FROST: Fingerprinting Remotely using OPFS-based SSD Timing [pdf]

Hacker News Top Papers

Summary

This paper presents FROST, a technique for remotely fingerprinting users by exploiting timing differences in the OPFS-based SSD storage.

No content available
Original Article
View Cached Full Text

Cached at: 05/31/26, 04:36 PM

%PDF\-1\.7 %��������� 32 0 obj << /Filter /FlateDecode /Length 4212 \>\> stream x��\\K�����\|X�,�����@n t�s��\`H\.��\)\>�,�ٽ\#C������\(�\_=\{���Mn?��w~\_���x�\)\#�q�\}��E�lؔ�Bm�9��ھ���\|�R;\)��M\+��J\)� %\|z\{�����\_���&iM�\]��\\�\}i\{/� ����ʟq益�1������F=� \`s�@�'��\.T&ڑ\( �Y\}\*��u���P�\>��PW��V���Et���GcD�as� �t���j�\!Υ�����ԫ��~�CG?���Q����\+�������OR\)��p��� �jE2h\#�\(���T&"�����7JX���Y���?^��aǟ���E ���n�����Y�&E�K<0m�������zq�\.n�Z�����z��h�߯�:���� � �to�B�\)��5Q��i�N��'�����F���~�^~�W��Y���O j@�Q��1mV�����;k����ƶ6vզ������~K�\!��G���8N3Z�w�Y���\`u4��F8ЅE���O9\- 6d ������5\|��P��\{ �5� lP\*V�\\oîy���m��hdfN�d��6H�Fx�\>��j�2醵�\_5����B⸶^�,\-2�fm�����Ƥ��il�\! r��,�/\\oB� ����RyPkCt���Y��h�J�\!�J\#�:5���\*n�\]�D���W�?=\!\|y%�ye�U�rA\_k;C\.�^\]\(��K���E��\`�� �Y�\-~^���i�/����eE�f�h�D�'�\>����\-̃h��R�c�M\}B�d��ɛ���\>"چ�\(�s�M�3�� \(�^�2Q�A�B�2�������0B�Q��pb��� �� �\(է\!�t@��F\+��\-�q/��c1�� ���2�����\{�\*F�~?���~yA"���@X��'�\>�� ��12P���Y\`@\!^�8cd�\]�۟��\`��PA�?õ�\)��\{���,�\(zFܝ�O�\|��=����ѳ��c�x�d�c�4�:��9���$���93xN�Ȭ8ٚp�h�����D�'Z\>������ Z\-�\-;D�E\(��4��٦��O�'��i��\!8���i\\D\!RO�\|b�;�����\_f���\)z��3��H\*��\>�T�\[��B��7����\#�JS� ����\*�X/� ^z��j�\\,����P���m��\\�b��Ҽ���\#�y�\` � ��'Y\+�xBC����ZdM� ��\(��P�b�k��%��d�Ն���6�~Pk�\\��9���Ƿ��\(\+��\(�Ѩ�<���J����J��\]CTx1��V�ᮼ���ê������ޣ�ı�9���tFܛ�Nx�Gs�L����M�i��w\#\!m�����\.�D��Be��k��\\\_\)ˮ �e���5YWI�� �k�� �&�ނL�g\.�ƾ ����\[�e\]��7\!���\!ߠLh�V�,G:kcf��������jY��Z�jJ�'ޏw\#���ҩ\*W�3��R����\{���M��7�z��=U�� ���C�eډ��$��B%�j�:\>&K����M�O��7�e�Oj��"7e�Z \\��z��B��\>�h����\)�μ�lk���aL��C1h��Д \\\+��J����Ԋ����\>MX�Ä���ޫ�橍�s;�6�����1jB�VA��\\��u�t�g��\}���\[�ҡ�^�0�� \(�ƻ:��Z��5"�s/�V��x�d%k\!