Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Certificates for localhost

letsencrypt.org

Post reply on HN
Print view View original

51–60 of 157 posts

Re: Certificates for localhost

#51

Post by xg15 »

What I don't understand is this bit:

> Fortunately, modern browsers consider “http://127.0.0.1:8000/" to be a “potentially trustworthy” URL . [...] WebSockets don’t get this treatment for either name.

It's good they at least added an exception for (verifyable) localhost access - but then why is the exception only given for HTTP? There seems to be a deliberate restriction that websockets are excluded.

I find this kind of strange and frustrating as the websockets wire protocal actually contains more protections against accessing vulnerable services than HTTP. So without this exception, this leaves you no way at all to connect to a local service via websockets.

I've found this ticket for chome[1] where apparently the rationale is that they want to move people to their own IPC messaging mechanism. However, this is chome only and requires you to register a chrome extension.

So if I get this right, this still leaves no standard way to have asynchronous communication with a local process.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=418482

Re: Certificates for localhost

#52

Post by mafro »

mholt wrote: post #33
zaroth wrote: post #12

I’ve always liked the concept of a localhost’d web app talking back to a localhost web server. It seems like a great way to get the cross-platform ease of use of developing the UI without having to do everything in browser, so you can optimize the heavy lifting and don’t end up with an Electron app pulling 8Gb of RAM and 100% Of 16 cores. But I could never quite satisfy the nagging feeling that the localhost server c…

> I’ve always liked the concept of a localhost’d web app talking back to a localhost web server. We're doing exactly this prime-time with Relica: https://relicabackup.com (sorry, not much on the landing page yet, but we have emailed out some info about the UI already [1]). That technique will allow us to distribute backup software that works the same for macOS, Linux, BSD, and Windows, right away; screenshot: [2]. An…

Interesting! How do you go about binding an unused port on client machines?

Re: Certificates for localhost

#53

Post by mholt »

mafro wrote: post #52
mholt wrote: post #33

Earlier quoted context omitted.

> I’ve always liked the concept of a localhost’d web app talking back to a localhost web server. We're doing exactly this prime-time with Relica: https://relicabackup.com (sorry, not much on the landing page yet, but we have emailed out some info about the UI already [1]). That technique will allow us to distribute backup software that works the same for macOS, Linux, BSD, and Windows, right away; screenshot: [2]. An…

Interesting! How do you go about binding an unused port on client machines?

Use port :0 to let the OS choose one.

But for now we just hard-code a port. I personally prefer this since it's easy to use and convenient to remember. But if a lot of client machines have conflicts, I guess we'll change that...

Re: Certificates for localhost

#54

Post by phlo »

justinclift wrote: post #50

> Traffic sent to 127.0.0.1 is guaranteed not to leave your machine. ... Isn't that a widely held, but incorrect, assumption? eg People with reasonable knowledge of IPv4 on *nix can still route 127.0.0.1 traffic out through an external interface? From memory, people used to do that when attempting to bypass various firewall/filter rules on other hosts for a locally attached network. Maybe things have tightened up/cha…

No, 127.0.0.1 should never appear on any network, and no network device should ever route it.

The earliest documentation I was able to find is in RFC 1122 [1] from 1989, but according to RFC 6890 [2], the principle dates back to 1981.

[1] https://tools.ietf.org/html/rfc1122#section-3.2.1.3

[2] https://tools.ietf.org/html/rfc6890 (table 4)

Re: Certificates for localhost

#55

Post by tedunangst »

justinclift wrote: post #50

> Traffic sent to 127.0.0.1 is guaranteed not to leave your machine. ... Isn't that a widely held, but incorrect, assumption? eg People with reasonable knowledge of IPv4 on *nix can still route 127.0.0.1 traffic out through an external interface? From memory, people used to do that when attempting to bypass various firewall/filter rules on other hosts for a locally attached network. Maybe things have tightened up/cha…

At that point... you break it, you buy it.

Re: Certificates for localhost

#56

Post by tootie »

zaroth wrote: post #12

I’ve always liked the concept of a localhost’d web app talking back to a localhost web server. It seems like a great way to get the cross-platform ease of use of developing the UI without having to do everything in browser, so you can optimize the heavy lifting and don’t end up with an Electron app pulling 8Gb of RAM and 100% Of 16 cores. But I could never quite satisfy the nagging feeling that the localhost server c…

If browser and server are on the same machine, you remove a whole host of the barriers to identification. You could use any sort of local knowledge like system files or your NIC as identification. NB: I haven't thought this through, but I'm sure there's something to it :)

Re: Certificates for localhost

#59

Post by andrewmd5 »

BillinghamJ wrote: post #13

The Plex approach to this kind of problem is pretty interesting: https://blog.filippo.io/how-plex-is-doing-https-for-all-its-... Unfortunately I haven't seen it being done elsewhere. It'd be nice if LetsEncrypt or similar could provide this for more generic everyday use.

We built a PKI on top of Lets Encrypt to deliver certificates to all of our users for Rainway: https://rainway.io/technology/

Similar to Plex, users run our software on their PC and then our web based client can connect to it from elsewhere.

It’s mainly used as a fallback if WebRTC fails (https://blog.rainway.io/real-time-communication-for-everyone...). If there is interest, happy to do a blog post.

Re: Certificates for localhost

#60

Post by maxvu »

vbezhenar wrote: post #35
maxvu wrote: post #31

Earlier quoted context omitted.

I visited recently and was wondering what that was. https://imgur.com/a/F2iAMm7 Who uses these tokens, and what for?

Ordinary people, for example I own one. It's a USB crypto device which stores private key and certificate. It handles all cryptographic operations inside, so private key can't be extracted (at least trivially). Actually most people use simple files, but it's significantly less secure, because file could be easily stolen. As to certificates, they are required for some internet services. There's portal http://egov.kz/c…

Excellent, thank you!
Post reply on HN