Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does the US Visa application website do a port-scan of my network?

news.ycombinator.com

Post reply on HN
Print view View original

261–269 of 269 posts

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#261

Post by johncolanduoni »

adastra22 wrote: post #254
johncolanduoni wrote: post #242

Earlier quoted context omitted.

It’s more that it wasn’t prevented back when the web was first coming together, because security wasn’t on almost anyone’s minds at all. There wasn’t a hole added at some point; it’s just that browsers didn’t specifically block domains that resolve to public IPs from accessing domains that resolve to private IPs. Realistically, it’s a backdoor to every network firewall that has existed for the entire era in which bro…

i thought it was prevented by standard browser cross-domain security checks. Thats why I'm so surprised.

Requests that need a CORS preflight will fail with any browser from the last 20 years, yes. The private IP addresses are not any more vulnerable than `www.google.com` is from `www.notgoogle.com` for cross-origin policy (subdomain-sensitive policies have a small extra vulnerability). But you’re right that doing this kind of thing without nefarious intent is an insane edge case and it should be opt-in. People spray `Access-Control-Allow-Origin: *` like it’s DDT in the 50s and half ass security in general when it’s on an intranet, so an extra guardrail is still worth it.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#262

Post by M95D »

akimbostrawman wrote: post #248
M95D wrote: post #247

Earlier quoted context omitted.

But it is intuitive... I don't know what you mean. You can't manage a whitelist with a single big red on/off button, if that's what you want.

You technically can, that is what community website rule Recipe are for.

I didn't knew community/public whitelists exist, nor any browser extension that uses whitelists and blocks all other connections by default, like uMatrix does. Do you have any examples?

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#263

Post by wlonkly »

jpeggtulsa wrote: post #243
karel-3d wrote: post #63

It's coming from a F5 script, which is a company that sells anti-bot protection amid other things. (It's coming from obfuscated script at /TSPD, which is a F5 thing.) https://www.f5.com/

Isn't F5 the company that makes nginx?

That bought nginx, but yes!

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#264

Post by psd1 »

adastra22 wrote: post #255
psd1 wrote: post #227

Earlier quoted context omitted.

I'm hazy on the details, but: Home Assistant has a well-known public name that opens your local instance. On first access, you need to give it the name or ip of your instance, which is saved in browser storage. This supports deep links into your config from forum posts. My mum also had a shitty D-Link wifi mesh device, which was packaged as an appliance. I cannot speak lowly enough about that garbage device, but then…

How is that the same thing? That is a DNS entry that resolves to an internal IP. That lets a user explicitly type a domain and get something internal. That wouldn’t allow cnn.com to ports scan my fridge.

No, it is not, or it would not work outside 192.168.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#265

Post by akimbostrawman »

M95D wrote: post #262
akimbostrawman wrote: post #248

Earlier quoted context omitted.

You technically can, that is what community website rule Recipe are for.

I didn't knew community/public whitelists exist, nor any browser extension that uses whitelists and blocks all other connections by default, like uMatrix does. Do you have any examples?

I meant that uMatrix has that community rules recipe feature you can apply with few clicks.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#267

Post by razodactyl »

Dylan16807 wrote: post #244
qingcharles wrote: post #209

Earlier quoted context omitted.

One thing a developer sat in DC or SV with a 5G iPhone 16 doesn't realize too, is that if you are visiting these web sites with a phone plan that has a tiny monthly data allowance then this bloat can blow out an entire month in one sitting. I worked with people on parole that were given free phones to use for job applications, finding their way around etc, and they would only get 3GB data a month. Some of the sites t…

> You'd get some plans that would drop down to 2G, but try using that for Google Maps when you're trying to find a bus to get you across the city. Sure, I'll do my best to try it. I'll approximate the throttle by limiting chrome to 128kbps, 500ms delay, and 5% packet loss for fun. With a fresh incognito session, google responds to "here to 4th street" in 10 seconds, and when I click to open maps it needs just under t…

There should be settings to emulate the bad network conditions: 2G in the field is nothing like the browser throttling.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#268

Post by dietr1ch »

gmueckl wrote: post #191
mrtksn wrote: post #46

Earlier quoted context omitted.

That would be quite clever for an incredibly horrible website. The other day my SO, who is a Turkish citizen, was filling up her visa application and after half an hour of meticulous form filling the system just kick her out. I think the session times out or something. If you haven't created an account or you haven't write down the current application ID everything is lost. In the process she was also directed to a n…

I had to deal with the DS-160 multiple times over the year. I don't think you give justice to how bad this website really is. I have started to notice that these "timeouts" are very random. At the worst times, the session "times out" immediately after login. These random logouts happens more frequently during certain times of the day and seems to follow a semi-predictable pattern. It is almost certainly tied to syste…

It's so bad that I used to have a DS-160.txt file with most of my responses so I could speed run a copy-paste session before something went wrong. The 5yr travel section was awful to fill.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#269

Post by Dylan16807 »

razodactyl wrote: post #267
Dylan16807 wrote: post #244

Earlier quoted context omitted.

> You'd get some plans that would drop down to 2G, but try using that for Google Maps when you're trying to find a bus to get you across the city. Sure, I'll do my best to try it. I'll approximate the throttle by limiting chrome to 128kbps, 500ms delay, and 5% packet loss for fun. With a fresh incognito session, google responds to "here to 4th street" in 10 seconds, and when I click to open maps it needs just under t…

There should be settings to emulate the bad network conditions: 2G in the field is nothing like the browser throttling.

It's not 2G in the field. 2G networks are gone. It's most likely 4G, plus a throttle, and the throttle is probably 128kbps.

And I put on a significant delay and significant packet loss. Was that not enough? Do I need something else too?

Post reply on HN