�\-\}���\>�iH���Z�v@��sg��5�� �\]ctL� �x� �I&=��g�3�\+ 4�������,zG�F��%��\)��Y��S��p���I��D�Ƹ\*?�/t�i��� ��0���:q����Z�޼�D51�z�Q&�Å��;�1�&���\|�� �H��\]\+fnr��\[H�q��\[TwǍ�t8\+3�Q;j�"���d0��Ԛ�ⲻ�� �й����iVT���?��4���e�G�����\(3�Qu����mO����\*��ִ��~6�X� �C/�4�7�������f U� 5 A�QKk�a�\} �� �s�5L2 �� \\ު\*�~���J��̨1h�����5gW�̱������Yp2�����\#\-ۻ�7� ������a�Sڻ���y���f��S��l�f��Π\#�O��4x2������g^\{�mf��к%Gu��Z��â�R�k��I\}�ͪ�y��w��@�t�8\!�d9���� 2M��6\]���^�\-\+�d����X����֧S�40�9i^X۽:8a�y�:k��dހ&��b�����x�\\�:�0�2��9t�\_&���A��F��g'\-��A���\!��\.���\|X2٣'��٘<~\\2�S�T&PZ�pi� \>��y�&�o��ɰ��եւ�j2��t��B��D��H�J\+�Ү��f�I��t��V;\#�w�q\#�ɫd�W�Z���S�z��K��̹0sܥ�P\+� ��<�L�����\}��Sh8u�xj�V� �u���\{��~�cx\(��Lԙ��:0�M6��q�\)� �e�'V\-�I,zph���n̴&@\*l������\*y�\\oԱ羜6 rX���������=����\)�ё��\]�,���B�n\>a�ꗾ\-��3; �s \`���BQ�����i��"\]u�S\{�\_����\[u�t�ܒ�H:��ΆHaX���Ӆ\*������� � ��\-f�øag\#�5�L9�ٚһ�=��Iלt�LD1K�/Ks���k�Łb/�;y���ϩ�қ���u�� "���ZN�\-A"����0�/?����E�0��O�c�mE\`�\-��2\)�\|��3&n�k�5mO���� ��l�M$dLe e�\!�3Ty'R~t�Q�@m�4���c��8性Z�2��@<����"'~�1L���<�Hj�C2p W���1pR�$��a"���kp\-%nQg ��:0RFY�i��i�:ucd�\\3 ܖm���\{�\+�%7؅���\`�����\(��PC�6&�K�����i%�u8JwהO�o����ģf^��'s����V�\`J���N�t�4�Ym\`U�\`LHER�e�M;85��x/��,��E��9\*C�\)?�p�� ����1� �r��qH���F\*������Z\_ ͅ�fS0�N��zܨ�S��S�wN\]�N���9�Qx��u�B��=���pt�S7���t��\\�N�C875 :���ԗH君� ��63�\}���K�r"\]�� W^��\]��xϤ4cW�b�BG ז�;\{�c�թ8�\)�LSm�=r��M��:��ے�� B��\_Y�"0�\}��e��hnQg\[���\\�t��\|����튈iP���lS���\#�5\#/��l��p��?��g�\{���U\\�U3k�8�ى9\!\.,���\!��%�Pf��E0ۆ V��j������jqg���I���\#��ļ9�s�M֌���\* ������\|�\_pm7\-��th��5ը��4S��c�\`�x����V��L�u�r6;KK5��N����e=�q��v\)��ۜ���~� \}���� ���L\#\#��� ��������\)��K�A��\|t�\-�\]7�Ǵ�=\*��X˂DV�Yi�^\]zֿ\|ڱ���/mm�g��6�G��F\(\#9������9uG��\{zoF��9z��\[��v�S \\f���\(B�"����փ~7=�\|��h�R\[��=l��D�\}3���S��\_FX/�\+��v��\{\-ڧ��Ն\[^�f�����RUtCa\+��\.