this post was submitted on 28 May 2026
138 points (97.9% liked)

Technology

84966 readers
3846 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 3 years ago
MODERATORS
all 39 comments
sorted by: hot top controversial new old
[–] tunetardis@piefed.ca 14 points 1 hour ago (1 children)

The attack creates a large OPFS file on the victim's SSD, with both Chrome and Safari allowing a website to claim up to 60% of total disk space through OPFS, which on a 256GB drive is over 150GB.

Am I reading this right? 60% of all your disk space can be confiscated by some random web site? I gotta figure out how to get my browser cache onto some tiny partition.

[–] Grostleton@lemmy.dbzer0.com 5 points 1 hour ago (2 children)

I've done it with some apps/games by placing the folder in question on a separate drive/partition and using junction points (I use Junction Link Magic, but you can do it manually from command prompt) to basically create a ghost of the folder in the original location that routes everything to the new location.

You could create a small hidden partition just for the browser cache folder to reside on using this method.

[–] ITGuyLevi@programming.dev 6 points 41 minutes ago

Symbolic links for the win!

[–] NewOldGuard@lemmy.ml 3 points 26 minutes ago

Replicating this on Linux would be as simple as ln -s to make a symbolic link

[–] partial_accumen@lemmy.world 1 points 8 minutes ago* (last edited 7 minutes ago)

The actual paper (PDF) this is based on gives much better information than the article. From that we get some really key information:

To allow FROST to measure SSD contention, the victim must perform activities that result in storage accesses to the same disk as the file used for contention measurement

This can't ready your SSD. It can only listen in on the conversation between your CPU and SSD when something else reads it or writes to it. The whole FROST approach has a number of clever tricks to generate reads from open applications though. Further, it requires the attacker's code to be running in an active browser session.

Also, If you have two SSDs, and your browser is on one, this FROST approach can't see anything written to or read from on the other SSD.

Lastly, there's a mention in the paper about hardware based SSD encryption being vulnerable, there's no mention of Software Whole Disk Encryption. Given how the researchers are using the SSD timing exploit, I would guess that a software (not hardware) whole disk encryption might be immune to this attack because the patterns of timings would be different with encrypted data being written to the SSD (instead of the data being encrypted by the SSD when written.

[–] Mearcfara@lemmy.ml 30 points 2 hours ago (4 children)

I wonder if, at any point, anyone stopped to ask themselves, "did I really go to school just so I can ply my knowledge and expertise to find even more ways to fucking track people who expressly don't want to be tracked so we can use the data for ad revenue (if not for other, even worse things)"?

[–] GreenKnight23@lemmy.world 27 points 1 hour ago (2 children)

software dev here.

I worked with a guy who was implementing application monitoring for clientside applications. think of it like google analytics for single page apps. he proposed we could require users install a browser plugin to make it easier to track and monitor the users on our app with the added benefit we could track them on other websites like our competition.

one person in a room of about 11 people spoke up about the implications of privacy and the backlash we might have from our user base when they find out that we basically just installed a keylogger in their browser.

the only thing that stopped this plan from going forward was the risk of losing users and potential revenue loss.

my point in all this is to answer your question. no, most people have stopped thinking about their actions and are just creating "solutions" to problems that don't exist.

[–] panda_abyss@lemmy.ca 5 points 58 minutes ago (1 children)

Hey I’ve been in that room! I don’t get it, I can’t live with that for of thing. And this is why I only have like 2 or 3 extensions (all ad blockers).

Execs love this shit. I only had one exec who pushed not to do that or open Pandora’s box.

He made a ton of cash, cashed out, and retired at 30 something. Awesome dude, I miss working under him.

[–] kboy101222@sh.itjust.works 1 points 50 minutes ago (2 children)

Out of curiosity, why 2-3 different ad blockers?

[–] GreenKnight23@lemmy.world 2 points 41 minutes ago

I have similar.

  • privacy badger
  • ublock
  • adblock plus

and have pihole on my network.

[–] panda_abyss@lemmy.ca 1 points 34 minutes ago

They often do different things.

Privacy badger, ublock, https everywhere are just required tools.

[–] Mearcfara@lemmy.ml 3 points 59 minutes ago

It's wild how quickly morality falls to the wayside (and is subsequently paved over). Especially crazy to abandon one's moral standing early on the path of solving problems that don't exist to appease people who don't care for a chance at the advancement of a career that you can't take with you in a field that could be wiped out by a solar flare, all to end up making the world a worse place for subsequent generations (I'm not a bleeding-heart idealist, lol).

I often think about a few people I know who have psych degrees. All were told, in different years, that if they wanted to make money as a psychologist, they needed to get in with tech companies. Some even got job offers.

[–] grue@lemmy.world 1 points 51 seconds ago

It is really hard to sort through job listings using ethics as your criteria.

[–] panda_abyss@lemmy.ca 7 points 1 hour ago* (last edited 1 hour ago) (1 children)

I studied data mining (now machine learning) and statistics.

I’ve spent my career explicitly NOT plying my knowledge this way. I don’t know how people do it.

I’d say my deep knowledge on how to track people has made me pretty averse to a lot of online things.

You know you can build marketing attribution systems and advertising metrics without violating user privacy.

But advertisers really like the idea of invading privacy and they pay out the nose for it.

[–] Mearcfara@lemmy.ml 3 points 55 minutes ago (1 children)

Good on you. Few are willing to take the overgrown path. And, funny how people who work with the subject matter often avoid it- the cybersecurity guy who doesn't own a computer, the guy who services food processing equipment who refuses to buy premade food, the guy who works/ed for the DoD who doesn't own a phone, etc.

