[deleted]
HTML5 localStorage allows sites to fill up users' hard disks
151–160 of 191 posts
Re: HTML5 localStorage allows sites to fill up users' hard disks
#152Firefox 16 in Linux Mint isn't affected
Re: HTML5 localStorage allows sites to fill up users' hard disks
#153So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
Just check if more than 3 subdomains are trying to allocate storage, and if they do request more than 4K size, request explicit permission to continue.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#154Earlier quoted context omitted.
http://feross.org/fill-disk/ He explains here that most browsers (except Firefox) don't follow the standard close enough, and ignore the exception for subdomains, i.e. 1.filldisk.com, 2.filldisk.com, etc.
Wait, haven't I heard this song before? It's the one about cookies, and .co.uk (i.e. every commercial site in the UK) sites all sharing the same cookies, because they all look like subdomains. Or was it all .friendly-hosting-company.com sites? The fundamental problem is, there's no easy way to distinguish domains and subdomains.
It doesn't happen for .co.uk, it does happen for .nhs.uk (by design).
http://publicsuffix.org/ has the list that you use to distinguish
Re: HTML5 localStorage allows sites to fill up users' hard disks
#155So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…
What does Firefox currently do?
I believe it has a default of 350MB but is user configurable.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#156The solution is simple but ugly: A root domain www.example.com can utilize upto 10MB of storage while sub-domains count towards that storage limit. Any domain trying to access more will automatically result in a user prompt. An exemption can be made for domains/subdomains that present a valid SSL certificate, the whole idea is to prevent abuse.
How would that work if the malicious page used IP addresses instead of hostnames? Then it's only a matter of how many IP addresses the author can use.
Being that IPv4 addresses are something that's having a bit of a shortage these days, it's not at the top of the list of things to worry about.
That said, if you're one of the few that has IPv6 access, this could turn in to an issue pretty quick.
Re: HTML5 localStorage allows sites to fill up users' hard disks
#157IE10 public bug site, btw:
http://connect.microsoft.com/IE/SelfNomination.aspx?ProgramI...
Re: HTML5 localStorage allows sites to fill up users' hard disks
#158Earlier quoted context omitted.
Just get .tk[1] domains. [1] http://www.nic.tk
Is there a catch?
minimum usage policy
http://en.wikipedia.org/wiki/.tk
Re: HTML5 localStorage allows sites to fill up users' hard disks
#159This is why Firefox has a quota on localStorage, per eTLD+1. Of course people keep complaining about this quota...
Re: HTML5 localStorage allows sites to fill up users' hard disks
#160Earlier quoted context omitted.
Actually, you'd only need to buy one TLD! Or, you could buy one regular domain and then ask to be put on the public suffix list. I'm guessing that would have the same effect for less money.
Wow, being put on the public suffix list is an interesting idea. How would one go about doing that?
Interesting question. I wonder if you could get into this list (without nefarious purpose) if you provided some major hosting service? Eg: I see k12-schools in the US are on that list, it would make sense to allow someone providing shared hosting to get on the list (to avoid users setting cross-domain cookies). Eg: appspot.com and blogspot.* is on the list[1].
More information:
http://publicsuffix.org/submit/ (and the rest of the site, obviously)