5 ms·
This would be a security problem. By measuring resource timing of a script copied from another site, one could determine if the browser has visited that other s
by strommen 11y ago
This would be a security problem. By measuring resource timing of a script copied from another site, one could determine if the browser has visited that other site.
(Resource timing is disallowed for cross-domain resources for exactly this reason).
- reaktivo 11y agoCan you further explain? I can't see how this would work.
- michaelmior 11y agoYou can request to load a particular script that you know comes from a given site. If it loads instantly (for some value of "instantly"), then the request was almost certainly served from cache.
- madeofpalk 11y agoYou can do that at the moment. I made a site where I 'guessed' if a user was an employee of a certain company by embedding an <img> from an employee portal (from the login screen) and timing how long it took for onLoad to trigger. Times under a certain threshold indicated that the image was probably cached and they work there. Of course, once you load it once it's cached, so you need to persist the first result... but you get the drift.
- ohitsdom 11y agoThe <img> was from a different domain?
- madeofpalk 11y agoYes. Images work cross domain and they still fire onLoad correctly.
- detaro 11y agoOne could have sites opt-in to it, e.g. by a HTTP header? CDNs and other common resources could allow it, but identifying files would still be protected.
- strommen 11y agoCORRECTION - resource timing is not disallowed entirely; only network timing details (to calculate latency, etc.) are disallowed. Sharing resources across pages based on has values would render this restriction moot. From http://www.w3.org/TR/resource-timing/ http://www.w3.org/TR/resource-timing/: "Statistical fingerprinting is a privacy concern where a malicious web site may determine whether a user has visited a third-party web site by measuring the timing of cache hits and misses of resources in the third-party web site. Though the PerformanceResourceTiming interface gives timing information for resources in a document, the cross-origin restrictions prevent making this privacy concern any worse than it is today using the load event on resources to measure timing to determine cache hits and misses."