8 ms·

How a web app can download and store over 2GB without you even knowing it

112 points by Nemmie 15y ago

fl3x 15y ago
This is not an issue in either Opera or Firefox. The title should probably reflect that it's limited to Chrome (and possibly other Webkit browsers + IE?).
- halefx 15y ago
  Why is not an issue in Opera and Firefox? Do they have smaller maximum caches? Or do they notify you of the background transfers?
  - throwaway64 15y ago
    the default local storage limit for Firefox is 5 megs per domain.
    - fl3x 15y ago
      Sorry for nitpicking, but I think local storage is a part of Web Storage (http://dev.w3.org/html5/webstorage/ http://dev.w3.org/html5/webstorage/), and not Application Cache (http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html http://www.whatwg.org/specs/web-apps/current-work/multipage/... or http://dev.w3.org/html5/spec/offline.html http://dev.w3.org/html5/spec/offline.html). I think that the Application Cache quota is not strictly connected to the local storage and session storage limits.
      - ef4 15y ago
        That's correct. Chromium has talked about unifying all these kinds of storage under one quota system, but it's not done yet.
  - fl3x 15y ago
    I don't think either notifies you about the background transfers, but e.g. Operas default cache limit for Application Cache is ~50 MB according to http://www.opera.com/support/usingopera/operaini/ http://www.opera.com/support/usingopera/operaini/.
AlexV 15y ago
It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side DDoS :)
- marshray 15y ago
  Or rack up an insane unexpected data bill.
- objclxt 15y ago
  iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.
  - njs12345 15y ago
    I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?
    - fl3x 15y ago
      That could probably work! The documentation at http://dev.w3.org/html5/spec/offline.html#disk-space http://dev.w3.org/html5/spec/offline.html#disk-space states that "care should be taken to ensure that the restrictions cannot be easily worked around using subdomains", so one would really have to use different domains as you write, which sounds a bit costly.
    - AlexV 15y ago
      Sub-domains should work also then. Just make a page with bunch of IFrames, each on a different, random sub-domain. Edit: Ooops; didn't see the comment above about sub-domains. Worth a try though!
sigil 15y ago
The fact that there's a limit is not surprising. That the limit is 2GB is a little surprising, but this is across all sites, so ok. That there's no cache ejection when you reach the limit just seems like a bug. Why not use LRU?
- lallysingh 15y ago
  The 2GB isn't just the local web-cache-size limit?
- espeed 15y ago
  Isn't 2 GB the memory limit on V8 (http://code.google.com/p/v8/issues/detail?id=847 http://code.google.com/p/v8/issues/detail?id=847)?
  - The_Sponge 15y ago
    That's for the javascript engine, not necessarily for the caching.
- moonboots 15y ago
  I would not want one rogue site evicting the caches of all other sites.
  - sigil 15y ago
    It's just a cache. It can be repopulated. But I see your point, a lower per-domain quota would make more sense.
notatoad 15y ago
>As a user, I had no idea that the website I'm browsing is downloading a suspicious amount of data in the background. not when you're browsing localhost, because it's implicitly trusted. chrome doesn't prompt you to allow access to the location services API when you're local either, but it does prompt for permission on the web. does the browser still not warn you if you try this same test using a remote server?
- Nemmie 15y ago
  Hmm, that would be odd. Geolocation asks for permission even if it's localhost. Also when I download Angry Birds, no permission is asked.

112 points by Nemmie 15y ago

fl3x 15y ago

This is not an issue in either Opera or Firefox. The title should probably reflect that it's limited to Chrome (and possibly other Webkit browsers + IE?).

halefx 15y ago
Why is not an issue in Opera and Firefox? Do they have smaller maximum caches? Or do they notify you of the background transfers?
- throwaway64 15y ago
  the default local storage limit for Firefox is 5 megs per domain.
  - fl3x 15y ago
    Sorry for nitpicking, but I think local storage is a part of Web Storage (http://dev.w3.org/html5/webstorage/ http://dev.w3.org/html5/webstorage/), and not Application Cache (http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html http://www.whatwg.org/specs/web-apps/current-work/multipage/... or http://dev.w3.org/html5/spec/offline.html http://dev.w3.org/html5/spec/offline.html). I think that the Application Cache quota is not strictly connected to the local storage and session storage limits.
    - ef4 15y ago
      That's correct. Chromium has talked about unifying all these kinds of storage under one quota system, but it's not done yet.
- fl3x 15y ago
  I don't think either notifies you about the background transfers, but e.g. Operas default cache limit for Application Cache is ~50 MB according to http://www.opera.com/support/usingopera/operaini/ http://www.opera.com/support/usingopera/operaini/.

AlexV 15y ago

It would be fun to execute this against a mobile device, where storage is expensive. 2GB might be all that is required to choke the device. A neat client-side DDoS :)

marshray 15y ago
Or rack up an insane unexpected data bill.
objclxt 15y ago
iOS (and Android I think, but I primarily dev iOS so that's where my knowledge is) won't let a website exceed a 5MB local storage limit without explicit user consent...so I suppose still technically possible, but not without getting the user to agree to it first.
- njs12345 15y ago
  I wonder if you could still perform a DOS by doing the following: - register 1000 domains - when the browser navigates to the first domain, store 5Mb - once the store has finished, redirect to the next domain - repeat steps 2-3 ad infinitum Anybody know if this would work?
  - fl3x 15y ago
    That could probably work! The documentation at http://dev.w3.org/html5/spec/offline.html#disk-space http://dev.w3.org/html5/spec/offline.html#disk-space states that "care should be taken to ensure that the restrictions cannot be easily worked around using subdomains", so one would really have to use different domains as you write, which sounds a bit costly.
  - AlexV 15y ago
    Sub-domains should work also then. Just make a page with bunch of IFrames, each on a different, random sub-domain. Edit: Ooops; didn't see the comment above about sub-domains. Worth a try though!

sigil 15y ago

The fact that there's a limit is not surprising. That the limit is 2GB is a little surprising, but this is across all sites, so ok. That there's no cache ejection when you reach the limit just seems like a bug. Why not use LRU?

lallysingh 15y ago
The 2GB isn't just the local web-cache-size limit?
espeed 15y ago
Isn't 2 GB the memory limit on V8 (http://code.google.com/p/v8/issues/detail?id=847 http://code.google.com/p/v8/issues/detail?id=847)?
- The_Sponge 15y ago
  That's for the javascript engine, not necessarily for the caching.
moonboots 15y ago
I would not want one rogue site evicting the caches of all other sites.
- sigil 15y ago
  It's just a cache. It can be repopulated. But I see your point, a lower per-domain quota would make more sense.

notatoad 15y ago

>As a user, I had no idea that the website I'm browsing is downloading a suspicious amount of data in the background. not when you're browsing localhost, because it's implicitly trusted. chrome doesn't prompt you to allow access to the location services API when you're local either, but it does prompt for permission on the web. does the browser still not warn you if you try this same test using a remote server?

Nemmie 15y ago
Hmm, that would be odd. Geolocation asks for permission even if it's localhost. Also when I download Angry Birds, no permission is asked.