Would you mind sharing some of the online things you're averse to, besides all that is implied by being on the Fediverse? I'm still new to this stuff.

[–] panda_abyss@lemmy.ca 2 points 35 minutes ago

Just things that can be correlated. Time, device, network, accounts, and apps all correlate. Precise location, device sensors, etc also correlate.

You have to decide what you want security or privacy against, then you have to be mindful always.

Every internet connection is a fingerprint.

E.g. The second you use that device on an VPN all your apps phoning home, checking notifications, logging events, etc. collapse your profile and deanonymize your anonymous activity.

So I actually use a dedicated device for anything I want a VPN on.

Opsec almost requires that you need a public device for your regular use, and a secondary device with limited scope, third party OS for higher privacy for anything you actually don’t want to share.

It’s safer to tunnel specific whitelisted connections through a VPN than whole device VPN for that reason (the less traffic goes to VPN the better). iOS VPN doesn’t work for that reason.

If you want VPN security, the best way is to run a container with only VPN networking, then a second container with the service you want protected and route all networking through the VPN container.

Also, say no to Chrome based apps looking for devices on your network. That uniquely fingerprints you across tons of surfaces.

They say it’s for chrome cast or something but it’s too much info to share.

[–] Maeve@kbin.earth 3 points 2 hours ago
[–] UnpopularCrow@lemmy.world 93 points 3 hours ago

“Google says fingerprinting is not a security vulnerability”. That is a very google thing to say.

[–] ushmel@piefed.world 102 points 3 hours ago* (last edited 3 hours ago) (4 children)

They really gave internet browsers too much access. Why the fuck does my browser need this level of clearance

[–] iturnedintoanewt@lemmy.world 2 points 40 minutes ago

I'm not even sure I'd allow them to know my resolution...

[–] Canconda@lemmy.ca 28 points 2 hours ago* (last edited 2 hours ago) (1 children)

They better hope there isn't another pandemic. Cuz I am officially labeling that quantity of free time as "1 Degoogle". and if I ever get my hands on another fuckin degoogle I am going to degoogle all over my fucking house

[–] HarneyToker@lemmy.world 25 points 2 hours ago (1 children)

You can Degoogle one step at a time. Make it a weekly habit to spend 10 minutes Degoogling every week and you won’t need to wait for another worldwide shutdown

[–] Canconda@lemmy.ca 16 points 2 hours ago* (last edited 2 hours ago) (1 children)

True. And I did hear if you degoogle at least 20 times a month it reduces your risk of prostate cancer.

[–] fonix232@fedia.io 14 points 2 hours ago (1 children)

Becau of the push for web apps to get around platform (and platform store) limitations.

e.g. Apple banned apps for vapes (not just talking about nic vapes but e.g. there's a number of cannabis flower vapourisers that use Bluetooth for fine tuned settings, those were forced to move over to web apps as the native apps simply got pulled), but also software like ESPHome is completely web based and needs access to raw USB devices to write the new firmware onto them, the list goes on.

Main issue seems to be that a lot of these APIs don't require explicit user approval. USB, Bluetooth does, but apparently accessing detailed system statistics doesn't? Make that make sense...

[–] sfxrlz@lemmy.world 9 points 2 hours ago

Well it’s all potential advertisement revenue

[–] aeronmelon@lemmy.world 4 points 2 hours ago

If you don’t allow ReCaptcha access to your address book, the website will fail to load.

[–] kalpol@lemmy.ca 3 points 1 hour ago

So that's not what the paper says

[–] Wildmimic@anarchist.nexus 37 points 2 hours ago* (last edited 2 hours ago) (1 children)

I looked it up - Firefox does not allow OFPS storage in private mode since November 2022 , so that is an option at least.

[–] Rothe@piefed.social 17 points 2 hours ago

But only in private mode?

[–] nymnympseudonym@piefed.social 1 points 35 minutes ago

Fun fact: running inside a flatpak or snap in no way mitigates this 😪

[–] Brummbaer@pawb.social 1 points 48 minutes ago

I remember when browsers just showed text.

We should just throw away the web and do something new. Maybe Fidonet over Reticulum so we can use radio.

[–] Peffse@lemmy.world 6 points 2 hours ago (2 children)

So the file has to exceed available RAM to benchmark the SSD performance? How viable is that at all? You'd be downloading gigabytes.

[–] RunningInRVA@lemmy.world 16 points 2 hours ago (1 children)

You don’t download the file. The JavaScript generates the file right on disk.

[–] Peffse@lemmy.world 3 points 1 hour ago (1 children)

Ah that makes more sense. Seems like something easy to detect at least.

It's been a while but doesn't Windows let you know when you exceed RAM usage and hit paging file?

[–] Jesus_666@lemmy.world 2 points 1 hour ago

You didn't hit the page file. This is OPFS, an in-browser filesystem that is sandboxed to each origin (essentially to each website), not directly accessible by the user, and exempt from the security checks that would guard access to the regular filesystem.

Yeah, that sounds to me like it needs a major revision.

[–] turdas@suppo.fi 1 points 47 minutes ago* (last edited 47 minutes ago)

You also have to provide access to your computer so the attacker can produce labeled training data for the neural network that performs the pattern matching for the actual fingerprinting.

Because that's what they did in the paper: they got the data and performed the attack on the same machine. There's no evidence presented in the paper that this identification could be generalised to arbitrary machines and configurations without prior access.

So yes, this is a complete nothingburger.

[–] Mwa@thelemmy.club 4 points 2 hours ago

Good i dont allow every Javascript on websites (usually)