Websites have a new way to spy on visitors: analyzing their SSD activity

<p>Over the decades, there has been no shortage of sites using clever techniques to covertly track visitors’ <a href="https://www.theregister.com/security/2010/12/03/popular-sites-caught-sniffing-user-browser-history/795097">browsing histories</a>, <a href="https://arstechnica.com/information-technology/2013/10/top-sites-and-maybe-the-nsa-track-users-with-device-fingerprinting/">device fingerprints</a>, and log <a href="https://arstechnica.com/tech-policy/2017/11/an-alarming-number-of-sites-employ-privacy-invading-session-replay-scripts/">keystrokes and mouse movements</a> in real time. Even Meta and Yandex were recently caught joining in the privacy-invasive <a href="https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/">free-for-all</a>.</p> <p>Now sites have a new way to spy on their visitors: measuring subtle interactions with their solid-state drives. The technique, named FROST (fingerprinting remotely using OPFS-based SSD timing), allows sites to monitor other sites a visitor is viewing and what apps are open on their devices.</p> <h2>A side channel based on contention</h2> <p>The technique, laid out in a <a href="https://hannesweissteiner.com/pdfs/frost.pdf">research paper</a>, exploits a <a href="https://en.wikipedia.org/wiki/Side-channel_attack">side channel</a>, a form of leak resulting from physical manifestations such as electromagnetic emanations, data caches, or the time required to complete a task. By measuring the manifestations, attackers can decrypt encrypted traffic and infer other confidential data.</p><p><a href="https://arstechnica.com/security/2026/05/websites-have-a-new-way-to-spy-on-visitors-analyzing-their-ssd-activity/">Read full article</a></p> <p><a href="https://arstechnica.com/security/2026/05/websites-have-a-new-way-to-spy-on-visitors-analyzing-their-ssd-activity/#comments">Comments</a></p> Reference : https://ift.tt/H2NmXEC