3 ms·
The webtiming paper provides more information on this form of attack - http://sip.cs.princeton.edu/pub/webtiming.pdf http://sip.cs.princeton.edu/pub/webtiming.p
by ksri 15y ago
The webtiming paper provides more information on this form of attack - http://sip.cs.princeton.edu/pub/webtiming.pdf http://sip.cs.princeton.edu/pub/webtiming.pdf
The summary of the paper makes me sad -
> We are not aware of any practical countermeasures to these attacks. There seems to be little hope that effective countermeasures will be developed and deployed any time soon.
- nodesocket 15y agoDidn't work in Firefox 8.0.1
- eCa 15y agoI'm getting almost random results in FF8. It differs quite a lot when comparing multiple runs. I'm more surprised that it thinks that I've logged into blogger (which I've never done on this computer) than that it misses my one-page visit to reddit about a week ago. And on the next round the results are reversed.
- rohitarondekar 15y agoTry the original: http://lcamtuf.coredump.cx/cachetime/orig.html http://lcamtuf.coredump.cx/cachetime/orig.html It worked for me on Chrome. The one linked now gives some weird entries.
- vegas 15y agoStill doesn't push through noscript.
- shdon 15y agoCountermeasures don't appear to be all that necessary, if the attack itself is ineffective. The results seem to be quite random, placing me at sites I've never been on and not noticing ones that I do visit regularly, such as Twitter and Facebook.
- gujk 15y agoThe countermeasure is trivial: single-origin policy or origin managmment for cache access. At a slightly expense of slower browsing when visiting evil websites.
- mike-cardwell 15y agoInstall RequestPolicy. It fixes this problem and many many more.