One of the more effective techniques is measuring the speed at which JS renders to your canvas. That's a sidechannel I don't think can be closed easily.
As long as JS exists, there will be effective means to examine the sandbox.
(I do agree they have unsafe defaults info. It's just removing it isn't enough.)
As long as JS exists, there will be effective means to examine the sandbox.
(I do agree they have unsafe defaults info. It's just removing it isn't enough.)