Collected research

The Clock is Still Ticking: Timing Attacks in the Modern Web

Tom Van Goethem, Wouter Joosen and Nick Nikiforakis · dl.acm.org

Browser features that parse or cache a cross-origin response let an attacker time the work done after the download finishes, so network jitter no longer matters. Video parsing, ApplicationCache, Service Workers and the Fetch API each leak response size, revealing a victim state on social networks such as age, location and private group membership, and defeating random-delay defences.

Record

Researcher

Tom Van Goethem, Wouter Joosen and Nick Nikiforakis

Published by

dl.acm.org

Topic

Other

In the archive

• Collected in the 2015 research round

Related sources

• The Clock is Still Ticking: Timing Attacks in the Modern Web (PDF) Whitepaper

Tags

• timing-attack
• side-channel
• xsleak
• info-leak
• cache
• service-worker
• javascript
• mitigation

This page is the archive's own catalogue record. The research is the work of Tom Van Goethem, Wouter Joosen and Nick Nikiforakis, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.