[HN Gopher] Show HN: Firefox addon to quarantine a tab to use of...
___________________________________________________________________
Show HN: Firefox addon to quarantine a tab to use offline with
private data
Introducing QuaranTab: Companion extension to quarantine tabs so
you can safely use them offline with private data I find myself
wanting to use online format parsers to quickly decode that
production JWT or decode a base64 Authorization header but cannot
trust these websites to not leak my information. I thought to
myself if only I could cut-off network access to this site, use it
offline, and then throw away all browsing data. So I created an
extension just for that. It uses Firefox contextual identities API
(Containers) to isolate browsing data and inter-tab communication.
Once the site is fully loaded, I then inject bogus proxy settings
for any requests leaving that container to effectively cut-off
network access. And once I'm done, I simply delete the Container.
Use Cases: * Parse a live JWT token * Convert a Base64
Authorization header * Hash a password * Parse a Protobuf message
* Submit my name and birthdate to estimate my date of death Check
out the MIT source code on GitHub [1] and install QuaranTab from
the Firefox store [2]. If anyone is interested in a discussion, I'd
love to chat about: 1. Any ideas on how we could implement this in
Chromium? Using private window as a "Container"? 2. Can you come
up with an exploit? I posted a 100usd bug bounty [3] if you find
one! 3. Is there any way to prove an extension in the store was
built from source in GitHub? I am imagining some kind of third-
party escrow service managing the Firefox store account and
building from specific public git repository. 1.
https://github.com/matusfaro/quarantab 2.
https://addons.mozilla.org/en-US/firefox/addon/quarantab/ 3.
https://github.com/matusfaro/quarantab#bug-bounty
Author : matusfaro
Score : 100 points
Date : 2023-09-11 16:06 UTC (5 hours ago)
| webstrand wrote:
| It would be nice if the code in the .xpi wasn't minified.
| matusfaro wrote:
| I can certainly do that. I used a browser extension boiler
| plate that minifies it by default. I submitted an issue for
| myself to fix this [1]
|
| 1. https://github.com/matusfaro/quarantab/issues/3
| mikae1 wrote:
| Thanks, now I can begin using https://gpx.studio
| solardev wrote:
| Cool add on! Thanks for this. It's a use case I've often thought
| about, for the purposes you mention. I wish there was a built in
| permission to disable AJAX after page load. Bad for ads, I guess.
|
| 2. Exploit idea (not trying for the bounty, just thinking aloud).
| I wonder if a website could play background music (or a video)
| with stenographically encoded data, then another tab could listen
| to it with microphone permissions on and decode it that way. I'm
| thinking like a fake video conferencing site, or malicious
| telephony how-to doc that deals with API calls and such and links
| to a fake password hasher that then plays the audio for the first
| tab to hear. Convoluted, I know, just an idea.
| matusfaro wrote:
| > built in permission to disable AJAX after page load
|
| Interesting, but consider this is a cat-and-mouse game. If you
| are the only one using this trick it may work for you, but I
| assume would be easy to overcome. (e.g. keep the page loading
| forever or until ads are loaded. Have the ads be J-free after
| page load, ...)
|
| > website could play background music ... another tab could
| listen
|
| You would need mic access from the other tab, but yes. If you
| send it over high enough frequency you wouldn't even hear it.
| You would just have a visual feedback that the tab is playing
| music.
|
| On a side-note, I recall there was some kind of hardware device
| pairing (maybe Chromecast?) that used data over voice to
| establish that you are physically near the other device.
| solardev wrote:
| > On a side-note, I recall there was some kind of hardware
| device pairing (maybe Chromecast?) that used data over voice
| to establish that you are physically near the other device.
|
| Yeah, that's pretty common in home smart devices. Looks like
| Google patented one version and Sonos has their
| implementation too. In my experience it works better than
| Bluetooth, especially in (2.4 GHz) noisy environments
| matusfaro wrote:
| Funny that you say Sonos.
|
| I also remember there was a data-over-voice library called
| "chirp.io" which now redirects to Sonos homepage. Now I
| know why they acquired them :)
| solardev wrote:
| I wonder if it's also part of the patent battle they got
| in with Google over smart speaker stuff.
|
| Side rant: It's so sad, to this day Google Assistant
| works terribly on my Sonos system, and it's a major
| reason I'm reluctant to further buy into their ecosystem.
| And Sonos's own assistant doesn't even support Spotify,
| last I checked. Their whole UX is... not great. I really
| wanted to work there and maybe try to fix some of the
| issues I experience as a user, but they rejected me.
| Alas.
| matusfaro wrote:
| We have our first bug bounty!
|
| Thank you "dz2742" for finding out [1] existing connections
| including websockets are not terminated and has won 100 USD! This
| is exactly the type of exploit I was hoping to catch.
|
| Now I have to figure out how to fix that :) And also think about
| refilling the bug bounty pool without becoming very poor very
| soon.
