JavaScript Template Attacks

Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals &quot;the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version&quot;.<p>Why it&#x27;s called a JavaScript <i>Template</i> Attack: &quot;A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript.&quot;

I don&#x27;t see whats new here - comparing global object values has always been used to identify browsers and versions. Same with looking for bugs&#x2F;quirks in JS engines.<p>New extension idea: adds random properties to window on each new page.

Link to Github-repo in slides <a href="https:&#x2F;&#x2F;github.com&#x2F;IAIK&#x2F;jstemplate" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;IAIK&#x2F;jstemplate</a>

I watched the video presentation, what&#x27;s the take-away from it? Yes, different environments have different properties, but we knew this since the first browsers appeared. Is there anything new? This does not lead to an unique fingerprint. Is it more about the automated system that detects the properties that change or just bringing awarness of the issue?