> 4) Browser blocks anything which doesn't match strict key values & value values and doesn't leave browser in plain text.
It is not that hard to leak out arbitrary info in strings or even numbers
It is not that hard to leak out arbitrary info in strings or even numbers
This is a losing battle. Don't engage.
In any multilevel computer system there are a number of
relatively low-bandwidth covert channels whose existence is
deeply ingrained in the system design. Faced with the large
potential cost of reducing the bandwidths of such covert
channels, it is felt that those with maximum bandwidths of
less than one (1) bit per second are acceptable in most
application environments. [...] Therefore, a Trusted
Computing Base should provide, wherever possible, the
capability to audit the use of covert channel mechanisms
with bandwidths that may exceed a rate of one (1) bit in ten
(10) seconds.
All of this is to say: If I could limit covert channels from webpages or mobile phone apps to 10 bps I'd do it in a heartbeat. Perfect is the enemy of good enough.