this post was submitted on 27 May 2026
86 points (97.8% liked)

Privacy

5706 readers
24 users here now

Welcome! This is a community for all those who are interested in protecting their privacy.

Rules

PS: Don't be a smartass and try to game the system, we'll know if you're breaking the rules when we see it!

  1. Be civil and no prejudice
  2. Don't promote big-tech software
  3. No apathy and defeatism for privacy (i.e. "They already have my data, why bother?")
  4. No reposting of news that was already posted
  5. No crypto, blockchain, NFTs
  6. No Xitter links (if absolutely necessary, use xcancel)

Related communities:

Some of these are only vaguely related, but great communities.

founded 2 years ago
MODERATORS
otter@lemmy.ca
shaytan@lemmy.dbzer0.com
86
Websites have a new way to spy on visitors: analyzing their SSD activity (arstechnica.com)
submitted 4 days ago by schnurrito@discuss.tchncs.de to c/privacy@lemmy.dbzer0.com
33 comments fedilink hide all child comments
top 33 comments
sorted by: hot top controversial new old
[–] Libb@piefed.social 29 points 4 days ago (2 children)

JavaScript, that once promised to be so useful, has become the tool of choice for the wonderful surveillance dystopia we live in...

A year ago, I tried for a few months to use the Web without any JavaScript running. If it was fine on a few selected (and, unsurprisingly, privacy respecting websites) it was... close to impossible everywhere else, including state/government/public services websites. That's the first thing I would want to change if we were to take back some control/privacy: official/public services should not rely on privacy invasive tools.

[–] Seimhe@lemmy.world 4 points 4 days ago

I wonder if it's possible to selectively limit it to certain libraries or function calls, disabling the rest.

[–] morto@piefed.social 2 points 3 days ago

For general use, it's almost impossible, but I found it very doable to have a browser without js in the phone, for reading stuff. Turns out most news and informational sites are readable without js.

[–] sp3ctr4l@lemmy.dbzer0.com 28 points 4 days ago* (last edited 4 days ago) (3 children)

canvasblocker ublockorigin privacybadger

about:config ->

-> javascript.options.shared_memory = FALSE

-> privacy.firstparty.isolate = TRUE

-> privacy.partition.network_state = TRUE

-> privacy.partition.network_state.oscp_cache= TRUE

-> privacy.partition.network_state.oscp_cache.pbmode = TRUE

-> privacy.partition.serviceWorkers = TRUE

-> privacy.reduceTimerPrecision = TRUE

-> privacy.resistFingerprinting.reduceTimerPrecision.jitter = TRUE

-> privacy.resistFingerprinting.reduceTimerPrecision.microseconds = 1000 ... or... more?

... might do something to stymie this?

From the paper:

We assume default configurations for the operating system and browser.

Well I have no idea what the 'default configuration' of ... Linux ... is...

But uh, theoretically this is something you could harden against by going balls to the wall with security preferences and options in firefox, waterfox, librewolf, ironfox, something like that... maybe?

Also, its maybe possible that using a seperate container for each seperate tab could also stymie this.

[–] alapakala@quokk.au 12 points 4 days ago (1 children)

OPFS

oh you firefox

Seems like a feature vendors need reconsider unimplementing/threat remodeling.

[–] sp3ctr4l@lemmy.dbzer0.com 5 points 4 days ago

Yeah I apparently missed all this but yeah, there seems to have been a significant hubub of basically... wait why do we even need this at all?

To satisfy lazy corporate web devs who can't be bothered to use existing APIs properly?

That's basically my take after after a light review of reading several threads in various places around this, over the last few years.

[–] flambonkscious@sh.itjust.works 3 points 4 days ago (1 children)

Interesting ideas in here, particularly the timer precision

[–] sp3ctr4l@lemmy.dbzer0.com 5 points 4 days ago* (last edited 4 days ago) (1 children)

Waterfox seems to already have a default of 1000 microseconds, if... I think, you go with 'strict' privacy settings option?

So on the one hand, a very brief perusal of the paper shows that the method needs like, sub 200 timings to work well.

