9 ms·

Show HN: Firefox addon to quarantine a tab to use offline with private data

166 points by matusfaro 3y ago

Introducing QuaranTab: Companion extension to quarantine tabs so you can safely use them offline with private data I find myself wanting to use online format parsers to quickly decode that production JWT or decode a base64 Authorization header but cannot trust these websites to not leak my information. I thought to myself if only I could cut-off network access to this site, use it offline, and then throw away all browsing data. So I created an extension just for that. It uses Firefox contextual identities API (Containers) to isolate browsing data and inter-tab communication. Once the site is fully loaded, I then inject bogus proxy settings for any requests leaving that container to effectively cut-off network access. And once I'm done, I simply delete the Container. Use Cases: * Parse a live JWT token * Convert a Base64 Authorization header * Hash a password * Parse a Protobuf message * Submit my name and birthdate to estimate my date of death Check out the MIT source code on GitHub [1] and install QuaranTab from the Firefox store [2]. If anyone is interested in a discussion, I'd love to chat about: 1. Any ideas on how we could implement this in Chromium? Using private window as a "Container"? 2. Can you come up with an exploit? I posted a 100usd bug bounty [3] if you find one! 3. Is there any way to prove an extension in the store was built from source in GitHub? I am imagining some kind of third-party escrow service managing the Firefox store account and building from specific public git repository. 1. https://github.com/matusfaro/quarantab https://github.com/matusfaro/quarantab 2. https://addons.mozilla.org/en-US/firefox/addon/quarantab/ https://addons.mozilla.org/en-US/firefox/addon/quarantab/ 3. https://github.com/matusfaro/quarantab#bug-bounty https://github.com/matusfaro/quarantab#bug-bounty

