Timing attack against HSTS to sniff browser history in Chrome and Firefox

Re:Timing attack against HSTS to sniff browser history in Ch... by zmanian on Tuesday October 27, 2015 @02:35AM (#10456609)

The site attacks seems to fail in Tor Browser. It returns a list of sites that have nothing to do with my browser history. Probably because Tor Browser reduces the time precision.[1]

It seems like it would be nice to require some sort of user privilege escalation like accessing location, or webcam to access high precision timing. This would close off a huge class of time related side channels.

[1]https://trac.torproject.org/projects/tor/ticket/1517

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by bcrypt on Tuesday October 27, 2015 @04:14AM (#10456799)

Tor Browser restricts js timing precision to 100 milliseconds, which makes this way harder. HTTPS Everywhere also creates a lot of false positives, although those can be subtracted out.

See discussion at https://trac.torproject.org/projects/tor/ticket/17423

[ Parent | on HN ]