|
| https://github.com/matusfaro/quarantab/issues/2
| stainablesteel wrote:
| that's a nice idea
|
| the same way you can silence the sound output of a tab you should
| have as simple and reliable a tool to stop communication to
| either the network, os or both.
|
| i'd love a tool to see which tabs are talking with each other
| also
| matusfaro wrote:
| > love a tool to see which tabs are talking with each other
| also
|
| Cool idea but probably not that useful and difficult to
| accomplish. There are many ways to communicate that could be
| grouped into:
|
| 1. tab -> tab (same domain)
|
| 2. tab -> tab (different domain)
|
| 3. tab -> server -> tab
|
| For #1, there are so many ways to transfer information it would
| be hard to detect and differentiate whether it's communication
| or just happens to be using the same resource. (e.g. one sets a
| cookie or local storage and the other one reads it)
|
| For #3, it would be impossible to detect. Especially if
| detection is an issue, both tabs could be communicating with
| unrelated servers which talk with each other.
|
| For #2, it would be the only interesting one as there is
| limited options (e.g. Broadcast Channel), but at the same time
| I assume rarely used in practice. And if detection is an issue,
| they would switch to #3 to avoid it.
| ravenstine wrote:
| Cool idea! I don't really picture myself using this, but I think
| this add-on is a great example of how great a browser Firefox is.
| I'd be the first to critique Mozilla, and there are definitely
| things about Firefox I don't like (ex. Pocket, telemetry on by
| default), but overall I think it's an amazing product in that it
| allows for multiple levels of isolation (profiles, containers,
| private mode) and a level of control over them that Chromium
| either doesn't do as cleanly or doesn't do at all. As an aside,
| the only thing I think Chromium does better is the debugging
| experience; I don't truly understand why Firefox thinks it
| shouldn't support debugging Node.js like Chromium does.
| matusfaro wrote:
| > it allows for multiple levels of isolation
|
| Yes! Chrome has a visually similar functionality to Firefox
| Containers hidden away behind a feature flag [1] at the moment.
| BUT under the hood it's simply just tab grouping with no
| isolation. I presume isolation is against Google's interests so
| we will never see this kind of feature.
|
| As for Firefox's API, the Contextual Identities API [2] that
| allows you to create/delete containers is amazing and easy to
| work with as a dev. And it works out-of-the-box, it doesn't
| need the companion addon Multi-Account Containers (MAC) [3]
| which really should've been part of Firefox in my opinion.
|
| 1. chrome://flags/#tab-groups-save
|
| 2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-
| ons/Web...
|
| 3. https://addons.mozilla.org/en-US/firefox/addon/multi-
| account...
| bad_user wrote:
| Firefox's containers are useless for privacy, given other
| enhancements of Firefox (e.g., Total Cookie Protection). And
| as far as "isolation", privacy or security are concerned,
| Chrome's profiles are actually superior due to ability to
| have different extensions and history per profile. Chrome's
| extensions in general still have superior security (e.g.,
| activate on click or only for certain websites), so sometimes
| different profiles aren't even needed.
|
| Chrome's Profiles are also remembered when you "install an
| app" (SSB/PWA), so you could have "apps" started in their own
| profiles.
|
| Firefox's containers are only useful if you want multiple
| logins to the same service in the same browser window. But I
| never found that usecase to be very compelling.
|
| Firefox's containers are an often lauded feature, and I don't
| understand why, given the integration issues or general
| awkwardness. It's probably a reminiscence of the "Facebook
| container" extension, which was a bandaid until better site
| isolation was implemented.
| matusfaro wrote:
| > Chrome's profiles are actually superior due to ability to
| have different extensions and history per profile
|
| Interesting attack vector I haven't thought about which
| could leak information out of a network-locked Firefox
| Container. It would be under an assumption you have either:
|
| 1. A malicious extension installed (you have a much worse
| problem in this case)
|
| 2. A side-effect of an existing extension that leaks
| information to the outside world. (e.g. translate a part of
| a page, lookup a word in a dictionary, pre-fetch some
| images...)
|
| > Firefox's containers are only useful if you want multiple
| logins
|
| I think there are valid use cases for both Containers and
| Profiles. You can go down the list to have more and more
| isolation as needed:
|
| - Grouping tabs to stay organized, no isolation
|
| - Firefox containers, same browser window, shared history &
| extensions
|
| - Chrome profiles, almost complete isolation within same
| browser (different processes)
|
| - Separate browser instances
|
| - Separate devices
| stonogo wrote:
| Firefox has profiles too. Containers are for use within a
| profile. You keep saying that containers aren't useful but
| you don't elucidate on _how_ they are useless for privacy
| or _what_ integration issues exist. I don 't know how to
| interpret 'general awkwardness.' Can you fill in some
| details?
