948414 - Firewall of private data

Status: UNCONFIRMED

(Core :: Security, defect)

Description

[look997]

Attachment: eng1.png

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:27.0) Gecko/20100101 Firefox/27.0 (Beta/Release)
Build ID: 20131130004001

Steps to reproduce:

Normal browser use.


Actual results:

Current protection data Private, rely on the user's query, an application can use the API? Compared to native applications is one limitation as web-based application needs every time to wait for permission.
  It may also ask once for a wider access to the files.
  However, this is not the best solution because the permit application of these data can do whatever he likes, for example, send them to the server, or share plug, which may seriously endanger your safety.


Many of these application processes the data from the disk, locally and does not need to be able to send them outside the control of the user.


Expected results:

http://lukaszpolowczyk.blogspot.com/2013/10/partial-offline-web-applications.html

Target
 The aim is to create a new mechanism. You can call it a sort of partial offline.
the proposed solution will make this type of data will be freely read locally and at the same time will not be available for servers or plugins. However, if you need to share, you will be able to immediately allow access to such data.
  This will prevent unsolicited communications with local data processing and questions about permission to send is less than the questions about the license read data.

  Security and privacy of data is greater than ever, and native applications by controlling the sending of data, easy to control using open web standards and jawnemu code.
  Browser using this security will guarantee that the web application is reliable and the application developer is honest and if it will be unfair, then you will learn about it and protect your data.

With this level of security, you can easily make API supports System clipboard. Maybe you can combine them with DataStore?
Know anyone have any other possible reasons for the introduction of safety standards that, when enabled control of Private data will be possible in web applications?

Depending on the decision makers of browsers may be an extension or replacement of existing collateral.
If this idea is not completed, I hope that it will even inspire you to something else. 


 To submit a proposal for security, I introduced a few concepts:,

    API Observing - data from FileAPI, camera, microphone, accelerometer, etc.
    API Reaction - data entered from the keyboard cursor keys or the mouse, touch events, gamepad, and other user actions
    Private data - abbreviated name of the data from the API Observing and API Reaction
    Neutrals data - data from the server (application files, media, website content), generated by the application of the user on the basis of neutral information (other than the API Observing and API Reaction)
    Local Data Storage - localStorage, IndexedBD, browser cache, offline cache, cookies, etc. DataStore 



I. Principles of opeation
 Private data will not be available for any plugins or servers, even for that of the application was downloaded.
  To be able to share Private data outside your application, you must immediately allow it.

  In this state, the application is free to use locally (on your device) Private data, but trying to send to the server or plugins are controlled and blocked question.
It should be read to determine any restrictions on the data, most of the existing systems of access rights.
  Even in offline mode all data will be marked Private.

 However, the data are not being Neutral and will be sent and retrieved without any control or lock.



II. Exceptiion of API Reaction
The only exception to this effect will be that sending data from the API Reaction is not checked by default.
  You would have to know how to activate control the sending of data from the API Reaction.
When this security by the user, the data from the API Reaction will be controlled in the same way as those of the API Observings.

There is no need for a data protection API Reaction work right away because the user must type something on the keyboard or the mouse to point out something to the data from the API Reaction occurred in the application and does not need to interact with the site until you turn on security.
  If necessary just turn on the security just before entering private information such as text box or selecting choices away.

This protection for API Reaction will not be included immediately as this could impair the operation of the basic features of the application such as a login page or send messages.

 The data stored in local Data Storages
  It is questionable whether the given OPTION of being able to control all the data from local data stores.
This would to some extent solve the problem of tracking by advertising scripts.
Do not obstruct the normal functioning of the application. Reading such as user preferences for cookies would be possible. The application could not, however, these preferences to send to the server. Scripts must retrieve the tracking preferncje on a normal server applications do not have to.
It would be better than the existing solutions to this problem, which, for example completely block cookies.


III. Label the data Private
 Data from the API Observing and Reaction will be marked. During the processing of the application, or pledge the track.
  This track will be visible at the browser engine, so that the developer / application it will not have the designation of contact. This does not require the webmaster of any additional knowledge or writing any code.

    All data from the API Observing and API Reaction will be saved in the Private versions of data types.
        They will provide additional information about the origin of the data.
        With the browser differentiates between Neutrals data from Private data.
        The data type determines the browser and the script engine can not change it.
    It is necessary to record the type Private, also processed data Private, eg: 

data1; // from the Private data

var data2 = function(data1); // the result of a function that uses data1
var data3 = data2; // simple variable transmission
var data4 = data3+1; // modify data
var brforeFor = document.getElementsByTagName("*").length;
for(nr=0; data4.costam <= nr; nr++){ // data obtained from the loop made ​​using data1
    $("#element").appendChild(document.createElement("div"));
}

var data5 = document.getElementsByTagName("div").length; // number of these elements is Private
var data5a = beforeFor - document.getElementsByTagName("div").length // and even the difference between the number of all elements of the DOM tree before and after the loop is Private
var all = document.getElementsByTagName("*").length; // actually, the number of elements in general too, because the number before the loop can know the server-side application

if(document.getElementsByTagName("div")[20]){ var data6 = 10; } else { var data6 = 20; } // the existence of such a number of elements is sufficient information to dane6 was a private variable

$("#element").className = data6; // DOM attribute

// Obtained from data provided by the CSS and taken further example:
// style CSS: body { width: 100px;}
$("#element").style.width = $("#element").className+"px";
var data7 = $("body").clientWidth - $("#sidebar").clientWidth; // according to CSS properties

xhr(data7,"example.com"); // dane7 still controlled and considered to be Private
 

 At first glance it may seem too complicated but these relationships JavaScript, CSS, HTML, result from the specification of Web standards, so in spite of appearances, there should be an additional burden on the CPU.

