31–34 of 34 posts
The fact that there's a limit is not surprising. That the limit is 2GB is a little surprising, but this is across all sites, so ok. That there's no cache ejection when you reach the limit just seems like a bug. Why not use LRU?
Isn't 2 GB the memory limit on V8 ( http://code.google.com/p/v8/issues/detail?id=847 )?
>As a user, I had no idea that the website I'm browsing is downloading a suspicious amount of data in the background. not when you're browsing localhost, because it's implicitly trusted. chrome doesn't prompt you to allow access to the location services API when you're local either, but it does prompt for permission on the web. does the browser still not warn you if you try this same test using a remote server?
It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side DDoS :)
iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.
Earlier quoted context omitted.
iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.
I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?