3 ms·
Reducing timer resolution was done early on as a quick reaction by browser developers when Spectre & Meltdown were first publicized. All an attacker needs to d
by docandrew 7y ago
Reducing timer resolution was done early on as a quick reaction by browser developers when Spectre & Meltdown were first publicized.
All an attacker needs to do is distinguish between a cached and non-cached memory read - i.e., was accessing some variable "faster" or "slower". There are lots and lots of ways to measure this. A good whitepaper is "Fantastic Timers and Where to Find Them: High-Resolution Microarchitectural Attacks in Javascript".
The TLDR is that timer resolution reduction is ineffective as a speculative attack mitigation.