3 ms·
>We show that despite Google's attempts to mitigate Spectre by deploying Strict Site Isolation, information extraction via malicious JavaScript code is still po
by jasonshaev 5y ago
>We show that despite Google's attempts to mitigate Spectre by deploying Strict Site Isolation, information extraction via malicious JavaScript code is still possible in some cases.
The allusion to Spectre seems odd to me too. This really has nothing to do with Spectre, other than it (sort of?) being a side-channel attack. So Google's Spectre mitigation not "fixing" this isn't surprising.
- tyingq 5y agoGoogle describes the strict site isolation as "Site Isolation is a large change to Chrome's architecture that limits each renderer process to documents from a single site" And they developed that largely in response to Spectre. What the paper did was related to the site isolation, and not Spectre, but there was a lineage there...Spectre -> Site Isolation -> This Side Channel attack still works. They showed that while Google said "single site", they really meant "same tld, but hostnames can differ" and "if you have control over a page on b.whatever.com, you can artificially gain side-channel visibility to c.whatever.com" via window.open() or iframes and some memory pressure. Seems fairly significant given that many sites have user generated content on a.example.com and more important/sensitive stuff on b.example.com.
- bawolff 5y ago> They showed that while Google said "single site", they really meant "same tld, but hostnames can differ" That is how "site" has been defined in the web world (compare to "origin"). For example, consider the SameSite attribute on cookies, site is also used there to mean same tld different hostname. So its not like google made a slip. They've been using this nomenclature consistently.