Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML5 localStorage allows sites to fill up users' hard disks

feross.org

Post reply on HN
Print view View original

91–100 of 191 posts

Re: HTML5 localStorage allows sites to fill up users' hard disks

#91

Post by yaix »

okamiueru wrote: post #89
afhof wrote: post #80

Earlier quoted context omitted.

That is a good way to never ever ever use a feature again. "Frightening Message: This website wants to do something scary. Do you want to allow some bad thing to happen to your computer?" That is how lay people, i.e. the people needed to mass adoption, read browser requests for Geo, storage, and other permissions. It would be better to have sane and safe defaults in the browser, rather than pester the user. Would coo…

It could be done as in Opera, where there is a initial limit, and a request to exceed it when maxed. http://i.imgur.com/SOoadOB.png

It should not be blocking though!

Re: HTML5 localStorage allows sites to fill up users' hard disks

#92

Post by rjh29 »

ricardobeat wrote: post #86
eksith wrote: post #44

Well this is frightening. You don't even need to create subdomains since basically anyone with wildcard subdomains enabled can do this without a sweat. All you need is a random number generator and rewrite x.domain.com to domain.com and the browser is none the wiser. Though I can't quite imagine why anyone would want to do this to some random stranger. Unless you knew the visitor or had some means of personally ident…

> anyone with wildcard subdomains enabled i.e. nobody. why the hell is webkit not following the standard here? they even implemented a permission dialog so you can allow an app going over quota.

Wildcard subdomains are ridiculously common on the web (unless I've misread you?) Blogspot, tumblr, tripod, basically anywhere using HTTP/1.1 Host-based routing of requests.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#93

Post by lerouxb »

feross wrote: post #5
yefim323 wrote: post #2

I was really annoyed by the fact that the "disk filling" started as soon as I clicked the link. However, the point really hit home. Is there a solution for this browser-side? EDIT: The link has been changed to the blog post describing the phenomenon. Good riddance!

You can use Firefox. Firefox actually implements a reasonable storage limit policy for this. 10MB for an entire domain (all subdomains included)

How does Firefox determine if something is a domain or a subdomain? Obviously the term subdomain is relative, so domain.com is already a subdomain of .com. But what about countries like the UK or South Africa where domains are commonly subdomains of .co.uk and .co.za?

Is there some generic way to know when a domain should be treated as a subdomain or do they basically hardcode the exceptions?

Example: does domain1.co.uk and domain2.co.uk share the same limit in Firefox? Probably not, but how does it know to treat them as separate?

Re: HTML5 localStorage allows sites to fill up users' hard disks

#94

Post by UnoriginalGuy »

m_st wrote: post #37

Reminds me how filing bugs with Microsoft is such a pain! There's no category for Windows 8 on MS Connect, so when we found a bug in Windows 8 RTM I found the name of an MS employee working on the feature in question on the MSDN forums, then through Google found his LinkedIn profile where he luckily published his eMail address. Microsoft should be ashamed. It seems like the best way to file a bug these days is to cre…

I'm actually aware of a very significant user impacting bug in Windows 8 (hint: It can cause every process in your startup/autorun list to not start consistently). But have no way to report it to them...

Has impacted my system multiple times since upgrading to Windows 8. Fortunately I know a work-around (eject the optical disc in the optical drive) but still -- annoying that I cannot even report it.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#95

Post by feross »

lerouxb wrote: post #93
feross wrote: post #5

Earlier quoted context omitted.

You can use Firefox. Firefox actually implements a reasonable storage limit policy for this. 10MB for an entire domain (all subdomains included)

How does Firefox determine if something is a domain or a subdomain? Obviously the term subdomain is relative, so domain.com is already a subdomain of .com. But what about countries like the UK or South Africa where domains are commonly subdomains of .co.uk and .co.za? Is there some generic way to know when a domain should be treated as a subdomain or do they basically hardcode the exceptions? Example: does domain1.co…

There's a hardcoded list of TLDs in the browser's source code. They update it from time to time whenever there's a new .co.uk style TLD to add.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#96

Post by jaredsohn »

pilif wrote: post #50

So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…

Limit how much can be placed in localstorage regardless of site based on time. (Or perhaps prompt whenever that limit is reached, in case there is a legit reason for it.)

This isn't perfect in that your localstorage could still be filled up slowly if you leave a page open in the background, but I think this solution is robust to many different techniques.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#97

Post by rtpg »

jaredsohn wrote: post #96
pilif wrote: post #50

So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…

Limit how much can be placed in localstorage regardless of site based on time. (Or perhaps prompt whenever that limit is reached, in case there is a legit reason for it.) This isn't perfect in that your localstorage could still be filled up slowly if you leave a page open in the background, but I think this solution is robust to many different techniques.

Prompt is the best solution to this. There's a prompt with flash.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#98

Post by lerouxb »

lerouxb wrote: post #93
feross wrote: post #5

Earlier quoted context omitted.

You can use Firefox. Firefox actually implements a reasonable storage limit policy for this. 10MB for an entire domain (all subdomains included)

How does Firefox determine if something is a domain or a subdomain? Obviously the term subdomain is relative, so domain.com is already a subdomain of .com. But what about countries like the UK or South Africa where domains are commonly subdomains of .co.uk and .co.za? Is there some generic way to know when a domain should be treated as a subdomain or do they basically hardcode the exceptions? Example: does domain1.co…

I see there's a list online: http://publicsuffix.org/

Re: HTML5 localStorage allows sites to fill up users' hard disks

#99

Post by wisty »

kevincrane wrote: post #10
mablae wrote: post #8

How is that done? Isn't there a limita Limit of 5Mb(?) per Domain definend in the HTML5 Spec for LocalStorage?

http://feross.org/fill-disk/ He explains here that most browsers (except Firefox) don't follow the standard close enough, and ignore the exception for subdomains, i.e. 1.filldisk.com, 2.filldisk.com, etc.

Wait, haven't I heard this song before?

It's the one about cookies, and .co.uk (i.e. every commercial site in the UK) sites all sharing the same cookies, because they all look like subdomains. Or was it all .friendly-hosting-company.com sites?

The fundamental problem is, there's no easy way to distinguish domains and subdomains.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#100

Post by tripzilch »

eksith wrote: post #44

Well this is frightening. You don't even need to create subdomains since basically anyone with wildcard subdomains enabled can do this without a sweat. All you need is a random number generator and rewrite x.domain.com to domain.com and the browser is none the wiser. Though I can't quite imagine why anyone would want to do this to some random stranger. Unless you knew the visitor or had some means of personally ident…

> Though I can't quite imagine why anyone would want to do this to some random stranger.

You must be new to the internet?

> Unless you knew the visitor or had some means of personally identifying him/her, there are more devastating ways of filling up a remote HD with just an IP and hostname (nmap and friends come to mind).

There's a few things:

This works by sending someone a link. So you can target people without knowing their IP. It's also so easy a kid could do it. Therefore, kids will do it, just to "fuck with eachother's shit". Not to mention, they'll do it to the school and the library, etc etc. There's also enough people doing things "for the lulz". Spam this link to a thousand people, crash a few PCs, hur hur hur. Again, the fact that it's browser-based and not IP-based allows for different types of attacks. They can spam specific communities and fora they don't like or are at odds with.

..

By the way, when I ran that site in Opera, it asked me whether I wanted to grant the site extra storage space, which I declined. I didn't feel like testing it in Chrome and crashing my things right now, but am I correct in assuming Chrome would not ask for this extra storage space, but simply take it, without any kind of upper limit?

Post reply on HN