Other nomination

Google User De-Anonymization

Michael Mimoso · Threatpost | The first stop for security news · 8 September 2014

Andrew Cantino's timing attack de-anonymises a chosen Google user: silently share a Google document with the target's address, then load it as an image and time the onerror callback. Loading averaged 891 ms when the document was accessible against 573 ms when it was not, revealing that account's presence with no cookie set.

Record

Researcher

Michael Mimoso

Published by

Threatpost | The first stop for security news

Date

8 September 2014

In the archive

• Nominated for the 2014 Top 10 Web Hacking Techniques

Tags

• timing-attack
• xsleak
• side-channel
• info-leak
• dom
• javascript
• case-study

This page is the archive's own catalogue record. The research is the work of Michael Mimoso, first published at the original source. Preserved copies are kept so the citation survives its host.