Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been wondering whether viewing a website offline increases the security risk.

The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to know that a java applet originating from the local file system has more privileges(like accessing the local file system) compared to one that comes from the internet. I don't really know how general this principle is, and whether websites that originate from your hard drive are even considered trusted.

Should I be concerned about a rogue applet coming with a website I download for viewing offline and posing a security risk? How are things with javascript for instance, are the restrictions relaxed there as well?

share|improve this question
add comment

2 Answers

As I understand it, an untrusted Java applet run in the browser is going to be sandboxed, so I don't believe it will have any more access to your system if you download it and run it in your browser locally than if you run it from the originating server, or from your browser cache, at least by design.

However, you should be concerned about Java applets, period. The number of vulnerabilities discovered in the JRE in the last few years is absolutely staggering. It's highly inadvisable to allow Java to run in the browser, so I would suggest that you don't want to run untrusted applets under any conditions.

share|improve this answer
    
Well, my intention was not to ask specifically about java applets, i gave it as an example. I was thinking more in the lines of Tom Hawkin's answer. –  enobayram May 9 '13 at 17:38
add comment

Whether Java, JavaScript or whatever, you are generally dealing with the Same Origin Policy that allows a page to be composed of more than one file. So there's read access going on there. Even with scriptless HTML you may be able to exfiltrate some information about image sizes and whether files exist. Some browsers will give little warnings when downloading HTML files.

share|improve this answer
    
Thanks, this is exactly what i had in mind. Does same origin policy give totally free access to my file system to an included Javascript script? –  enobayram May 9 '13 at 17:40
    
@enobayram No. It governs how a script can interact with objects and scripts from other sites on the page. It has nothing to do with accessing anything outside of the browser. –  Xander May 9 '13 at 20:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.