@arstechnica

I have to wonder if the required read/write mechanisms for this particular mode of attack would have the added 'benefit' of shortening SSD lifespans.

Fuck data merchants.

@arstechnica

Blocking JavaScript is ugly but JavaScript is a huge problem of malware, viruses, surveillance and bullshit.

Can a subset of JavaScript be used, so the page displays, but JavaScript isn't analysing my drives?

@arstechnica how it works: It's all based on timing how long it takes for JavaScript statements to access the local storage for the (malicious) website. If other websites or local apps are also accessing the same SSD at the same time, those accesses will take longer because of contention for the SSD. Different websites and apps have different usage patterns of the local storage. You can take all that timing data and feed it into a pretrained convolutional neural network to detect which websites and apps are running.

It requires at least 1G of storage, so savvy users can detect unusual storage usage, and for everyone else browser makers can reduce storage limits per website below that.

#cybersecurity #FROST

@arstechnica Techniques like this are why I run JShelter ( https://jshelter.org )

Unfortunately Cloudflare requires fingerprinting to be allowed 🤮

@arstechnica

New attack fingerprints you by SSD timing. My threat model is just being too cheap to upgrade.