Re: [fetch] Cache mode: security review (#39)

Hi! My initial reaction is that is a pretty terrible idea. I'm willing to be convinced otherwise, but I don't think that the assumptions being made here hold.

In short, timing attacks are different in kind from the kinds of attacks this API would enable. That is, there is a qualitative difference between a 100% effective API that would enable rapid brute-forcing of recently visited URLs/GET parameters, and a mostly effective hack that gave a certain probability of success with a large amount of slop and network traffic (and associated latency).



---
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/39#issuecomment-141026843