Le 20/06/2014 10:44, Georg Koppen a écrit :
Aymeric Vitte:That's really strange, why don't you just disable it like cookies, indexedDB, etc?Cookies are not disabled in Tor Browser (only third party cookies). And, oh, there is this fun bug in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=536509 http://scarybeastsecurity.blogspot.com/2009/12/bypassing-intent-of-blocking-third.html Georg
So the logic is: we accept non third party cookies, therefore we accept localStorage and we suppose localStorage is disabled for third parties.
The problem is that if you block all cookies (like a Tor user should be doing visiting sites like yt), the localStorage remains available and bypasses cookies blocking, if you take yt, you can see things floating in localStorage like yt-remote-device-id {id, creation_date, expire=creation_date+1 year}, even if ephemeral (from your design) it persists until you close your browser
And what's the point of allowing localStorage if you allow non third party cookies?
There are bugs and unclear behavior of what happens in the main page or in iframes, that's usual, everybody knows thhis, unclear behavior between different options settings, and unclear behavior of blocking options when they exist.
Your examples are the perfect illustration of this, I think at least the users should be clearly aware of the risks and have the option to block everything.
As I mentioned previously any type of local storage is much more dangerous than the usual cookie-like uses, even if we should disregard the cases where you are hacking yourself, we can not ignore the fact that your local storage can be easily accessed by someone else if you give him a chance
I am waiting to read your design document but from my standpoint in the frame of the Tor Browser it should be clearly blocked.
-- Peersm : http://www.peersm.com node-Tor : https://www.github.com/Ayms/node-Tor GitHub : https://www.github.com/Ayms -- tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk