Wednesday, January 16, 2008 by
Pascal Meunier in
General,
Given all the noise that was made about cookies and programs that look for "spy cookies", the silence about DOM storage is a little surprising. DOM storage allows web sites to store all kinds of information in a persistent manner on your computer, much like cookies but with a greater capacity and efficiency. Another way that web sites store information about you is Adobe's Flash local storage; this seems to be a highly popular option (e.g., youtube stores statistics about you that way), and it's better known. Web applications such as pandora.com will even deny you access if you turn it off at the
Flash management page. If you're curious, see the contents in "~/.macromedia/Flash_Player/#SharedObjects/", but most of it is not human readable.
I wonder why DOM storage isn't used much after being available for a whole year; I haven't been able to find any web site or web application making use of it so far, besides a proof of concept for taking notes. Yet, it probably will be (ab)used, given enough time. There is no user interface in Firefox for viewing this information, deleting it, or managing it in a meaningful way. All you can do is turn it on or off by going to the "about:config" URL, typing "storage" in the filter and set it to true or false. Compare this to what you can do about cookies... I'm not suggesting that anyone worry about it, but I think that we should have more control over what is stored and how, and the curious or paranoid should be able to view and audit the contents without needing the tricks below. Flash local storage should also be auditable, but I haven't found a way to do it easily.
Auditing DOM storage. To find out what information web sites store on your computer using DOM storage (if any), you need to find where your Firefox profile is stored. In Linux, this would be "~/.mozilla/firefox/". You should find a file named "webappsstore.sqlite". To view the contents in human readable form, install sqlite3; in Ubuntu you can use Synaptic to search for sqlite3 and get it installed. Then, the command:
echo 'select * from webappsstore;' | sqlite3 webappsstore.sqlite
will print contents such as (warning, there could potentially be a lot of data stored):
cerias.purdue.edu|test|asdfasdf|0|homes.cerias.purdue.edu
Other SQL commands can be used to delete specific entries or change them, or even add new ones. If you are a programmer, you should know better than to trust these values! They are not any more secure than cookies.
Leave a comment (10 so far) »