On the other hand... I have no idea if the exploit method effectively circumvents the way this timing speed limit actually works.

I basically just sped read everything lol.

[–] wyldrstallyns@lemmy.dbzer0.com 1 points 4 days ago

So, you're saying you only needed one timer?

[–] far_university1990@reddthat.com 2 points 4 days ago (1 children)

Mullvad browser maybe better for this than librewolf?

[–] sp3ctr4l@lemmy.dbzer0.com 2 points 4 days ago (1 children)

Potentially?

Maybe?

I would not call myself an expert here, I don't... dev webbrowsers, more like I'm a privacy minded power user.

I'm literally just spitballing, I can guarantee nothing.

Maybe if I did a full crash course over like a month or two, I could have what I would call a 'semi-informed' opinion.

[–] far_university1990@reddthat.com 1 points 4 days ago

Because mullvad based on torbrowser which known very fingerprint resistant.

[–] recklessengagement@lemmy.world 21 points 4 days ago (1 children)

I give up. I'm throwing my computers away. Goodbye everyone

[–] sp3ctr4l@lemmy.dbzer0.com 5 points 4 days ago (1 children)

Never give up.

Never surrender.

See my other comment.

[–] Seimhe@lemmy.world 4 points 4 days ago

By Grabthor's Hammer, you're right.

[–] mindbleach@sh.itjust.works 7 points 3 days ago

Today in "why the fuck is that an API?"

[–] 01189998819991197253@infosec.pub 11 points 4 days ago

Joke's on them. I have an HDD.

[–] 9point6@lemmy.world 11 points 4 days ago (1 children)

Well now I don't seem so crazy for having a minimum of 100 tabs open at any one time.

Surely past a certain point it just becomes white noise

[–] calliope@piefed.blahaj.zone 23 points 4 days ago (1 children)

The bad news is that the article says

One of the best ways to prevent FROST attacks is to close tabs as soon as they’re no longer needed

Leaving the tabs open just gives them more opportunities to track you.

[–] alapakala@quokk.au 4 points 4 days ago (1 children)

or, no tabs at all. Let the window manager tab browser sessions instead. Isolated/jailed, ofc..

[–] 9point6@lemmy.world 3 points 4 days ago* (last edited 4 days ago) (1 children)

Nah, that's not gonna do anything for this given it is looking at the I/O characteristics of your SSD, it doesn't need any permissions to do this, it's basically just copying stuff in its own sandbox and pulling data from analysing the transfer characteristics.

Unless for every site you want to visit you install a fresh SSD, with a new installation of a browser and you only ever visit a given site from its dedicated browser and SSD, and do nothing else with it. (This is not limited to figuring out just what sites you're visiting, but also what applications you're ruining)

The alternative is something similar to what I suggested which is to basically ensure your SSD is spammed with accesses so it's very hard to pull out the individual signals.

It's similar to a VPN connection. If someone is particularly interested in you, they can look at the pattern of VPN transfer traffic. If you open a connection and then go straight to a website and nothing else, it's relatively trivial for a determined enough adversary to take a fingerprint of the transfer sizes and timings. Enough times they can get a good set of fingerprints that they can then start to match to actual sites.

Now this was regarded as quite hard to do until AI tools like this one come along to dramatically reduce the time needed to do this analysis.

A way to mitigate the above is to make sure your connections are doing multiple things so it's harder to pull these fingerprints from traffic patterns. So I'm assuming the same strategy would work here given it's basically the same kind of attack

[–] alapakala@quokk.au 1 points 4 days ago (1 children)

bruh, read my other comments 🧵

OPFS should not exist.

[–] 9point6@lemmy.world 2 points 4 days ago* (last edited 4 days ago) (1 children)

Sorry could you elaborate? You just linked to the MDN page in the comment and claimed it was bad in that one. Did you mean to link to a different one?

It's implemented everywhere, so it's not that it's a single browser doing something weird, it seems to be sandboxed (in a conventional sense), and there's plenty of use cases where an application might need high performance storage access or a pseudo filesystem.

