Attack Presented by: Vinuthna Nalluri and Brett Parker

Typos “For example, a letter entered in a text box affect all the follow-up auto-suggestion contents…”

Purpose Paper is too focused on the existence of the problem of side-channel leaks, but does not contribute enough to solving the problem Problem has been around a long time, and paper has done nothing but explain it Does not offer any significant methods for prevention

Attack cases Give many examples of what an attacker might due, given certain vulnerabilities But, don’t consider many important situations Perhaps attacking these vulnerabilities is not as simple as your paper makes it out to be

Query Word Leaks Discussion is too narrow – not enough examples Show what happens when user types single letters at a time very slowly But what if the user types quickly? Reduces number of AJAX requests, so guessing an entire word or query is not that easy Should have included details about how an attacker might proceed in this type of situation

Query Word Leaks What about personalized suggestions? Previously-searched terms are stored in web history and are automatically suggested at each new search How can an attacker obtain these when there are no AJAX requests for them? Not that easy

OnlineHealth Say that it is easy for an attacker to obtain the auto- suggested search terms for illnesses based on the fact that each character returned is different byte size But, what if all the bytes are made to be the same size? It would make the attack much more difficult

Your argument “We found that mitigation of such side-channel threats is much more difficult than it appears to be, as such an effort often needs to be application-specific” We agree. Also, you say… “…[universal] mitigations are unlikely to be applied in reality due to the uncertainty of their effectiveness…” 

Packet-padding So, why spend the entire second half of the paper discussing universal methods that don’t work (too much overhead)? Also, why dedicate an entire section (appendix) to describing your implementation of a packet-padding prototype? You already argued that it is proven not to work well! If that was your focus, it should have been more in- depth!

Automatic Tools You say that manually finding vulnerabilities in code and implementing mitigation policies is too costly and that automatic tools should be developed for this process Fine. Then why didn’t you include any insight on how this could be done?

Thanks!