How a web app can download and store over 2GB without you even knowing it • Hacker News Board

Re: How a web app can download and store over 2GB without you even knowing it

#11

Post by njs12345 » Sun, Mar 25, 2012, 3:58 PM UTC

objclxt wrote: post #8

AlexV wrote: post #6

It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side DDoS :)

iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.

I wonder if you could still perform a DOS by doing the following:

  - register 1000 domains
  - when the browser navigates to the first domain, store 5Mb
  - once the store has finished, redirect to the next domain
  - repeat steps 2-3 ad infinitum

Anybody know if this would work?

Re: How a web app can download and store over 2GB without you even knowing it

#12

Post by fl3x » Sun, Mar 25, 2012, 4:05 PM UTC

njs12345 wrote: post #11

objclxt wrote: post #8

Earlier quoted context omitted.

iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.

I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?

That could probably work!

The documentation at http://dev.w3.org/html5/spec/offline.html#disk-space states that "care should be taken to ensure that the restrictions cannot be easily worked around using subdomains", so one would really have to use different domains as you write, which sounds a bit costly.

Re: How a web app can download and store over 2GB without you even knowing it

#13

Post by AlexV » Sun, Mar 25, 2012, 4:07 PM UTC

njs12345 wrote: post #11

objclxt wrote: post #8

Earlier quoted context omitted.

iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.

I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?

Sub-domains should work also then. Just make a page with bunch of IFrames, each on a different, random sub-domain.

Edit: Ooops; didn't see the comment above about sub-domains. Worth a try though!

Re: How a web app can download and store over 2GB without you even knowing it

#14

Post by sigil » Sun, Mar 25, 2012, 4:14 PM UTC

The fact that there's a limit is not surprising. That the limit is 2GB is a little surprising, but this is across all sites, so ok. That there's no cache ejection when you reach the limit just seems like a bug. Why not use LRU?

Re: How a web app can download and store over 2GB without you even knowing it

#15

Post by kijin » Sun, Mar 25, 2012, 4:32 PM UTC

AlexV wrote: post #6

It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side DDoS :)

Heh, you could easily DoS a Canadian home internet user (not mobile) by transferring a massive amount of data behind their back. So many people here are stuck with 25GB/mo limits.

Re: How a web app can download and store over 2GB without you even knowing it

#16

Post by lallysingh » Sun, Mar 25, 2012, 4:54 PM UTC

sigil wrote: post #14

The fact that there's a limit is not surprising. That the limit is 2GB is a little surprising, but this is across all sites, so ok. That there's no cache ejection when you reach the limit just seems like a bug. Why not use LRU?

The 2GB isn't just the local web-cache-size limit?

Re: How a web app can download and store over 2GB without you even knowing it

#17

Post by espeed » Sun, Mar 25, 2012, 5:35 PM UTC

sigil wrote: post #14

The fact that there's a limit is not surprising. That the limit is 2GB is a little surprising, but this is across all sites, so ok. That there's no cache ejection when you reach the limit just seems like a bug. Why not use LRU?

Isn't 2 GB the memory limit on V8 (http://code.google.com/p/v8/issues/detail?id=847)?

Re: How a web app can download and store over 2GB without you even knowing it

#18

Post by evanm » Sun, Mar 25, 2012, 5:39 PM UTC

njs12345 wrote: post #11

objclxt wrote: post #8

Earlier quoted context omitted.

iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.

I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?

I mean, theoretically. But would a user actually willingly wait out this process?

Re: How a web app can download and store over 2GB without you even knowing it

#19

Post by ef4 » Sun, Mar 25, 2012, 5:45 PM UTC

objclxt wrote: post #8

AlexV wrote: post #6

It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side DDoS :)

iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.

localStorage and application cache are not the same thing.

localStorage is the one that prompts the user for more than 5MB, but the author was using application, which I've never seen prompt.

Re: How a web app can download and store over 2GB without you even knowing it

#20

Post by ef4 » Sun, Mar 25, 2012, 5:46 PM UTC

fl3x wrote: post #10

throwaway64 wrote: post #4

Earlier quoted context omitted.

the default local storage limit for Firefox is 5 megs per domain.

Sorry for nitpicking, but I think local storage is a part of Web Storage ( http://dev.w3.org/html5/webstorage/ ), and not Application Cache ( http://www.whatwg.org/specs/web-apps/current-work/multipage/... or http://dev.w3.org/html5/spec/offline.html ). I think that the Application Cache quota is not strictly connected to the local storage and session storage limits.

That's correct. Chromium has talked about unifying all these kinds of storage under one quota system, but it's not done yet.