Researchers say they can spy on your browsing by measuring SSD activity through a browser API — claim FROST attack requires no permissions or user interaction to identify which apps and websites you're using
www.tomshardware.com
The technique correctly identified visited websites with roughly 89% accuracy and running applications with roughly 96% accuracy on a test Mac
  • Buddahriffic@lemmy.worldEnglish
    1·
    2 days ago

    Sounds like a bunch of timing attacks could be rendered useless if access to an accurate timer required special permission. And without the permission, it either limited the resolution or added random jitter to any timer APIs.

    • bitfucker@programming.devEnglish
      2·
      1 day ago

      Yeah, honestly we should have a way to instrument JS without actually making the JS runtime able to read the measurement data