Chrome will Soon Let You Share Links to a Specific Word or Sentence on a Page

Re:Chrome will Soon Let You Share Links to a Specific Word o... by fooyc on Friday February 15, 2019 @06:09AM (#19169951)

Can this be used to gain some informations about the content of a webpage, with a timing attack ?

Searching a phrase on a webpage will be faster when the phrase exists, on average. If this timing is observable, this could be exploited to guess the content of a web page.

Someone did this already with selector-based anchors: https://blog.sheddow.xyz/css-timing-attack/

[ Parent | on HN ]

Re:Chrome will Soon Let You Share Links to a Specific Word o... by bokan on Friday February 15, 2019 @10:37AM (#19171716)

Feature author here.

The CSS timing attack actually influenced the design process heavily. The original design was to use a stripped down CSS selector but we found this too large of an attack surface.

There's definitely still concerns around making sure a 3rd party can't exfiltrate information from the page using this but we think we've found a set of restrictions that should prevent this: https://github.com/bokand/ScrollToTextFragment#security

[ Parent | on HN ]