“Side-Channel Leaks in Web Applications: A Reality Today, a Challenge Tomorrow”

1. “Side-Channel Leaks in Web Applications: A Reality Today, a Challenge Tomorrow” Attack Presented by: VinuthnaNalluri and Brett Parker

2. Typos • “For example, a letter entered in a text box affect all the follow-up auto-suggestion contents…”

3. Purpose • Paper is too focused on the existence of the problem of side-channel leaks, but does not contribute enough to solving the problem • Problem has been around a long time, and paper has done nothing but explain it • Does not offer any significant methods for prevention

4. Attack cases • Give many examples of what an attacker might due, given certain vulnerabilities • But, don’t consider many important situations • Perhaps attacking these vulnerabilities is not as simple as your paper makes it out to be

5. Query Word Leaks • Discussion is too narrow – not enough examples • Show what happens when user types single letters at a time very slowly • But what if the user types quickly? Reduces number of AJAX requests, so guessing an entire word or query is not that easy • Should have included details about how an attacker might proceed in this type of situation

6. Query Word Leaks • What about personalized suggestions? • Previously-searched terms are stored in web history and are automatically suggested at each new search • How can an attacker obtain these when there are no AJAX requests for them? • Not that easy

7. OnlineHealth • Say that it is easy for an attacker to obtain the auto-suggested search terms for illnesses based on the fact that each character returned is different byte size • But, what if all the bytes are made to be the same size? • It would make the attack much more difficult

8. Your argument • “We found that mitigation of such side-channel threats is much more difficult than it appears to be, as such an effort often needs to be application-specific” • We agree. Also, you say… • “…[universal] mitigations are unlikely to be applied in reality due to the uncertainty of their effectiveness…” 

9. Packet-padding • So, why spend the entire second half of the paper discussing universal methods that don’t work (too much overhead)? • Also, why dedicate an entire section (appendix) to describing your implementation of a packet-padding prototype? • You already argued that it is proven not to work well! • If that was your focus, it should have been more in-depth!

10. Automatic Tools • You say that manually finding vulnerabilities in code and implementing mitigation policies is too costly and that automatic tools should be developed for this process • Fine. • Then why didn’t you include any insight on how this could be done?

11. Thanks!