    Saving Private data in local Data Storages
         Private data can be stored in local Data Storages, however, will be marked in the same way as the Private data in your application and during their treatment.
         The trail will also remain in future sessions of the application and even in other applications, if you will have access to the Data Storages.



IV. Control sending Private data

    If you attempt to use a function (XHR, submit, etc.), which refers to the server or to the plug, the browser checks to see if the outgoing data is stored in data type Private data.
        Data Observing API default will be controlled
        Data from the API Reaction will be controlled only if the user has control switches send data to API Reaction. By default, the sending will not be controlled.
    If they are, then the function is stopped and returns a status of "uninitialized" and waiting for your action.
    The message appears to you with detailed information about the data to be released. At the information is the question of whether the data can be sent.
        If the user agrees, then the script moves and status change as normal.
        If you do not agree to this status (to be determined):
             remains the same
            404
             you need to create a new status, indicating the absence of consent
    If necessary, one shot off the control of Private data (to avoid repeating the message) for: 
        various sources of data
        the whole session 
        current and future sessions



V. Management  
Security is controlled from the icon on the address bar or in another place, and the corresponding non-intrusive messages.

     The icon is always visible, and after you click you have access to:
        Options include safeguards for data from the API Reaction
        Options include local data protection for Data Storages
        Option to turn off security for the data from the API Observing
         Link to the list of data used by the application Private data
    If you try to provide controlled data on the server or Private data to plug a message appears that:
         Preview image, text, content text box choices indicated mouse, audio, data, etc., to be made available.
         The same view of the source data from which the data were obtained to provide.
         Information on the API from which the data (or the camera, a microphone, a disk (file location), etc.) and that are stored in the local Storage data.
         The date used by the application (stored in the Private data type, useful when using data from another session or application).
         The question "Is the disposal of the example.com domain?"
         Possible answers: Share, Always share, Not share.
         In the case of applications can not wait for the sharing of data, so the knives appear also asked for permission to disclose the data before using them (using the existing API). You can still send information to track sensitive data in the icon.

VI. Encription
API data encryption (mostly) Private data.

The application can only ask for a set of data encryption, encryption is a browser.
The encryption is independent of the application (as is the case for example mega.co.nz) and controlled by the browser, making it safer.

Because of that, the encrypted data is secure Private, the application can not be approved share / send and retrieve from the server / plugins.
The server only stores encrypted data inaccessible to him.
If encrypted data is Private, you keep your property being Private, even after decryption.


1. Proposed encryption API

tableEncrypt =  navigator.encrypt(blob/text); // generates an array of container and other data
tableEncrypt =  navigator.encryptToText(blob/text); // generates an array of encrypted data in the form of text and other data

 API call causes the encryption of the message:

     Viewer data to be encrypted (such as when sending data Private)
     Field to enter or generate a private key (with copy/save in file)
     Fields to enter or select from the list* public keys of people who want to share encrypted data
     Approved encryption key and a cancel process

 *A reliable list of contacts, can the built-in browser (Persona) may derived from application developers, but in some way protected against identity theft.

2. Sharing encrypted data with others

     The encrypted data can be automatically included copies of private keys.
     These copies of the private key will be encrypted with different public keys of which provides the data.
     Only the owners of the private key to the public key will be able to read the private key to shared data and decrypt the encrypted data.
     The application could read the list of public keys from the table and use it to identify in its internal system (listKeysPublic = tableEncript.publicKeyList;). 
    You can connect it somehow encrypted communication WebRTC/P2P.


 

3. API reading encrypted data
data2 = navigator.decrypt(tableEncript.data); // Private data after decryption will still be marked as Private

4 Choice
I would like to use this API was the standard used in every possible place.
When data is stored on the server but not available to him, it created some limitations, so application developers should leave the choice:

    Enable encryption offers greater security and avoids the use of data for purposes such as advertising or governmental request.
     If you forget the encryption for the possibility of such generating thumbnails server-side support in data processing by the server.  

 For example:
In Google+ photo could encrypt all your photos and share key access only to selected individuals.
Thumbnails would be generated on the user side, not function automatic selection of the best images.

But you can not force developers to use encryption, the question is how to convince them?

VII.Feeling of safety
Native applications with closed code could theoretically send private data (recording Skype, Windows every step you) against the wishes of the owners because you can not control it.

In view of the still not quite extinct scandal PRISM described in this article would be a security look no further.

Applications themselves are sufficiently controlled by the browser, so hackers could focus on verifying the reliability and safety code only browser, operating system and hardware.
By the way, how Mozilla sees to it that just before the compilation of the official builds of Firefox anyone has not added any user tracking code?

Comment 1

[look997]

Attachment: eng2.png

Comment 2

[look997]

Attachment: shareencripteng.png

Comment 3

[look997]

Translated Gogle Translate.

Comment 4

[Hallvord R. M. Steen [:hallvors]]

Not that I'm an expert, but.. tainting data seems 
1) Extremely hard. Difficult to implement, difficult to handle from an app developer's point of view.
2) Almost pointless. How many apps out there do you trust with your private data but you would NOT trust the server or the app's developer sufficiently to let the data travel over the wire? How am I as a user meant to make such a trust decision?

I vote for wontfix - for what it's worth..