#74 Consider protection from leaky forms
Opened by polcak. Modified

Previous research focused on leaky forms, e.g.:

  • https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities web-trackers-
    exploit-browser-login-managers. (also available as PETS paper)
  • Nikiforakis, N., Invernizzi, L., Kapravelos, A., Acker, S. V., Joosen, W. et al. You Are
    What You Include: Large-scale Evaluation of Remote JavaScript Inclusions. In:
    Proceedings of the ACM Conference on Computer and Communications Security (CCS).
    New York, Washington, USA: [b.n.], 2012.
    Available from: https://www.kapravelos.com/publications/jsinclusions-CCS12.pdf
  • Starov, O., Gill, P. a Nikiforakis, N. Are You Sure You Want to Contact Us?
    Quantifying the Leakage of PII via Website Contact Forms. In: Proceedings on
    Privacy Enhancing Technologies. Darmstadt, Germany: Sciendo, Záÿí 2016. DOI:
    10.1515/popets-2015-0028. Dostupné z: https://doi.org/10.1515/popets-2015-0028.
  • https://www.wired.com/story/leaky-forms-keyloggers-meta-tiktok-pixel-study/, https://homes.esat.kuleuven.be/~asenol/leaky-forms/#leak-inspector

We have a code that aims to provide protections from leaky forms, see https://github.com/polcak/jsrestrictor/pull/94

Regarding the permissions:

  • browsingData and webNavigation - we already need this (browsingData is optional for Firefox) so if we made the functionality optional for Firefox, we do not need additional permissions.

  • contextMenus - the permission is not needed, we can make the locking work through pop up or make the permission optional.

So I do not think that permissions are a problem anymore.

The problem is making the functionality really work. We added a mechanism to automatically lock forms that works for some forms but does not for others. Another issue is in letting the user know that the page is locked (a notification that some users seem to hate? changes in DOM that are fingerprintable?). There is an issue in breaking Chrome navigation. For more details see https://www.fit.vut.cz/study/thesis-file/23572/23572.pdf (especially Chapter 7, in Czech, try automatic translators).


Metadata