3 ms·

Interesting question: Can HTML5 localStorage be used to circumvent cookie controls in lieu of using Flash cookies?

mbrubeck 16y ago
It would be pretty intrusive/noticeable, since the user has to opt in to allow the site to use it. So it's probably only a risk on sites that also make legitimate use of Web Storage. localStorage is subject to same-origin restrictions (so advertisers can't easily use it to track you across sites). And localStorage is handled like cookies when you use the private browsing mode in browsers like Firefox and Chrome, e.g.: "When the browser goes into private browsing mode, a new, temporary database is created to store local storage data; this database is empied, and is thrown away when private browsing mode is turned off." https://developer.mozilla.org/en/dom/storage#localStorage https://developer.mozilla.org/en/dom/storage#localStorage (This is true of Flash 10.1 also, but wasn't true for older versions.)
pornel 16y ago
It can be used as alternative to cookies (HTTP cache can be as well), but it's not as easy: • local storage is limited to page origin. • It's part of the browser, so browser's standard privacy functions can affect it as well.
adamdecaf 16y ago
Yep. Set data: window.localStorage.setItem(key, value); Get all data. // (Given that you have the "key" be numeric) /** * var setData = ['trackingID', 'trackingURL', 'trackingTS']; * for ( var i = 0; i < setData.length; i++) { * window.localStorage.setItem(i, setData[i]); * } */ var n = 0, items = [], count = window.localStorage.length; while (n < count) { items[n++] = window.localStorage.getItem(window.localStorage.key(n)); } /* return items; */ ----- Or, you can just set the items with trivial keys (id, timestamp, url) and get the values with window.localStorage.getItem([id, timestamp...]).

It would be pretty intrusive/noticeable, since the user has to opt in to allow the site to use it. So it's probably only a risk on sites that also make legitimate use of Web Storage. localStorage is subject to same-origin restrictions (so advertisers can't easily use it to track you across sites). And localStorage is handled like cookies when you use the private browsing mode in browsers like Firefox and Chrome, e.g.: "When the browser goes into private browsing mode, a new, temporary database is created to store local storage data; this database is empied, and is thrown away when private browsing mode is turned off." https://developer.mozilla.org/en/dom/storage#localStorage https://developer.mozilla.org/en/dom/storage#localStorage (This is true of Flash 10.1 also, but wasn't true for older versions.)

pornel 16y ago

It can be used as alternative to cookies (HTTP cache can be as well), but it's not as easy: • local storage is limited to page origin. • It's part of the browser, so browser's standard privacy functions can affect it as well.

adamdecaf 16y ago

Yep. Set data: window.localStorage.setItem(key, value); Get all data. // (Given that you have the "key" be numeric) /** * var setData = ['trackingID', 'trackingURL', 'trackingTS']; * for ( var i = 0; i < setData.length; i++) { * window.localStorage.setItem(i, setData[i]); * } */ var n = 0, items = [], count = window.localStorage.length; while (n < count) { items[n++] = window.localStorage.getItem(window.localStorage.key(n)); } /* return items; */ ----- Or, you can just set the items with trivial keys (id, timestamp, url) and get the values with window.localStorage.getItem([id, timestamp...]).