Stealing secrets from developers using WebSockets • Hacker News Board

Re: Stealing secrets from developers using WebSockets

#141

Post by benibela » Fri, May 22, 2020, 8:01 PM UTC

lstamour wrote: post #62

toupeira wrote: post #60

Oh well. I ended up adding these rules to uBlock Origin, suggestions for improvement welcome: ||localhost^$important,third-party ||127.*^$important,third-party ||10.*^$important,third-party ||192.168.*^$important,third-party ||172.16.*^$important,third-party ||172.17.*^$important,third-party ||172.18.*^$important,third-party ||172.19.*^$important,third-party ||172.20.*^$important,third-party ||172.21.*^$important,thi…

That won’t help if someone sets up public DNS to point to localhost or 127.0.0.1 though. Unless you check after DNS is resolved? It’s also possible someone might bind to an IPv6 address. Better to rely on fixes mentioned elsewhere for web socket servers running on the local machine, including inserting a secret key into web socket path or query param, ensuring the web socket validates the path or query, and ensuring…

I have even pointed various webpages to 127.0.0.1

When I do not want the browser to access somedomain.com, I redirect somedomain.com to 127.0.0.1 in my hosts file

Re: Stealing secrets from developers using WebSockets

#142

Post by chrisfosterelli » Fri, May 22, 2020, 9:59 PM UTC

Ajedi32 wrote: post #113

chrisfosterelli wrote: post #107

Earlier quoted context omitted.

> Developers not understanding CORS is simply all the more reason why it's good that CORS defaults to secure behavior whenever possible. The harder you make it for ignorant developers to shoot themselves (and their users) in the foot, the better. Right, but not understanding something doesn't mean it is more difficult to shoot yourself in the foot -- in fact it's the opposite. The zoom vulnerability is an example of…

I'm not trying to saying that CORS is harder to shoot yourself in the foot with because it's hard to understand. Rather, it's harder to shoot yourself in the foot with because not understanding it usually just means your site's pages aren't accessible to other origins at all. (That's one reason why so many developers seem to have so much trouble with it; rather than breaking their site's security and remaining comple…

I see what you're saying and agree with the fundamentals. I think we disagree on this assumption:

> they instead break their site's functionality and need to spend a bunch of "extra" time learning about CORS and the same origin policy before they can get it to work

In my experience, a very large percentage of developers don't do this. They try that, then find it confusing, and they only estimated two days for this task, which is already late, so they just sort out enough to get it to work. For most cases, this is importing `cors()` and passing it in as middleware. The easiest config... and also the one that makes your site available to all origins.

At the end of the day it will always come down to developer education. Someone will make something easy to use. So we might as well make it really simple to use and understand, so that it's easier to educate the right way to build things.

Re: Stealing secrets from developers using WebSockets

#143

Post by m00dy » Fri, May 22, 2020, 11:24 PM UTC

cjbprime wrote: post #106

m00dy wrote: post #44

Earlier quoted context omitted.

Or you can have this on firewall level.

No you can't -- the request from the browser is coming from inside the firewall, on an internal IP.

well, I meant that there are some special firewalls that you can handle dns-rebinding attacks.

Re: Stealing secrets from developers using WebSockets

#144

Post by jfkebwjsbx » Sat, May 23, 2020, 1:57 AM UTC

danShumway wrote: post #125

jfkebwjsbx wrote: post #101

Earlier quoted context omitted.

> the web makes it relatively easy to take simple security measures like disabling scripts by default The average user will never learn to configure and use software like uMatrix.

Everything is relative. More users will learn to configure and use software like uMatrix than will ever learn to configure IP tables, firewalls, or SE Linux policies. Doubly so when you factor in other web tools that are much easier to use like uBlock Origin, where disabling Javascript by default is a single option, and enabling it again per-website is a single menu-item click. Compared to alternative platforms, secu…

> Also keep in mind the audience.

You were saying you were "bullish on the web". That implies discussing the average user, not the HN crowd.

Re: Stealing secrets from developers using WebSockets

#145

Post by danShumway » Sat, May 23, 2020, 2:29 AM UTC

jfkebwjsbx wrote: post #144

danShumway wrote: post #125

Earlier quoted context omitted.

Everything is relative. More users will learn to configure and use software like uMatrix than will ever learn to configure IP tables, firewalls, or SE Linux policies. Doubly so when you factor in other web tools that are much easier to use like uBlock Origin, where disabling Javascript by default is a single option, and enabling it again per-website is a single menu-item click. Compared to alternative platforms, secu…

> Also keep in mind the audience. You were saying you were "bullish on the web". That implies discussing the average user, not the HN crowd.

I'm not going to argue over semantics. I am bullish on the web as a secure application platform for HN readers, and I am bullish on the web as a secure application platform for everyday users.

Of the current platforms available today for ordinary, nontechnical users, the web is currently in the best position on both security and privacy, and it's currently making the best progress in both of those areas as well.

Firefox is pulling up features from Tor, and while right now they're only available to advanced users, more of them will be enabled by default in the future. We've already seen movement from 'advanced' features to 'everyday' features with Firefox starting to inline more of its tracker blocking. Containers are another strong concept that I suspect will get more powerful and more accessible over time. There's some concern over new features (particularly web USB and file access), but we're also seeing a lot of holes get closed around core browser concepts. The changes Chrome is making around SameSite cookies are huge, and both technical and novice users will get them for free without requiring any training or technical knowledge at all.

On the extension front, uBlock Origin isn't as powerful as uMatrix, but it's wildly simple to use; every single computer I set up has it installed, even when I'm setting up computers for kids. That alone is a substantial security and privacy gain over other platforms -- I can't block ads and phishing attacks within my niece's smartphone games, but I can block ads when they're watching Youtube videos. And uBlock Origin is simple enough to install that average users can do so. At this point, there's practically no reason for anyone, anywhere not to be running an adblocker. And when you think about that, it's kind of crazy that in maybe 5 or 6 clicks from a bare-bones browser, any nontechnical user can get better adblocking on the web today than is even possible for an advanced user to set up on a modern smartphone.

So yeah, I'm bullish on the web.

I genuinely don't understand what's controversial about this. Yes, average users probably can't specifically use uMatrix without training. But the web is still the best option available today for those people, even if the only thing they ever do is install uBlock Origin. I'm still advising everyone I know (regardless of their technical know-how) to use apps like Facebook and Twitter inside a browser instead of installing native clients on their phones/tablets/PCs.

Is there another application platform you think is making better progress in this area? What about the web makes you think I shouldn't be bullish about it?

Re: Stealing secrets from developers using WebSockets

#146

Post by fit2rule » Sat, May 23, 2020, 2:40 PM UTC

jasonkester wrote: post #130

scoot_718 wrote: post #4

Why the actual fuck will a browser allow traffic to localhost from anywhere else?

A better question is why developers, the only group of people likely to understand this security issue, continue to run things on localhost? Custom hostnames are such a better solution, but for some reason developers don't use them.

In many projects I have worked on in the last 2 decades, one of the first things I find myself needing to do is fix the name services and setup of .local/.home .. To me it really appears that the skill of naming things starts at the the network - to that end, crap-named networks propagate amnesia.