Differences

This shows you the differences between two versions of the page.

--- privacy:browser_storage [2026/08/31 19:48] – New page: browser storage beyond cookies — localStorage, sessionStorage, IndexedDB, Cache Storage, service workers and the caches as measurement targets. Corpus-backed (1,120 crawl papers; 120 hand-audited candidates; 43 Tier A), three tested probes (read karel.kubicek.claude
+++ privacy:browser_storage [2026/09/17 07:22] (current) – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude
@@ Line 299: / Line 299: @@
 </code>
-**Two automation libraries driving the identical browser build disagree about whether third-party storage is shared across sites, and neither documents it where you would look.** Playwright launches Chromium with ''ThirdPartyStoragePartitioning'' in its ''--disable-features'' list, because its ''storageState'' serialiser cannot express partitioned storage; Puppeteer does not. The window matters and is narrower than it looks: Chrome partitioned for all users in **July 2023**, and Playwright started opting out in **1.48.0, released 8 October 2024**((''ThirdPartyStoragePartitioning'' first appears in ''chromiumSwitches'' in the ''playwright-core'' 1.48.0 npm tarball and is absent from 1.47.0; the commit is ''fix(chromium): disable ThirdPartyStoragePartitioning'' (PR 32701), 2024-09-19. Checked 2026-08-31.)) — so a crawl on Playwright 1.47 or earlier partitioned like real Chrome, and one on 1.48 or later does not. A measurement of third-party ''localStorage'' made with default Playwright since October 2024 is measuring a browser that stopped existing for real users in mid-2023, and will over-count cross-site persistence. [[Programming:Stateful stateless#Since 2022 the engine decides, not you]] has the maintainers' own account of why the flag is there and the warning that it is expected to stop being available.
+**Two automation libraries driving the identical browser build disagree about whether third-party storage is shared across sites, and neither documents it where you would look.** Playwright launches Chromium with ''ThirdPartyStoragePartitioning'' in its ''%%--disable-features%%'' list, because its ''storageState'' serialiser cannot express partitioned storage; Puppeteer does not. The window matters and is narrower than it looks: Chrome partitioned for all users in **July 2023**, and Playwright started opting out in **1.48.0, released 8 October 2024**((''ThirdPartyStoragePartitioning'' first appears in ''chromiumSwitches'' in the ''playwright-core'' 1.48.0 npm tarball and is absent from 1.47.0; the commit is ''fix(chromium): disable ThirdPartyStoragePartitioning'' (PR 32701), 2024-09-19. Checked 2026-08-31.)) — so a crawl on Playwright 1.47 or earlier partitioned like real Chrome, and one on 1.48 or later does not. A measurement of third-party ''localStorage'' made with default Playwright since October 2024 is measuring a browser that stopped existing for real users in mid-2023, and will over-count cross-site persistence. [[Programming:Stateful stateless#Since 2022 the engine decides, not you]] has the maintainers' own account of why the flag is there and the warning that it is expected to stop being available.
-The fix is not one line, because Playwright passes its whole disabled list as a single argument and ''--disable-features'' beats ''--enable-features'': adding ''--enable-features=ThirdPartyStoragePartitioning'' on its own changes nothing, measured. What works is to rebuild the disabled list without that one feature. The script below does that with ''ignoreDefaultArgs'' plus a replacement argument; a later mutation test found the replacement argument alone is sufficient, because Chromium takes the last ''--disable-features'' it is given — so treat the ''ignoreDefaultArgs'' line as belt-and-braces rather than as the load-bearing part.
+The fix is not one line, because Playwright passes its whole disabled list as a single argument and ''%%--disable-features%%'' beats ''%%--enable-features%%'': adding ''%%--enable-features%%=ThirdPartyStoragePartitioning'' on its own changes nothing, measured. What works is to rebuild the disabled list without that one feature. The script below does that with ''ignoreDefaultArgs'' plus a replacement argument; a later mutation test found the replacement argument alone is sufficient, because Chromium takes the last ''%%--disable-features%%'' it is given — so treat the ''ignoreDefaultArgs'' line as belt-and-braces rather than as the load-bearing part.
 <file javascript partition_probe.mjs>
@@ Line 507: / Line 507: @@
 | {[aggarwal2010_analysis]} USENIX Sec 2010 | top 100 Chrome extensions | **71** "stored data to disk using the localStorage API" — the first measurement of storage as a private-browsing leak rather than as a tracking vector |
 | {[zhou2015_monitoring]} IEEE S&P 2015 | Alexa sites, instrumented Firefox | recorded third-party script accesses to ''localStorage'' and ''indexedDB'' as a distinct permission, and observed scripts reaching for storage "presumably adding an extra tracking approach should the user reject or delete their cookie" |
-| {[lerner2016internet]} USENIX Sec 2016 | archived pages, 1996–2016 | ''localStorage'' use "rises rapidly since its introduction in 2009, indicating that tracking defenses should increasingly consider on storage mechanisms beyond cookies" |
+| {[lerner2016_internet]} USENIX Sec 2016 | archived pages, 1996–2016 | ''localStorage'' use "rises rapidly since its introduction in 2009, indicating that tracking defenses should increasingly consider on storage mechanisms beyond cookies" |
 | {[steffens2019_dont]} NDSS 2019 | Alexa top 5,000 | more than **8%** show an exploitable flow from client-side storage into a dangerous sink, rising to **21%** among the sites that use persisted data in a sink at all. "Virtually all flows that originate from a Local Storage source have no encoding applied to them" |
 | {[watanabe2020_melting]} NDSS 2020 | Alexa top 10K, reachable sites | around **40%** carried a unique fingerprintable record in their cookie and ''localStorage'' |
@@ Line 514: / Line 514: @@
 | {[solomos2021_tales]} NDSS 2021 | Alexa top 10K eTLD+1 | **94%** have a valid favicon resource. The favicon cache "is not affected by user actions that clear other caches, local storages and browsing data" and is not isolated from incognito |
 | {[mishra2021_dejavu]} PETS 2021 | Tranco top 100,000 | **91,755** cacheable resources on **12,970** websites are usable to identify a returning visitor; **25%** of them had expiry beyond 100 days |
-| {[fouad2022my]} PETS 2022 | Alexa top 30,000 | **1,150 (3.83%)** use cookie respawning with browser fingerprinting. Related work had already shown ''ETag'', ''localStorage'' and IndexedDB used as respawn stores |
+| {[fouad2022_cookie]} PETS 2022 | Alexa top 30,000 | **1,150 (3.83%)** use cookie respawning with browser fingerprinting. Related work had already shown ''ETag'', ''localStorage'' and IndexedDB used as respawn stores |
 | {[ali2023_navigating]} NDSS 2023 | 126 versions of 7 browsers | **21** mechanisms usable as a tracking vector, 13 of them cross-site; every latest version tested was vulnerable to at least one |
 | {[patat2023_drm]} PETS 2023 | tested browser configurations | mobile Opera and Samsung Internet **retained EME persistent sessions after cookie and site-data deletion** — a store outside the storage APIs entirely |