Chris Siebenmann weighs in with thoughts on:
Browers[sic] can't feasibly stop web pages from talking to private (local) IP addresses (2019)
https://utcc.utoronto.ca/~cks/space/blog/web/BrowsersAndLoca...
A proposal to restrict sites from accessing a users’ local network
11–20 of 392 posts
Re: A proposal to restrict sites from accessing a users’ local network
#12I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".
[flagged]
Re: A proposal to restrict sites from accessing a users’ local network
#13What is so hard in blocking apps on android from listening on random ports without permission?
Re: A proposal to restrict sites from accessing a users’ local network
#14Earlier quoted context omitted.
Idk, I like the idea of my browser warning me when a random website I visit tries to talk to my network. if there's a legitimate reason I can still click yes. This is orthogonal to any ads and data collection.
I have this today from macOS. To me it feels more appropriate to have the OS attempt to secure running applications.
No you don’t - you get a single permission prompt for the entire browser. You definitely don’t get any permission-site permission options from the OS
Re: A proposal to restrict sites from accessing a users’ local network
#15Do note that since the removal of NPAPI plugins years ago, locally-installed software that intends to be used by one or more public websites has to run an HTTP server on localhost. It would be really annoying if this use case was made into an unreasonable hassle or killed entirely. (Alternatively, browser developers could've offered a real alternative, but it's a bit late for that now.)
[flagged]
> Googlers present a solution no one is asking for,
I'm asking for it. Random web sites have no business poking around my internal network.
Re: A proposal to restrict sites from accessing a users’ local network
#16I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".
[flagged]
I'm sure it will require some work, but this is the price of security. The idea that any website I visit can start pinging/exploiting some random unsecured testing web server I have running on localhost:8080 is a massive security risk.
Re: A proposal to restrict sites from accessing a users’ local network
#17Internet Explorer solved this with their zoning system right?
https://learn.microsoft.com/en-us/previous-versions/troubles...
Re: A proposal to restrict sites from accessing a users’ local network
#18Earlier quoted context omitted.
[flagged]
I'm sure it will require some work, but this is the price of security. The idea that any website I visit can start pinging/exploiting some random unsecured testing web server I have running on localhost:8080 is a massive security risk.
[flagged]
Re: A proposal to restrict sites from accessing a users’ local network
#19Earlier quoted context omitted.
[flagged]
I'm sure it will require some work, but this is the price of security. The idea that any website I visit can start pinging/exploiting some random unsecured testing web server I have running on localhost:8080 is a massive security risk.
Or probing your local network for vulnerable HTTP servers, like insecure routers or web cameras. localhost is just the tip of the iceberg.
Re: A proposal to restrict sites from accessing a users’ local network
#20Internet Explorer solved this with their zoning system right? https://learn.microsoft.com/en-us/previous-versions/troubles...
Ironically, Chrome partially supported and utilized IE security zones on Windows, though it was not well documented.