1

Chrome has a file system API that seems to persist through normal clearing of the cache, etc.

(In fact, I'm not sure if there's any built-in way to clear this data globally.)

Isn't this a security issue? Why is this allowed, and why does no one seem to be worried about it?

I seem to recall that storage mechanisms that aren't easy to clear have always caused lots of security concerns, and I'm baffled at why this one seems to have flown under the radar.

Is there something about it that makes it less of an issue than usual?

  • 1
    I've answered about the implications below, but I'd consider supercookies to be a privacy/usability issue that is not a security issue. No privilege boundary is crossed by them, and I'd only consider it a security problem if they were not working in accordance with the spec. – David Jan 15 '18 at 2:58
  • @David: Ah, thanks; you should add that to your answer -- it's a great point! – Mehrdad Jan 15 '18 at 3:00
  • Tools like CCleaner can be helpful. – ThankYouSRT Jan 15 '18 at 10:29
  • The "file system API" you linked here only seems to work when the user drag-and-drops a real folder from their PC onto the page. I don't see how you could possibly expect that to be used as a supercookie, since the webpage needs active user intervention in order to access it. – Ajedi32 Jan 15 '18 at 14:20
  • @Ajedi32: I'm not sure where you got that idea but it most definitely works on my computer without me dragging or dropping anything. – Mehrdad Jan 15 '18 at 19:30
2

In order to use persistent storage, the application must request quota, which results in a prompt to the user. It could obviously be used as a supercookie at that point, but given that the user has been prompted, it seems to be a less concerning avenue than other areas. (Also, being Chrome specific would likely make it less targeted than other supercookie techniques.)

Temporary storage is not prompted, but the browser can clear it at any time. I'm not sure when this occurs, but I believe it should occur if you clear all local data.

I'm not aware of any specific security concerns related to this API, since it provides a sandboxed filesystem to each origin. (It cannot read/write arbitrary data from other applications or locations on the user's computer.)

I consider this a privacy issue more so than a security issue -- in my mind, if the API is working as intended and does not leak/reveal data that was not in the original design, then it's a privacy decision that was made by the spec designers. (Obviously, many users are unhappy by many privacy decisions that have been made -- I'm not saying it's desirable.) It becomes a security concern when a privilege boundary is crossed or you can use it to reveal information that the designers did not intend. (Such as the implications of canvas fingerprinting.)

  • That's only for PERSISTENT though. The TEMPORARY one (despite the name) seems to stick around and doesn't get cleared with everything else either. – Mehrdad Jan 15 '18 at 2:59
  • @Mehrdad - I believe under "Clear Browsing Data" -> "Advanced" -> "Hosted app data" will do it. Alternatively its possible via the developer tools. – Hector Jan 15 '18 at 13:00
  • @Hector: Nope, I just tried it, it doesn't do it. – Mehrdad Jan 15 '18 at 19:28
  • is the data stored in OS's temp folder? The OS should clear at some point, maybe reboot or disk cleanup... – dandavis Jan 16 '18 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.