• 42 Posts
  • 124 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle



  • The problem is that so many browsers leverage hardware acceleration and offer access to the GPUs. So yes, the browsers could fix the issue, but the underlying cause is the way GPUs handle data that the attack is leveraging. Fixing it would likely involve not using hardware acceleration.

    As these patterns are processed by the iGPU, their varying degrees of redundancy cause the lossless compression output to depend on the secret pixel. The data-dependent compression output directly translates to data-dependent DRAM traffic and data-dependent cache occupancy. Consequently, we show that, even under the most passive threat model—where an attacker can only observe coarse-grained redundancy information of a pattern using a coarse-grained timer in the browser and lacks the ability to adaptively select input—individual pixels can be leaked. Our proof-of-concept attack succeeds on a range of devices (including computers, phones) from a variety of hardware vendors with distinct GPU architectures (Intel, AMD, Apple, Nvidia). Surprisingly, our attack also succeeds on discrete GPUs, and we have preliminary results indicating the presence of software-transparent compression on those architectures as well.

    It sounds distantly similar to some of the canvas issues where the acceleration creates different artifacts which makes it possible to identify GPUs and fingerprint the browsers.



























  • That’s a decent start, but you need a browser that’s resistant to fingerprinting through some plugins and something like ublock origin that will block all embedded content. At some point, it may require you to use a phone number, and at that point you may have a problem. If you avoid that, one of the biggest threats are the facebook and related meta content placed on other pages around the internet. The pixel is one aspect, but almost any facebook content can still track you across sites. These are easily blocked with a decent adblocker and probably privacybadger too.

    I know lots of folks will disagree, but I’d care less about Facebook tracking you as they mostly only care about serving you ads and making content suggestions to keep you on the platform to view more ads. Facebook has never served me a relevant ad, and even with a lot of use still can’t recommend things I’m interested in. Data leaks and sharing is a concern, but that’s a concern with every site. I think when it comes to privacy, there’s far bigger concerns.