user data accessible through javascript in browser

Question

There are websites which display user information, such as browser version and operating system

This website goes even further, and displays some additional information, such as desktop resolution, and also any secondary network interfaces. In my case, it detected my eth1 network interface 192.168.0.6

I have noticed that this information is only available when javascript is enabled. I am wondering therefore, what else is accessible through javascript. In particular, if javascript can access files in users home.

Answer 1

This is a moving target, as there is a cat-and-mouse game as attackers discover new techniques and browsers implement new defences. In general, JavaScript:

• can access config information about your browser and plugins. The site you linked seems to be a good summary of the current techniques.
• cannot access your local files, at least, unless you explicitly drag and drop a file (or use a file upload field). Nor can it access your address book.
• can only access cookies (and HTML 5 local storage) from its own domain, not others.
• can sometimes see your web history, using CSS history sniffing. This leak is largely fixed in newer browsers, but some subtle issues remain.
• can load resources (e.g. images) from other sites. It can't access the content (unless it's an explicitly allowed cross-domain request).
• cannot access JSON data from other sites. This used to be possible using JSON Hijacking but modern browsers have fixed this.
• can tell how long a resource takes to load. This can be abused to tell if a user is logged in to a particular site, and even if they have any messages that match a particular search string.
• can exploit vulnerabilities (e.g. cross-site scripting, cross-site request forgeries) on other web sites, and against the web browser itself.
• can perform computations for the site owner, using the client's computer e.g. BitCoin mining.

An interesting related question is what can content like Java, Flash and PDF do? My knowledge runs out here, but I do know that a PDF file can print a document with no user interaction. Quite surprising - a fully patched 2014 browser allows an untrusted website to automatically print!

If you want to know the full story, read The Browser Security Handbook.

Answer 2

One more point is the GeoLocation API, which can be used to determine your coordinates.

If it is available and the user agrees, you can do

navigator.geolocation.getCurrentPosition(function(position) {
  do_something(position.coords.latitude, position.coords.longitude);
});