commit 245e999d5e19bd5f4bd44feed0336b2156581df1
author mgiuca <mgiuca@chromium.org> Thu Apr 13 06:32:55 2017
committer Commit bot <commit-bot@chromium.org> Thu Apr 13 06:32:55 2017
tree b3ff3363e474113c848ba32bd57e3e73357a2271
parent c73d5721559290e45c7d3aa8b5d1a5ef6caaade8

getInstalledRelatedApps: Introduce random delay to stop timing attacks.

Queries to this API have a sleep of 0--8ms, randomly chosen based on a
SHA-256 hash of the app ID, salted with a unique stable device ID. This
prevents websites from being able to determine whether a non-related app
is installed based on the time the query takes.

The website is unable to compare the timing of different apps because
they have different random delays, and unable to predict the random
delay for a given device, because the salt is unknown.

BUG=707071

Review-Url: https://codereview.chromium.org/2802603002
Cr-Commit-Position: refs/heads/master@{#464322}