Front-End Performance - The Dark Side
summary
Shows concrete exploits: string equality timing differences (100µs vs 1,000µs) leak secrets and require a constant-time compare to fix; combines fetch + Resource Timing, CSP and requestAnimationFrame to detect redirects; uses image/video parsing and a cache storage timing attack to measure file size and login state (750ms vs 1,250ms); demos like Snifly and the HEIST research extract visited sites and sensitive tokens from gzip sites. Live demos run reliably and reliably distinguish logged‑in state and age/gender targets.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 5:27The problem
- 8:12The old privacy problem
- 13:34Sniffly
- 15:28Timing Attack
- 21:46Video Parse Timing Attack
- 22:52Cache Storage Timing Attack
- 28:25Heist
- 30:00Same Site Cookies
- 32:42Block ThirdParty Cookies
related talks
17mVisualising Front-End Performance Bottlenecks
11mMaking Performance Personal at FT Labs
01h 01mWeb Performance Deep Dive
37mSecret Shortcuts of Loading Web Performance
42mFront-End Performance
16mCoding Session: Stunning Performance
20mReal metrics for front-end performance
01h 02mWeb Performance Tuning with browser APIs