A timing attack with CSS selectors and JavaScript

Re:A timing attack with CSS selectors and JavaScript by gcb0 on Sunday October 07, 2018 @10:22AM (#18160664)

you all should install uMatrix webextension and stop just "wishing". the future is now :)

[ Parent | on HN ]

Re:A timing attack with CSS selectors and JavaScript by notriddle on Sunday October 07, 2018 @03:57PM (#18162334)

Did they fix the problem where disabling javascript didn't enable the `<noscript>` tag?

[ Parent | on HN ]

Re:A timing attack with CSS selectors and JavaScript by nerdponx on Sunday October 07, 2018 @10:33AM (#18160716)

Does uMatrix let me block specific JS web APIs and HTML elements like iframes? It never could in the past.

[ Parent | on HN ]

Re:A timing attack with CSS selectors and JavaScript by gcb0 on Sunday October 07, 2018 @03:00PM (#18162092)

yes. I block iframes globally and the web never been better.

it will show a checkered pattern with a link to open the frame in another window. so you don't even have to whitelist sites or anything. if you care about the frame, like for a embedded video, just open it on its own tab with a single click

[ Parent | on HN ]

Re:A timing attack with CSS selectors and JavaScript by clear_dg on Sunday October 07, 2018 @11:15AM (#18160947)

uMatrix can block frames and js requests on a domain/sub-domain level. afaik, it can't block at url level, if that's what you meant.

That said, uMatrix, from what I remember, uses the webRequest api which does work from urls. So if you know JS, you can always create an extension and add your own filter.

[ Parent | on HN ]

Re:A timing attack with CSS selectors and JavaScript by nerdponx on Sunday October 07, 2018 @04:18PM (#18162420)

To be clear, on the JS side I'm talking about providing whitelist-only access to things like the ambient light level, which is provided through a standardized browser API.

[ Parent | on HN ]