undefined | Better HN

0 pointsvoidmain8y ago0 comments

It seems like practical attacks rely on having a reasonably precise timer available. The spectre paper uses SharedArrayBuffer to synthesize a timer, which is a recent and obscure feature:

https://groups.google.com/a/chromium.org/forum/#!topic/blink...

https://groups.google.com/forum/#!topic/mozilla.dev.platform...

Chrome and Firefox's "intent to ship" posts both contain claims to the effect that there probably aren't any really serious timing channel attacks, which... seems to have been disproved. Why isn't SharedArrayBuffer already being disabled as a stopgap? I think users can turn it off in firefox, how about Chrome?

0 comments

jncraton8y ago

SharedArrayBuffer will be disabled by default as a stopgap:

https://blog.mozilla.org/security/2018/01/03/mitigations-lan...

performance.now() accuracy is also being reduced.

kibwen8y ago

> I think users can turn it off in firefox, how about Chrome?

This month's stable Chrome release will be outright disabling SharedArrayBuffer until additional mitigations are enacted.

londons_explore8y ago

Which sucks for people who've built sites which rely on it.

It isn't exactly polyfillable.

erichurkman8y ago

That shouldn't be that many sites. It only hit Chrome stable in July 2017; Firefox in August 2017; and Edge November 2017.

olliej8y ago

I believe SAB is being disabled, and apparently precision of performance.now() as well? (based on other comments)

caf8y ago

about:config javascript.options.shared_memory in Firefox.

kiwijamo8y ago

Turned off by default for me in 57.0.3/macOS. Is it usually on by default on other platforms?

scarygliders8y ago

Just checked on Windows and it was on by default for me for Firefox 57.0.3

j / k navigate · click thread line to collapse