the deprecated and modern storage-quota APIs report the same origin quota
Check id legacy-quota-surface-agreement
What an ordinary browser yields
The deprecated and modern quota surfaces agree to within an order of magnitude — two APIs, one underlying pool — or the row declines where the deprecated API no longer exists.
What a detector infers
navigator.webkitTemporaryStorage.queryUsageAndQuota and navigator.storage.estimate() describe the same thing — this origin's storage quota — through two APIs separated by about a decade. That makes this a genuine invariant rather than a lookup table: whatever the underlying number is, both doors onto it must report it, on any browser, without anyone needing to know what the right value would be. The failure it catches is specific and, in this category, common. When a build normalises its storage quota to defeat a private-window classifier, it patches the API that every guide names — the modern one — and the deprecated door is left answering from the real disk. A detector reaches the contradiction with one extra call to an API nobody thinks about any more. The comparison is deliberately loose: an order of magnitude, not equality. The legacy surface historically reported a per-origin slice rather than the whole pool, so exact equality would fail honest browsers, while a gap of 10x or more is not something two views of one quota produce by accident. The row declines where the deprecated API is absent, which is ordinary and increasingly common — its removal is a fact about the build's age, not about its honesty.
How to resolve it
Derive both surfaces from the same quota. If the quota is being normalised, normalise it below the API layer so that every surface reporting it — modern, deprecated, and the worker's copy — reports the same number. Patching only the API that documentation names leaves the older one telling the truth.
Read in the wild by
CloakBrowser issues
A stealth-browser tracker records a normalised storage quota that a detector defeated by reading the value from a different surface than the one that was patched.
CloakHQ/CloakBrowser #46, #44 (storage quota surfaces / worker-scope read)
CloakHQ/CloakBrowser#46Every attribution traces to a published artifact. See the sources and their limits.
Nearby checks in Capability surfaces
- emoji advance widths are identical in a fresh realm
emoji-surface-vs-realmEmoji do not render from the page's fonts but from a platform font supplied by the operating system — Segoe UI Emoji on Windows, Apple Color… - the Web Animations surface is identical in a fresh realm
animation-surface-vs-realmThe Web Animations API exposes a small, precisely specified surface: whether Element.animate exists, whether the timeline and KeyframeEffect… - the platform theme resolves the CSS system colours coherently
system-colors-vs-platformThe CSS system-colour keywords — Highlight, HighlightText, Canvas, CanvasText, ButtonFace, ButtonText, GrayText and their newer siblings… - the user-agent stylesheet resolves identically in a fresh realm
default-style-values-vs-realmEvery browser ships a user-agent stylesheet: the rules that make a heading bold and a button look like a button before any site CSS exists. - the permission descriptors this build accepts are the platform's, not a lookup table's
permission-name-support-setThe Permissions specification deliberately fixes no list of names. - form-factor-gated APIs match the form factor the client hints claim
platform-gated-apis-vs-form-factorSome Web APIs are not compiled for every platform, so their presence is a fact about the binary rather than about the user agent. - Web Bluetooth is present or absent as the claimed desktop platform requires
bluetooth-availability-vs-platformnavigator.bluetooth is part of Chrome's desktop surface on Windows, macOS and Linux, and it is provided by the platform layer rather than by… - the WebAuthn surface is as complete as the claimed platform's browser ships it
webauthn-surface-vs-platformWebAuthn reaches further down the stack than most web APIs: PublicKeyCredential is not a self-contained JavaScript object but the front door…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Capability surfaces checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Capability surfaces — the family legacy-quota-surface-agreement belongs to.