News for hackers. Stuff that matters.

A comment on Timing attack against HSTS to sniff browser history in Chrome and Firefox.

Re:Timing attack against HSTS to sniff browser history in Ch... by gergles on Monday October 26, 2015 @10:51PM (#10455976)
Thankfully, this particular attack does not work with a running µmatrix. I do see a bunch of image requests to all these domains, but it shows that I haven't visited any (except for the ones that are blocked completely by hosts files, amusingly enough).
[ Parent | on HN ]
Re:Timing attack against HSTS to sniff browser history in Ch... by bcrypt on Monday October 26, 2015 @11:37PM (#10456155)
adblocked domains are indistinguishable from hsts blocked domains in terms of timing. so they show up as false positives. a clever attacker could subtract them out though.
[ Parent | on HN ]