32
Is there a way to block browser JavaScript from executing commands that retrieve sensitive information from my local machine, while still allowing JavaScript that is only used for rendering web pages? (lemmy.world)
submitted 4 days ago* (last edited 4 days ago) by happeningtofry99158@lemmy.world to c/privacy@lemmy.ml
13 comments fedilink hide all child comments

As a security-conscious user, I've used NoScript since Firefox's early days, but its restrictive nature has become frustrating. I'm often forced to go unprotected just to access websites with multiple scripts running on different domains, which defeats the purpose of using NoScript and balances security and usability that it once provided.

Is there a way to block browser JavaScript from executing commands that retrieve sensitive information from my local machine, while still allowing JavaScript that is only used for rendering web pages?

by sensitive information I'm referring to

  • local machine time
  • local machine ram
  • local machine operating system + version
  • local machine hardware
  • Serial Number
  • Hardware ID
  • UUID
  • Windows Device ID
  • Windows Product ID
  • ...

greatly appreciate any insight

EDIT:

could be possible solution

https://discuss.grapheneos.org/d/16025-vanadium-and-what-to-use-on-desktop/19

  • ~~LibreJS: GNU LibreJS aims to address the JavaScript problem described in Richard Stallman's article The JavaScript Trap.~~
  • JShelter: Mitigates potential threats from JavaScript, including fingerprinting, tracking, and data collection. Slightly modifies the results of API calls, differently on different domains, so that the cross-site fingerprint is not stable. Applies security counter-measures that are likely not to break web pages. Allows fine-grained control over the restrictions and counter-measures applied to each domain.

@bjoern_tantau@swg-empire.de

Most of those things cannot be collected through JavaScript.

Local time can.

RAM can only be approximated to protect user privacy. Edit: And it’s not available on Firefox.

OS+version are already in your browser’s user-agent string that is sent out with every request you make.

Machine hardware cannot be enumerated. JavaScript can try to guess your GPU based on what it can do with WebGL.

There is no way to get a serial number or similar.

To spoof timezone/OS+version/browser+version ... and disable WebGL, use https://sereneblue.github.io/chameleon/

top 13 comments
sorted by: hot top controversial new old
[-] wizardbeard@lemmy.dbzer0.com 7 points 4 days ago

Harsh question: Do you have a real need to prevent this data from being collected, or are you investigating just for ~~funsies~~ best practice advice? There are a lot of posts like this where people overestimate the threat model they have and insist on needing to block things that are nearly impossible to, or at least have significant tradeoffs like you are dealing with now.

Javascript is also not the only source that sites can use for these pieces of info from your machine. Local time in particular can be estimated by looking up the rough location of your IP address then matching to a time zone.

Anyway.

I would assume you could technically fork localCDN (replaces remote javascript libraries with local copies) and then manually edit the local javascript library copies to remove the calls you are concerned about.

There's also options like uBlock Origin's methods of only whitelisting specific scripts. Much more flexible than NoScript. You can block scripts that are third party and only allow site specific ones fairly easily, without digging deep into the settings.

Bear in mind that your specific combination of installed extensions can also be a unique identifier though.

[-] happeningtofry99158@lemmy.world 2 points 4 days ago

Do you have a real need to prevent this data from being collected

maybe

or are you investigating just for best practice advice?

yes

There are a lot of posts like this where people overestimate the threat model they have and insist on needing to block things that are nearly impossible to, or at least have significant tradeoffs like you are dealing with now

could you explain why it is nealy impossible from only blocking javascript from attaining "local machine operating system + version "? I don't think this kind of information is relevant for webpage displaying. I dont think webpage will break if we ban js from doing so

I would assume you could technically fork localCDN (replaces remote javascript libraries with local copies) and then manually edit the local javascript library copies to remove the calls you are concerned about.

that could work I guess when I have enough js knowledge

There’s also options like uBlock Origin’s methods of only whitelisting specific scripts. Much more flexible than NoScript. You can block scripts that are third party and only allow site specific ones fairly easily, without digging deep into the settings.

is it possible to adjust uBlock Origin whitelisting and disallow js that retrieve "local machine operating system + version " from running?

Bear in mind that your specific combination of installed extensions can also be a unique identifier though.

Does this mean website can see all the extensions I installed?

[-] normalexit@lemmy.world 6 points 4 days ago

Some browsers have built in fingerprint resistance techniques you can enable:

https://support.mozilla.org/en-US/kb/resist-fingerprinting

I wouldn't entirely trust it, but enabling this feature in strict mode would tick a few of your listed boxes.

[-] hexagonwin@lemmy.sdf.org 2 points 4 days ago

maybe jshelter can help?

[-] happeningtofry99158@lemmy.world 1 points 4 days ago

thanks a lot

[-] 0x01@lemmy.ml 2 points 4 days ago

Javascript can't generally access your local machine directly, but scoped local data like cookies are available. What in particular are you nervous about? You could run your browser in a virtual machine?

[-] happeningtofry99158@lemmy.world 1 points 4 days ago

by sensitive information I'm referring to

  • local machine time
  • local machine ram
  • local machine operating system + version
  • local machine hardware
  • Serial Number
  • Hardware ID
  • UUID
  • Windows Device ID
  • Windows Product ID
  • ...

Can I prevent javascript from running specific command that retrieve these information?

[-] 0x01@lemmy.ml 3 points 4 days ago

You could monkeypatch some javascript functions like the constructor Date types, but there will always be things not thought of that will leak date info. Hardware identifiers are quite difficult to get in javascript and several browsers already obfuscate that info.

Honestly if you're very concerned, I really do think a virtual machine is your absolute safest approach, obviously the browsing experience is worse.

Check out amiunique.org to see what fingerprinting is generally available in your current browser

[-] bacon_pdp@lemmy.world 1 points 4 days ago

This is the closest thing I have found

https://www.gnu.org/software/librejs/index.html

[-] happeningtofry99158@lemmy.world 1 points 4 days ago

and seems to be better than noscript

[-] rschofield@lemm.ee 1 points 4 days ago

Have you looked into Pi-hole?

[-] happeningtofry99158@lemmy.world 3 points 4 days ago

from my understanding it is a dns blocker, not sure how it is related though, could you elaborate?

this post was submitted on 23 Jun 2025
32 points (100.0% liked)

Privacy

39239 readers
352 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
k_o_t@lemmy.ml
tmpod@lemmy.pt
Yayannick@lemmy.ml
ranok@sopuli.xyz