4 ms·

It seems like practical attacks rely on having a reasonably precise timer available. The spectre paper uses SharedArrayBuffer to synthesize a timer, which is a

It seems like practical attacks rely on having a reasonably precise timer available. The spectre paper uses SharedArrayBuffer to synthesize a timer, which is a recent and obscure feature: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/dnzvgTswfbc https://groups.google.com/a/chromium.org/forum/#!topic/blink... https://groups.google.com/forum/#!topic/mozilla.dev.platform/Fjh9z7Er3aA https://groups.google.com/forum/#!topic/mozilla.dev.platform... Chrome and Firefox's "intent to ship" posts both contain claims to the effect that there probably aren't any really serious timing channel attacks, which... seems to have been disproved. Why isn't SharedArrayBuffer already being disabled as a stopgap? I think users can turn it off in firefox, how about Chrome?

kibwen 9y ago
> I think users can turn it off in firefox, how about Chrome? This month's stable Chrome release will be outright disabling SharedArrayBuffer until additional mitigations are enacted.
- londons_explore 9y ago
  Which sucks for people who've built sites which rely on it. It isn't exactly polyfillable.
  - erichurkman 9y ago
    That shouldn't be that many sites. It only hit Chrome stable in July 2017; Firefox in August 2017; and Edge November 2017.
olliej 9y ago
I believe SAB is being disabled, and apparently precision of performance.now() as well? (based on other comments)
caf 9y ago
about:config javascript.options.shared_memory in Firefox.
- kiwijamo 9y ago
  Turned off by default for me in 57.0.3/macOS. Is it usually on by default on other platforms?
  - scarygliders 9y ago
    Just checked on Windows and it was on by default for me for Firefox 57.0.3
jncraton 9y ago
SharedArrayBuffer will be disabled by default as a stopgap: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ https://blog.mozilla.org/security/2018/01/03/mitigations-lan... performance.now() accuracy is also being reduced.

kibwen 9y ago

> I think users can turn it off in firefox, how about Chrome? This month's stable Chrome release will be outright disabling SharedArrayBuffer until additional mitigations are enacted.

londons_explore 9y ago
Which sucks for people who've built sites which rely on it. It isn't exactly polyfillable.
- erichurkman 9y ago
  That shouldn't be that many sites. It only hit Chrome stable in July 2017; Firefox in August 2017; and Edge November 2017.

olliej 9y ago

I believe SAB is being disabled, and apparently precision of performance.now() as well? (based on other comments)

caf 9y ago

about:config javascript.options.shared_memory in Firefox.

kiwijamo 9y ago
Turned off by default for me in 57.0.3/macOS. Is it usually on by default on other platforms?
- scarygliders 9y ago
  Just checked on Windows and it was on by default for me for Firefox 57.0.3

jncraton 9y ago

SharedArrayBuffer will be disabled by default as a stopgap: https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/ https://blog.mozilla.org/security/2018/01/03/mitigations-lan... performance.now() accuracy is also being reduced.