I want to use a client-side JS app, but I want to prevent it from leaking sensitive data.

For example, I want to check if my password is compromised using the haveibeenpwned service, which accepts SHA1 hashes. I've found a site that lets me generate SHA1 hashes that do not use a server to do so. But I need to enter my password there, and I'm worried the service will leak it to some database.

I'd like to make sure the SHA1 generator site has no way of sending my password anywhere. I don't trust that site.

The process I'm thinking of:

  • Use incognito mode. This prevents the site from storing information.
  • After the page is loaded, shut it off the network by using the DevTools (f12 -> network -> offline). This prevents the site from communicating to the outside.

Is this process secure? Are there any ways a site could send or store anything?

Note: I know I can generate an SHA1 from the command line, but I'm looking for a secure web-based one.

| improve this question | | | | |
  • 2
    Incognito simply tries to prevent your browser from storing history locally. It does not prevent a website from recording what you send it or your IP. – forest Apr 6 '18 at 11:21
  • 1
    Yes, but I believe checking the Offline flag would prevent that. – sashee Apr 6 '18 at 11:54

The following process using Incognito Mode would be possible:

  1. Load the page in Incognito window/tab
  2. Disconnect (not just via the DevTool, more like pulling cables or shut down WiFi)
  3. Do your SHA1 generation
  4. Clean Up: Close the Incognito window/tab (to clear Cache&Cookies and stop eventually runnung JS script) This is important as the site might be able to upload some data asynchronously (after the reconnection)
  5. Reconnect
| improve this answer | | | | |
  • I meant to do both. So open the site in incognito, then make it offline. As I see your approach is similar to this one. (2) is the toggle Offline, (4) is handled by incognito AFAIK. – sashee Apr 6 '18 at 11:53
  • @sashee That's right. 4 is handled by incognito mode, if you close the incognito window/tab before step 5. I will edit my answer to respect your input. – mad_manny Apr 6 '18 at 11:55
  • Also for the cleanup step, I believe it is extremely hard to clean up properly. What if the page uses an Iframe on a different domain to store information? That might not show up in the devtools. I think the websites have many ways to store hidden informations, it's easy to miss something. – sashee Apr 6 '18 at 11:59
  • Also, regarding your (2) points: "not just via the DevTool, more like pulling cables or shut down WiFi". Do you know any vulnerability that bypasses Chrome's Offline checkbox? Or shutting down WiFi is to make 100% sure it can't communicate? – sashee Apr 6 '18 at 12:01
  • 2
    @forest, "there are ways to store persistent information even in incognito mode": Now that's discomforting. Could you give me some directions where could I find more info about it? – sashee Apr 6 '18 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.