted code from random sources just to book a flight or order a pizza.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#62

Post by crispyambulance »

abetusk wrote: post #59

From the paper [1]: Each round of attack consists of three steps. In the first step, the cache is primed, i.e., the attacker completely fills some of the cache sets with its own data. The attacker then waits some time to allow the victim to execute. Finally, the attacker probes the cache by measuring the time it takes to access the previously-cached data ... From a brief glance, it looks like they then use the timing…

It seems like a very difficult and iffy technique to get NOT a lot of information.

We're talking here about an attacker finding out what website domain names are open in other tabs on a target's browser? Is that a big deal?

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#63

Post by theWheez »

crispyambulance wrote: post #62
abetusk wrote: post #59

From the paper [1]: Each round of attack consists of three steps. In the first step, the cache is primed, i.e., the attacker completely fills some of the cache sets with its own data. The attacker then waits some time to allow the victim to execute. Finally, the attacker probes the cache by measuring the time it takes to access the previously-cached data ... From a brief glance, it looks like they then use the timing…

It seems like a very difficult and iffy technique to get NOT a lot of information. We're talking here about an attacker finding out what website domain names are open in other tabs on a target's browser? Is that a big deal?

For you and me, probably not, but perhaps of interest to a state agency to attempt to profile the use of sites by a foreign intelligence's members.

It is probably difficult to say which sites one is using, but an easier task would be to profile by time and IP address that it seems that this group of people visits site A a lot around X time.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#64

Post by yawz »

whitelister wrote: post #53
yawz wrote: post #50

What is the most intuitive Chrome extension that you've used to block JavaScript on every site and to create a whitelist as you went?

I recommend uMatrix. At first it will take a few minutes to understand how it works, though. You can turn on and off images, css, scripts, XHR, etc, for individual sites or globally. I use it in that manner, with scripting off by default. If I am visiting a new site that needs javascript, I gradually whitelist specific bits until it works and then "save" those settings for that domain.

Thank you!

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#65

Post by soared »

crispyambulance wrote: post #62
abetusk wrote: post #59

From the paper [1]: Each round of attack consists of three steps. In the first step, the cache is primed, i.e., the attacker completely fills some of the cache sets with its own data. The attacker then waits some time to allow the victim to execute. Finally, the attacker probes the cache by measuring the time it takes to access the previously-cached data ... From a brief glance, it looks like they then use the timing…

It seems like a very difficult and iffy technique to get NOT a lot of information. We're talking here about an attacker finding out what website domain names are open in other tabs on a target's browser? Is that a big deal?

Useful for advertisers. If you have amazon.com open that good to know. But if you have amazon.com, sears.com, and appliances.com, then I know you are actively researching major appliances and I need to advertise my brand to you ASAP.

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#66

Post by anyzen »

leni536 wrote: post #11
anyzen wrote: post #6

Not sure if I understand this correctly, but the attacker's JS must load the pages in question to see if they are in cache, right? Wouldn't that put also them in cache, which means that next time this technique is used it will not work? Even more, there is now plausible deniability: "I never saw these pages, I guess some JS must have been snooping around and put them to my cache..." And the logical workaround is disa…

> And the logical workaround is disabling cache,... The attack uses the CPU cache, not the browser cache.

Thank you for the clarification!

Re: This JavaScript can snoop on other browser tabs to work out what you're visiting

#68

Post by newscracker »

nuxi wrote: post #14
newscracker wrote: post #10

> The takeaway, they contend, is that anything short of running a single browser tab at any one point in time poses a privacy risk: if you open a second tab, JavaScript in it can snoop on the other tab. Disabling JavaScript completely will kill off the attack, but also kill off a lot of websites, which rely on JS functionality to work. Firefox Focus [1], my most used browser (single tab only), seems to be safe from t…

Firefox Focus does have multiple tabs - long press on a link, then select "Open link in new tab".

Maybe you're in a different platform and/o country? It doesn't and hasn't had more than one tab on iOS for me from the time it launched till now. I'm typing this comment from Firefox Focus and a long press on any link shows "Open" as an option, but nothing related to tabs.
Post reply on HN