There are websites which display user information, such as browser version and operating system

This website goes even further, and displays some additional information, such as desktop resolution, and also any secondary network interfaces. In my case, it detected my eth1 network interface

I have noticed that this information is only available when javascript is enabled. I am wondering therefore, what else is accessible through javascript. In particular, if javascript can access files in users home.

  • Your question is kind of general as javascript in a browser can access a number of relevant characteristics of your system (screen resolution, window size, OS version, browser version, browser plug-ins installed, etc...). It cannot however access arbitrary files on your computer or your home network. – jfriend00 Apr 8 '14 at 18:20

This is a moving target, as there is a cat-and-mouse game as attackers discover new techniques and browsers implement new defences. In general, JavaScript:

  • can access config information about your browser and plugins. The site you linked seems to be a good summary of the current techniques.
  • cannot access your local files, at least, unless you explicitly drag and drop a file (or use a file upload field). Nor can it access your address book.
  • can only access cookies (and HTML 5 local storage) from its own domain, not others.
  • can sometimes see your web history, using CSS history sniffing. This leak is largely fixed in newer browsers, but some subtle issues remain.
  • can load resources (e.g. images) from other sites. It can't access the content (unless it's an explicitly allowed cross-domain request).
  • cannot access JSON data from other sites. This used to be possible using JSON Hijacking but modern browsers have fixed this.
  • can tell how long a resource takes to load. This can be abused to tell if a user is logged in to a particular site, and even if they have any messages that match a particular search string.
  • can exploit vulnerabilities (e.g. cross-site scripting, cross-site request forgeries) on other web sites, and against the web browser itself.
  • can perform computations for the site owner, using the client's computer e.g. BitCoin mining.

An interesting related question is what can content like Java, Flash and PDF do? My knowledge runs out here, but I do know that a PDF file can print a document with no user interaction. Quite surprising - a fully patched 2014 browser allows an untrusted website to automatically print!

If you want to know the full story, read The Browser Security Handbook.

| improve this answer | |
  • 1
    That is interesting. But how can you explain then, that the website can see my secondary network interface? – Martin Vegter Apr 9 '14 at 10:56
  • @MartinVegter - The site uses WebRTC to get that information; whatismybrowser.com/what-is-my-local-ip-address I would class this as example of my first point "config information". – paj28 Apr 9 '14 at 11:19

One more point is the GeoLocation API, which can be used to determine your coordinates.

If it is available and the user agrees, you can do

navigator.geolocation.getCurrentPosition(function(position) {
  do_something(position.coords.latitude, position.coords.longitude);
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.