3 ms·
With this attack however doesn't the vulnerability depend on the attackers ability to see the size of the response to the Cross-Origin request? So if the attac
by raesene6 10y ago
With this attack however doesn't the vulnerability depend on the attackers ability to see the size of the response to the Cross-Origin request?
So if the attackers JavaScript can't see a unique response it can't get the difference in size and can't execute the attack...
- pfg 10y agoThe attack determines the size based on the timing information returned by the Resource Timing APIs and the compression side-channel. This is described in section 2.2 of the paper.
- Buge 10y agoThey could use javascript to request the reddit homepage, and use TCP window stuff to see what the size was.