necovek 3y ago
While I applaud your effort and thinking of privacy issues, I will continue to do these in a terminal and Python REPL for all the reasons you bring up. It would certainly be nice to get something ala F-droid for free software extensions like yours (which guarantees source code matches built package IIRC), as a response to your question 3. I am sure one can create an alternative extensions store in FF and change some config in about:config to use it, though it's likely non-trivial.
- matusfaro 3y ago
  Agreed, and to be honest, this extension is more for myself as I would be extremely skeptical if someone else made it especially with the permissions it requires. It would probably be more successful as a feature added to an existing trusted extension such as Temporary Containers.
- nix0n 3y ago
  > I will continue to do these in a terminal and Python REPL for all the reasons you bring up. Do you have a way to prevent terminal utilities from accessing the network?
  - 5e92cb50239222b 3y ago
    $ bwrap --unshare-net --dev-bind / / bash $ curl google.com curl: (6) Could not resolve host: google.com Or you could use firejail, or do it manually with `unshare`, or with any of the container runtimes (docker, podman). https://wiki.archlinux.org/title/Bubblewrap https://wiki.archlinux.org/title/Bubblewrap https://wiki.archlinux.org/title/Firejail https://wiki.archlinux.org/title/Firejail
    - matusfaro 3y ago
      Interesting options, wasn't aware of those. The only minor counter-argument would be laziness as a security threat: the more difficult you make the process, the more likely the user will skip seemingly useless steps, thus compromising security.
  - necovek 3y ago
    I generally avoid non-trusted utilities altogether. I am most likely to load up data (for the use cases mentioned in the extension description) into a Python shell and deal with it using json, base64, pprint and similar modules. Some things I can do with regular POSIX and GNU tools directly from the CLI, so I'd trust those too on my Debian/Ubuntu systems (where there is usually a guarantee you can get the source code for the binary you are running). It's definitely possible Debian/Ubuntu experience a supply chain attack too, but it's significantly less likely than a random library from github IMO.
ravenstine 3y ago
Cool idea! I don't really picture myself using this, but I think this add-on is a great example of how great a browser Firefox is. I'd be the first to critique Mozilla, and there are definitely things about Firefox I don't like (ex. Pocket, telemetry on by default), but overall I think it's an amazing product in that it allows for multiple levels of isolation (profiles, containers, private mode) and a level of control over them that Chromium either doesn't do as cleanly or doesn't do at all. As an aside, the only thing I think Chromium does better is the debugging experience; I don't truly understand why Firefox thinks it shouldn't support debugging Node.js like Chromium does.
- matusfaro 3y ago
  > it allows for multiple levels of isolation Yes! Chrome has a visually similar functionality to Firefox Containers hidden away behind a feature flag [1] at the moment. BUT under the hood it's simply just tab grouping with no isolation. I presume isolation is against Google's interests so we will never see this kind of feature. As for Firefox's API, the Contextual Identities API [2] that allows you to create/delete containers is amazing and easy to work with as a dev. And it works out-of-the-box, it doesn't need the companion addon Multi-Account Containers (MAC) [3] which really should've been part of Firefox in my opinion. 1. chrome://flags/#tab-groups-save 2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/contextualIdentities https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... 3. https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...
  - bad_user 3y ago
    Firefox's containers are useless for privacy, given other enhancements of Firefox (e.g., Total Cookie Protection). And as far as "isolation", privacy or security are concerned, Chrome's profiles are actually superior due to ability to have different extensions and history per profile. Chrome's extensions in general still have superior security (e.g., activate on click or only for certain websites), so sometimes different profiles aren't even needed. Chrome's Profiles are also remembered when you "install an app" (SSB/PWA), so you could have "apps" started in their own profiles. Firefox's containers are only useful if you want multiple logins to the same service in the same browser window. But I never found that usecase to be very compelling. Firefox's containers are an often lauded feature, and I don't understand why, given the integration issues or general awkwardness. It's probably a reminiscence of the "Facebook container" extension, which was a bandaid until better site isolation was implemented.
solardev 3y ago
> Submit my name and birthdate to estimate my date of death Totally off topic, but curious how this works? Nationality and life expectancy? Sex at birth? Assassins for hire?
- SahAssar 3y ago
  DNaaS: Death Note as a Service
  - matusfaro 3y ago
