Quick summary: an automated approach to browser fingerprinting, with two new side-channel attacks on browser engines, that reveals "the underlying operating system, CPU architecture, used privacy-enhancing plugins, as well as exact browser version".
Why it's called a JavaScript Template Attack: "A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript."
Yep it's actually mentioned somewhere in the paper:
Chari et al. [10] introduced template attacks as a strong
form of side-channel attacks. They first collect side-channel
traces from an attacker-controlled device, the so-called template. Then, they collect a single trace from an identical device
processing an unknown secret. The unknown secret can then
be recovered by comparing the trace to the recorded templates.
I don't see whats new here - comparing global object values has always been used to identify browsers and versions. Same with looking for bugs/quirks in JS engines.
New extension idea: adds random properties to window on each new page.
I watched the video presentation, what's the take-away from it? Yes, different environments have different properties, but we knew this since the first browsers appeared. Is there anything new? This does not lead to an unique fingerprint. Is it more about the automated system that detects the properties that change or just bringing awarness of the issue?
Why it's called a JavaScript Template Attack: "A template is a matrix of properties (rows) for various environments (columns). All properties, e.g., browser properties, are retrieved through JavaScript."