<story><title>Front-End Performance: The Dark Side</title><url>https://dev.opera.com/blog/timing-attacks/</url></story><parent_chain></parent_chain><comment><author>willscott</author><text>This is a cool side-channel attack that makes use of two nuances in the web.&lt;p&gt;First, the cache storage mechanism in service workers allows a site&amp;#x27;s javascript to cache a 3rd party request it has loaded through the fetch API. Caches aren&amp;#x27;t thinking about timing attacks, and in general are performance sensitive, so it&amp;#x27;s reasonable to expect that larger resources will take longer to cache and this time can be observed by the page.&lt;p&gt;Second, you can generate facebook posts which are targeted to specific demographics - like age ranges or specific ages. This will generate URLs which will have a different page length when loaded by logged in users in the target demographic compared to others. It looks like this is possible because there is not an explicit &amp;#x27;access-control-allow-origin&amp;#x27; header set on facebook, and while the &amp;#x27;x-frame-options:deny&amp;#x27; prevents loading of the content, it can still be cached by a 3rd party.</text></comment>
<story><title>Front-End Performance: The Dark Side</title><url>https://dev.opera.com/blog/timing-attacks/</url></story><parent_chain></parent_chain><comment><author>Dylan16807</author><text>Well that&amp;#x27;s an interesting timing attack in the brows-- &lt;i&gt;why does Facebook have a way to create posts that return 404 to specific demographics&lt;/i&gt;?</text></comment>