What are you storing on my hard disk?

Question

Since cryptography is all about transparency, I'd like to know what is stored in my 3 KB? Why isn't it a plain cookie? Is it so that it persists between automatic cookie clear outs?

It appears to be a SQLite 3.x database...

As suggested I asked, and here's the reply...

"I wouldn't be able to tell you exactly what is stored there as that's not possible for me to know - it could be any number of various things, but likely it's something used by one of our JavaScript functions to temporarily store data you've entered. For example, when you switch to a different sorting method when viewing search results or a question, or even when you've typed something into the answer box and it saves a draft. Unfortunately I do not have an exhaustive list of every part of the site that uses local storage."

Answer 1

I don't know what's being stored in your browser's LocalStorage, but you can always examine it yourself via Chrome's developer tools. (A similar feature exists on Firefox too, although you need to enable the Storage tab in developer tools first.)

For me, all I see there is an entry named se:fkey that contains a seemingly random 128-bit hex string and what appears to be a Unix timestamp. Apparently, the random string is used as a CSRF token for AJAX requests, and is put into LocalStorage with a timestamp in order to keep it synchronized between tabs. If you like, you can view the unminified version of the code that stores it; look for the bind_fkeyUpdate() function.

---

Searching all the JS code used on this page for other mentions of localStorage (easily done on Firefox dev tools using the "search all files" feature of the Debugger tab), it seems that Stack Exchange's internal click analytics code (search for StackExchange.gps here) also uses LocalStorage, but only ephemerally to cache data until it can be relayed to the SE servers via AJAX. Thus, in normal use, you probably wouldn't notice it just by inspecting the stored data.

In any case, while such click-tracking analytics code does present some genuine privacy concerns (only somewhat mitigated in this case by the fact that the data isn't going to any third-party servers), the ephemeral use of LocalStorage in the tracking code doesn't really affect those concerns much; such click tracking would be no more or less invasive even if done without using LocalStorage.

---

Apparently, there also used to be some code in the SE client-side codebase that used LocalStorage to track next/previous button clicks somewhere. All that's now left of that code are the following lines:

// this is needed to reclaim a bunch of localStorage crap from the next/previous button experiment
var cleanupNextAndPreviousButtonState = function () {
    try {
        localStorage.removeItem('nextPrevTrackState');
        localStorage.removeItem('nextPrevTrackState2');
        localStorage.removeItem('nextPrevState');
    } catch (e) { }
};

Honestly, I have no idea what the original use of those LocalStorage keys was, but all that the remaining code is doing is erasing them if they're still present.

Answer 2

What are you…

Since most of us (99.999%) are merely fellow users with no behind-the-scenes insights, you're somewhat asking the wrong people here.

Personally, I'm guessing those 3KB of local storage hold nothing else than benign data… like cached network login credentials et al. I would be happy to look at whatever data my local storage holds to be able to tell you more, but the web clients I use are so locked down, that my local storage generally is absolute virgin (meaning: untouched with no data whatsoever due to according configuration).

Anyway, something tells me the StackExchange devteam knows for sure what their sourcecode might be storing to and retrieving from their average users' browsers. In case of doubt, they can be contacted directly via the dedicated contact page.