3 ms·

This is probably safe, but I really can't bring myself to do it.

by kurthr 5y ago

unwiredben 5y ago
Running it on Firefox with web inspector opened, I saw no network traffic at all after the page loaded, so it wasn't sending the network name or password anywhere off my device.
- gruez 5y ago
  This method picks up "most" requests, but not all. eg. websocket and webrtc can be used to exfiltrate data but it won't show up on inspector.
  - kroltan 5y ago
    They do show up, not the connections themselves, but the initiation, no?? At least I always see lots of 101 Switching Protocols responses on sites that use websocket, it might be some sort of nonstandard gateway though. Never used it so dunno. Of course even if that's the case, you gotta load the website with the network inspector already open, to see the initiation.
    - switz 5y ago
      You can "hide" a websocket connection behind a shared worker and that won't show up in the network connection tab. I do that on a site of mine, but for a less nefarious reason: sharing a websocket connection between multiple tabs.
johtso 5y ago
Are there any tools to run an untrusted client side web application isolated from the internet?
- gruez 5y ago
  turn off wifi/unplug network cable?
  - AndrewOMartin 5y ago
    and never plug back in again ;)
    - nicolaslem 5y ago
      A private browser window should take care of this problem.
  - memco 5y ago
    Probably should also run it in a sandboxed tab and delete all site related data after use. It is possible for sites to detect network connection and sync data when a connection is re-established. EDIT: you could also just run the local server in offline mode and shut it down before you re-connect.
- boring_twenties 5y ago
  useradd -m luser iptables -I OUTPUT 1 -m owner --uid-owner luser -j REJECT Now log in as luser and run your browser.
  - r1ch 5y ago
    This would still allow data exfiltration via DNS. It really needs to be done at the browser level.
    - boring_twenties 5y ago
      This rule blocks all IP traffic including DNS requests.
      - r1ch 5y ago
blantonl 5y ago
The source code is here, so run it yourself. https://github.com/bndw/wifi-card https://github.com/bndw/wifi-card
- OJFord 5y ago
  If you're going to do that, simpler to just use `qrencode` with the same contents as this is using: WIFI:T:WPA;S:${ssid};P:${password};; Unless you need to frequently generate WiFi login QR codes (single purpose!) from a device without a convenient command line, e.g. mobile, there's not really a reason to self-host this. (It makes sense for OP/the project to host it as a demo and for people who don't care or trust it to use though - I'm not hating on the site existing.)

This is probably safe, but I really can't bring myself to do it.

by kurthr 5y ago

This is probably safe, but I really can't bring myself to do it.

Running it on Firefox with web inspector opened, I saw no network traffic at all after the page loaded, so it wasn't sending the network name or password anywhere off my device.

gruez 5y ago
This method picks up "most" requests, but not all. eg. websocket and webrtc can be used to exfiltrate data but it won't show up on inspector.
- kroltan 5y ago
  They do show up, not the connections themselves, but the initiation, no?? At least I always see lots of 101 Switching Protocols responses on sites that use websocket, it might be some sort of nonstandard gateway though. Never used it so dunno. Of course even if that's the case, you gotta load the website with the network inspector already open, to see the initiation.
  - switz 5y ago
    You can "hide" a websocket connection behind a shared worker and that won't show up in the network connection tab. I do that on a site of mine, but for a less nefarious reason: sharing a websocket connection between multiple tabs.

johtso 5y ago

Are there any tools to run an untrusted client side web application isolated from the internet?

gruez 5y ago
turn off wifi/unplug network cable?
- AndrewOMartin 5y ago
  and never plug back in again ;)
  - nicolaslem 5y ago
    A private browser window should take care of this problem.
- memco 5y ago
  Probably should also run it in a sandboxed tab and delete all site related data after use. It is possible for sites to detect network connection and sync data when a connection is re-established. EDIT: you could also just run the local server in offline mode and shut it down before you re-connect.
boring_twenties 5y ago
useradd -m luser iptables -I OUTPUT 1 -m owner --uid-owner luser -j REJECT Now log in as luser and run your browser.
- r1ch 5y ago
  This would still allow data exfiltration via DNS. It really needs to be done at the browser level.
  - boring_twenties 5y ago
    This rule blocks all IP traffic including DNS requests.
    - r1ch 5y ago

blantonl 5y ago

The source code is here, so run it yourself. https://github.com/bndw/wifi-card https://github.com/bndw/wifi-card

OJFord 5y ago
If you're going to do that, simpler to just use `qrencode` with the same contents as this is using: WIFI:T:WPA;S:${ssid};P:${password};; Unless you need to frequently generate WiFi login QR codes (single purpose!) from a device without a convenient command line, e.g. mobile, there's not really a reason to self-host this. (It makes sense for OP/the project to host it as a demo and for people who don't care or trust it to use though - I'm not hating on the site existing.)