Hacker News Reader

Comment by analyte123 | Hacker News Reader

Hate to be this guy, but things trying to be like this should implement a CSP with `connect-src 'none'` (and `form-action: 'none'` and `self` restrictions on everything else). Otherwise I can't be assured that the secrets won't be sent off without disconnecting my network interface.

View on HN

Love you being this guy as this is a very valid point! I am on the go right now, but will ad this in about 2 hours.

The problem with connect-src 'none' is that is does not allow the webassembly to load than (as this is loaded via js)

`Content Security Policy: The page’s settings blocked the loading of a resource at http://localhost:8080/wasm/wasm.wasm (“connect-src”).`

For now I only added `default-src: 'self'; form-action 'none'` to the index.html

And according to HN that only took you 1 hour and 17 minutes (but I guess "2 hours ago" could be rounded down). Way to under-promise and over-deliver!

https://bs.parity.io/#-BananaSplit-shamir uses different approaches to force offline use.

Why not just embed the wasm directly in the webpage?

Funny I came up with the same idea about 10min ago :D It is now directly embedded via a data uri.

This allows to set `connect-src: 'data'`

CSP = Content Security Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

"To enable CSP, you need to configure your web server to return the Content-Security-Policy HTTP header (sometimes you will see mentions of the X-Content-Security-Policy header, but that's an older version and you don't need to specify it anymore).

Alternatively, the <meta> element can be used to configure a policy, for example: <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; child-src 'none';">"

You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.

I think the point is that you go to the site, and save the HTML on your local machine, and then run it from there.

It would be amazing if there was a property you could add to the <html> tag to enforce that the browser would prevent any network access or disk writes.

As it stands I think after you save the files, you would have to look into each .js file downloaded as part of the bundle to check for outgoing network requests?

The code is tiny except for vue_debug.js which is 193KB.

> save the HTML on your local machine, and then run it from there

Yes; there is another js Shamir utility that works like that; it requires you to download the html and refuses to run unless it detects that you are offline. :-)

https://bs.parity.io/#-BananaSplit-shamir

> refuses to run unless it detects that you are offline

They could just display the "please disconnect" error for a while, then sneakily stop checking after some date, collecting data every time you forget to disconnect. You'd need to check the code, or never forget to disconnect - the latter is probably a mistake waiting to happen.

Chrome bug page for "offline-only PWAs" if you want to star it: https://bugs.chromium.org/p/chromium/issues/detail?id=995236

Are you saying JS could modify the CSP policy or meta tag after page load?

Suddenly I'm thinking it would be very cool to be able to right-click on a tab and say 'Take Tab Offline' Imagine if it was like a toggle on the tab itself like muting sound from a tab. It would instruct the browser to isolate the tab/process from the network? I'm not sure how Web Workers play into this.

You have no guarantee that the server won't just "if (ip === companyName) { don't serve CSP + serve infiltrated JS }" in the future.

I mean you could absolutely inspect the source for the page, but these things could be modified at runtime by JS, right?

I'm talking about the meta tags. It would be neat to have a toggle on the tab for isolating the content of the page from the network.

You'd have to restrict localstorage and stuff like that too, else they could save data and then send it when they regain network access.

If you have a use-case, or some ideas, there's Chrome bug page for "offline-only PWAs": https://bugs.chromium.org/p/chromium/issues/detail?id=995236

Correct me if I'm wrong, but couldn't they just save your secret data to localStorage and then send it off when you load another page from the same origin (a page without those headers)? Or does the CSP of one page somehow apply to the whole origin? I'm not up to date on this stuff.

How do I verify whether or not this is the case? Do I need to check the headers in the network inspector? (My guess is there's no way to check on mobile?)

Reply on news.ycombinator.com