4 ms·

Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals "the underlying operating sys

Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals "the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version". Why it's called a JavaScript Template Attack: "A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript."

tantalor 7y ago
> Why it's called... I still don't get it, very weird name. In JavaScript, "templates" are special strings that support interpolation: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
- lioeters 7y ago
  I agree the name is a bit confusing, I also immediately thought of template literals, wondering what kind of vulnerability it could have.
- kreetx 7y ago
  There's also a <template> html tag that one could relate the title to.
thope 7y ago
could be related to sidechannel template attack methodology: https://wiki.newae.com/Template_Attacks https://wiki.newae.com/Template_Attacks
- tantalor 7y ago
  Yep it's actually mentioned somewhere in the paper: Chari et al. [10] introduced template attacks as a strong form of side-channel attacks. They first collect side-channel traces from an attacker-controlled device, the so-called template. Then, they collect a single trace from an identical device processing an unknown secret. The unknown secret can then be recovered by comparing the trace to the recorded templates.