Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML5 localStorage allows sites to fill up users' hard disks

feross.org

Post reply on HN
Print view View original

81–90 of 191 posts

Re: HTML5 localStorage allows sites to fill up users' hard disks

#81

Post by JoachimSchipper »

afhof wrote: post #80
yaix wrote: post #76

Just ask the user if its okay, like with geo data, translate web site, etc. "Allow example.com to track your location?" [Yes] [No] "Allow a1.example.com to store x MB of data locally?" [Yes] [No] Also > The HTML5 Web Storage standard was developed to allow sites to store larger amounts of data (like 5-10 MB) than was previously allowed by cookies (like 4KB). Main difference is that cookies are uploaded to the server…

That is a good way to never ever ever use a feature again. "Frightening Message: This website wants to do something scary. Do you want to allow some bad thing to happen to your computer?" That is how lay people, i.e. the people needed to mass adoption, read browser requests for Geo, storage, and other permissions. It would be better to have sane and safe defaults in the browser, rather than pester the user. Would coo…

Would cookies be used for tracking you everywhere if the browser asked for permission on every use? Would this be a good or bad thing?

(It's not like keeping state in the URL is hard - using cookies just looks marginally better.)

Re: HTML5 localStorage allows sites to fill up users' hard disks

#82

Post by JoachimSchipper »

jacobr wrote: post #62
eksith wrote: post #44

Well this is frightening. You don't even need to create subdomains since basically anyone with wildcard subdomains enabled can do this without a sweat. All you need is a random number generator and rewrite x.domain.com to domain.com and the browser is none the wiser. Though I can't quite imagine why anyone would want to do this to some random stranger. Unless you knew the visitor or had some means of personally ident…

Pretty bad for a company if someone injects a HD-filling script to their site.

Meh, just Goatse'ing them works pretty well too, no need to get fancy about it.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#83

Post by dangrossman »

callahad wrote: post #73
zanny wrote: post #65

Earlier quoted context omitted.

There really isn't an easy way to avoid this problem even if you follow the standard fixed quota per domain and subdomains don't count policy. You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. In the end, the problem is that one page can itself infer to other domain / subdomains in its document and those can execute and utilize localstorage. They have to, though, so you ca…

> You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. Thankfully, in this case, domain registrations are expensive. Filling a 16 GB iPad with this technique would cost around $10,000 in registrar fees. A 128 GB SSD could be filled for under $100,000. ...So I wanted to come in here and say "cost prohibitive!" but... maybe not, given that most devices will be at least partiall…

It's easy to get a huge block of IPv6 addresses. Each IP is a separate domain as far as browser policies go, generally.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#84

Post by reitzensteinm »

pilif wrote: post #50

So. The question I'm asking myself now is how to fix this. Giving .domain.com a shared quota will allow one tumblr or github pages user to monopolize all storage, effectively removing local storage for this kind of scenario (also removing it for the host which is even more annoying). A maybe workable solution would be to only allow creation of new keys for the first-party origin. What I mean is that whatever.example.…

What about this: writes to a.mydomain.com from a page with www.mydomain.com in the address bar count towards the quota for both a.mydomain.com and www.mydomain.com.

You'd have to store the other domains your page has written to in its own local storage area, but it doesn't seem to me like the book keeping would be that complicated.

You could use a coarse rule of all data in a.mydomain.com counts, and use a larger quota of n * per-domain-limit.

You could visit as many legit-site.tumblr.com addresses as you want with this rule.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#86

Post by ricardobeat »

eksith wrote: post #44

Well this is frightening. You don't even need to create subdomains since basically anyone with wildcard subdomains enabled can do this without a sweat. All you need is a random number generator and rewrite x.domain.com to domain.com and the browser is none the wiser. Though I can't quite imagine why anyone would want to do this to some random stranger. Unless you knew the visitor or had some means of personally ident…

> anyone with wildcard subdomains enabled

i.e. nobody. why the hell is webkit not following the standard here? they even implemented a permission dialog so you can allow an app going over quota.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#87

Post by callahad »

dangrossman wrote: post #83
callahad wrote: post #73

Earlier quoted context omitted.

> You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. Thankfully, in this case, domain registrations are expensive. Filling a 16 GB iPad with this technique would cost around $10,000 in registrar fees. A 128 GB SSD could be filled for under $100,000. ...So I wanted to come in here and say "cost prohibitive!" but... maybe not, given that most devices will be at least partiall…

It's easy to get a huge block of IPv6 addresses. Each IP is a separate domain as far as browser policies go, generally.

I would gladly accept this vulnerability in order to live in your IPv6-enabled future. Great point. :)

Re: HTML5 localStorage allows sites to fill up users' hard disks

#88

Post by yaix »

afhof wrote: post #80
yaix wrote: post #76

Just ask the user if its okay, like with geo data, translate web site, etc. "Allow example.com to track your location?" [Yes] [No] "Allow a1.example.com to store x MB of data locally?" [Yes] [No] Also > The HTML5 Web Storage standard was developed to allow sites to store larger amounts of data (like 5-10 MB) than was previously allowed by cookies (like 4KB). Main difference is that cookies are uploaded to the server…

That is a good way to never ever ever use a feature again. "Frightening Message: This website wants to do something scary. Do you want to allow some bad thing to happen to your computer?" That is how lay people, i.e. the people needed to mass adoption, read browser requests for Geo, storage, and other permissions. It would be better to have sane and safe defaults in the browser, rather than pester the user. Would coo…

Browsers like Chrome do it with geolocation for example. If it is required for the user to get a certain service they want, what's the "scary" part? You can say no and use the parts of the site that work with it, or yes and get the extra functionality. Like with geolocation.

Re: HTML5 localStorage allows sites to fill up users' hard disks

#89

Post by okamiueru »

afhof wrote: post #80
yaix wrote: post #76

Just ask the user if its okay, like with geo data, translate web site, etc. "Allow example.com to track your location?" [Yes] [No] "Allow a1.example.com to store x MB of data locally?" [Yes] [No] Also > The HTML5 Web Storage standard was developed to allow sites to store larger amounts of data (like 5-10 MB) than was previously allowed by cookies (like 4KB). Main difference is that cookies are uploaded to the server…

That is a good way to never ever ever use a feature again. "Frightening Message: This website wants to do something scary. Do you want to allow some bad thing to happen to your computer?" That is how lay people, i.e. the people needed to mass adoption, read browser requests for Geo, storage, and other permissions. It would be better to have sane and safe defaults in the browser, rather than pester the user. Would coo…

It could be done as in Opera, where there is a initial limit, and a request to exceed it when maxed.

http://i.imgur.com/SOoadOB.png

Post reply on HN