| roldie wrote:
| A counter anecdote is that I have the exact opposite use
| case. I don't share my computer with other users, so I've
| never needed something like profiles. Firefox containers
| are great for keeping different sites, especially those
| notorious for tracking (e.g. Amazon, Google, LinkedIn)
| completely isolated from each other or from general
| browsing. Plus, the extension that allows for creating
| temporary containers is great for one-off visits to
| e-commerce sites without needing to switch to a new
| private/incognito window. I'm not sure I've ever wanted my
| extensions isolated by container/profile, that seems like
| it would hinder productivity. Same for history. It's great
| having all my history commingled, especially if I want to
| find something from 30 tabs ago.
| vorticalbox wrote:
| Firefox really needs to release containers for mobile.
| matusfaro wrote:
| The Contextual Identity API indicates that it's supported
| [1] in Firefox for Android so will need see how usable it
| is. I was planning on testing my extension on Android soon.
|
| Looking into it more, there is an open request to complete
| the work in Android Firefox [2] and also to make the MAC
| extension for Android too [3]
|
| 1. https://developer.mozilla.org/en-US/docs/Mozilla/Add-
| ons/Web...
|
| 2. https://bugzilla.mozilla.org/show_bug.cgi?id=1807456
|
| 3. https://connect.mozilla.org/t5/ideas/multi-account-
| container...
| justin_oaks wrote:
| Many of the use cases mentioned are available through a single
| tool called CyberChef.
|
| There is an online version [1] but it doesn't submit any data to
| any servers. It only loads JS for the operations it needs to
| perform.
|
| You can also download it and run it offline [2]. This is what I
| do.
|
| I'll leave it up to you to decide if this makes QuaranTab
| unnecessary or if it's the perfect reason to use QuaranTab.
|
| [1] https://gchq.github.io/CyberChef/
|
| [2] https://github.com/gchq/CyberChef/releases/
| boarnoah wrote:
| This extension is still very cool.
|
| +1 to Cyberchef, its awesome. If you really have qualms about
| the URL its trivial to re-host / serve it to yourself offline.
|
| My favorite part is whole recipe feature (Cyberchef builds a
| URL with the configured processors you use to process data).
|
| I find myself using that a ton to share XPath / JPAth
| expressions type work with sample data to others by sharing
| that URL.
| solardev wrote:
| > Submit my name and birthdate to estimate my date of death
|
| Totally off topic, but curious how this works? Nationality and
| life expectancy? Sex at birth? Assassins for hire?
| SahAssar wrote:
| DNaaS: Death Note as a Service
| matusfaro wrote:
| What actually triggered my idea was a recent DNaaS HN post
| [1] that tells you your expected life expectancy and other
| cool facts based on your country and birthdate which I was
| reluctant to input my actual birthday.
|
| 1. https://news.ycombinator.com/item?id=37324733&
| solardev wrote:
| Oh my god, this is scary. I don't _want_ to live until the
| 2060s, lol. It terrifies me to think about how the world
| will be then...
|
| But anyway, thanks for the link!
|
| For the curious, this is their methodology:
|
| > Remaining life expectancy at specific age (in days) was
| obtained by interpolating (spline) the 5 yearly/duration
| age-specific period life expectancies.
|
| > Population.io uses official demographic data produced by
| the United Nations and published in the World Population
| Prospects
| finite_depth wrote:
| [dead]
| necovek wrote:
| While I applaud your effort and thinking of privacy issues, I
| will continue to do these in a terminal and Python REPL for all
| the reasons you bring up.
|
| It would certainly be nice to get something ala F-droid for free
| software extensions like yours (which guarantees source code
| matches built package IIRC), as a response to your question 3.
|
| I am sure one can create an alternative extensions store in FF
| and change some config in about:config to use it, though it's
| likely non-trivial.
| matusfaro wrote:
| Agreed, and to be honest, this extension is more for myself as
| I would be extremely skeptical if someone else made it
| especially with the permissions it requires.
|
| It would probably be more successful as a feature added to an
| existing trusted extension such as Temporary Containers.
| nix0n wrote:
| > I will continue to do these in a terminal and Python REPL for
| all the reasons you bring up.
|
| Do you have a way to prevent terminal utilities from accessing
| the network?
| 5e92cb50239222b wrote:
| $ bwrap --unshare-net --dev-bind / / bash $ curl
| google.com curl: (6) Could not resolve host: google.com
|
| Or you could use firejail, or do it manually with `unshare`,
| or with any of the container runtimes (docker, podman).
|
| https://wiki.archlinux.org/title/Bubblewrap
|
| https://wiki.archlinux.org/title/Firejail
| matusfaro wrote:
| Interesting options, wasn't aware of those.
|
| The only minor counter-argument would be laziness as a
| security threat: the more difficult you make the process,
| the more likely the user will skip seemingly useless steps,
| thus compromising security.
___________________________________________________________________
(page generated 2023-09-11 22:01 UTC)