Timing attacks on Web privacy

We describe a class of attacks that can compromise the privacy of users Web-browsing histories. The attacks allow a malicious Web site to determine whether or not the user has recently visited some other, unrelated Web page. The malicious page can determine this information by measuring the time the users browser requires to perform certain operations. Since browsers perform various forms of caching, the time required for operations depends on the users browsing history; this paper shows that the resulting time variations convey enough information to compromise users privacy. This attack method also allows other types of information gathering by Web sites, such as a more invasive form of Web cookies. The attacks we describe can be carried out without the victims knowledge, and most anonymous browsing tools fail to prevent them. Other simple countermeasures also fail to prevent these attacks. We describe a way of reengineering browsers to prevent most of them. 1. Introduction ...