6 ms·

Hate to be this guy, but things trying to be like this should implement a CSP with `connect-src 'none'` (and `form-action: 'none'` and `self` restrictions on e

Hate to be this guy, but things trying to be like this should implement a CSP with `connect-src 'none'` (and `form-action: 'none'` and `self` restrictions on everything else). Otherwise I can't be assured that the secrets won't be sent off without disconnecting my network interface.

l1am0 6y ago
Love you being this guy as this is a very valid point! I am on the go right now, but will ad this in about 2 hours.
thinkloop 6y ago
CSP = Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP "To enable CSP, you need to configure your web server to return the Content-Security-Policy HTTP header (sometimes you will see mentions of the X-Content-Security-Policy header, but that's an older version and you don't need to specify it anymore). Alternatively, the <meta> element can be used to configure a policy, for example: <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; https://*; child-src 'none';">"
dylz 6y ago
You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.
- zaroth 6y ago
  I think the point is that you go to the site, and save the HTML on your local machine, and then run it from there. It would be amazing if there was a property you could add to the <html> tag to enforce that the browser would prevent any network access or disk writes. As it stands I think after you save the files, you would have to look into each .js file downloaded as part of the bundle to check for outgoing network requests? The code is tiny except for vue_debug.js which is 193KB.
  - deleted 6y ago
    [deleted]
  - ahazred8ta 6y ago
    > save the HTML on your local machine, and then run it from there Yes; there is another js Shamir utility that works like that; it requires you to download the html and refuses to run unless it detects that you are offline. :-) https://bs.parity.io/#-BananaSplit-shamir https://bs.parity.io/#-BananaSplit-shamir
    - ijpsud 6y ago
      > refuses to run unless it detects that you are offline They could just display the "please disconnect" error for a while, then sneakily stop checking after some date, collecting data every time you forget to disconnect. You'd need to check the code, or never forget to disconnect - the latter is probably a mistake waiting to happen. Chrome bug page for "offline-only PWAs" if you want to star it: https://bugs.chromium.org/p/chromium/issues/detail?id=995236 https://bugs.chromium.org/p/chromium/issues/detail?id=995236
- blitmap 6y ago
  Are you saying JS could modify the CSP policy or meta tag after page load? Suddenly I'm thinking it would be very cool to be able to right-click on a tab and say 'Take Tab Offline' Imagine if it was like a toggle on the tab itself like muting sound from a tab. It would instruct the browser to isolate the tab/process from the network? I'm not sure how Web Workers play into this.
  - dylz 6y ago
    You have no guarantee that the server won't just "if (ip === companyName) { don't serve CSP + serve infiltrated JS }" in the future.
    - blitmap 6y ago
      I mean you could absolutely inspect the source for the page, but these things could be modified at runtime by JS, right? I'm talking about the meta tags. It would be neat to have a toggle on the tab for isolating the content of the page from the network.
      - ijpsud 6y ago
        You'd have to restrict localstorage and stuff like that too, else they could save data and then send it when they regain network access. If you have a use-case, or some ideas, there's Chrome bug page for "offline-only PWAs": https://bugs.chromium.org/p/chromium/issues/detail?id=995236 https://bugs.chromium.org/p/chromium/issues/detail?id=995236
andai 6y ago
How do I verify whether or not this is the case? Do I need to check the headers in the network inspector? (My guess is there's no way to check on mobile?)
l1am0 6y ago
The problem with connect-src 'none' is that is does not allow the webassembly to load than (as this is loaded via js) `Content Security Policy: The page’s settings blocked the loading of a resource at http://localhost:8080/wasm/wasm.wasm http://localhost:8080/wasm/wasm.wasm (“connect-src”).` For now I only added `default-src: 'self'; form-action 'none'` to the index.html
- zaroth 6y ago
  And according to HN that only took you 1 hour and 17 minutes (but I guess "2 hours ago" could be rounded down). Way to under-promise and over-deliver!
- ahazred8ta 6y ago
  https://bs.parity.io/#-BananaSplit-shamir https://bs.parity.io/#-BananaSplit-shamir uses different approaches to force offline use.
- jerry1979 6y ago
  Why not just embed the wasm directly in the webpage?
  - l1am0 6y ago
    Funny I came up with the same idea about 10min ago :D It is now directly embedded via a data uri. This allows to set `connect-src: 'data'`
ijpsud 6y ago
Correct me if I'm wrong, but couldn't they just save your secret data to localStorage and then send it off when you load another page from the same origin (a page without those headers)? Or does the CSP of one page somehow apply to the whole origin? I'm not up to date on this stuff.