    What actually triggered my idea was a recent DNaaS HN post [1] that tells you your expected life expectancy and other cool facts based on your country and birthdate which I was reluctant to input my actual birthday. 1. https://news.ycombinator.com/item?id=37324733& https://news.ycombinator.com/item?id=37324733&
    - solardev 3y ago
      Oh my god, this is scary. I don't want to live until the 2060s, lol. It terrifies me to think about how the world will be then... But anyway, thanks for the link! For the curious, this is their methodology: > Remaining life expectancy at specific age (in days) was obtained by interpolating (spline) the 5 yearly/duration age-specific period life expectancies. > Population.io uses official demographic data produced by the United Nations and published in the World Population Prospects
  - finite_depth 3y ago
    [dead]
- halJordan 3y ago
  Actuarials publish tables based on all of that data, and more
solardev 3y ago
Cool add on! Thanks for this. It's a use case I've often thought about, for the purposes you mention. I wish there was a built in permission to disable AJAX after page load. Bad for ads, I guess. 2. Exploit idea (not trying for the bounty, just thinking aloud). I wonder if a website could play background music (or a video) with stenographically encoded data, then another tab could listen to it with microphone permissions on and decode it that way. I'm thinking like a fake video conferencing site, or malicious telephony how-to doc that deals with API calls and such and links to a fake password hasher that then plays the audio for the first tab to hear. Convoluted, I know, just an idea.
- matusfaro 3y ago
  > built in permission to disable AJAX after page load Interesting, but consider this is a cat-and-mouse game. If you are the only one using this trick it may work for you, but I assume would be easy to overcome. (e.g. keep the page loading forever or until ads are loaded. Have the ads be J-free after page load, ...) > website could play background music ... another tab could listen You would need mic access from the other tab, but yes. If you send it over high enough frequency you wouldn't even hear it. You would just have a visual feedback that the tab is playing music. On a side-note, I recall there was some kind of hardware device pairing (maybe Chromecast?) that used data over voice to establish that you are physically near the other device.
  - solardev 3y ago
    > On a side-note, I recall there was some kind of hardware device pairing (maybe Chromecast?) that used data over voice to establish that you are physically near the other device. Yeah, that's pretty common in home smart devices. Looks like Google patented one version and Sonos has their implementation too. In my experience it works better than Bluetooth, especially in (2.4 GHz) noisy environments
    - matusfaro 3y ago
      Funny that you say Sonos. I also remember there was a data-over-voice library called "chirp.io" which now redirects to Sonos homepage. Now I know why they acquired them :)
stainablesteel 3y ago
that's a nice idea the same way you can silence the sound output of a tab you should have as simple and reliable a tool to stop communication to either the network, os or both. i'd love a tool to see which tabs are talking with each other also
- matusfaro 3y ago
  > love a tool to see which tabs are talking with each other also Cool idea but probably not that useful and difficult to accomplish. There are many ways to communicate that could be grouped into: 1. tab -> tab (same domain) 2. tab -> tab (different domain) 3. tab -> server -> tab For #1, there are so many ways to transfer information it would be hard to detect and differentiate whether it's communication or just happens to be using the same resource. (e.g. one sets a cookie or local storage and the other one reads it) For #3, it would be impossible to detect. Especially if detection is an issue, both tabs could be communicating with unrelated servers which talk with each other. For #2, it would be the only interesting one as there is limited options (e.g. Broadcast Channel), but at the same time I assume rarely used in practice. And if detection is an issue, they would switch to #3 to avoid it.
webstrand 3y ago
It would be nice if the code in the .xpi wasn't minified.
- matusfaro 3y ago
  I can certainly do that. I used a browser extension boiler plate that minifies it by default. I submitted an issue for myself to fix this [1] 1. https://github.com/matusfaro/quarantab/issues/3 https://github.com/matusfaro/quarantab/issues/3
matusfaro 3y ago
We have our first bug bounty! Thank you "dz2742" for finding out [1] existing connections including websockets are not terminated and has won 100 USD! This is exactly the type of exploit I was hoping to catch. Now I have to figure out how to fix that :) And also think about refilling the bug bounty pool without becoming very poor very soon. https://github.com/matusfaro/quarantab/issues/2 https://github.com/matusfaro/quarantab/issues/2
mikae1 3y ago
Thanks, now I can begin using https://gpx.studio https://gpx.studio
justin_oaks 3y ago
