Can a malicious website access the contents of files on a computer?

Solution 1:

Unless you explicitly grant a website—which is secure (HTTPS) or insecure (HTTP)—access to an item on your system that website will not have access to that item on your system.

This might be paranoid, but if I go to a website that might not be 100% secure, can they tell what is inside my hard drive desktop's PDF or what is inside my images on my hard drive?

In general, unless you explicitly give them access to your hard drive—or documents on your hard drive—then no, an insecure website won’t be able to access anything.

That said (and emphasizing this to make it clear) there are indeed some incredibly rare—and esoteric—“zero-day” exploits that might be of concern in some edge cases. But in general, you—as an end user—need to go out of your way to allow a website to gain access to documents on your system. As long as your OS is patched and browsers are up to date you are safe. And even in cases where you are not patched and upgraded (and again emphasizing this to make it clear) the risk is still incredibly low.

The only concern with a website that “might not be 100% secure” (as the original question stated and I am assuming HTTPS versus plain HTTP) is that when you transmit data back and forth HTTPS is encrypted and HTTP is not encrypted.

The risk then is if you type something into the site via a form and such, if the site is plain HTTP then the data you are transmitting is just clear text that anyone with a packet sniffer has the potential to read. But that is a slim chance at best.

Like if you are on a known public Wi-Fi network then maybe someone is on that network with you and potentially capturing packets and thus could detect what you are typing.

In general if you are on a secure network at home or elsewhere—and your browser and OS are patched—you are “safe.”

An “insecure” website only really is a concern if you send data to them or you download an item from said website that will run code on your system.

Solution 2:

By design browsers do not allow this but there is always the possibility of a bug that can be exploited to gain a higher level of access to your system. These bugs are fairly rare and always fixed very quickly so this is mainly an issue if your OS or browser is out of date. Both of these auto update now so just don't disable auto updates and you can be sure of a fairly good level of protection against malicious websites.

Solution 3:

A remote computer can't access anything on your computer without the aid of co-operating software on your computer.

In the case of you using your computer to visit an untrusted website, you are using browser software on your computer to initiate web requests (the HTTP or HTTPS protocol) to receive data from the remote computer. In this simple model, the remote computer has absolutely no access to your computer, but... browsers have some features which complicate this picture.

Modern browsers have a feature which allows you to upload files from your computer. A website may include a form which makes use of this feature. This feature does not give the website a view into your computer. When your browser processes such a form, it presents you with a file selection control; your browser can see the files on your computer, and when you make a selection, your browser sends the contents of that file, and only that file to the remote system. The way this feature works leads some people to believe that the website can see files on your computer when it actually cannot.

All modern browsers have JavaScript engines built into them. The website may include JavaScript code which is intended to be executed by your browser. When the browser receives JavaScript in a page, it will typically execute it automatically. JavaScript is normally used to enhance the user experience; it has certain capabilities and some limitations. The JavaScript engine can't "see" into your computer - can't see your files or what may be going on in other programs, but it can direct the browser to load other files from the same site - images, pages, etc.. JavaScript could make the browser at least attempt to download and execute a program which may have greater access to or control over your system. While JavaScript itself is limited in what it can do on your computer, it is nevertheless possible for a malicious programmer to make use of JavaScript to trick an unsuspecting user into downloading a more capable and malicious program.

TL;DR: An untrusted website cannot by itself see into your computer. But, a site can try to trick you into downloading and executing malicious software. Such software could potentially do anything on your computer. Your browser should not automatically download such software; at the very least, it should require your explicit acceptance. A malicious website could, however, try to trick you into giving such acceptance.