15

I have a webpage I would like to use locally (the JSON-LD Playground). It appears to be designed to operate without connecting to a server. I would like to have a strong confidentiality guarantee for the data I put in it. Is there a way to prevent javascript in a browser from doing anything that can communicate with the internet (e.g. loading additional images or requesting documents via the Fetch Api).

The best approach I've come up with so far is simply to be disconnected from the internet while using it and then closing the browser before re-enabling the internet. However, this is a cumbersome process. Is there a better process? My intent is to download the page and all of the scripts it references locally and then do whatever additional steps are needed to put the page in a sandbox.

4
  • 2
    For your particular use case, the JSON-LD playground is open source so you may just host it yourself locally
    – Bergi
    Commented Jun 10 at 19:25
  • Worth considering that any browser extensions you have installed might still have access to the content you're pasting into your local copy of JSON-LD Playground... potentially even storing that data in localStorage for future retrieval and transmission when the browser does have internet access. I like other's suggestions of using a special sandboxed browser instance for this purpose. Commented Jun 11 at 18:22
  • I'm also sceptical about the claim that the application works without any network connection at all. Have you actually tested this, Cort Ammon? With an empty browser cache? As stated in my answer, the application constantly loads schemas from schema.org. That obviously doesn't work in offline mode, so you'll get flooded with errors. Of course you could redirect schema.org to some local server if you already know all schemas you'll ever need, but then you still need network access.
    – Ja1024
    Commented Jun 12 at 6:53
  • @Ja1024 I wasn't paying attention to brower caches, but it did work with the computer disconnected from any network. Or at least the features I was looking at did. If there were some schema.org supported features that silently failed, I did not notice them.
    – Cort Ammon
    Commented Jun 13 at 3:39

7 Answers 7

15

Firefox has an offline mode, just press “alt” to reveal the file menu, and select “Work offline”. Combine this with private browsing to make sure nothing is kept in storage for later.

If you want to use Firefox for browsing in parallel, you can create a separate profile for it. To do this, just launch it with

firefox -P

Combine with -private to start in private browsing mode. Add a profile name behind the -P to select a specific profile automatically.

There also seems to be an undocumented -offline option, so if you create a profile named “test”, you can start it in both offline and private modes with

firefox -P test -offline -private
5
  • 1
    That's a really nice feature! Thank you for pointing out out. I actually didn't know that menu (made visible with 'alt') was even there!
    – Cort Ammon
    Commented Jun 11 at 1:29
  • These days -no-remote is no longer required to multi-instance with separate profiles, and I'd actually recommend against it: it breaks things like desktop notifications.
    – Bob
    Commented Jun 11 at 1:41
  • @Bob thanks for the info, I have removed it from the answer
    – Didier L
    Commented Jun 11 at 9:14
  • You might want/need -new-instance instead of -no-remote.
    – allo
    Commented Jun 11 at 16:24
  • @allo -new-instance also does nothing particularly useful (ref): all it does in modern Firefox is change whether an error is shown if you attempt to re-use the same profile. The only requirement to launch a separate profile is to simply specify the profile with -P, since Firefox 67 fixed remoting with multiple instances.
    – Bob
    Commented Jun 12 at 8:30
9

You can use Firejail to sandbox a particular Firefox instance. This allows you to restrict network access, ranging from no access at all to forcing all traffic through a firewall for more fine-grained rules. Alternatively, you could run Firefox in a container (like Docker) or virtual machine. The latter two options are more heavyweight, though.

Setting up a local copy of the playground application is definitely a good idea. Since the code is open source, you don't have to scrape the files.

Note that the application makes requests to schema.org for downloading schema information, so disabling network access entirely may be tricky. However, you can fix this with a firewall, or download all necessary schema files in advance (if you know what you'll need).

9

You can use an addon like uMatrix that injects CSP headers to prevent cross-site network requests.

Note that this may not work with file paths, as there are no HTTP headers, so no CSP header can be injected. A workaround is to use a local HTTP server. You can for example use python:

python -m http.server --bind 127.0.0.1

to serve a folder at http://localhost:8000.

1

Is there a way to prevent javascript in a browser from doing anything that can communicate with the internet (e.g. loading additional images or requesting documents via the Fetch Api).

