HTML5 localStorage allows sites to fill up users' hard disks • Hacker News Board

Re: HTML5 localStorage allows sites to fill up users' hard disks

#111

Post by quotemstr » Thu, Feb 28, 2013, 9:57 AM UTC

UnoriginalGuy wrote: post #94

m_st wrote: post #37

Reminds me how filing bugs with Microsoft is such a pain! There's no category for Windows 8 on MS Connect, so when we found a bug in Windows 8 RTM I found the name of an MS employee working on the feature in question on the MSDN forums, then through Google found his LinkedIn profile where he luckily published his eMail address. Microsoft should be ashamed. It seems like the best way to file a bug these days is to cre…

I'm actually aware of a very significant user impacting bug in Windows 8 (hint: It can cause every process in your startup/autorun list to not start consistently). But have no way to report it to them... Has impacted my system multiple times since upgrading to Windows 8. Fortunately I know a work-around (eject the optical disc in the optical drive) but still -- annoying that I cannot even report it.

I might be able to help; please provide contact information.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#112

Post by tripzilch » Thu, Feb 28, 2013, 9:59 AM UTC

okamiueru wrote: post #89

afhof wrote: post #80

Earlier quoted context omitted.

That is a good way to never ever ever use a feature again. "Frightening Message: This website wants to do something scary. Do you want to allow some bad thing to happen to your computer?" That is how lay people, i.e. the people needed to mass adoption, read browser requests for Geo, storage, and other permissions. It would be better to have sane and safe defaults in the browser, rather than pester the user. Would coo…

It could be done as in Opera, where there is a initial limit, and a request to exceed it when maxed. http://i.imgur.com/SOoadOB.png

Heh, that may possibly be one of the final features for other browsers to copy from Opera, before they join the herd and switch to webkit :)

I'm actually not sure how much that'll change Opera, and affect their way of innovating new features to include.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#113

Post by espadrine » Thu, Feb 28, 2013, 10:02 AM UTC

okamiueru wrote: post #90

Here is how it looked in Opera: http://i.imgur.com/SOoadOB.png

Too bad that outstanding solution will be vaporized from the face of this earth and replaced by Chrome's implementation!

Re: HTML5 localStorage allows sites to fill up users' hard disks

#114

Post by twinge » Thu, Feb 28, 2013, 10:09 AM UTC

crdoconnor wrote: post #78

zanny wrote: post #65

Earlier quoted context omitted.

There really isn't an easy way to avoid this problem even if you follow the standard fixed quota per domain and subdomains don't count policy. You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. In the end, the problem is that one page can itself infer to other domain / subdomains in its document and those can execute and utilize localstorage. They have to, though, so you ca…

You could prompt for domains that use more than a small amount - say, 25-100k. Once they hit that point, show a prompt below the toolbar that shows how much data is being used by the whole domain, in real time and allow it to keep on filling up with data until the user says stop or always allow.

You could continue to allow 5mb for each subdomain, but wait until say, 25mb for the sum(*.domain.tld) before prompting. For example, this would allow {www,mail,docs,plus,???}.google.com to continue as they are now until google.com managed to rack up 25mb worth of data. After which point the user might want to know they're holding on to a fair bit of data for one particular site.

Then again, prompting is really annoying, and most people just click "okay" and without comprehending.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#115

Post by curiousdannii » Thu, Feb 28, 2013, 10:17 AM UTC

The Chromium developers really dislike localStorage (http://code.google.com/p/chromium/issues/detail?id=58985#c7)

They'll have to fix this bug, but I won't be surprised if they try to remove localStorage entirely soon.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#116

Post by chrismorgan » Thu, Feb 28, 2013, 10:18 AM UTC

HTML5 localStorage does not allow sites to fill up users' hard disks (without their permission).

Bad, non-conforming implementations do.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#117

Post by recuter » Thu, Feb 28, 2013, 10:37 AM UTC

hoodoof wrote: post #70

Wouldn't this have earned the guy a $60,000 Chrome bug bounty if he had reported it through the right channels?

It isn't a bug.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#118

Post by zepolen » Thu, Feb 28, 2013, 10:48 AM UTC

pilif wrote: post #50

So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…

5MB per subdomain, 100MB per domain, configurable limits, prompt when a site/subdomain requires more.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#119

Post by sfaruque » Thu, Feb 28, 2013, 10:53 AM UTC

I'm working on writing a guide on how to use localStorage to publish on www.localstorage.org.

Should I include a part about the possible abuses?

Re: HTML5 localStorage allows sites to fill up users' hard disks

#120

Post by exterm » Thu, Feb 28, 2013, 10:53 AM UTC

smnrchrds wrote: post #72

Untit1ed wrote: post #49

Finally a good non-ideological reason to use Firefox :)

Actually it is kind of ideological: Firefox is following standards

you can use this as a reason for using opera, too.