What is your reasoning for unimplementing it rather than mitigating the issue? I don't believe there is an equivalent web technology to this that people could use instead.

[–] alapakala@quokk.au 1 points 4 days ago (1 children)

As demonstrated in the paper, OPFS enables attackers to read more than just browsing habits, but also solid state gates’ data.
Meaning, if vendors require HPSA, they will need to redesign their entire threat model to an isolated securely atomized one that OPFS by design cannot secure.

[–] 9point6@lemmy.world 1 points 4 days ago (1 children)

I get that the paper has discovered a flaw, but I don't see how it is unmitigatable, it's still a sandboxed filesystem at the end of the day, rate smoothing and noise insertion seem like fairly obvious first steps and I'm far from an expert.

It's like saying we should get rid of VPNs because they suffer the same kinds of side channel risk.

[–] alapakala@quokk.au 1 points 4 days ago* (last edited 4 days ago) (1 children)

I mentioned threat remodeling for several reasons. One of them is, as designed OPFS fails every single one of your suggestions, and more.

So, an entire HPSA model needs to be redesigned, or stick to non HPSA whatsoever until further peer reviewed refuzzing has been made.

This type vectorization isn't novel, it's just hilarious vendors just accepted it without further security considerations.

we should get rid of VPNs because they suffer the same kinds of side channel risk.

🤝🤣

[–] 9point6@lemmy.world 1 points 4 days ago* (last edited 4 days ago) (1 children)

🤝🤣

Why did you chop off the start of the sentence to make it look like I was saying the thing you were?

I was pointing out it's a ridiculous thing to suggest

I mentioned threat remodeling for several reasons. One of them is, as designed OPFS fails every single one of your suggestions, and more.

So, an entire HPSA model needs to be redesigned, or stick to non HPSA whatsoever until further peer reviewed refuzzing has been made.

This type vectorization isn't novel, it's just hilarious vendors just accepted it without further security considerations.

Right, yes it definitely needs fixing, that's what I'm saying. Then you veer off into saying we should build it from scratch again? Why? There's no apparent need for that given what you've said, you're just describing what we do to fix the existing standard?

It's the web, vendors don't break existing APIs unless there's no other option and from what you've written so far, the problem is in the implementation, not the API.

[–] alapakala@quokk.au 1 points 4 days ago* (last edited 4 days ago) (1 children)

bruv, have you ever designed a fighter jet from a raft?

Because that is the equivalence of comparing OPFS is to a secured PostgreSQL query.

You cannot attain security from a raft, when fighter jets only need to drop bomps like a carpet to write on cities, and traverse microseconds of distances compared to whatever the wind is.

OPFS is insecure by design.

[–] 9point6@lemmy.world 1 points 4 days ago* (last edited 4 days ago)

A postgres query is not a filesystem and also not intended at all for large binary blob storage and arbitrary range access? That's an entirely different tool for completely different use cases.

The existing filesystem API (that the OPFS API appears to build on) is entirely reasonable for its intended use case, and is actually even more entrenched than OPFS given it exists for non-sandboxed uses, and has done for quite a long time. Remember, browser vendors will not break web APIs unless there's no other option, for good reason.

I also feel like you keep shooting past the fact this is a side channel attack. It's fairly reasonable to conclude any storage operation that hits the SSD could be used for this kind of thing. So basically any equivalent approach would require the same mitigations.

You've still not made any valid case for your claim that it's insecure by design.

Just so we can draw this to a close: please explain, specifically and succinctly, which fixes you would make and why specifically the existing OPFS is fundamentally incompatible with your suggestions.

So far there has been nothing like that in this thread, just hand waving and it's insecure by design, just trust me bro

[–] bangupjobasusual@lemmy.world 4 points 4 days ago

That doesn’t seem right, there are so many variables that go into io scheduling… this wouldn’t work in many use cases

[–] sic_semper_tyrannis@lemmy.today 4 points 4 days ago (1 children)

That's insane

[–] alapakala@quokk.au 1 points 4 days ago

nrly, just Mozilla things.

[–] A404@lemmy.dbzer0.com 2 points 4 days ago

Great, just what we needed