Content Security Policy is a method to limit which resources a webpage can load. This can effectively prevent "loading additional images or requesting documents via the Fetch Api", but it is not perfectly watertight against data exfiltration. In particular, malicious JavaScript can create a <a> link tag with a URL that contains some sensitive data and click that link using JavaScript.

Isolated Web Apps somewhat do what you want. You install an IWA once and after that its integrity is protected. Again, if it contained malicious code when it was installed it can still exfiltrate sensitive information.

1
  • 1
    Content Security Policy (CSP) does only work if you control the server, or , as an alternative, the HTML code, for some directives. The OP, in the original setup, does control neither.
    – Marcel
    Commented Jun 11 at 13:30
1

Most browsers, including Google Chrome and Firefox, support an offline setting in the F12 developer mode.

While this is not targetted at the casual user, it's easy to temporarily set. See https://stackoverflow.com/a/29326005/79485 for example with Google Chrome.

1
  • This. Devs need to be able to test their offline functionality, and browsers need to support it in the devtools. Commented Jun 11 at 14:32
1

As an alternative to all the offline-mode browser options (which are good, to be clear), you can also prevent a program from accessing the network, via outbound firewall rules. On Windows and Linux this can be done with in-box tools; MacOS used to require third-party tools but possibly no longer does. Essentially, just create a browser executable with a different name (either install a browser specifically for this purpose, or copy an existing browser executable under a new name; it might even work to just use a symbolic link to a normal browser), and then set firewall rules that prevent the new executable from traversing the firewall at all.

This has the advantage of not requiring program-level support for offline mode; you can use this to isolate any program - from nosy software that wants to "phone home" to games that only use network functionality to show ads - from the Internet. It's not secure against actively malicious software running with otherwise-normal permissions (such software could, for example, create a new copy of itself under a name that is allowed network access, and then execute that copy), but it works fine against malicious browser javascript assuming the javascript hasn't already broken out of the browser sandbox (and if it has, you have bigger problems!)

0

I didn't see an OS mentioned, however, if you're on Linux you could instal your browser under flatpak, and then switch the network off explicitly. Overall, this strategy gives you a browser for which it is much less likely that there will be any access (either way) between the running application and your host user session, home directory, etc.

flatpak run \
  --unshare=network --unshare=ipc \
  --nofilesystem=host --nofilesystem=home \
  --filesystem=/home/user/Downloads \
  org.mozilla.firefox

This is what I've done in the command shown above, where I disable network and ipc subsystems, and prevent access to host and home storage profiles. I then explicitly allow access to the Downloads directory only (and all sub-dirs), but you could choose any. You can also launch this pak, do some things in the shell, and then launch the gui app. For example:

flatpak run --unshare=network --unshare=ipc --nofilesystem=host --nofilesystem=home --filesystem=/home/user/Downloads \
  --verbose --command=bash \
  org.mozilla.firefox
...
[📦 org.mozilla.firefox ~]$  # do-stuff
...
[📦 org.mozilla.firefox ~]$ /app/bin/firefox  # launch gui

DISCUSSION

Behind the scenes, flatpak will use bwrap (bubblewrap) to encapsulate the application and its dependencies, and isolate it from the host to varying extents by dropping capabilities. (In this case, it is for ease of configuration and app-repo.)

I recommend starting the browser for the first time offline, configure the profile settings for privacy, then restarting to make sure settings hold. Next go online and instal extensions (such as uMatrix or uBlock-origin), as well as a garish theme so it's instantly recognisable... there's plenty to choose from! Then go offline again to introduce the sensitive data.

Aside from explicitly sharing parts of the file-system, there are shared directories already mapped in both spaces. For example, /run/user/1000/.flatpak/org.mozilla.firefox/tmp/ is mapped to /tmp inside the running pak.

Conveniently the mozilla pak also has openssl and gpg bundled, which gives more options for data security. Any data decrypted to the ~/ home directory inside the running pak will be isolated from the host user session and filesystem. (Root and memory access would be required to access data that are within the running pak.) Note that key-presses are not isolated however.

(Test what the browser could see, in the event of a break in containment, by navigating to the file:/// url. Test what can be seen inside the running pak by creating a uniquely named file in various spots, and then trying to find that file from the host user session.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .