21–30 of 34 posts
It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side DDoS :)
Heh, you could easily DoS a Canadian home internet user (not mobile) by transferring a massive amount of data behind their back. So many people here are stuck with 25GB/mo limits.
Earlier quoted context omitted.
I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?
Sub-domains should work also then. Just make a page with bunch of IFrames, each on a different, random sub-domain. Edit: Ooops; didn't see the comment above about sub-domains. Worth a try though!
The fact that there's a limit is not surprising. That the limit is 2GB is a little surprising, but this is across all sites, so ok. That there's no cache ejection when you reach the limit just seems like a bug. Why not use LRU?
It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side DDoS :)
iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.
Earlier quoted context omitted.
I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?
I mean, theoretically. But would a user actually willingly wait out this process?
The fact that there's a limit is not surprising. That the limit is 2GB is a little surprising, but this is across all sites, so ok. That there's no cache ejection when you reach the limit just seems like a bug. Why not use LRU?
I would not want one rogue site evicting the caches of all other sites.
Earlier quoted context omitted.
Heh, you could easily DoS a Canadian home internet user (not mobile) by transferring a massive amount of data behind their back. So many people here are stuck with 25GB/mo limits.
That's absurd. I can't even imagine having to live with that kind of cap—I easily download 25GB in a day.
not when you're browsing localhost, because it's implicitly trusted. chrome doesn't prompt you to allow access to the location services API when you're local either, but it does prompt for permission on the web. does the browser still not warn you if you try this same test using a remote server?
Earlier quoted context omitted.
iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.
localStorage and application cache are not the same thing. localStorage is the one that prompts the user for more than 5MB, but the author was using application, which I've never seen prompt.
Earlier quoted context omitted.
I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?
I mean, theoretically. But would a user actually willingly wait out this process?