164
Researchers say they can spy on your browsing by measuring SSD activity through a browser API
(www.tomshardware.com)
this post was submitted on 28 May 2026
164 points (98.2% liked)
Technology
84966 readers
3830 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
So the file has to exceed available RAM to benchmark the SSD performance? How viable is that at all? You'd be downloading gigabytes.
You don’t download the file. The JavaScript generates the file right on disk.
Ah that makes more sense. Seems like something easy to detect at least.
It's been a while but doesn't Windows let you know when you exceed RAM usage and hit paging file?
You didn't hit the page file. This is OPFS, an in-browser filesystem that is sandboxed to each origin (essentially to each website), not directly accessible by the user, and exempt from the security checks that would guard access to the regular filesystem.
Yeah, that sounds to me like it needs a major revision.
but in order for the file to use all available RAM, other processes that still need memory will eventually trigger the out of memory warning... no?
unless I'm completely misunderstanding and OPFS has a set limit of RAM usage before it automatically starts writing to drives.
You also have to provide access to your computer so the attacker can produce labeled training data for the neural network that performs the pattern matching for the actual fingerprinting.
Because that's what they did in the paper: they got the data and performed the attack on the same machine. There's no evidence presented in the paper that this identification could be generalised to arbitrary machines and configurations without prior access.
So yes, this is a complete nothingburger.