6 ms·
There really isn't an easy way to avoid this problem even if you follow the standard fixed quota per domain and subdomains don't count policy. You could just em
by zanny 14y ago
There really isn't an easy way to avoid this problem even if you follow the standard fixed quota per domain and subdomains don't count policy. You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way.
In the end, the problem is that one page can itself infer to other domain / subdomains in its document and those can execute and utilize localstorage. They have to, though, so you can embed an html5 game in your blog from some other site that you liked. It comes with the territory.
Sadly, it seems like the best answer is the horrible UX'd prompt - "do you want to allow x.y.z to store local content on your computer?" the same way you have to verify downloads and know exactly what you are running locally.
- natrius 14y agoPrompt for origins that have never been visited directly by the user.
- pests 14y agoIsn't this how some browser recently started treating cookies? I believe so and makes sense to me as well.
- callahad 14y ago> You could just embed iframes to diskeater1.net, diskeater2, etc and fill up the disk that way. Thankfully, in this case, domain registrations are expensive. Filling a 16 GB iPad with this technique would cost around $10,000 in registrar fees. A 128 GB SSD could be filled for under $100,000. ...So I wanted to come in here and say "cost prohibitive!" but... maybe not, given that most devices will be at least partially filled already.
- yaix 14y agoJust get .tk[1] domains. [1] http://www.nic.tk http://www.nic.tk
- dangrossman 14y agoIt's easy to get a huge block of IPv6 addresses. Each IP is a separate domain as far as browser policies go, generally.
- callahad 14y agoI would gladly accept this vulnerability in order to live in your IPv6-enabled future. Great point. :)
- crdoconnor 14y agoYou could prompt for domains that use more than a small amount - say, 25-100k. Once they hit that point, show a prompt below the toolbar that shows how much data is being used by the whole domain, in real time and allow it to keep on filling up with data until the user says stop or always allow.
- twinge 14y agoYou could continue to allow 5mb for each subdomain, but wait until say, 25mb for the sum(*.domain.tld) before prompting. For example, this would allow {www,mail,docs,plus,???}.google.com to continue as they are now until google.com managed to rack up 25mb worth of data. After which point the user might want to know they're holding on to a fair bit of data for one particular site. Then again, prompting is really annoying, and most people just click "okay" and without comprehending.