371
Researchers say they can spy on your browsing by measuring SSD activity through a browser API (www.tomshardware.com)
submitted 5 months ago by to c/technology@lemmy.world
73 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 5 months ago (9 children)

So the file has to exceed available RAM to benchmark the SSD performance? How viable is that at all? You'd be downloading gigabytes.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] 22 points 5 months ago (7 children)

    You don’t download the file. The JavaScript generates the file right on disk.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 4 points 5 months ago (6 children)

    Ah that makes more sense. Seems like something easy to detect at least.

    It's been a while but doesn't Windows let you know when you exceed RAM usage and hit paging file?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 5 points 5 months ago (5 children)

    You didn't hit the page file. This is OPFS, an in-browser filesystem that is sandboxed to each origin (essentially to each website), not directly accessible by the user, and exempt from the security checks that would guard access to the regular filesystem.

    Yeah, that sounds to me like it needs a major revision.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 5 months ago (4 children)

    but in order for the file to use all available RAM, other processes that still need memory will eventually trigger the out of memory warning... no?

    unless I'm completely misunderstanding and OPFS has a set limit of RAM usage before it automatically starts writing to drives.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 5 months ago (3 children)

    You seem fixated on the idea that OPFS is some kind of ramdisk. It isn't. When a website stores a file in OPFS, the browser writes some kind of opaque data structure describing all stored files to disk. That data structure can take whichever shape the browser desires excewpt for just dumping those files in a directory in order to isolate OPFS from the regular filesystem.

    You can query the browser for the maximum quota available to you and then just tell it that you want a file that big. Boom, now you own that chunk of the user's SSD.

    As has been pointed out elsewhere, that's still of dubious value for fingerprinting but I don't particularly enjoy the thought that random websites can just occupy gigabytes of space on my computer without even asking.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 5 months ago* (2 children)

    Yeah, I guess I was fundamentally misunderstanding OPFS. I was thinking it was just resident in memory as a process of the browser. What exactly does this line mean, though?

    The file must exceed the system's available RAM so that every random 4 KB read hits the SSD rather than the OS’s page cache.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 5 months ago (1 child)

    The OS can cache parts of files in RAM to speed up accesses. That cache is called the page cache. If your file is big enough you can fairly reliably access random parts of it and expect the OS to not have cached them no matter how big the page cache is. So each read hits the SSD, allowing you to observe its performance.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 5 months ago*

    You also have to provide access to your computer so the attacker can produce labeled training data for the neural network that performs the pattern matching for the actual fingerprinting.

    Because that's what they did in the paper: they got the data and performed the attack on the same machine. There's no evidence presented in the paper that this identification could be generalised to arbitrary machines and configurations without prior access.

    So yes, this is a complete nothingburger.

  • permalink
  • fedilink
  • source
  • parent