Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals "the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version".

Why it's called a JavaScript Template Attack: "A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript."



> Why it's called...

I still don't get it, very weird name.

In JavaScript, "templates" are special strings that support interpolation: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...


I agree the name is a bit confusing, I also immediately thought of template literals, wondering what kind of vulnerability it could have.


There's also a <template> html tag that one could relate the title to.


could be related to sidechannel template attack methodology:

https://wiki.newae.com/Template_Attacks


Yep it's actually mentioned somewhere in the paper:

Chari et al. [10] introduced template attacks as a strong form of side-channel attacks. They first collect side-channel traces from an attacker-controlled device, the so-called template. Then, they collect a single trace from an identical device processing an unknown secret. The unknown secret can then be recovered by comparing the trace to the recorded templates.




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: