2

As part of my degree, we're currently looking at a hypothetical scenario in which internet access is introduced to prison cells. As part of the information risk assessment, I was wondering if it is possible to disable elements of a webpage that inmates could use to communicate or sign up to services (comment sections, forms, etc) while possibly leaving search bars usable. Since the machine would be controlled and locked down by the prison staff, any necessary software could be installed on the inmates machine.

  1. Is it possible for a network admin to set rules that would disable specific parts of a page?
  2. If not, does software exist that could provide this function if installed on the users machine?
  3. Would this need to be done for each website individually, or could it be done in a generic fashion across any website?

My questions are regarding the practicalities of this, not the ethics. I have already looked into that part.

I do not know a lot about web design (I know the basics of HTML), so I do not know if it is possible to do this. Any thoughts would be appreciated!

Improve this question
2
  • 2
    Look into MITM proxy solutions that allow modifying the traffic, at which point you can "just" strip out any HTML you don't like. And set up for HTTPS MITM (easy if you control the certificate store on the client).
    – user
    Dec 31, 2017 at 12:11
  • as a web dev, i can safely answer: no, no, and yes (if possible). It's wildy impractical. Perhaps with a white-list of sites, and filters for each list entry, it could be done, at least until a site re-design, but it's flaky and brittle. a better choice would be pre-downloding approved sites and allowing local-only "rebrowsing"
    – dandavis
    Dec 31, 2017 at 16:26

2 Answers 2

Reset to default
2

Believe it or not, large corporations are even more paranoid about this sort of thing due to concerns about data leakage, mandated retention of communications (for discovery or due to regulations), and botnet C&C. The term I last heard used was "Read Only Web", and it can sort of be accomplished by doing the usual MITM inspection of all traffic (and blocking anything encrypted or suspicious). I did find a Symantec article describing doing this with a Blue Coat proxy (which they own).

Improve this answer
0
2

Disabling the functionality inside the user interface of the web application (i.e. inside the browser) can be done by using some kind of proxy, but it needs to be done on for each application. Still, it will not help against a knowledgeable user which could enable the needed functionality again inside the browser by modifying the HTML and reversing the changes done by the proxy.

More restrictive is limiting which kind of requests can be send. If done inside the proxy the user has no way of bypass these restrictions since he has no access to the proxy. Such limitations could be done based on allowed request methods and path but the restrictions but they still need to be done individually for each allowed web site. It might also be necessary to regularly update these rules since sites change.

disable elements of a webpage that inmates could use to communicate or sign up to services

Note that such restrictions make only sense if you limit what sites can be accessed to a few in the first place (can be done with the proxy). And you need to make sure that no unwanted communication partner controls any of these allowed sites since communication could also be done without having any active elements on the site, for example by visiting explicit URL's like http://example.com/q?your+message+here.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .