Power analysis have opens a lot of doors for indirect attacks.

If they can predict which site you're on, they can also possibly detect an unsecured secure algorithm's state.

SSL or PGP had a similar "power starvation" attack: reducing the power to the power supply and watching power drainage allowed one to predict private keys.

The attack has been patched, then.

This sounds really interesting! Do you have any links where I can read more about this power starvation attack?

I remembered it correctly: It's the RSA part of OpenSSL which was cracked (or leaked to be exact), 11 years ago (wow, time flies).

Summary is here [0], and paper is here [1].

[0]: https://www.theregister.com/2010/03/04/severe_openssl_vulner...

[1]: http://web.eecs.umich.edu/~valeria/research/publications/DAT...

Does anyone actually use their phone while attached to a wireless charger? It seems incredibly awkward.

I actually use mine. Generally stream music to something. However, you don't need to use it.

iOS does a lot of thing during charging. Face recognition, backups, mail checks, software updates, another applications' background stuff.

It might as well interact with your home or car over BT (cars have wireless charging these days). There's a myriad of opportunities there.

There are wireless charging phone mounts:

* https://www.rammount.com/shop-all/phone-mounts/wireless-char...

There really is none, if you control the environment where someone is charging their phone while using it, it wouldn’t be hard to just point a hidden camera at the screen.

Or just offer free wi-fi and watch people’s traffic.

That assumes the camara always has a view and that there's no VPN or other layer protecting the traffic.

No, if all you want is detecting which one of 20 websites a user is browsing to, which you can by checking how much power it uses, you can definitely do that from traffic patterns even if the traffic flows through a vpn.

And this ‘leak’ assumes a user has his phone on a charger while it is already full, there is no guarantee it works.

To me this is notable research because if this side-channel attack is possible, then maybe more serious ones are.