Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Websites have a new way to spy on visitors: analyzing their SSD activity

arstechnica.com

Post reply on HN
Print view View original

91–97 of 97 posts

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#91

Post by lxgr »

hollerith wrote: post #72
VMG wrote: post #64

Earlier quoted context omitted.

Unfortunately, real apps and native tech stacks can not only write data to your SSD, they can usually write data to the user directory however they want and they can read it as well! Browsers are at least somewhat sandboxed

This is a Linux-centric take. It does not apply for example to iPadOS or to AluminiumOS (coming soon to a Googlebook near you). It applies less and less over time to MacOS. Yes, if one is committed to the standard Linux desktop, then one must hope that any proprietary apps one might need will continue to be available through the browser, but I'm ready to let the standard Linux desktop go (not right now, but eventuall…

It very much applies to macOS, or do you know of a way to know what permissions a sideloaded macOS application will have before opening it that's accessible to regular users?

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#92

Post by lxgr »

rayiner wrote: post #84
freedomben wrote: post #69

Earlier quoted context omitted.

> can we go back to real apps and native tech stacks Please God, no. If you're worried about the invasiveness of browser-based apps, native is out of the frying pan and into the fire

Except you’re not going to install native apps for the vast majority of things you use a browser for. You’re going to use the browser for content consumption and native apps for a few things that need system access.

Are you arguing that it's better to install a small handful of highly privileged applications as opposed to none?

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#93

Post by lxgr »

nostrademons wrote: post #4
tovve wrote: post #3

Still don't really understand how it works - I put the reddit logo into your local storage and it only took 20ms to take it out again instead of 50ms so therefore you have reddit open in another tab?

I assume it's something like this: Attacking website periodically makes random reads from a large file in localStorage. Other tabs and websites open have Javascript running that periodically performs operations that will result in SSD traffic. For example, GMail has a certain polling interval to check for new mail, and each request is going to result in a cache write that makes the SSD busy and delays other conflicti…

Usually side channels get way stronger when exploited cooperatively. Think ad scripts embedded on multiple sites communicating with each other across tracking protection and other sandboxes, for example.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#94

Post by runako »

Rohansi wrote: post #88
runako wrote: post #87

Earlier quoted context omitted.

I think that when I install an app, typically it will tell me up front how much disk space is required. For example, in the Mac App Store, the size of the app is at the top of the page. > Should those also be limited to a few MB? I also want to highlight that many/most websites that think of themselves as apps are at odds with their users in that perception. As an engineer, I know full well that e.g. the URL https://…

> But most users think it's a website. I'd be willing to bet most (younger?) users don't know what the difference between an app and a website is. Can't really blame them when the line between them has been blurring more and more over time. I think a growing number of users wouldn't even mention installing as a differentiator because you install PWAs (except on iOS). Anyway, I think an important bit of information th…

> most (younger?) users don't know what the difference between an app and a website is

Yeah, I doubt this because younger users overlap most heavily with "had to ask a parent for permission to install an app."

> It's a reasonable thing to do for an app, so why not a website/PWA?

Again, I chose to install an app and it has transparent install requirements. A website does not clear either of those bars.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#95

Post by hollerith »

lxgr wrote: post #91
hollerith wrote: post #72

Earlier quoted context omitted.

This is a Linux-centric take. It does not apply for example to iPadOS or to AluminiumOS (coming soon to a Googlebook near you). It applies less and less over time to MacOS. Yes, if one is committed to the standard Linux desktop, then one must hope that any proprietary apps one might need will continue to be available through the browser, but I'm ready to let the standard Linux desktop go (not right now, but eventuall…

It very much applies to macOS, or do you know of a way to know what permissions a sideloaded macOS application will have before opening it that's accessible to regular users?

The very fact that you've qualified your question with "sideloaded" suggests that you are already aware that a non-sideloaded MacOS app is installed into a sandbox that is much more secure than anything available on a standard Linux desktop excepting possibly Qubes and Secureblue, and hardly anyone uses Qubes or Secureblue -- probably for very good reasons.

Re: Websites have a new way to spy on visitors: analyzing their SSD activity

#97

Post by lxgr »

hollerith wrote: post #95
lxgr wrote: post #91

Earlier quoted context omitted.

It very much applies to macOS, or do you know of a way to know what permissions a sideloaded macOS application will have before opening it that's accessible to regular users?

The very fact that you've qualified your question with "sideloaded" suggests that you are already aware that a non-sideloaded MacOS app is installed into a sandbox that is much more secure than anything available on a standard Linux desktop excepting possibly Qubes and Secureblue, and hardly anyone uses Qubes or Secureblue -- probably for very good reasons.

Yes, and I'm also aware that most macOS apps are still only available as a sideload, where sandboxing is optional and importantly not user visible before the app runs.
Post reply on HN