Many of the use cases mentioned are available through a single tool called CyberChef. There is an online version [1] but it doesn't submit any data to any servers. It only loads JS for the operations it needs to perform. You can also download it and run it offline [2]. This is what I do. I'll leave it up to you to decide if this makes QuaranTab unnecessary or if it's the perfect reason to use QuaranTab. [1] https://gchq.github.io/CyberChef/ https://gchq.github.io/CyberChef/ [2] https://github.com/gchq/CyberChef/releases/ https://github.com/gchq/CyberChef/releases/
- boarnoah 3y ago
  This extension is still very cool. +1 to Cyberchef, its awesome. If you really have qualms about the URL its trivial to re-host / serve it to yourself offline. My favorite part is whole recipe feature (Cyberchef builds a URL with the configured processors you use to process data). I find myself using that a ton to share XPath / JPAth expressions type work with sample data to others by sharing that URL.
  - lxgr 3y ago
    I've been curious about this: Is there a way to exfiltrate data from a locally downloaded single page application? Due to the same-origin principle, plain XHR and similar should be out, but what about CORS or script/image embedding with query parameters?
    - wazzaps 3y ago
      It's possible if the destination allows it, like Google Analytics
    - justin_oaks 3y ago
      Data exfiltration works just fine with a locally downloaded SPA. There's Script/image embedding as you mention. There's also iframes and form submissions. As for XHR, the same-origin principle doesn't prevent the request from going out; it prevents the response from being readable by the page. Even so, a remote site can add the right CORS headers to allow access from anywhere, and your browser will happily send the data out AND allow the page to read the response. You could probably mitigate most, if not all, exfiltration using a CSP [1] that you manually add to the HTML meta tag. The reason for using a local copy is so once I verify that the copy I have is "clean" (either built myself or reviewed, and confirmed to not send data out) then I can trust that version until I replace it. If I load data from a website, there are no guarantees that I don't get a different version every time. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
danShumway 3y ago
> 3. Is there any way to prove an extension in the store was built from source in GitHub? I am imagining some kind of third-party escrow service managing the Firefox store account and building from specific public git repository. This is (in theory) part of Mozilla's review process, and depending on how the extension is submitted they can (I've heard) be fairly strict about it. But it's not user-facing at all and I don't know how universally they review source code. It really needs to be fixed from Mozilla's end though; I don't see much reason to get a 3rd-party involved instead of to lobby Mozilla to add some kind of process on its own that's more prominent. A 3rd-party verification service would be possible (you'd just download the extension from Mozilla's servers and extract it, re-run the build process and check to see if the artifacts matched), and in theory you could even have a completely separate extension store from Mozilla's -- as long as the extensions are signed you can host them anywhere, and there's nothing preventing you from getting other extensions built from source signed. You could have a pseudo-F-Droid addon store that distributed Mozilla-signed extensions you've pulled from Git and built yourself. But... I mean, I just feel like it's something we should lobby Mozilla to do, they're in the best position to do it and in the best position to have the most impact if they do.
danShumway 3y ago
Interesting project! Off the top of my head I guess it would be a larger addition since this is currently using built-in Firefox features for isolation, but recording/caching requests that are made during the initial load in order to "freeze" a website until the user chooses to update would make this more useful. If you do want to go down that route, using the blocking `webRequest` to record responses and stick them into storage and then re-serve them from the cache would possibly be the best way to go about it. At that point though I'd probably advise seeing if you could get off of `<all_urls>` as a required permission? And I haven't ever played with blocking network requests for websockets, so I'm not sure if they'd require separate handling. Just a thought. But regardless, thanks for sharing :)
madacol 3y ago
You can add to your uses cases a web viewer for MRI/CT scan results https://madacol.github.io/ozempic-dicom-viewer/ https://madacol.github.io/ozempic-dicom-viewer/
wazzaps 3y ago
A (user-unfriendly-but-workable) solution for chromium is Devtools->Network->Network Conditions->Offline, then clear all storage and cache after you're done. This only works if you have one tab of this website, since tabs of the same website can message each other (and exfiltrate data). Also useful for debugging frontend bugs in "destructive" operations in production :)
justin_oaks 3y ago
I wonder how far you could get in accomplishing the same thing by setting a Content Security Policy (CSP) [1] on the page. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
icar 3y ago
I use and recommend https://flathub.org/apps/com.github.liferooter.textpieces https://flathub.org/apps/com.github.liferooter.textpieces

