Firefox 85 released

Posted Jan 27, 2021 13:04 UTC (Wed) by scientes (guest, #83068)
In reply to: Firefox 85 released by scientes
Parent article: Firefox 85 released

If I am not mistaken, the only way to examine these caches is through javascript, so why can't Firefox just introduce "opaque" resources, for pictures and video, that to javascript are just black boxes, and have fixed (fake) file sizes?

Firefox 85 released

Posted Jan 28, 2021 1:38 UTC (Thu) by roc (subscriber, #30627) [Link] (2 responses)

If you read the comments here, the fundamental problem is cache timing, and there really is no way to make cache timing undetectable.

Firefox 85 released

Posted Feb 17, 2021 12:48 UTC (Wed) by immibis (subscriber, #105511) [Link] (1 responses)

There is if JavaScript code isn't allowed to access the timing.

For an image, that means the width and height are fixed in advance, so it can't affect layout information readable by JS, and pixel data is inaccessible. I believe browsers already make pixel data inaccessible to JS for cross-site images. Then JS has no way to know whether the image has loaded or not. Hopefully it also bypasses service workers...

Firefox 85 released

Posted Feb 17, 2021 16:35 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link]

You can play tricks with CSS and use image height as a signal. This way you can watch the Y coordinates of a special test element.

You'll have to disable ALL timing functionality in JS to fix that, maybe leaving something extremely coarse like 100ms intervals.