4 ms·

The limitation on high precision timers isn't due to privacy, it's because of the Spectre/Meltdown family of attacks. We'd like to lift those restrictions, at l

by om2 7y ago

The limitation on high precision timers isn't due to privacy, it's because of the Spectre/Meltdown family of attacks. We'd like to lift those restrictions, at least conditionally, and are looking into it. I appreciate the note about your use case. (BTW requestAnimationFrame should give you precise callbacks at the screen's refresh rate, and is probably better than using timer-related APIs.)

akersten 7y ago
Fundamentally Spectre is a privacy issue, just not in the tracking sense here, right - it's a side channel by which memory can be leaked. Anyway, the reason I brought up timers is that things like getting the screen's refresh rate, or measuring how long a canvas render takes with a particular font, (etc.) are all data points that can be used in a fingerprinting profile. I worry about the negative impacts of mitigations against those kind of measurements. I don't think it's possible to catalog all the various routes by which data could be inferred by timing. If things like this are in the scope of what Webkit is trying to prevent, I'm fairly nervous. Off topic, but just for some game industry perspective: often we don't want to sequence exactly at the refresh rate (especially if it's variable or frames are being dropped) in contexts like logic loops or physics simulations that need to happen at specific frequencies regardless of how quickly frames are drawn. For example, synchronizing a client "tick rate" with a game server's requires millisecond precision.
- om2 7y ago
  Thanks for the info. For dual use technologies we are considering a machine learning approach to identifying fingerprinters (as opposed to legit clients). Also, to my knowledge, screen refresh rate is not currently a top fingerprinting vector. As for Spectre, we treat it primarily as a security threat. It can admittedly be privacy invasive but it would be awkward to use it for tracking.

by om2 7y ago

akersten 7y ago

Fundamentally Spectre is a privacy issue, just not in the tracking sense here, right - it's a side channel by which memory can be leaked. Anyway, the reason I brought up timers is that things like getting the screen's refresh rate, or measuring how long a canvas render takes with a particular font, (etc.) are all data points that can be used in a fingerprinting profile. I worry about the negative impacts of mitigations against those kind of measurements. I don't think it's possible to catalog all the various routes by which data could be inferred by timing. If things like this are in the scope of what Webkit is trying to prevent, I'm fairly nervous. Off topic, but just for some game industry perspective: often we don't want to sequence exactly at the refresh rate (especially if it's variable or frames are being dropped) in contexts like logic loops or physics simulations that need to happen at specific frequencies regardless of how quickly frames are drawn. For example, synchronizing a client "tick rate" with a game server's requires millisecond precision.

om2 7y ago
Thanks for the info. For dual use technologies we are considering a machine learning approach to identifying fingerprinters (as opposed to legit clients). Also, to my knowledge, screen refresh rate is not currently a top fingerprinting vector. As for Spectre, we treat it primarily as a security threat. It can admittedly be privacy invasive but it would be awkward to use it for tracking.