4 ms·

It must be time consuming to read other process' memory through such a side channel. Then limiting JS execution time for web pages should mitigate this vulnerab

It must be time consuming to read other process' memory through such a side channel. Then limiting JS execution time for web pages should mitigate this vulnerability? By default only small amount of js execution is allowed for web pages (small event handlers and such). If a page tries to execute more js, browser should ask user's permission to extend the limit. (Maybe several levels of the limit should be supported?). Some web pages could be added to a permanent list of trusted domains with permanently increased limit. Upd: 4-5 minutes, in the first video (https://youtu.be/Z2RtpN77H8o?si=XB4oI9ner8pFTIqN https://youtu.be/Z2RtpN77H8o?si=XB4oI9ner8pFTIqN) - see the time on the top right of their screen. When the attack starts it's 5:22, ends at 5:27.

piperswe 3y ago
This will likely just fatigue users, who will just keep tapping "yes" on the prompts to make the websites work.
- userbinator 3y ago
  The point is that most sites don't need that much intense JS processing. Also, a "no, and don't ask again" button would be very useful in this case.
  - InsomniacL 3y ago
    The end-user would have no idea if that much JS processing is legitimately required or not. "no, and don't ask again" would cause no-end of support issues.
    - avodonosov 3y ago
      I know one end-user who would very much want a browser setting for default compute limit for domains / pages, after which browser will start asking confirmation, as described in the above comments. Web pages could also ask for such permission upfront, using e.g. a Meta tag. Such a setting whould also reduce malicious crypto mining possibilities.
- avodonosov 3y ago
  Most web sites will not be affected. Also, a well designed notification dialog, with clear explantion and useful options - allow once, forbid, allow and add the website to trusted domains for N days, etc. - will help users.
InsomniacL 3y ago
ignoring people just clicking 'yes' on popup boxes... if JS execution was limited to 60 seconds, and the attack takes ~5 mins, limiting the attack to 59 seconds would still have a 1/5 success rate. It doesn't close the vuln and just adds un-necessary friction for users.
- saagarjha 3y ago
  Not if the exploit requires a minimum of 5 minutes.

piperswe 3y ago

This will likely just fatigue users, who will just keep tapping "yes" on the prompts to make the websites work.

userbinator 3y ago
The point is that most sites don't need that much intense JS processing. Also, a "no, and don't ask again" button would be very useful in this case.
- InsomniacL 3y ago
  The end-user would have no idea if that much JS processing is legitimately required or not. "no, and don't ask again" would cause no-end of support issues.
  - avodonosov 3y ago
    I know one end-user who would very much want a browser setting for default compute limit for domains / pages, after which browser will start asking confirmation, as described in the above comments. Web pages could also ask for such permission upfront, using e.g. a Meta tag. Such a setting whould also reduce malicious crypto mining possibilities.
avodonosov 3y ago
Most web sites will not be affected. Also, a well designed notification dialog, with clear explantion and useful options - allow once, forbid, allow and add the website to trusted domains for N days, etc. - will help users.

InsomniacL 3y ago

ignoring people just clicking 'yes' on popup boxes... if JS execution was limited to 60 seconds, and the attack takes ~5 mins, limiting the attack to 59 seconds would still have a 1/5 success rate. It doesn't close the vuln and just adds un-necessary friction for users.

saagarjha 3y ago
Not if the exploit requires a minimum of 5 minutes.