㷧��﫱'��Qa�������y��2T\-��\+9\*�QR ��y��O� ���ʘEK��jQ���U���� ��<8 ��Ԛ��d\]�x���j:Ԗ�\]�ҳ�������e�l ۝\),Nv�\[\)�4S�\+����T� r���2N�Zi �Ξ��CȤ���QHx\`�\}O2\}\{r�R�����\-���O�خ�niƂJ���� \{PZW\>�K�o��J��C/6��&xe\>\{���h0� endstream endobj 63 0 obj << /Filter /FlateDecode /Length 3947 \>\> stream xڝ��$\)Ο�\(sט@L ��ͻ� �S0H;<���F���\`���x?:鍪;H�x\|�X��\}%�����@���j� �6������ ��M�h��U���؏�����A��9�\!�܁�L��l2��oԍ����$ҕ8�V���t��Q�wfg\.�^M�C�%q��ĦRB취�L�%7t� 򙨒F l��;\!S�\.D��\(�kB��m�\(�/���\`��\)jS�� ��h�2���k���y�Pt�3�� �5�j�3��MV��o:ٴ�n^�\-V�\>v��6\-��u�B?��\+��P�~lo�'WΙ5G����h�7�" �\)�\#g��;:�h\+9tIm\!�G�B����b�Z4\{@�Փ\.l�� ��\{�'y�ۛ����׎��͊�\(\]8�,�m���;9ѹ�҈�8xꈸ���$:�M�T�C�F\-W�l��� �hB��T��V�\\rvp��ܐb�$��~����Z$�8Ǔ���0\)\)l���\`�Z�Y �t���ۅ��:@&�Yk/9����Y�IV���\*\!?^�~����3A���Ļ R�׵�<=���\>~%��c3��"�\)� =�\!�y���yS��S\]Ui��Cvѓb�䜚j��b���NJJ\}z���tVY���\+uN�����m;���heߣ��zl9�T�h\`�h�vzE�C�b�1�=8�u�������\{r�U�1cv���@Y�kX�\[���q�ދ\\����Ί�\.�%w�Σ�Iuk� �4zM� \#<���p���\(GԜ̈���Pb��s�\}��ҚٍO�K3�\{�w\(Yp�;5\\��\_szH1��^C\|�RiC�N� �8\.\-C��\*� ��\)����\!�sg��0�S?\)�\!���%7tڲ�fnHɱ燺\+y�ԸH��8��R՟���V��G\>�9^oKPtJ�l\{W ����u�DQ�� GȧY ��p��B�\_F;����\*l\*�Q�ɜ��w\*�M"����ޭ����\[a����Иtj�i�������4\]:��z\`P3U�\.���^���Y�'a�MnӠgW\[8I���3�g8��nj�\_M��W���a� \]��u��\>gǶ떒���1\!��OWA���H��k'�Fe�������NV��h̼7�N\+��n��?�\#^ަ�n��S�0JCi��N�v�"���T׏�뎩�t\>d�ͮîIÓy�i�3Y2?�S�/,��Ao�̦����a���J6��\+Ӌ\+�f ����\+��G2\#�f�XM�һ��I���y^�\\�\]ڌg\!7��4�TP �eWn�� ��ԯv\[� ����s��㘙8�<�L��y��z,%1��'��3� ���\\����k��6Y\{���d�@n���DϛS�¶w�d'� f=��;Y��,��t�,'/VA� ��\>�INs����M����E��������\)�/�\.�iQ\\۠����\["B~WO޴�"�3&1f�8EɕH���<ٻ���Wz�x���y�j\-��x\)�Rq�"�w��H�Z'��Z�k��\{/ ��\(wZ�m\.\>��Z3�\[E��BZ�\*�?�e\}Q�~I��\#l��H��G?�s@��k@wڮdZ�i\{��� j��T�?0'G �v�Ꝉi9bNf�8 ;��d��\.l/�b�?z:��Y�@j ?Tx���\>,��~�6��,�̸��T�\-yPxɘL�ǎ�������bd�2���\+���qM��k�9��:X8j�Z�� ����,p=�����xR�� ��\\\*ސ���\.��T\.���^R?���8���\}��W� ^I\)�\|����=�\!Nu��ZɕW��v9��pb�L�1BSiJ�pq$�Q붷�"A�\[ �\-��� z�=��Lڜ��2 $��� ̋�"���9\*�Qv������h\*6ۓz �Z�\|,�CvfҨY7� �R������J���p�\\faX�1�C9�Iǹ�\_���N�5a�G^ܥSɢ��9\(U��\!�\\29�\#ɸ��oᐦ�y�G��U�ú�� �g�v��n �l8��^\!�<���\_^P�\+���L�lI� \]0l�k ��Key�q5�6�j�U�FR�8��\)5k�1�b����\]����&<���s"W,���q�i��\}\{\.