Is it correct to say that extracting information about the text in a target iframe using this attack depends on knowing the pixel widths of all the characters in the font used in an arbitrary line of text in the target iframe?
It is even more complex as the width of a text in most fonts also varies with the specific order of the characters because of kerning (VAI takes less space than VIA, because the A is placed closer to the V in former) and ligatures (for example the dot of the i in "fi" is often swallowed by the f).
Comments
Fascinating.
Is it correct to say that extracting information about the text in a target iframe using this attack depends on knowing the pixel widths of all the characters in the font used in an arbitrary line of text in the target iframe?
It is even more complex as the width of a text in most fonts also varies with the specific order of the characters because of kerning (VAI takes less space than VIA, because the A is placed closer to the V in former) and ligatures (for example the dot of the i in "fi" is often swallowed by the f).