trusted browsers for uncertain timesdkohlbre/papers/uncertaintimes-slides.pdf · trusted browsers...
TRANSCRIPT
![Page 1: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/1.jpg)
Trusted Browsers for Uncertain Times
David Kohlbrenner and Hovav Shacham
UC San Diego
![Page 2: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/2.jpg)
Building a browser that can provably mitigate timing attacks
![Page 3: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/3.jpg)
Trusted Browsers for
Uncertain Times
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 4: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/4.jpg)
Timing attacks● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 5: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/5.jpg)
Browsers and timing attacks● Browser has multiple privilege levels
○ User secrets
○ System secrets
○ Origin secrets
● Browsers expose detailed information
○ performance.now()
○ getAnimationFrame()
● Browsers compute and communicate between levels
![Page 6: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/6.jpg)
Timing attacks in web browsers● SVG Filter cross-origin pixel stealing
● JavaScript cache timing attacks
● Fingerprinting
● History Sniffing
![Page 7: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/7.jpg)
What is being done about it? - SVG attack
![Page 8: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/8.jpg)
What is being done about it? - Cache attack
![Page 9: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/9.jpg)
What is being done about it? - Cache attack
![Page 10: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/10.jpg)
Unfortunately,this doesn’t work.
![Page 11: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/11.jpg)
Better clocks with edges
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 12: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/12.jpg)
Rounding down the clock
![Page 13: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/13.jpg)
Clock-edge technique
![Page 14: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/14.jpg)
Clock-edge technique - performance.now()
![Page 15: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/15.jpg)
Clock-edge technique - performance.now()
![Page 16: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/16.jpg)
Implicit clocksin the browser
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 17: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/17.jpg)
Implicit clocks - Techniques● <video> frames
● Web Speech
● <video> played
● setTimeout()
● CSS Animations
● WebVTT API
● XHRs with cooperating server
![Page 18: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/18.jpg)
Implicit clocks - Techniques● <video> frames
● Web Speech
● <video> played
● setTimeout()
● CSS Animations
● WebVTT API
● XHRs with cooperating server
Probably many many more!
![Page 19: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/19.jpg)
Implicit clocks - WebVTT● Subtitles for <video> elements
● Specified in a .vtt file
○ WEBVTT
00:00:00.000 --> 00:00:00.001
A very short duration subtitle
● Specifies arbitrary subtitles with 1ms granularity
● track.activeCues returns all displayed subtitles
![Page 20: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/20.jpg)
Implicit clocks - WebVTT
![Page 21: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/21.jpg)
Implicit clocks - WebVTT and clock-edge
![Page 22: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/22.jpg)
How to mitigate timing attacks
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 23: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/23.jpg)
Degrade all clocks available to the attacker.
![Page 24: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/24.jpg)
Fuzzy time for the VAX security kernel● “[A] collection of techniques that reduces the bandwidths of covert timing
channels by making all clocks available to a process noisy.”
● “Reducing Timing Channels with Fuzzy Time”
○ Hu at Oakland 1991!
