<story><title>Spook: Side channel attack which could read the memory from password managers</title><url>https://www.spookjs.com/</url></story><parent_chain></parent_chain><comment><author>bee_rider</author><text>This title seems a bit over-broad. The attack is based on using the built-in chrome credential manager. Further, it seems to depend either on the user installing an evil chrome plugin (in which case, you are already doomed, right?), or confusing a website like Tumblr into mixing up the user content and the login page, and getting the autofill info there.&lt;p&gt;The second attack seems limited to just the site that is being messed with. The fact that sites like Tumblr which apparently (?) host random unvetted javascript for bloggers aren&amp;#x27;t protected by site isolation is not that surprising, right?&lt;p&gt;Anyway, autofill and built-in password managers have always seemed suspicious to me. People should stick to stuff like keepass I guess.</text></comment>
<story><title>Spook: Side channel attack which could read the memory from password managers</title><url>https://www.spookjs.com/</url></story><parent_chain></parent_chain><comment><author>bananaportfolio</author><text>It looks like they were able to exploit the Last Level Cache of Intel and Apple processors, but failed to do so against an AMD processor using the Zen architecture. Instead of plainly saying as much, the authors simulate a theoretical leakage rate for AMD processors by way of making V8 expose clflush in absence of a practical LLC eviction mechanism.</text></comment>