Re: [libreplanet-discuss] HTML tags that should be stripped for privacy reasons.

[Mike Gerwitz]

On Fri, Jan 27, 2017 at 13:29:52 +0000, Josh Branning wrote:
> What I would really like is implementation details on how to avoid many of
> the issues stated on this page:
> https://en.wikipedia.org/wiki/Internet_privacy
>
> So like two columns; Stated problem, and possible solution.

This isn't a problem that can be summarized as such with any meaningful
level of detail.

I'm not entirely sure what you mean by handling it on the
webserver.  Is this like a privacy-respecting proxy server (in which
case you can look into things like Privoxy[0])?  The other concern there
is that you'd have to MitM HTTPS connections (with the user's consent,
of course), which is dangerous.

There are many things that you'd have difficulty detecting outside of
the user's browser---you'd be doing static analysis on behaviors that
aren't entirely defined until runtime, or might be difficult to
detect.  If you don't entirely strip out JS, it's not possible to
mitigate most things unless you execute the code on your server and
analyze it (since it can just modify the DOM).

Ultimately, the user can trust only their web browser, not a remote
server, so mitigations also have to be done there.  And the level of
complexity there is staggering (see NoScript; Privacy Badger; uBlock
Origin; etc).

With regards to information, the Tor Browser has documented some
implementation details[1].

One of the best ways to learn how to mitigate issues is to know how to
exploit them, in practice and in theory.  OWASP has some good material
(duplicated in various projects, granted) that's readily available.[2]

You can also look at commits in repositories of these various projects.


[0]: http://www.privoxy.org/
[1]: https://www.torproject.org/projects/torbrowser/design/
[2]: https://www.owasp.org/index.php/Category:OWASP_Project

-- 
Mike Gerwitz
Free Software Hacker+Activist | GNU Maintainer & Volunteer
GPG: D6E9 B930 028A 6C38 F43B  2388 FEF6 3574 5E6F 6D05
Old: 2217 5B02 E626 BC98 D7C0  C2E5 F22B B815 8EE3 0EAB
https://mikegerwitz.com

signature.asc
Description: PGP signature