Clarify guidance around storage quota

[pwnall]

Storage quota should not be based on free disk space, to avoid cross-origin resource size leaks.

• At least two implementers are interested (and none opposed):
  • Chrome - we currently grant quota based on total disk space
  • …
• Tests are written and can be reviewed and commented upon at:
  • …
• Implementation bugs are filed:
  • Chrome: https://crbug.com/960305
  • Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1552848
  • Safari: …

(See WHATWG Working Mode: Changes for more details.)

[annevk]

In a way this duplicates the prior sentence, right?

It's also not clear this is sufficient to fully address #70. See https://bugzilla.mozilla.org/show_bug.cgi?id=1552848#c7.

[pwnall]

In a way this duplicates the prior sentence, right?

In my understanding, the first sentence is a positive recommendation (yes, use total disk space as an upper limit for quota) and the second sentence is a negative recommendation (no, do not use free disk space as a quota cap).

Please feel free to use different words if my proposal isn't clear / doesn't accomplish its goal.

It's also not clear this is sufficient to fully address #70. See https://bugzilla.mozilla.org/show_bug.cgi?id=1552848#c7.

Agreed. A full solution will probably have to be very prescriptive to demonstrably avoid both cross-origin resource size leaks and fingerprinting. I submitted this PR as a step forward.

According to my understanding, the spec currently recommends using free disk space as a quota cap. This is dangerous because it enables HEIST-like attacks. The text I proposed switches the recommendation to total disk space. This closes off the attacks mentioned above, at the cost of leaking some information about disk capacity. I think the latter is a lesser evil, so this is better guidance than what's currently in the spec. I don't think this PR would fully fix #70 and I didn't claim it would 😄

[annevk]

I put up #108 as an alternative. Let me know what you think.