![Page 25: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/25.jpg)
Covert channels● Two clocks
● Modulated
○ The channel
● Reference
○ Wall clock, etc
![Page 26: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/26.jpg)
Fuzzy time for the VAX security kernel● VAX VMM
○ Single thread per VM
○ Clean VM interface
● All I/O is asynchronous
![Page 27: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/27.jpg)
Fuzzy time - Problem● Ineffective countermeasures to disk covert channel
○ Cannot be closed
○ Not auditable
○ Added noise impractical
○ No hardware solution
● Plenty of other potential ‘shared buses’
![Page 28: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/28.jpg)
Fuzzy time - Solution● “reduce the accuracy and precision of system clocks”
● “randomly alter the timings of I/O operations”
![Page 29: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/29.jpg)
Fuzzy time - Solution● Explicit clocks
○ “make the interval-timer interrupt random”
![Page 30: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/30.jpg)
Fuzzy time - Solution● Explicit clocks
○ “make the interval-timer interrupt random”
![Page 31: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/31.jpg)
Fuzzy time - Solution● Explicit clocks
○ “make the interval-timer interrupt random”
● Implicit clocks
○ “[use] random clock ticks … to make fuzzy the clocks derived
from I/O operations”
○ “Add new buffers … for all I/O operations”
![Page 32: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/32.jpg)
Fuzzy time - Solution guarantees● Degraded clocks
○ Limit the bandwidth
● Time granularity
○ g
● Bounded channel bandwidth
○ For any timing covert channel
○ ~
![Page 33: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/33.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Todo
ActiveActive
Response queue
![Page 34: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/34.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Todo Todo
ActiveActive
Response queue
![Page 35: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/35.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Todo Todo
ActiveActive
Response queue
![Page 36: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/36.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Todo Todo
Active
Response queue
Done Todo
![Page 37: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/37.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Todo Todo
Response queue
Done TodoDone Todo
![Page 38: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/38.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Todo Todo
Response queue
Done TodoDone TodoActive Active
![Page 39: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/39.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Response queue
Done TodoDone TodoActive Active
![Page 40: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/40.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Response queue
Done TodoDone TodoActive Active
![Page 41: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/41.jpg)
Next queue
Currently queued
Fuzzy time - I/O queuing
Active
Response queue
Done Done Active Active
![Page 42: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/42.jpg)
Fermata● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 43: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/43.jpg)
Fermata - Why adapt fuzzy time?● Degrade clocks
○ Slow down attacks
● Verifiability
● Browsers are uniquely well suited
![Page 44: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/44.jpg)
Fermata - Fuzzy time for browsers● Adapt the VAX fuzzy time model to JS etc!
● Put all I/O operations into queues
● Make all the explicit clocks fuzzy
● Prove everything falls into a fuzzy time defense
But with
JavaScript!
![Page 45: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/45.jpg)
Fermata - Fuzzy time for browsers● Adapt the VAX fuzzy time model to JS etc!
● Put all I/O operations into queues
● Make all the explicit clocks fuzzy
● Prove everything falls into a fuzzy time defense
● Change all DOM accesses to be asynchronous!
But with
JavaScript!
![Page 46: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/46.jpg)
FuzzyfoxRationale and design
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 47: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/47.jpg)
Why we didn’t build Fermata1. We didn’t know if it would work
2. We didn’t know what to start with
3. We want to push mitigations to real browsers
![Page 48: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/48.jpg)
Fuzzyfox● Patch set on trunk Mozilla Firefox
● Supports multiple clock granularities
○ Tested 0.5ms to 100ms
● Fully fuzzes explicit clocks
● Breaks main thread into ‘ticks’
● Delays outgoing HTTP request start
![Page 49: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/49.jpg)
Next queue
Current queue
Fuzzyfox - Main thread queuing
![Page 50: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/50.jpg)
Next queue
Current queue
Fuzzyfox - Main thread queuing
Done Done Active Todo
Todo Todo
Todo
![Page 51: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/51.jpg)
Next queue
Current queue
Fuzzyfox - Main thread queuing
Done Done Active Todo
Todo Todo
Todo
Todo
![Page 52: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/52.jpg)
Next queue
Current queue
Fuzzyfox - Main thread queuing
Done Done Active Todo
Todo Todo
Todo
Todo
![Page 53: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/53.jpg)
Next queue
Current queue
Fuzzyfox - Main thread queuing
Done Done Active Todo
Todo Todo
Todo
Todo
Pause
![Page 54: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/54.jpg)
Next queueCurrent queue
Fuzzyfox - Main thread queuing
