I feel like that web only is a positive way forward. If only it was possible to prove nothing goes back to the server I think it would gain a lot more trust. Though companies who want to see your data might not be so keen. On my phone, but will try it out when I get home.
I've long wished for something like OpenBSDs pledge to be available in browsers, ideally both through meta tags and through JS APIs. Once a pledge is made, the resource will be unavailable to the page until it's closed, like: - I pledge to only make network connections to X, Y and Z - I pledge to only make GET requests to http://example.com/foo/ * - I pledge not to use canvas, iFrames or storage APIs This info wouldn…
* first requirement can already be done using Content-Security-Policy header
* haven't found a suitable header for the second requirement
* third requirement can be done with Permissions-Policy header