JavaScript Timing Attack Benchmarks

Ya know fingerprinting? The technique that allowed Do Not Track to be used to aid tracking? Yeah, JavaScript engines have been doing their best to mitigate it. This effort, along with a move to prevent timing attacks, led to JavaScript engines intentionally making timing inaccurate, so hackers can’t get precise measurements of the current computers performance or how expensive a certain operation is. Unfortunately, this means, without tweaking things, benchmarks have the same problem.

A dark-mode text screenshot explains how browser defenses against fingerprinting and timing attacks make JavaScript timing measurements inaccurate. The punchline is that the same protections that hinder hackers also make unadjusted performance benchmarks unreliable, creating an ironic problem for developers. It is shared as a reaction to JavaScript performance discussions and the frustrations of benchmarking modern browsers. EN: A dark-mode text screenshot explains how browser defenses against fingerprinting and timing attacks make JavaScript timing measurements inaccurate. The punchline is that the same protections that hinder hackers also make unadjusted performance benchmarks unreliable, creating an ironic problem for developers. It is shared as a reaction to JavaScript performance discussions and the frustrations of benchmarking modern browsers.

• @gentoomemes / 15423 2025-01-01