אը��r�� $;��/v � �O�=��oO\>d�ɣ���\(Zٓ i��ޢ�ϼRh �Y�\!�ɣ%�z\[�e\>Rq �ԇEiT�P߳��R^z�24l�ô��6̠eq�ޗ��Sk\)\*\.�%�i�\(e<�=Ok�k꫸�޴L���\#\*߁���W<�6L/��e���J\|=w\+���3��q���,�� ���z\#�22��\-�^Û�CL�\[�e�D�����\.ٻ���\`h��c�7g&1�zb�=�󺣞����u o���UɥC8\# ڔu���\}�K�G���d���QK�2/��R��1�^��\`2�� �Z&� J��������\}D�MG���H�S��1�G���3��9ˆXDhV�9��4����"�i�W\]\_��q�A��v�uZ�I\*\>���c\*�׹�=���6�\. ���"����PôC\(�&Ͼ��A��\*�6\`��n��r:�/3�Cz�x�ż����d�n����dW\_�����m�\]Nʾ��A�0�^�nSfZ�� �߼�Y �� ;�e�n\)J6渖�l�\[��\-Q�iu��\.�4� C�i����\.���W��\(�1$Q��X�8С\|9�\}"P�\|�ɐ'&1�\*�Ж\\���\`����\*���5Q��<��p҅���:���;�Ά�C����Eܒ�/��;h/��a\+�&�ɿu�����\+h�Gg��� H\-�\`��p�nT�z�ׯ�9s��\`�s��o�S���Cб�\{�f���6�7�99��Iy�k�4\{��dkg���m��7V^����:��ku���Ve�L~��\*l�O����є�1��~�d��o^�j7V��\!n�����\!2Nv��\#s��E���X�\)�1�XZ��\*Nɬ3� �yV'�8�B�����c����I������4��u7�P�ۮV7�ݶ'�6Y� ��\_h�ԛ��/j�R�\-6bZj��ËZ\_G�9��D�t�s�aεj�\)���1Ly���V\[�ʺ�4 ��~ŵ���N���U\.\[�L���h�ʍB=�OْO$����򪌸�\)������������ endstream endobj 113 0 obj << /Filter /FlateDecode /Length 3127 \>\> stream x��\[;o$� ��\)��\+�:�z���m��I���FE��hf�ۦ0왡^\|�H��������m�z���p ":�����o\*\}�7uSA ���EJ���o�\|�R;\)��b��J\)�J?AJ���6�RH?����~��镴�7��ENK3��2i�UHU��:��Kc,���4�$�/\-,\!=��8"��6����ބ:�6ͮ<�ϟ���Ǜ�<��P���������9'@1����&\(���2yk����B\*����7����\|�2\.���4�ma��\_eYxt�$\)T�̝"\#��l�s��L��=�\)\|�u��R\_��L�u�,6\\%\)φ�\[x\\dLli�D:"�2���N�f��,� �Ɠ h^�A�w=�֜�� OLoH��ĝ�\]��t��i8��B\(�1G�\!t\[��E,7w&���0�D�e�9�DCG4$�2gY�^ٴ���bR��y\_5���a�J����Ϋ�֔@Ce4~Q�����ږ ��W�t����S�^Y\!�OV���;9�ђ��T:�ǘ� Q���J���H6�h�r��\]��4��\`��f5�"��鲅\# L�t��@J�\_��<��~��nΑ��\_����\}�V a؁�z����o3۽S�nm� c�E4�4WDWW��,�;\.� :ST��\#�����ad��C$��%� �\!5�\-k�k�\!�G�6\\�ʭ��A�<\*C�j���ua��9��2�A� �\`�����\)��i�� ̈�D�z\>U�~�I\{��H^�f ����ꕲ\]�VXl��\\�3m�R U����y����ig���j� G\_ \|�av���\-O q��2X/������p9AK�������iS\|�\!��$hcƜkh\(9 ����1B�0qb�?��Kb\)v\_����$c�W�՘4�b8�A�"��3�e�?��4O�;�����,���ߎ\(�u��\+�/�<�\|��G��4����q���\`���t��1�������p�~�\[��F��ՙ���q�\[�\[ O�h�3g\) �5�5B�� \!