Thank you Yossi! Given Total Cookie Protection and state/storage partitioning the main attack vector we have to worry about is new windows I think, which is what section 6.3.2 states as well. It seems to me this is a PoC of what has been discussed in XS-Leaks meetings as well, namely using the CPU caches as a global side channel. Essentially any global resource can be (ab)used as such. I'm a bit puzzled by the CORB suggestion in 6.3.3. It seems that would essentially come down to disabling cross-origin new windows altogether? (The fact that we have gotten to the point whereby we force attackers to open new windows does suggest that software-imposed boundaries have helped, I think. But I'll readily concede that opening a new window is trivial.)
Bug 1749129 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Thank you Yossi! Given Total Cookie Protection and state/storage partitioning the main attack vector we have to worry about is new windows I think, which is what section 6.3.2 states as well. It seems to me this is a PoC of what has been discussed in XSLeaks meetings as well, namely using the CPU caches as a global side channel. Essentially any global resource can be (ab)used as such. I'm a bit puzzled by the CORB suggestion in 6.3.3. It seems that would essentially come down to disabling cross-origin new windows altogether? (The fact that we have gotten to the point whereby we force attackers to open new windows does suggest that software-imposed boundaries have helped, I think. But I'll readily concede that opening a new window is trivial.)