Consider to expose decoding time for FCP and LCP?  #104

Activity

1. noamr commented on Apr 10, 2024

   

   noamr

   on Apr 10, 2024

   Contributor

   More actions

   This is also connected to #62.
2. clelland

   self-assigned this

   on Apr 23, 2024
3. noamr commented on Oct 14, 2024

   

   noamr

   on Oct 14, 2024

   Contributor

   More actions

   We've discussed this with the security folks.
   As for as LCP/element-timing goes, the current restriction with Timing-Allow-Origin doesn't make sense because that's a resource-based protection and render time is for the whole document.

   So the current proposal is to remove the TAO restrictions, and instead coarsen the render time by 4ms (and clamp to the load time) when the document is not cross-origin-isolated. This would make trying to use timing attacks to figure out information about cross-origin images based on their decoding time not useful.
4. noamr commented on Oct 17, 2024

   

   noamr

   on Oct 17, 2024

   Contributor

   More actions

   A more detailed explanation about this for the WG call:

   • The renderTime value is really the paint time of the frame after two conditions are fulfilled: (1) the image is loaded & decoded, (2) the image is added to the DOM.
   • This is potentially a cross-origin leak, as it can expose decoding time information about cross-origin no-cors images.
   • So element timing / LCP for images was guarded by having Timing-Allow-Origin on the image if it's cross-origin. Images failing the TAO test would receive a renderTime of zero.
   • This is an ineffective measure, because resources are rendered together in the same frame, thus receiving the same timing. It's easy enough to add a cross-origin image to the DOM together with a small same-origin image, and receive the render time for both.
   • The alternative proposed is that we use cross-origin isolation for this rather than Timing-Allow-Origin. Cross-origin isolation protects any cross-origin resource on the page from indirect leaks, rather than a particular resource.
   • When cross-origin isolation is not present, we'll still expose renderTime - but over-coarsened (to 4ms resolution). This would allow enough information for performance analysis, while being coarse enough so that it does not expose decoding information in a meaningful way.
   • This has been generally discussed with our internal security team, and will pass through an additional review after it's blessed by the WebPerfWG and we're ready to ship it.
5. noamr

   added 2 commits that reference this issue on Nov 4, 2024

   Remove TAO check from element timing reporting

   ...

   This issue will close once commit d5cfcf9 is merged into the 'main' branch.

   d5cfcf9

   Revise security and privacy section to remove TAO

   ...

   This issue will close once commit c356eba is merged into the 'main' branch.

   c356eba
6. noamr

   closed this as completedin #105on Nov 4, 2024
7. noamr

   closed this as completedin 486220fon Nov 4, 2024
8. clelland

   added a commit that references this issue on Dec 16, 2024

   Inclujde `PaintMixin` in `PerformanceElementTiming` (#81)

   ...

   5e609be