The risk here is that there are more individuals with the skills to take this type of attack and bring it to a browser near you.
One apps data is another apps code.
Unfortunately, I've had no luck getting others to buy into the idea that they should understand this level of detail so they can make these calls. Quite frustrating and depressing, since companies will relentlessly exploit their indifference.
If the only way to get trackers on the average person is to serve it from the same first-party domain, or to bundle it in with the giant 'app.js', you better believe they'll do that.
Right now, the fact that only a small fraction of people run adblockers, and an even smaller fraction block javascript, is what allows it to work.
In my case when every attempt fails I know it could be the side effect of some other privacy add on. If it's a random blog/news, that's the end of it. If I really have to use that site I open Chrome, do what I have to do, close it. Of course given a choice I pick sites that work well with only JS from a few inevitable sources.
I would like to salute my shitty ISP for keeping me safe from timing attacks using their unreliable network infrastructure.