��F�9Z�p��S�\+�/;\>x�3F�o��F�����ʼEO?��l���p1�� �7g�8D�26GB�����k°���n<�j<��&�R���o\*V�"ų���D\.��:%���꩗G�������͉�uV��LZ��O�u��֞�� �Ga�\#葅r��D������\#�S4��E��$�e�U�=�\#F\)�w���wn� �������h��f�8��I0݂ޟ�\(��4�1��Π��g�@�k i\*Ŷ8:UDJ:��id��CǁW��7����G\}�=�<�=�ej�uJ���L�2��O=k/h���H�= �\!\_��\[�Ĉ���/���w^�k�՛��<\\�o6���b\|����q\*eŭ^1\{��Ġ�SO���W@\_�I��ۤ�;u\>��ՙ~ \}����s��7� ������\_���\+���Rͼnuu�V�4�e�,�I7\[�uzR�b5�ŧᤶ���K�����g���rV�k���ε�p�VWO7eu�o���dS~r\`\+:%�V��%�o�d%��1\#8�p\*P̘�@�u��hLjrV$�'N��/nQͨ\-K��\.����5M��Tg�7\.\)��%\!��i�U��T%k�ף� ��B �R���:^��� \.�ry�KI,е���\(����@w����ŝ4��R���"eF�6�E8���\\FQ00C0x�"��R0عH����� �N�����eG���,d�ݎ߀�U�y��U@�/&k��d��\-r���<�R��6\> r��I� �N�I� �S�\>�Y�CAs�4\{��~��\!n\]LX�j A��B�g�8H�rs�\*j5Z\_��\[��\+tz;괡Qf�0��S"��^5g�딇�9=�w�,��� ��0���\|�<2��u�~��QL\[%��=V�Idy���5\!��3��k���ގ\.�0iO���A;�/8p:\!w������1�Y ,�nJ�Q?7������C\*�x��u�p\[� ��L�^Z��\\Mmc8ɼBڼ���yL^�ڗ �ث�g��� �e/y^�^7�Ij����b9�FV%��\_����m�Վ�̤�r\{'�Fo\`\[�ry�f�U\`���wN���lw�le�o�e�\#a�\+�j��� �A躒�I ,�O��@���9C���\]��zr�����kA�3?� bY�5��8�\*���D�� ��s?��\_b�Qf6�&x^\*�D�ҙ���H=�Ҟ8s�M���\{,��Zg8�n��Q\{ў: ���o�n՜\]�\|'Ab�m�J �v\}��i��3��3�pAg�n�1TC4���EvHT"�Rq�����\_W$���\.��<�:���v��BZ ��\.ÓSC��"�t��Z�qܳ p�5߬�y�=�r�\_V�����������F�ch�mIf�w��\* ���\_V�iӷ\#�Qw���\+�����U�\`ukq�A M�Ƿ����^�u�^����8�P�ϧ���P���\}Ŭ�3"���\.����J ��Z���ZG�����?U��\|ӵy3�F��\+��/\- l� �� �PC\!��\!4C�Wu=������l�u�xhJʂ��'q="=���J�q�4�oXÞb1�V\}5�s�/$����c�\*F�6s�A\)5�a�v��X�����\[�\[��i�j��oS�������d�Q"��\-i�\)��E����g��5�1\)G=��7�Es�g���~�/� E��&�\)�;㒏���Ύ��G�������Z���Н/Q$8��M�&5\(,�J�"�\#0A\[�L���uW���I� ؗ�� �����y;�o���'\[���ŭ��My�T���h�\*���ZO45=��?\_o�W�Ÿ endstream endobj 159 0 obj << /Filter /FlateDecode /Length 3670 \>\> stream xڝ���1߯��9X\-Y�����m�73�ڑ�?��:X�\(u��Q<�u\_2��0��v������G�J�\.���7��0��:��\>b�͚��������wg��������gu���\_��������� �a����m����7CP�x��Qv\!