166 points by matusfaro 3y ago

necovek 3y ago

While I applaud your effort and thinking of privacy issues, I will continue to do these in a terminal and Python REPL for all the reasons you bring up. It would certainly be nice to get something ala F-droid for free software extensions like yours (which guarantees source code matches built package IIRC), as a response to your question 3. I am sure one can create an alternative extensions store in FF and change some config in about:config to use it, though it's likely non-trivial.

matusfaro 3y ago
Agreed, and to be honest, this extension is more for myself as I would be extremely skeptical if someone else made it especially with the permissions it requires. It would probably be more successful as a feature added to an existing trusted extension such as Temporary Containers.
nix0n 3y ago
> I will continue to do these in a terminal and Python REPL for all the reasons you bring up. Do you have a way to prevent terminal utilities from accessing the network?
- 5e92cb50239222b 3y ago
  $ bwrap --unshare-net --dev-bind / / bash $ curl google.com curl: (6) Could not resolve host: google.com Or you could use firejail, or do it manually with `unshare`, or with any of the container runtimes (docker, podman). https://wiki.archlinux.org/title/Bubblewrap https://wiki.archlinux.org/title/Bubblewrap https://wiki.archlinux.org/title/Firejail https://wiki.archlinux.org/title/Firejail
  - matusfaro 3y ago
    Interesting options, wasn't aware of those. The only minor counter-argument would be laziness as a security threat: the more difficult you make the process, the more likely the user will skip seemingly useless steps, thus compromising security.
- necovek 3y ago
  I generally avoid non-trusted utilities altogether. I am most likely to load up data (for the use cases mentioned in the extension description) into a Python shell and deal with it using json, base64, pprint and similar modules. Some things I can do with regular POSIX and GNU tools directly from the CLI, so I'd trust those too on my Debian/Ubuntu systems (where there is usually a guarantee you can get the source code for the binary you are running). It's definitely possible Debian/Ubuntu experience a supply chain attack too, but it's significantly less likely than a random library from github IMO.

ravenstine 3y ago

Cool idea! I don't really picture myself using this, but I think this add-on is a great example of how great a browser Firefox is. I'd be the first to critique Mozilla, and there are definitely things about Firefox I don't like (ex. Pocket, telemetry on by default), but overall I think it's an amazing product in that it allows for multiple levels of isolation (profiles, containers, private mode) and a level of control over them that Chromium either doesn't do as cleanly or doesn't do at all. As an aside, the only thing I think Chromium does better is the debugging experience; I don't truly understand why Firefox thinks it shouldn't support debugging Node.js like Chromium does.

matusfaro 3y ago
> it allows for multiple levels of isolation Yes! Chrome has a visually similar functionality to Firefox Containers hidden away behind a feature flag [1] at the moment. BUT under the hood it's simply just tab grouping with no isolation. I presume isolation is against Google's interests so we will never see this kind of feature. As for Firefox's API, the Contextual Identities API [2] that allows you to create/delete containers is amazing and easy to work with as a dev. And it works out-of-the-box, it doesn't need the companion addon Multi-Account Containers (MAC) [3] which really should've been part of Firefox in my opinion. 1. chrome://flags/#tab-groups-save 2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/contextualIdentities https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... 3. https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...
- bad_user 3y ago
  Firefox's containers are useless for privacy, given other enhancements of Firefox (e.g., Total Cookie Protection). And as far as "isolation", privacy or security are concerned, Chrome's profiles are actually superior due to ability to have different extensions and history per profile. Chrome's extensions in general still have superior security (e.g., activate on click or only for certain websites), so sometimes different profiles aren't even needed. Chrome's Profiles are also remembered when you "install an app" (SSB/PWA), so you could have "apps" started in their own profiles. Firefox's containers are only useful if you want multiple logins to the same service in the same browser window. But I never found that usecase to be very compelling. Firefox's containers are an often lauded feature, and I don't understand why, given the integration issues or general awkwardness. It's probably a reminiscence of the "Facebook container" extension, which was a bandaid until better site isolation was implemented.

solardev 3y ago

> Submit my name and birthdate to estimate my date of death Totally off topic, but curious how this works? Nationality and life expectancy? Sex at birth? Assassins for hire?

SahAssar 3y ago
DNaaS: Death Note as a Service
- matusfaro 3y ago
  What actually triggered my idea was a recent DNaaS HN post [1] that tells you your expected life expectancy and other cool facts based on your country and birthdate which I was reluctant to input my actual birthday. 1. https://news.ycombinator.com/item?id=37324733& https://news.ycombinator.com/item?id=37324733&
  - solardev 3y ago
    Oh my god, this is scary. I don't want to live until the 2060s, lol. It terrifies me to think about how the world will be then... But anyway, thanks for the link! For the curious, this is their methodology: > Remaining life expectancy at specific age (in days) was obtained by interpolating (spline) the 5 yearly/duration age-specific period life expectancies. > Population.io uses official demographic data produced by the United Nations and published in the World Population Prospects
- finite_depth 3y ago
  [dead]
halJordan 3y ago
Actuarials publish tables based on all of that data, and more

solardev 3y ago

Cool add on! Thanks for this. It's a use case I've often thought about, for the purposes you mention. I wish there was a built in permission to disable AJAX after page load. Bad for ads, I guess. 2. Exploit idea (not trying for the bounty, just thinking aloud). I wonder if a website could play background music (or a video) with stenographically encoded data, then another tab could listen to it with microphone permissions on and decode it that way. I'm thinking like a fake video conferencing site, or malicious telephony how-to doc that deals with API calls and such and links to a fake password hasher that then plays the audio for the first tab to hear. Convoluted, I know, just an idea.

