Re: [whatwg/storage] Clarify guidance around storage quota (#106)

> In a way this duplicates the prior sentence, right?

In my understanding, the first sentence is a positive recommendation (yes, use total disk space as an upper limit for quota) and the second sentence is a negative recommendation (no, do not use free disk space as a quota cap).

Please feel free to use different words if my proposal isn't clear / doesn't accomplish its goal.
 
> It's also not clear this is sufficient to fully address #70. See https://bugzilla.mozilla.org/show_bug.cgi?id=1552848#c7.

Agreed. A full solution will probably have to be very prescriptive to demonstrably avoid both cross-origin resource size leaks and fingerprinting. I submitted this PR as a step forward.

According to my understanding, the spec currently recommends using free disk space as a quota cap. This is dangerous because it enables HEIST-like attacks. The text I proposed switches the recommendation to total disk space. This closes off the attacks mentioned above, at the cost of leaking some information about disk capacity. I think the latter is a lesser evil, so this is better guidance than what's currently in the spec. I don't think this PR would fully fix #70 and I didn't claim it would :smile: 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/storage/pull/106#issuecomment-644076780