Why Is This Website Port Scanning Me? • Hacker News Board

Re: Why Is This Website Port Scanning Me?

#141

Post by klodolph » Wed, May 20, 2020, 3:10 PM UTC

djsumdog wrote: post #108

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful. But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT). I agree; m…

Why is ASM insane? Are you talking about WASM? That’s got the same security model as JavaScript.

Re: Why Is This Website Port Scanning Me?

#142

Post by OJFord » Wed, May 20, 2020, 3:10 PM UTC

djsumdog wrote: post #113

the8472 wrote: post #85

Earlier quoted context omitted.

> So what, does Firefox need a freaking iptables implementation now? umatrix is the layer7 firewall you're looking for, it can block websocket connections, cross-domain ones in particular are quite easy.

I've had performance issues with umatrix. I tried blocking all JS by default and explicitly enabling scripts. In theory that should make the browser preform better. I suspect there are a bunch of sites that can't run a function or reach a JS resource and then just go into spin loops eating through resources .. either that or the blocking itself is resource intensive.

> I suspect there are a bunch of sites that can't run a function or reach a JS resource and then just go into spin loops eating through resources

Google Maps.

Re: Why Is This Website Port Scanning Me?

#143

Post by megous » Wed, May 20, 2020, 3:12 PM UTC

crankylinuxuser wrote: post #69

woadwarrior01 wrote: post #24

Earlier quoted context omitted.

Port scanning from an external host is fine and dandy, but doing it on localhost from the user's browser crosses the line, IMO.

Then why did your "user agent" permit it? Seems rather anti-user.

I use uMatrix, and only thanks to that I realized my bank is doing this too a long time ago.

Re: Why Is This Website Port Scanning Me?

#144

Post by jschwartzi » Wed, May 20, 2020, 3:12 PM UTC

craftinator wrote: post #122

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

Whatever happened to a control panel to turn off all of the things you Don't Want? All of these protocols should have triple toggle switches, Enabled, Ask, Disabled. If something on the page doesn't load because that protocol is disabled, it logs to the console so you can turn on what you need for that page. I get that adding lots of user controls makes state management difficult, but there are tried and true ways to…

Firefox is open-source, so you could add that. I would really appreciate being able to turn WebUSB WebBluetooth and WebRTC off entirely as those expose a lot of devices that I need not to be exposed to the Internet.

Re: Why Is This Website Port Scanning Me?

#145

Post by Reelin » Wed, May 20, 2020, 3:13 PM UTC

jimmaswell wrote: post #138

jackewiehose wrote: post #99

Earlier quoted context omitted.

There is media.peerconnection.enabled in about:config. When set to false, WebRTC doesn't work but I'm not sure if there isn't anything left active. Also uBlock has an option "Prevent WebRTC from leaking IP adresses". WebRTC should be disabled by default or firefox should ask explicitly like with webcam-access. There have already been reports where sites use your browser as a peer in a P2P-network (without your consen…

> Prevent WebRTC from leaking IP adresses A local IP?

Yes, oddly enough. It can be used by a website you visit to gain information about your local network which turns out to be incredibly effective for fingerprinting.

Re: Why Is This Website Port Scanning Me?

#146

Post by u801e » Wed, May 20, 2020, 3:13 PM UTC

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> Firefox also seemingly blocks access to 192.168/24 and 10/8.

What about 172.16.0.0/12?

Re: Why Is This Website Port Scanning Me?

#147

Post by edoo » Wed, May 20, 2020, 3:16 PM UTC

datenwolf wrote: post #118

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

You forgot WebUSB – I wish I was joking, but I'm not: https://developer.mozilla.org/en-US/docs/Web/API/USB

I see irony in all this web functionality.

Back in the 90's if you wanted an ohms law calculator you had to go download a poorly written program from some random website. Network admins started locking down what you could download, run, and install due to security problems. Flash became a hit and they started piling on features in the browser so you could run things dynamically without having to download something.

Fast forward almost 30 years and the browser has become so full featured it is practically a weak OS sandbox that allows you to run just about anything. It was originally being extended to avoid that in the first place, and here we are almost back to square one.

Re: Why Is This Website Port Scanning Me?

#148

Post by thanksforfish » Wed, May 20, 2020, 3:19 PM UTC

Re: Why Is This Website Port Scanning Me?

#149

Post by Spivak » Wed, May 20, 2020, 3:19 PM UTC

phkahler wrote: post #131

habyte wrote: post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

Native applications? Not everything needs to run in a browser.

But that’s even worse! Native apps have even less (i.e. zero most of the time) sandboxing than the browser.

This wouldn’t be a meaningful security improvement for anyone.

Re: Why Is This Website Port Scanning Me?

#150

Post by driverdan » Wed, May 20, 2020, 3:20 PM UTC

osolo wrote: post #63

My kids complained today that Google Classroom isn't working. After a quick investigation, I noticed that Snort on my firewall blocked the relevant Google server due to incoming TCP port scans. Sigh.

Can you share the server IP / hostname?