On: How a web app can download and store over 2GB with...

[njs12345]

I wonder if you could still perform a DOS by doing the following:

  - register 1000 domains
  - when the browser navigates to the first domain, store 5Mb
  - once the store has finished, redirect to the next domain
  - repeat steps 2-3 ad infinitum

Anybody know if this would work?

[fl3x → njs12345]

That could probably work!

The documentation at http://dev.w3.org/html5/spec/offline.html#disk-space states that "care should be taken to ensure that the restrictions cannot be easily worked around using subdomains", so one would really have to use different domains as you write, which sounds a bit costly.

[AlexV → njs12345]

Sub-domains should work also then. Just make a page with bunch of IFrames, each on a different, random sub-domain.

Edit: Ooops; didn't see the comment above about sub-domains. Worth a try though!

[evan_ → AlexV]

A malicious actor might write a wordpress worm to assemble a domain botnet and cross-link them all to each other such that visiting one stores 5 megs of nonsense from every site on a visitor's client.

[andrewaylett → njs12345]

At least on Gingerbread, the browser has quite a low global limit -- I sometimes hit it just from using Twitter and Google Search.

[evanm → njs12345]

I mean, theoretically. But would a user actually willingly wait out this process?

[Joeri → evanm]

They would if you do it in an iframe while letting them play a flash game. They might even attribute slowdowns to the flash game.

[joshfraser → evanm]

it doesn't need to be downloaded. it can be populated with generated data using JavaScript.