mjhjmtu

This might be paranoid, but if I go to a malicious website, can they tell what is inside a PDF on my desktop or what is inside my images on my hard drive?

I have a Chromebook and a Windows machine.

Unless you explicitly grant a website—which is secure (HTTPS) or insecure (HTTP)—access to an item on your system that website will not have access to that item on your system.

This might be paranoid, but if I go to a website that might not be 100% secure, can they tell what is inside my hard drive desktop's PDF or what is inside my images on my hard drive?

Unless you explicitly give them access to your hard drive—or documents on your hard drive—then no, an insecure website won’t be able to access anything.

The only concern with a website that “might not be 100% secure” (and I am assuming HTTPS versus plain HTTP) is that when you transmit data back and forth HTTPS is encrypted and HTTP is not encrypted.

The risk then is if you type something into the site via a form and such, if the site is plain HTTP then the data you are transmitting is just clear text that anyone with a packet sniffer has the potential to read. But that is a slim chance at best.

Like if you are on a known public Wi-Fi network then maybe someone is on that network with you and potentially capturing packets and thus could detect what you are typing.

But in general if you are on a secure network at home or elsewhere you are “safe.”

In general, an “insecure” website only matters if you send data to them.

A remote computer can't access anything on your computer without the aid of co-operating software on your computer.

In the case of you using your computer to visit an untrusted website, you are using browser software on your computer to initiate web requests (the HTTP or HTTPS protocol) to receive data from the remote computer. In this simple model, the remote computer has absolutely no access to your computer, but... browsers have some features which complicate this picture.

Modern browsers have a feature which allows you to upload files from your computer. A website may include a form which makes use of this feature. This feature does not give the website a view into your computer. When your browser processes such a form, it presents you with a file selection control; your browser can see the files on your computer, and when you make a selection, your browser sends the contents of that file, and only that file to the remote system. The way this feature works leads some people to believe that the website can see files on your computer when it actually cannot.

All modern browsers have JavaScript engines built into them. The website may include JavaScript code which is intended to be executed by your browser. When the browser receives JavaScript in a page, it will typically execute it automatically. JavaScript is normally used to enhance the user experience; it has certain capabilities and some limitations. The JavaScript engine can't "see" into your computer - can't see your files or what may be going on in other programs, but it can direct the browser to load other files from the same site - images, pages, etc.. JavaScript could make the browser at least attempt to download and execute a program which may have greater access to or control over your system. While JavaScript itself is limited in what it can do on your computer, it is nevertheless possible for a malicious programmer to make use of JavaScript to trick an unsuspecting user into downloading a more capable and malicious program.

TL;DR: An untrusted website cannot by itself see into your computer. But, a site can try to trick you into downloading and executing malicious software. Such software could potentially do anything on your computer. Your browser should not automatically download such software; at the very least, it should require your explicit acceptance. A malicious website could, however, try to trick you into giving such acceptance.