Add text for cache timing

chapters/methods.tex

@@ -692,7 +692,69 @@ party websites.
 \subsection{Cache Timing}
 \label{subsec:cache timing}
 
+Cache timing attacks are another form of history stealing which enables an
+attacker to probe for already visited \glspl{URL} by timing how long it takes a
+client to fetch a resource. Timing attacks are most commonly used in
+cryptography to indirectly observe the generation or usage of a cipher key by
+measuring cpu noises, frequencies, power usage or other properties that allow
+conclusions to be drawn about the key. This type of attack is referred to as a
+side-channel attack. Cache timing exploits the fact that it takes time to load
+assets for a website. It works by measuring the time a client takes to access a
+specified resource. If the time is short, the resource has most likely been
+served from the cache and has thus been downloaded before, implying a visit to a
+website which uses that resource. If it takes longer than a cache hit would, on
+the other hand, the resource did not exist before and has to be downloaded now,
+suggesting that no other website using that resource has been visited before. In
+practice an attack might look like this (taken from
+\cite[p.~2]{feltenTimingAttacksWeb2000}):
 
+\begin{enumerate}
+	\item Alice visits a website from Bob called \texttt{bob.com}.
+	\item Bob wants to find out whether Alice visited Charlie's website
+		\texttt{charlie.com} in the past.
+	\item Bob chooses a file from \texttt{charlie.com} which is regularly
+		downloaded by visitors to that site.
+	\item Bob implements a script or program that checks the time it takes
+		to load the file from \texttt{charlie.com} and embeds it in his
+		own site.
+	\item The program is loaded by Alice upon visiting and measures the time
+		needed to load the file from \texttt{charlie.com}.
+	\item If the measured time is below a certain threshold, the file has
+		probably been downloaded into the cache and Alice has therefore
+		visited \texttt{charlie.com} before.
+\end{enumerate}
+
+Bob can do this process for multiple resources and for every user that visits
+his website, collecting browser history information on all of them. Since
+caches exist to boost performance and avoid unnecessary loading of content from
+servers which has already been downloaded before, timing attacks are very hard
+to circumvent because caches exist solely for that purpose. Countermeasures
+either cause a massive slowdown when browsing the web due to the ubiquity of
+caches, or imply a substantial change in user agent design.
+
+\citeauthor{feltenTimingAttacksWeb2000} \cite{feltenTimingAttacksWeb2000} were
+the first to conduct a study on the feasibility of cache timing attacks and
+concluded that accuracy in determining whether a file has been loaded from cache
+or downloaded from a server is generally very high ($>95\%$). Furthermore, they
+evaluated a host of countermeasures such as turning off caching, altering hit or
+miss performance and turning off Java and JavaScript but concluded that they
+were unattractive or at worst ineffective. They propose a partial remedy for
+cache timing by introducing \emph{Domain Tagging} which requires that resources
+are tagged with the domain they have initially been loaded from. Once another
+website wants to determine whether a user has visited a site before by
+cross-loading a resource, the domain does not match the tagged domain on the
+resource. If that is the case, the initial cache hit gets transformed into a
+cache miss and the resource has to be downloaded again, fooling the attacker
+into believing that the origin website has not been visited before. It is
+necessary to mention that at the time (2000) \glspl{CDN} were not as widely
+used as today. Since websites rely on \glspl{CDN} to cache resources that are
+used on multiple sites and can thus be served much faster from cache, domain
+tagging would effectively nullify the performance boost a \gls{CDN} provides by
+converting every cache hit into a cache miss. The authors themselves question
+the effectiveness of such an approach.
+
+While the attack presented by \citeauthor{feltenTimingAttacksWeb2000} relies on
+being able to accurately time resource loading, a reliable network is needed. 
 
 \subsection{Cache Control Directives}
 \label{subsec:cache control directives}