4 ms·
I guess I'm missing the practical vector associated with the "compare" timing attack. All of the js source code is available to see in a debugger, as well as al
by dclowd9901 11y ago
I guess I'm missing the practical vector associated with the "compare" timing attack. All of the js source code is available to see in a debugger, as well as all of the stored memory values. If you've put sensitive information (a secret) in the browser, you've already failed...
- mathias 11y agoThat’s true for client-side JavaScript (like I said in the presentation). It’s a whole different story if you’re using server-side JavaScript (e.g. Node.js), though.
- dclowd9901 11y agoAbsolutely true, but this presentation was about "front end"; maybe I misunderstand the usage of that term...