Done Done Active Todo Todo TodoTodo TodoPause
![Page 55: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/55.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done Done Active Todo Todo TodoTodo TodoPause
![Page 56: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/56.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done Done Active Todo TodoTodo TodoPauseDone
![Page 57: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/57.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done Done Active Todo Todo TodoTodoPauseDone Done
![Page 58: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/58.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done Done Todo Todo TodoTodoPauseDone Done Done
![Page 59: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/59.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done Done Todo Todo TodoTodoPauseDone Done Done Pause
![Page 60: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/60.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done Done Todo TodoTodoPauseDone Done Done PauseActive
![Page 61: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/61.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done Done TodoTodoTodoPauseDone Done Done PauseActiveDone
![Page 62: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/62.jpg)
Queue 3
Queue 2
Queue 1
Fuzzyfox - Main thread queuing
Done Done
Todo
TodoTodo
Done Done Done
ActiveDone
Pause
Pause
![Page 63: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/63.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done TodoDone Done Done ActiveDone
Epoch
TodoPause Done TodoPause
Epoch Epoch
![Page 64: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/64.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done TodoDone Done Done ActiveDone
Epoch
TodoPause Done TodoPause
Epoch Epoch
![Page 65: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/65.jpg)
Current queue
Fuzzyfox - Main thread queuing
Done TodoDone Done Done ActiveDone
Epoch
TodoPause Done TodoPause
Epoch Epoch
● Sleep● Update clocks● Flush queues● Schedule next pause
![Page 66: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/66.jpg)
FuzzyfoxEffectiveness
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 67: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/67.jpg)
Fuzzyfox - Effectiveness - Explicit - performance.now()Firefox Fuzzyfox
![Page 68: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/68.jpg)
Fuzzyfox - Effectiveness - Implicit - WebVTT clockFirefox Fuzzyfox
![Page 69: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/69.jpg)
FuzzyfoxPerformance
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 70: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/70.jpg)
Fuzzyfox - Performance● “Micro” performance
○ Synthetic microbenchmark page load times
● “Macro” performance
○ Real website load times
● Interactivity
○ User study
![Page 71: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/71.jpg)
Fuzzyfox - Performance● “Micro” performance
○ Synthetic microbenchmark page load times
● “Macro” performance
○ Real website load times
● Interactivity
○ User study
![Page 72: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/72.jpg)
Fuzzyfox - Performance - Micro benchmarks● Page load times
○ As reported by onload()
● Measured effects of
○ Sequential resource loads
○ Parallel resource loads
![Page 73: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/73.jpg)
Fuzzyfox - Performance - Sequential loads
![Page 74: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/74.jpg)
Fuzzyfox - Performance vs Tor Browser
![Page 75: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/75.jpg)
Takeaways● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 76: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/76.jpg)
Timing attacksRounding clocks doesn’t work
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 77: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/77.jpg)
Fuzzy timeSecure operating systems tech
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 78: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/78.jpg)
FermataA different design for the browser
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 79: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/79.jpg)
FuzzyfoxDefenses that can work
and that we can deploy
● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
![Page 80: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/80.jpg)
Takeaways● Time and web browsers
● Mitigating attacks
● A trusted browser
● A (less) trusted browser
This material is based upon work supported by
the National Science Foundation and by a gift from Mozilla.
We thank Kyle Huey, Patrick McManus, Eric Rescorla,
and Martin Thomson at Mozilla for helpful discussions
about this work, and for sharing their insights with us
about Firefox internals.
![Page 81: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/81.jpg)
Fuzzyfox - Effectiveness - Explicit - performance.now()Firefox Fuzzyfox
![Page 82: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/82.jpg)
Fuzzyfox - Effectiveness - Implicit - WebVTT clockFirefox Fuzzyfox
![Page 83: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/83.jpg)
Performance - Micro benchmarks - Sequential loads
![Page 84: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/84.jpg)
Performance - Micro benchmarks - Tor Browser
![Page 85: Trusted Browsers for Uncertain Timesdkohlbre/papers/uncertaintimes-slides.pdf · Trusted Browsers for Uncertain Times Time and web browsers Mitigating attacks A trusted browser](https://reader030.vdocuments.us/reader030/viewer/2022041001/5ea2a02c29c90b7f4b09a0c8/html5/thumbnails/85.jpg)
Performance - Load times* - Google search