search

mindedsecurity / behave

Behave! A monitoring browser extension for pages acting as "bad boi"
GNU General Public License v3.0
330 stars 22 forks source link

Detects IPFS/Companion using websites #15

Open Mikaela opened 4 years ago

Mikaela commented 4 years ago

I am not entirely sure if this is a bug or intented behaviour, but Behave! detects sites accessing resources from IPFS when using a local gateway (IPFS Desktop and IPFS Companion) and I think there should possibly be an option to whitelist it as it's the expected behaviour of IPFS Companion.

Example steps:

  1. Install IPFS Desktop from https://github.com/ipfs-shipyard/ipfs-desktop/releases/
  2. Install IPFS Companion (browser-extension) from https://addons.mozilla.org/firefox/addon/ipfs-companion/ or https://chrome.google.com/webstore/detail/ipfs-companion/nibjojkomfdiaoajekhjakgkdhaomnch
  3. Select IPFS Companion from browser toolbar and click on "Go To My Node" and Behave! will warn about access to 127.0.0.1:5001 (IPFS default API port).
  4. Alternatively visit a webiste such as mine, https://mikaela.info/, which fetches resources (in my case my avatar and favicon) from IPFS and Behave! warns about mikaela.info accessing 127.0.0.1:8080 (default IPFS Gateway port).
    • when the user isn't using IPFS Companion and IPFS Desktop/daemon, the site currently makes requests to ipfs.dweb.link instead. The purpose of IPFS Companion is to redirect the request to local gateway instead of a public one.
wisec commented 4 years ago

@Mikaela thank you for submitting this!

I'll look into it ASAP.

Mikaela commented 4 years ago

Since I opened this issue, I have also started trying IPFS CDN which is a fork of Decentraleyes that currently redirects Jquery requests to local IPFS gateway and also causes notifications.