Yes, saving the page, disconnecting your network connection, then deleting the page would work, but it's a real bother.
After first gaining popularity, the domain could later pass to someone with malicious intent quite easily, eg:
1. Tech people like HN verify the site as credible and approve of it
2. The site gains popularity and goes viral / receives significant use
3. The original author abandons the site because of costs, or simple boredom
4. A malicious actor acquires the domain and begins recording users credentials alongside IP addresses.
Conceivably, an enormous amount could be captured before the malicious recording became exposed, and (importantly) most of those whose credentials were compromised would have no straightforward path by which they could be alerted.
Other scenarios: site is malicious to begin with but set up to not transmit credentials during its first ~28 days.
Mirrors of this site with credential capture added, (hard to claim that's a flaw of this site itself, just a flaw with "this type of site being normalized").
Oh you first try fake data? That's easy to counter. For example probabilisticly: the app tosses a coin and only sends the data with 50% chance the first time. Now half of people using your approach will think the app is safe and get their data stolen anyway. Or use some side channel, delay activity, ...
> View the source code
It would be really nice if the source code in the browser (no, not the Github repo; how do I know the web server served the same thing as the Github repo?) were displayed in a human-readable format with proper tabbing, comments if applicable, and not an obfuscated, minified form.
In fact if your goal isn't specifically obfuscation, it's not necessary to minify JS in general. Web servers do a good job gzipping stuff.
https://www.figma.com/blog/webassembly-cut-figmas-load-time-...
I believe right now, I could use foo.min.js and serve you a cruddy foo.min.map.js to mislead you.
If I served you the original sources foo.concat.js and a build script to go from foo.concat.js => foo.min.js instead, we could have both the speed of the minified version and the (proven by the browser) accurate source code and maps!
I'm not sure if this affects service workers though.
The original way to do this via a synchronous XHR request in visibilitychange/beforeunload/unload handlers gave you a 1-2s window to exfiltrate the data. That's been deprecated in exchange for a more insidious "invisible background connection to the server maintained after closing the tab or navigating away" that doesn't involve any UI delays. (For "a better experience" of course, not for stealth! Never!)
It's called the beacon API [0] and it's supported by basically all browsers [1]. This was introduced because, chiefly among others, Google Analytics was stuck between blocking in head to record the page view or moving to the end of the html document and using documentready but with a fairly high risk of user navigating away before all that had a chance to trigger at all or after it triggered but before it could exfiltrate the data.
[0]: https://developer.mozilla.org/en-US/docs/Web/API/Beacon_API
Excerpt from their KB
Navigator.sendBeacon() .... It’s intended to be used for sending analytics data to a web server, and avoids some of the problems with legacy techniques for sending analytics, such as the use of XMLHttpRequest.
https://developer.mozilla.org/en-US/docs/Web/API/Navigator/s...
I remember seeing service workers in browser devtools or task manager without having given explicit permission.
And it's crazy you can't disable phone service on iPhone.
Also, if you worried about someone accessing your network then you probably need to isolate your devices from seeing each other.
TBH other than pwning my router or misusing my IP address in some way I don't see much problem having my devices on public net. All of them run firewall and are up to date. Most traffic is HTTPS and I'm not sure if you can MITM with just Wifi password lol.