Stefan Gast

223 Followers
321 Following
1,017 Posts

PhD Candidate in the CoreSec group at #TUGraz, focusing on side-channel security. Apart from that, I also post #Linux and #privacy related stuff.

Opinions posted here are my own and do not necessarily reflect those of my employer.

Websitehttps://stefangast.eu

To the user-interface designers and programmers out there: If the unfortunate event happens and you have to show an error message, please make sure the message is actually helpful for identifying the issue. You might think that hiding technical details is user-friendly, but in fact, the opposite is true. Do not make us guess what is wrong, tell us what you know!

You might be afraid that this confuses users who are less tech-savvy. Not necessarily, if you give them a rough idea first (maybe in a more emphasized font) and then continue with the details you have (maybe in a smaller font). I am quite sure users are able to ignore the parts they do not understand, and if they need support, at least the person giving support has something to work with.

Some simple examples:

❌ "Cannot connect to bluetooth device."
❓ "Okay, but why?"
✅ "Cannot connect to bluetooth device 'foo' (maybe it is turned off?): The device does not respond."

❌ "Cannot open file."
❓ "Which file? And again, why?"
✅ "Cannot open file 'testfile.txt' for reading: Permission denied"

❌ "Something went wrong when trying to load the website."
❓ "Again, what's the problem? Is the network interface down? Is the DNS server down? Is the target server itself down? Give me a hint, please!"
✅ "Cannot load the website. Maybe your computer is not connected to the Internet? Details: No route to host (192.168.10.1) when attempting to connect to the DNS server."

This is nothing new. In fact, it is just an adaptation of the top-down writing approach we also use when writing scientific papers, for example: You begin with a rough overview and give increasingly more details later in the text.
But do not omit the details completely!

#usability #userinterfaces #userinterfacedesign #errormessages #programming #writing #technicalwriting

I have just presented our paper on Zero Click SnailLoad at ESORICS 2025 in Toulouse. Thank you to all who attended my talk, also for the nice discussion!

Also thanks to @c1t for taking the picture!

#ESORICS2025 #Toulouse #SnailLoad #sidechannel

I was at the EuroS&P workshops today, presenting our study on the security of educational test systems. I liked the welcoming atmosphere and the interesting discussions. And of course, Venice is a nice location for all this. 🙂

The full paper is available here: https://stefangast.eu/papers/testsystems.pdf
Great collaboration with Sebastian Felix, Alexander Steinmaurer, Jonas Juffinger and @lavados

#EuroSP2025 #Venice

Really? We've sunk so low? This is from the #shopify instance of gravurzeile.de:
It was a pleasure to present #CounterSEVeillance at #NDSSSymposium2025 today. Thanks to everyone attending, also for the interesting and nice discussion after the talk! 🙂

Just in case somebody else was wondering:
Today I have noticed graphical glitches at the bottom of #YouTube videos when hovering over them in #Firefox, see the attached screenshot.
This is _not_ a rendering problem in Firefox, and _not_ an issue with the graphics card driver.
Instead, this is just the canvas fingerprinting protection of Firefox at work, preventing websites from obtaining canvas data.
A website trying to read canvas data without proper permissions obtains random data instead.
In the case of YouTube, this results in the effect shown in the screenshot.
This can be checked by temporarily giving YouTube the permission to read canvas data (I'm not recommending to be generous with that permission).

More information can be found here:
https://browserleaks.com/canvas#how-does-it-work
https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting

Canvas Fingerprinting

Canvas fingerprinting is a tracking method that uses HTML5 Canvas code to generate a unique identifier for each individual user. The method is based on the fact that the unique pixels generated through Canvas code can vary depending on the system and browser used, making it possible to identify users.

BrowserLeaks
Announcing #CounterSEVeillance, a novel attack on AMD SEV-SNP inferring control-flow information and operand properties from performance-counter data with single-instruction resolution.
We present 4 case studies with attacks on RSA, TOTP verification and HQC.
Thanks to @hweissi, @supersingular and @lavados for the amazing collaboration!
You can read the full paper (to appear at #NDSS2025) here: https://stefangast.eu/papers/counterseveillance.pdf

I had the pleasure to contribute to Lukas Maar's #USENIX2024 paper "SLUBStick".
SLUBStick elevates limited heap vulnerabilities within the #Linux kernel to arbitrary memory read-and-write primitives, leveraging a timing side channel.
Thanks to Lukas Maar, Martin Unterguggenberger, Mathias Oberhuber and Stefan Mangard for this great opportunity!
Congratulations to Lukas Maar for driving the paper to acceptance at USENIX Security!

You can read the full paper here: https://stefangast.eu/papers/slubstick.pdf

#SLUBStick #Kernel #Linux #KernelSecurity #sidechannel #usenixsecurity #usenixsec

Announcing SnailLoad, the first fully remote website- and video-fingerprinting attack working via arbitrary TCP connections.
SnailLoad does not require any attacker code on the victim machine, any TCP connection is enough.

Great collaboration with Roland Czerny, Jonas Juffinger, Fabian Rauscher, @silent_bits and @lavados.

See the website for the full paper and a live demo: https://www.snailload.com
(1/3)

#SnailLoad #sidechannel #networksecurity

SnailLoad: Exploiting Remote Network Latency Measurements without JavaScript

I had the pleasure to contribute to the #USENIX2024 paper "Divide and Surrender", recovering the full secret key from the reference implementation of the HQC Key Encapsulation Mechanism, exploiting a timing side channel arising from non-constant-time modulo operations.
Thanks to Robin Leander Schröder and Qian Guo for this opportunity and congratulations to Robin Leander Schröder for getting his first paper accepted at USENIX Security!

You can read the full paper here: https://stefangast.eu/papers/divide_and_surrender.pdf

#divideandsurrender #hqc #sidechannel #postquantumcrypto #usenixsecurity