matusfaro 3y ago
> built in permission to disable AJAX after page load Interesting, but consider this is a cat-and-mouse game. If you are the only one using this trick it may work for you, but I assume would be easy to overcome. (e.g. keep the page loading forever or until ads are loaded. Have the ads be J-free after page load, ...) > website could play background music ... another tab could listen You would need mic access from the other tab, but yes. If you send it over high enough frequency you wouldn't even hear it. You would just have a visual feedback that the tab is playing music. On a side-note, I recall there was some kind of hardware device pairing (maybe Chromecast?) that used data over voice to establish that you are physically near the other device.
- solardev 3y ago
  > On a side-note, I recall there was some kind of hardware device pairing (maybe Chromecast?) that used data over voice to establish that you are physically near the other device. Yeah, that's pretty common in home smart devices. Looks like Google patented one version and Sonos has their implementation too. In my experience it works better than Bluetooth, especially in (2.4 GHz) noisy environments
  - matusfaro 3y ago
    Funny that you say Sonos. I also remember there was a data-over-voice library called "chirp.io" which now redirects to Sonos homepage. Now I know why they acquired them :)

stainablesteel 3y ago

that's a nice idea the same way you can silence the sound output of a tab you should have as simple and reliable a tool to stop communication to either the network, os or both. i'd love a tool to see which tabs are talking with each other also

matusfaro 3y ago
> love a tool to see which tabs are talking with each other also Cool idea but probably not that useful and difficult to accomplish. There are many ways to communicate that could be grouped into: 1. tab -> tab (same domain) 2. tab -> tab (different domain) 3. tab -> server -> tab For #1, there are so many ways to transfer information it would be hard to detect and differentiate whether it's communication or just happens to be using the same resource. (e.g. one sets a cookie or local storage and the other one reads it) For #3, it would be impossible to detect. Especially if detection is an issue, both tabs could be communicating with unrelated servers which talk with each other. For #2, it would be the only interesting one as there is limited options (e.g. Broadcast Channel), but at the same time I assume rarely used in practice. And if detection is an issue, they would switch to #3 to avoid it.

webstrand 3y ago

It would be nice if the code in the .xpi wasn't minified.

matusfaro 3y ago
I can certainly do that. I used a browser extension boiler plate that minifies it by default. I submitted an issue for myself to fix this [1] 1. https://github.com/matusfaro/quarantab/issues/3 https://github.com/matusfaro/quarantab/issues/3

matusfaro 3y ago

We have our first bug bounty! Thank you "dz2742" for finding out [1] existing connections including websockets are not terminated and has won 100 USD! This is exactly the type of exploit I was hoping to catch. Now I have to figure out how to fix that :) And also think about refilling the bug bounty pool without becoming very poor very soon. https://github.com/matusfaro/quarantab/issues/2 https://github.com/matusfaro/quarantab/issues/2

mikae1 3y ago

Thanks, now I can begin using https://gpx.studio https://gpx.studio

justin_oaks 3y ago

Many of the use cases mentioned are available through a single tool called CyberChef. There is an online version [1] but it doesn't submit any data to any servers. It only loads JS for the operations it needs to perform. You can also download it and run it offline [2]. This is what I do. I'll leave it up to you to decide if this makes QuaranTab unnecessary or if it's the perfect reason to use QuaranTab. [1] https://gchq.github.io/CyberChef/ https://gchq.github.io/CyberChef/ [2] https://github.com/gchq/CyberChef/releases/ https://github.com/gchq/CyberChef/releases/