l1am0 6y ago

Love you being this guy as this is a very valid point! I am on the go right now, but will ad this in about 2 hours.

thinkloop 6y ago

CSP = Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP "To enable CSP, you need to configure your web server to return the Content-Security-Policy HTTP header (sometimes you will see mentions of the X-Content-Security-Policy header, but that's an older version and you don't need to specify it anymore). Alternatively, the <meta> element can be used to configure a policy, for example: <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; https://*; child-src 'none';">"

dylz 6y ago

You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.

zaroth 6y ago
I think the point is that you go to the site, and save the HTML on your local machine, and then run it from there. It would be amazing if there was a property you could add to the <html> tag to enforce that the browser would prevent any network access or disk writes. As it stands I think after you save the files, you would have to look into each .js file downloaded as part of the bundle to check for outgoing network requests? The code is tiny except for vue_debug.js which is 193KB.
- deleted 6y ago
  [deleted]
- ahazred8ta 6y ago
  > save the HTML on your local machine, and then run it from there Yes; there is another js Shamir utility that works like that; it requires you to download the html and refuses to run unless it detects that you are offline. :-) https://bs.parity.io/#-BananaSplit-shamir https://bs.parity.io/#-BananaSplit-shamir
  - ijpsud 6y ago
    > refuses to run unless it detects that you are offline They could just display the "please disconnect" error for a while, then sneakily stop checking after some date, collecting data every time you forget to disconnect. You'd need to check the code, or never forget to disconnect - the latter is probably a mistake waiting to happen. Chrome bug page for "offline-only PWAs" if you want to star it: https://bugs.chromium.org/p/chromium/issues/detail?id=995236 https://bugs.chromium.org/p/chromium/issues/detail?id=995236
blitmap 6y ago
Are you saying JS could modify the CSP policy or meta tag after page load? Suddenly I'm thinking it would be very cool to be able to right-click on a tab and say 'Take Tab Offline' Imagine if it was like a toggle on the tab itself like muting sound from a tab. It would instruct the browser to isolate the tab/process from the network? I'm not sure how Web Workers play into this.
- dylz 6y ago
  You have no guarantee that the server won't just "if (ip === companyName) { don't serve CSP + serve infiltrated JS }" in the future.
  - blitmap 6y ago
    I mean you could absolutely inspect the source for the page, but these things could be modified at runtime by JS, right? I'm talking about the meta tags. It would be neat to have a toggle on the tab for isolating the content of the page from the network.
    - ijpsud 6y ago
      You'd have to restrict localstorage and stuff like that too, else they could save data and then send it when they regain network access. If you have a use-case, or some ideas, there's Chrome bug page for "offline-only PWAs": https://bugs.chromium.org/p/chromium/issues/detail?id=995236 https://bugs.chromium.org/p/chromium/issues/detail?id=995236

andai 6y ago

How do I verify whether or not this is the case? Do I need to check the headers in the network inspector? (My guess is there's no way to check on mobile?)

l1am0 6y ago

The problem with connect-src 'none' is that is does not allow the webassembly to load than (as this is loaded via js) `Content Security Policy: The page’s settings blocked the loading of a resource at http://localhost:8080/wasm/wasm.wasm http://localhost:8080/wasm/wasm.wasm (“connect-src”).` For now I only added `default-src: 'self'; form-action 'none'` to the index.html

zaroth 6y ago
And according to HN that only took you 1 hour and 17 minutes (but I guess "2 hours ago" could be rounded down). Way to under-promise and over-deliver!
ahazred8ta 6y ago
https://bs.parity.io/#-BananaSplit-shamir https://bs.parity.io/#-BananaSplit-shamir uses different approaches to force offline use.
jerry1979 6y ago
Why not just embed the wasm directly in the webpage?
- l1am0 6y ago
  Funny I came up with the same idea about 10min ago :D It is now directly embedded via a data uri. This allows to set `connect-src: 'data'`

ijpsud 6y ago

Correct me if I'm wrong, but couldn't they just save your secret data to localStorage and then send it off when you load another page from the same origin (a page without those headers)? Or does the CSP of one page somehow apply to the whole origin? I'm not up to date on this stuff.