Re: [css-houdini-drafts] [css-paint-api] CSS Paint API leaks browsing history

I would think a reasonable way around this would be something like the following:
* when a paint callback is invoked, record what it does (either (preferably) as a sequence of canvas drawing commands, or as a bitmap)
* only invoke the paint callback again when it is invoked with a different set of dependent properties (exposing only unvisited styles in this set of properties) or a different size (which can't change as a result of visitedness)

That said, although the paper doesn't explicitly say so, I'm assuming the "Amplified attack" variant is also counting calls to the paint callback and only doing the `registerPaint` that marks the link as visited on the second call... if that's not the case then I don't actually understand how that attack is working.

-- 
GitHub Notification of comment by dbaron
Please view or discuss this issue at https://github.com/w3c/css-houdini-drafts/issues/791#issuecomment-412604601 using your GitHub account

Received on Monday, 13 August 2018 17:47:37 UTC