boarnoah 3y ago
This extension is still very cool. +1 to Cyberchef, its awesome. If you really have qualms about the URL its trivial to re-host / serve it to yourself offline. My favorite part is whole recipe feature (Cyberchef builds a URL with the configured processors you use to process data). I find myself using that a ton to share XPath / JPAth expressions type work with sample data to others by sharing that URL.
- lxgr 3y ago
  I've been curious about this: Is there a way to exfiltrate data from a locally downloaded single page application? Due to the same-origin principle, plain XHR and similar should be out, but what about CORS or script/image embedding with query parameters?
  - wazzaps 3y ago
    It's possible if the destination allows it, like Google Analytics
  - justin_oaks 3y ago
    Data exfiltration works just fine with a locally downloaded SPA. There's Script/image embedding as you mention. There's also iframes and form submissions. As for XHR, the same-origin principle doesn't prevent the request from going out; it prevents the response from being readable by the page. Even so, a remote site can add the right CORS headers to allow access from anywhere, and your browser will happily send the data out AND allow the page to read the response. You could probably mitigate most, if not all, exfiltration using a CSP [1] that you manually add to the HTML meta tag. The reason for using a local copy is so once I verify that the copy I have is "clean" (either built myself or reviewed, and confirmed to not send data out) then I can trust that version until I replace it. If I load data from a website, there are no guarantees that I don't get a different version every time. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

danShumway 3y ago

> 3. Is there any way to prove an extension in the store was built from source in GitHub? I am imagining some kind of third-party escrow service managing the Firefox store account and building from specific public git repository. This is (in theory) part of Mozilla's review process, and depending on how the extension is submitted they can (I've heard) be fairly strict about it. But it's not user-facing at all and I don't know how universally they review source code. It really needs to be fixed from Mozilla's end though; I don't see much reason to get a 3rd-party involved instead of to lobby Mozilla to add some kind of process on its own that's more prominent. A 3rd-party verification service would be possible (you'd just download the extension from Mozilla's servers and extract it, re-run the build process and check to see if the artifacts matched), and in theory you could even have a completely separate extension store from Mozilla's -- as long as the extensions are signed you can host them anywhere, and there's nothing preventing you from getting other extensions built from source signed. You could have a pseudo-F-Droid addon store that distributed Mozilla-signed extensions you've pulled from Git and built yourself. But... I mean, I just feel like it's something we should lobby Mozilla to do, they're in the best position to do it and in the best position to have the most impact if they do.

danShumway 3y ago

Interesting project! Off the top of my head I guess it would be a larger addition since this is currently using built-in Firefox features for isolation, but recording/caching requests that are made during the initial load in order to "freeze" a website until the user chooses to update would make this more useful. If you do want to go down that route, using the blocking `webRequest` to record responses and stick them into storage and then re-serve them from the cache would possibly be the best way to go about it. At that point though I'd probably advise seeing if you could get off of `<all_urls>` as a required permission? And I haven't ever played with blocking network requests for websockets, so I'm not sure if they'd require separate handling. Just a thought. But regardless, thanks for sharing :)

madacol 3y ago

You can add to your uses cases a web viewer for MRI/CT scan results https://madacol.github.io/ozempic-dicom-viewer/ https://madacol.github.io/ozempic-dicom-viewer/

wazzaps 3y ago

A (user-unfriendly-but-workable) solution for chromium is Devtools->Network->Network Conditions->Offline, then clear all storage and cache after you're done. This only works if you have one tab of this website, since tabs of the same website can message each other (and exfiltrate data). Also useful for debugging frontend bugs in "destructive" operations in production :)

justin_oaks 3y ago

I wonder how far you could get in accomplishing the same thing by setting a Content Security Policy (CSP) [1] on the page. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

icar 3y ago

I use and recommend https://flathub.org/apps/com.github.liferooter.textpieces https://flathub.org/apps/com.github.liferooter.textpieces