Light

Episode #957 Quiz

The Protected Audience API
Date: 2024-01-16 | Length: 1 hr | Episode page at twit.tv

About this episode

Gibson described compromised IoT appliances as potential botnet nodes, using an LG washing machine’s 3.6GB daily upload to illustrate covert outbound traffic and recommending guest-LAN isolation or disconnection. He also covered DDoS null routing, KyberSlash timing leaks in Kyber implementations, and Google’s browser-side Protected Audience API ad auctions with isolated worklets.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what is the key browser-side change Google made to web advertising with the Protected Audience API?

Question 1

According to the episode, what is the key browser-side change Google made to web advertising with the Protected Audience API?

It requires advertisers to embed their own auction code directly into each webpage It removes all ad selection logic from the browser and leaves only contextual matching to publishers It shifts ad selection entirely to a centralized Google service that scores bids on remote servers It turns the browser into an ad-auctioning engine that runs auctions locally on the user's device

Question 2: What timing side-channel flaw was found in some Kyber implementations discussed in the episode?

Question 2

What timing side-channel flaw was found in some Kyber implementations discussed in the episode?

Secret-dependent table lookups caused cache-line eviction patterns Secret-dependent integer division caused measurable execution-time variation Secret-dependent elliptic-curve scalar multiplication caused branch misprediction leaks Secret-dependent modular exponentiation caused power-analysis leakage

Question 3: What did the StatCounter browser map show about global browser usage in the episode?

Question 3

What did the StatCounter browser map show about global browser usage in the episode?

Internet Explorer still dominated most of the map outside a few isolated regions Safari had become the leading browser in most of Africa and Asia Firefox had become the dominant browser across Europe and North America Chrome had become overwhelmingly dominant across most regions of the world

Question 4: What concrete mitigation does the episode recommend for compromised or risky IoT devices like the networked washing machine?

Question 4

What concrete mitigation does the episode recommend for compromised or risky IoT devices like the networked washing machine?

Mirror the device traffic to a cloud service for continuous anomaly detection Enable port forwarding so the vendor can patch the device from outside Place the device on a separate guest LAN with no access to the high-value LAN Expose the device only through a VPN so it can be managed remotely

Question 5: According to the episode, what was the practical effect of the carrier's null routing during the SourceHut DDoS incident?

Question 5

According to the episode, what was the practical effect of the carrier's null routing during the SourceHut DDoS incident?

It blocked both the attack traffic and all legitimate traffic to the targeted service It rate-limited the source networks enough to keep the service fully reachable It filtered only malformed packets while allowing normal service traffic to continue It rerouted legitimate traffic through a backup datacenter while dropping the attack

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.