Hacker News new | ask | show | jobs
by john_strinlai 5 hours ago
that wont work with anti-fingerprinting, which rounds

>In Firefox, the privacy.reduceTimerPrecision preference is enabled by default and defaults to 2ms.

2 comments

I thought some of the timer precision stuff was a specific security measure, not just a privacy one, because of stuff like Spectre[1]:

> The branch predictor would then be mistrained by iterating over a very large dataset using bitwise operations for setting the index to in-range values, and then using an out-of-bounds address for the final iteration. A high-precision timer would then be required in order to determine if a set of reads led to a cache hit or a cache miss. While browsers like Chrome, Firefox have restrictions on the resolution of timers, the Spectre author was able to create a high-precision timer using the web worker feature of HTML5.

> As of Firefox 57.0.4, Mozilla was reducing the resolution of JavaScript timers to help prevent timing attacks, with additional work on time-fuzzing techniques planned for future releases.

[1]: https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...

Shucks, it works in the spec.

  ¯\_(ツ)_/¯