I think what would be more interesting is using this as a side channel for communication between different sandboxed contexts.
Websites have a new way to spy on visitors: analyzing their SSD activity
51–60 of 97 posts
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#52Wait, wait, wait: browsers allow websites to store junk on my drive? They take up gigabytes of memory and still write to disk on top of this? Without even asking whether the site can use local storage? Years and years back when laptops still had HDDs, I had a script to put the Firefox profile &c on a ramdisk and sync it on reboots so that it didn't spin up the drive constantly. I guess I should have kept doing it. It…
My shortcut for launching "clean" Chromium session is `chromium --user-data-dir=$(mktemp -d)` -- each launch creates a new transient profile directory under /tmp, which is itself a RAM disk. Persistent settings are achieved by setting system-wide defaults in /etc/chromium, including using system-wide managed policy JSON.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#53I’m skeptical of these side channel attacks that rely on training a neural network on specific controlled scenarios on controlled hardware. I believe that with enough time and effort and the perfect circumstances where the user is only visiting their website and doing one other thing that the network was trained on it can match. It does not seem useful as a general purpose side channel vector.
Publish or perish. It worked once, in a controlled lab, mostly (80-90% guess). Good enough for more millions in funding..
Not really joking here.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#54That's it, I'm turning off JavaScript for everything non essential from here on out.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#55I was interested in this so i created a proof of concept: https://github.com/brammittendorff/opfs-ssd-timing
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#56Wait, wait, wait: browsers allow websites to store junk on my drive? They take up gigabytes of memory and still write to disk on top of this? Without even asking whether the site can use local storage? Years and years back when laptops still had HDDs, I had a script to put the Firefox profile &c on a ramdisk and sync it on reboots so that it didn't spin up the drive constantly. I guess I should have kept doing it. It…
Browsers have an absolute insane level of relatively unchecked permissions to do whatever they want on a client. There's a lot of effort by browser developers to scope creep the browser into essentially being an OS-agnostic tech stack (one where, conveniently, code can be shipped across the network "as necessary", removing a lot of user agency for the software being ran); Chrome being the biggest driver of this, whil…
It's also the technology that will allow software to run without a continuous connection to the server. If you want to break out of a world where companies own your data it's the tech that is needed.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#57Wait, wait, wait: browsers allow websites to store junk on my drive? They take up gigabytes of memory and still write to disk on top of this? Without even asking whether the site can use local storage? Years and years back when laptops still had HDDs, I had a script to put the Firefox profile &c on a ramdisk and sync it on reboots so that it didn't spin up the drive constantly. I guess I should have kept doing it. It…
Browsers have an absolute insane level of relatively unchecked permissions to do whatever they want on a client. There's a lot of effort by browser developers to scope creep the browser into essentially being an OS-agnostic tech stack (one where, conveniently, code can be shipped across the network "as necessary", removing a lot of user agency for the software being ran); Chrome being the biggest driver of this, whil…
Flash ended up getting blocked/banned by all browsers because it turned into a giant gaping security hole.
> By January 2021, all major browsers were blocking all Flash content unconditionally.
It looks like we-the-users need to be blocking any and every one of these parasites.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#58I laugh at your spying attempts from my HD-equipped laptop, ...
I laugh at your spying attempts from my cURL e-mail service that I use instead of a web browser.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#59Earlier quoted context omitted.
> Simply add random access times. That doesn't work. Because the random times are uniformly distributed it's possible to remove it from the data by additional sampling. You do make it harder because you need a lot more data, but it's still possible to extract the signal, because the noise is uniform.
The interesting mitigation would be snapping I/O to a course clock. You could then set it to hold the result until the next tick. E.g. An I/O tick of 20ms, and it would only return on 20ms boundaries, then almost every SSD would look the same. It would slow down the API a bit, but privacy has tradeoffs.
Probably still does not work. Assume a request takes X ms and let us look at what you will observe depending on where within a tick period it arrives.
If it arrives anywhere from 0 ms to (20 - X) ms after a tick, it will complete before the next tick, so the measured duration will be between X ms and 20 ms. If it arrives later in the tick period, it will miss the next tick and have to wait an additional tick period, so the measured duration will be between 20 ms and (20 + X) ms.
If you make N repetitions, you would normally see a spike of density 1 at X. With the 20 ms tick wait, you will see a uniform distribution of density 1/20 between X and (20 + X).
You would have to perform each request and then return the result exactly 20 ms after it was received in order to mask the request duration. But that just creates a new target, your timers and queues to delay the response. Or making the load so high, that requests take more than 20 ms.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#60Why don't SSDs trust websites anymore?
Because every time they open up, the site gives them the F̶R̶O̶S̶T̶ cold shoulder.