Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

131–140 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#131

Post by donnachangstein »

ryanisnan wrote: post #129
donnachangstein wrote: post #120

Earlier quoted context omitted.

> Can anyone explain to me if there is any way to determine whether an inbound IPv6 address is "local"? No, because it's the antithesis of IPv6 which is supposed to be globally routable. The concept isn't supposed to exist. Not to mention Google can't even agree on the meaning of "local" - the article states they completely changed the meaning of "local" to be a redefinition of "private" halfway through brainstorming…

It's very useful to have this additional information in something like a network address. I agree, you shouldn't rely on it, but IPv6 hasn't clicked with me yet, and the whole "globally routable" concept is one of the reasons. I hear that, and think, no, I don't agree.

Globally routable doesn't mean you don't have firewalls in between filtering and blocking traffic. You can be globally routable but drop all incoming traffic at what you define as a perimeter. E.g. the WAN interface of a typical home network.

The concept is frequently misunderstood in that IPv4 consumer SOHO "routers" often combine a NAT and routing function with a firewall, but the functions are separate.

Re: A proposal to restrict sites from accessing a users’ local network

#132

Post by cwilby »

Is it just me or am I not seeing any example that isn't pure theory?

And if it is just me, fine I'll jump in - they should also make it so that users have to approve local network access three times. I worry about the theoretical security implications that come after they only approve local network access once.

Re: A proposal to restrict sites from accessing a users’ local network

#133

Post by ryanisnan »

donnachangstein wrote: post #131
ryanisnan wrote: post #129

Earlier quoted context omitted.

It's very useful to have this additional information in something like a network address. I agree, you shouldn't rely on it, but IPv6 hasn't clicked with me yet, and the whole "globally routable" concept is one of the reasons. I hear that, and think, no, I don't agree.

Globally routable doesn't mean you don't have firewalls in between filtering and blocking traffic. You can be globally routable but drop all incoming traffic at what you define as a perimeter. E.g. the WAN interface of a typical home network. The concept is frequently misunderstood in that IPv4 consumer SOHO "routers" often combine a NAT and routing function with a firewall, but the functions are separate.

That makes sense. I do love the idea of living in a world without NAT.

Re: A proposal to restrict sites from accessing a users’ local network

#134

Post by AStonesThrow »

donnachangstein wrote: post #120
rerdavies wrote: post #112

I worry that there are problems with Ipv6. Can anyone explain to me if there actually is a way to determine whether an IPv6 is site local? If not, the proposal is going to have problems on IPv6-only networks. I have an struggled with this issue in the past. I have an IoT application whose websever wants to reject any requests from a non-local address. After failing to find a way to distinguish IPv6 local addresses, I…

> Can anyone explain to me if there is any way to determine whether an inbound IPv6 address is "local"? No, because it's the antithesis of IPv6 which is supposed to be globally routable. The concept isn't supposed to exist. Not to mention Google can't even agree on the meaning of "local" - the article states they completely changed the meaning of "local" to be a redefinition of "private" halfway through brainstorming…

> can't even agree on the meaning of "local"

Well, who can agree on this? Local network, private network, intranet, Tailscale and VPN, Tor? IPv6 ULA, NAT/CGNAT, SOCKS, transparent proxy? What resources are "local" to me and what resources are "remote"?

This is quite a thorny and sometimes philosophical question. Web developers are working at the OSI Layer 6-7 / TCP/IP Application Layer.

https://en.wikipedia.org/wiki/OSI_model#Comparison_with_TCP/...

Now even cookies and things like CSRF were trying to differentiate "servers" and "origins" and "resources" along the lines of the DNS hierarchy. But this has been fraught with complication, because DNS was not intended to delineate such things, and can't do so cleanly 100% of the time.

Now these proposals are trying to reach even lower in the OSI model - Layer 3, Layer 2. If you're asking "what is on my LAN" or "what is a private network", that is not something that HTTPS or web services are supposed to know. Are you going to ask them to delve into your routing table or test the network interfaces? HTTPS was never supposed to know about your netmask or your next-hop router.

So this is only one reason that there is no elegant solution for the problem. And it has been foundational to the way the web was designed: "given a uniform locator, find this resource wherever it may be, whenever I request it." That was a simpler proposition when the Web was used to publish interesting and encyclopedic information, rather than deliver applications and access sensitive systems.

Re: A proposal to restrict sites from accessing a users’ local network

#136

Post by EGreg »

MajesticHobo2 wrote: post #91
LegionMammal978 wrote: post #76

Earlier quoted context omitted.

The idea is, the malicious actor would use a 'simple request' that doesn't need a preflight (basically, a GET or POST request with form data or plain text), and manage to construct a payload that exploits the target device. But I have yet to see a realistic example of such a payload (the paper I read about the idea only vaguely pointed at the existence of polyglot payloads).

There doesn't need to be any kind of "polyglot payload". Local network services and devices that accept only simple HTTP requests are extremely common. The request will go through and alter state, etc.; you just won't be able to read the response from the browser.

Exactly. People who are answering must not have been aware of “simple” requests not requiring preflight.

Re: A proposal to restrict sites from accessing a users’ local network

#138

Post by kccqzy »

kuschku wrote: post #99
kccqzy wrote: post #37

Earlier quoted context omitted.

The split horizon DNS model mentioned in that article is to me insane. Your DNS responses should not change based on what network you are connected to. It breaks so many things. For one, caching breaks because DNS caching is simplistic and is only cached with a TTL: no way to tell your OS to associate a DNS cached response to a network. I understand why some companies want this, but doing it on the DNS level is a mas…

I'm surprised you've never seen this before. Especially for universities it's very common to have the same hostname resolve to different servers, and provide different results, depending on whether you're inside the university network or not. Some sites may require login if you're accessing them from the internet, but are freely accessible from the intranet. Others may provide read-write access from inside, but limit…

No I haven't seen this before. I have seen however the behavior where login is required from the Internet but not on the university network; I had assumed this is based on checking the source IP of the request.

Similarly the use case of read-write access from inside, but limited read-only access from the outside is also achievable by checking the source IP.

Re: A proposal to restrict sites from accessing a users’ local network

#139

Post by hello_computer »

fn-mote wrote: post #55
hello_computer wrote: post #39

just the fact that this comes from google is a hard pass for me. they sell so many adwords scams that they clearly do not give a damn about security. “security” from google is just another one of their trojan horses.

Don't post shallow dismissals. The same company runs Project Zero, which has a major positive security impact. [1]: https://googleprojectzero.blogspot.com/

project zero is ZERO compared to the millions of little old ladies around the world getting scammed through adwords. only security big g cares about is its own. they have the tools to laser-in on and punish the subtlest of wrongthink on youtube, yet it’s just too tall of an order to focus the same laser on tech support scammers…

Re: A proposal to restrict sites from accessing a users’ local network

#140

Post by saintleonardo »

hello_computer wrote: post #139
fn-mote wrote: post #55

Earlier quoted context omitted.

Don't post shallow dismissals. The same company runs Project Zero, which has a major positive security impact. [1]: https://googleprojectzero.blogspot.com/

project zero is ZERO compared to the millions of little old ladies around the world getting scammed through adwords. only security big g cares about is its own. they have the tools to laser-in on and punish the subtlest of wrongthink on youtube, yet it’s just too tall of an order to focus the same laser on tech support scammers…

[dead]
Post reply on HN