• 38 Posts
  • 69 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle



  • The problem is that so many browsers leverage hardware acceleration and offer access to the GPUs. So yes, the browsers could fix the issue, but the underlying cause is the way GPUs handle data that the attack is leveraging. Fixing it would likely involve not using hardware acceleration.

    As these patterns are processed by the iGPU, their varying degrees of redundancy cause the lossless compression output to depend on the secret pixel. The data-dependent compression output directly translates to data-dependent DRAM traffic and data-dependent cache occupancy. Consequently, we show that, even under the most passive threat model—where an attacker can only observe coarse-grained redundancy information of a pattern using a coarse-grained timer in the browser and lacks the ability to adaptively select input—individual pixels can be leaked. Our proof-of-concept attack succeeds on a range of devices (including computers, phones) from a variety of hardware vendors with distinct GPU architectures (Intel, AMD, Apple, Nvidia). Surprisingly, our attack also succeeds on discrete GPUs, and we have preliminary results indicating the presence of software-transparent compression on those architectures as well.

    It sounds distantly similar to some of the canvas issues where the acceleration creates different artifacts which makes it possible to identify GPUs and fingerprint the browsers.




















  • Yes-- same with bluetooth or ordering groceries for delivery and giving your home address. There’s always ways to leak data and make it no longer anonymous. However, from my knowledge of how some of these datasets work, they aren’t putting in a lot of effort into truly trying to make sure the joins are 100% accurate because it rarely matters. They generally don’t give a shit about you as an individual. The most common uses of the data are for advertising and mistargeting doesn’t cost enough to justify the time to verify the data.

    Paying in cash though can make it anonymous, or by using virtual cards that mask your card id.






  • This has arguably always been the case. A century ago, it could take years to get something published and into a book form such that it could be taught, and even then it could take an expert to interpret it to a layperson.

    Today, the expert can not only share their research, they can do interviews and make tiktok videos about a topic before their research has been published. If it’s valuable, 500 news outlets will write clickbait, and students can do a report on it within a week of it happening.

    A decent education isn’t about teaching you the specifics of some process or even necessarily the state-of-the-art, it’s about teaching you how to learn and adapt. How to deal with people to get things accomplished. How to find and validate resources to learn something. Great professors at research institutions will teach you not only the state-of-the-art, but the opportunities for 10 years into the future because they know what the important questions are.





  • You should care, but it’s maybe more of a question about how much and about what specific things. There are some easy-to-do things, and then there’s others that get exhausting

    Some of this depends on why you care about privacy and where you live. It’s a lot of work, and in some places, like the US, there’s a lot of data being sold anyway (credit/debit cards, tvs, streaming services, and stores can almost all sell some of your data and it can be difficult to stop them). Keeping Bluetooth on also enables you to be tracked going in and out of stores and other various locations.

    It can be a lot of work, but some things are more worthwhile than others. There are likely some things you’re just going to have to live with.