> The only way to prevent this attack is for both incognito mode and normal mode to use the same storage medium, so that the API runs at the same speed regardless.
Couldn't Chrome also just lie about when the writes completed? You don't need to actually switch storage mediums in order to emulate its properties.