Re: [w3c/IndexedDB] SSD wear: does it sound like a real risk? (Issue #511)

evanstade left a comment (w3c/IndexedDB#511)

Chromium does not have any mitigations against this and to my knowledge it has never been identified as an active attack vector. DOS in general is seen as a kind of abuse, but not [security-relevant](https://chromium.googlesource.com/chromium/src/+/lkgr/docs/security/faq.md#are-denial-of-service-issues-considered-security-bugs), and as such receives less attention. I think if we had field reports of malicious sites actually doing something like the user's described concern, we'd need to carefully consider how to mitigate it. The only thing that's even close to this is that [persistent storage](https://web.dev/articles/persistent-storage) requires a permission, which is granted by user dialog in FF and by heuristics in Chromium.

> browsers already buffer IndexedDB in memory.

Chromium does not do this beyond whatever the OS page cache does.

Chromium does (heavily) buffer Local Storage in memory, but that also leads to a lot of data loss on crashes, and it's more practical because Local Storage has a much lower size cap.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/IndexedDB/issues/511#issuecomment-6504161069
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/IndexedDB/issues/511/6504161069@github.com>