�%�1n\`�Al�\>��xF�I�������\|�7��'۠��� �a�\!H�m����vJ�������� �����\`�����C�����y���k�:� ��0�����s�\]�\[VX\+&� ���w� �5�"���O�yxv�\}���ΡB \_�H=����S����,��M���yZ;�� �\}�D5��̬�;VHD�O��\]��vx A� q���Pc�g��A���Q�1�&�\)�\*�\#'0�\- � u�V����fWz�������X��bY���YF�&�c�l'�~�X�P2�b�C�8�h��ͣ�V\\y��N�c Қ�l��\)�OW� � � ����\.˩t�p�k;EB\_��r��9���\>��"��a�pc��Q��;��D� �כ��/�\\� @g�ۀ�/ȢY9� �&L�\#�bh���$\`���\]��p��t�=\[�f�d\[Zf�F �;�NJ� j �Ń��n����ہ���݉��0B2\[bTo���G�79 Sb��d�����ܕ�w�4��e�pR�q\+h~��U�I��� �$�\[��Fs�&��zw�DK� y�=^mԒ\]����CT��������i������dl�؀�� u��'n\.G������n�1h��4��\*n�G������\}I����f�P����Is�\{vk�q\]��\-����� �?��U\]�c����K%�1 l\]������n���$�z���xU��Iik;��\(eAK���o,�����J�i&/$oD��6Z�������EV��\#n%��n���Ɯv���ǵp�Q\!�͂���=7���%�/\\�������\+�\]����\.����\\�\.ύf�q��\_%^��\`3ٟ���\*E�L���y�ߩn�\{��但�o\]\+vv��"�oF�P �?��� � ����"=zK����dw���0;��%j�Q��T����RQg�0�u\[�n\>��P,FQ����B�\>��l����$'��0\>\)�1�ѳ��mmUC\`� '�&\>G� �k㘤�\{t�\>�/f�ד�\+�k�7����5�\}�"������:S��r\-���BDM�e�lbw�\[���헓ݘo\]�5�\)M�ı����R� K\_%\*���w49co��S��99$s$VnO��o�Y��k�T�p��l\#��/�\_dZ5�ε�����w����~�VDŽeeI�7��&�a�ȳyHs�,@�ڴ��l����x8�ҍ�l9üt\_����U��\|㶱l��������$�\}�el�h�%\\�H �\[\-\)�����e�\\�V��8R

Similar Articles

Websites Can Now Spy on You Through Your Hard Drive

Wired

A new technique called FROST exploits SSD timing side channels in browsers to spy on users' activities, identifying open websites and apps without requiring any interaction beyond visiting a malicious site.

Known By Their Actions: Fingerprinting LLM Browser Agents via UI Traces

Hugging Face Daily Papers

This paper demonstrates that websites can identify which large language model powers a browsing agent by analyzing its behavioral patterns and timing data, achieving up to 96% F1 score across 14 frontier LLMs. It formalizes this attack surface and shows that random timing delays are insufficient to prevent identification.

How to Write to SSDs

Lobsters Hottest

This paper proposes out-of-place write optimizations for database systems to fully leverage SSD performance, achieving 1.65-2.24x throughput improvement and 6.2-9.8x reduction in flash writes on OLTP benchmarks.