Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

171–180 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#171

Post by varenc »

tombakt wrote: post #69
xp84 wrote: post #64

Earlier quoted context omitted.

Doesn't CORS just restrict whether the webpage JS context gets to see the response of the target request? The request itself happens anyway, right? So the attack vector that I can imagine is that JS on the browser can issue a specially crafted request to a vulnerable printer or whatever that triggers arbitrary code execution on that other device. That code might be sufficient to cause the printer to carry out your ev…

No, a preflight (OPTIONS) request is sent by the browser first prior to sending the request initiated by the application. I would be surprised if it is possible for the client browser to control this OPTIONS request more than just the URL. I am curious if anyone else has any input on this topic though. Maybe there is some side-channel timing that can be used to determine the existence of a device, but not so sure abo…

This tag:
triggers a local network GET request without any CORS involvement.

Re: A proposal to restrict sites from accessing a users’ local network

#172

Post by AnthonyMouse »

AshamedCaptain wrote: post #114
fn-mote wrote: post #62

Earlier quoted context omitted.

I think you're mistaken about this. Use case 1 in the document and the discussion made it clear to me.

Browsers allow launching HTTP requests to localhost in the same way they allow my-malicious-website.com to launch HTTP requests to say mail.google.com . They can _request_ a resource but that's about it -- everything else, even many things you would expect to be able to do with the downloaded resource, are blocked by the same origin policy. [1] Heck, we have a million problems already where file:/// websites cannot a…

This is specifically in response to the recent Facebook chicanery where their app was listening on localhost and spitting out a unique tracking ID to anything that connects, allowing arbitrary web pages to get the tracking ID and correspondingly identify the user visiting the page.

But this is trying to solve the problem in the wrong place. The problem isn't that the browser is making the connection, it's that the app betraying the user is running on the user's device. The Facebook app is malware. The premise of app store curation is that they get banned for this, right? Make everyone who wants to use Facebook use the web page now.

Re: A proposal to restrict sites from accessing a users’ local network

#173

Post by Pxtl »

AStonesThrow wrote: post #166
Pxtl wrote: post #163

Honestly I think cross-site requests were a mistake. Tracking cookies, hacks, XSS attacks, etc. My relationship is with your site. If you want to outsource that to some other domain, do that on your servers, not in my browser.

Cross-site requests have been built in to the design of the WWW since the beginning. The whole idea of hyperlinking from one place to another, and amalgamating media from multiple sites into a single page, is the essence of the World Wide Web that Tim Berners-Lee conceived at CERN, based on the HyperCard stacks and Gopher and Wais services that had preceded it. Of course it was only later that cookies and scripting a…

I'm aware of that but obviously there's a huge difference between the user clicking a link and navigating to a page on another domain and the site making that request on the user's behalf for a blob of JS.

Re: A proposal to restrict sites from accessing a users’ local network

#174

Post by nothrabannosir »

3eb7988a1663 wrote: post #167
socalgal2 wrote: post #153

I wish they'd (Apple/Micrsoft/Google/...) would do similar things for USB and Bluetooth. Lately, every app I install, wants bluetooth access to scan all my bluetooth devices. I don't want that. At most, I want the app to have to declare in their manifest some specific device IDs (short list) that their app is allowed to connect to and have the OS limit their connections to only those devices. For for example the Bose…

I am still holding out hope that eventually at least Apple will offer fake permission grants to applications. Oh, app XYZ "needs" to see my contact list to proceed? Well it gets a randomized fake list, indistinguishable from the real one. Similar with GPS. I have been told that WhatsApp does not let you name contacts without sharing your address book back to Facebook.

In iOS you can share a subset of your contacts. This is functionally equivalent and works as you described for WhatsApp.

Re: A proposal to restrict sites from accessing a users’ local network

#175

Post by tomrod »

freeone3000 wrote: post #111
LegionMammal978 wrote: post #76

Earlier quoted context omitted.

The idea is, the malicious actor would use a 'simple request' that doesn't need a preflight (basically, a GET or POST request with form data or plain text), and manage to construct a payload that exploits the target device. But I have yet to see a realistic example of such a payload (the paper I read about the idea only vaguely pointed at the existence of polyglot payloads).

Oh, you can only send arbitrary text or form submissions . That’s SO MUCH.

Correct.

Re: A proposal to restrict sites from accessing a users’ local network

#176

Post by charcircuit »

jm4 wrote: post #148
mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

This sounds crazy to me. Why should websites ever have access to the local network? That presents an entirely new threat model for which we don’t have a solution. Is there even a use case for this for which there isn’t already a better solution?

>for which we don’t have a solution

It's called ZTA, Zero Trust Architecture. Devices shouldn't assume the LAN is secure.

Re: A proposal to restrict sites from accessing a users’ local network

#177

Post by charcircuit »

themikesanto wrote: post #42

Google loves wreaking havoc on web standards. Is there really anything anyone can do about it at this point? The number of us using alternative browsers are a drop in the bucket when compared to Chrome's market share.

Google open source the implementation of them which any other browser is free to use.

Re: A proposal to restrict sites from accessing a users’ local network

#178

Post by protocolture »

donnachangstein wrote: post #12
mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

[flagged]

This attitude kept IE6 in production well after its natural life should have concluded.

Re: A proposal to restrict sites from accessing a users’ local network

#179

Post by moktonar »

The web is currently just “controlled code execution” on your device. This will never work if not done properly. We need a real “web 3.0” where web apps can run natively and containerized, but done correctly, where they are properly sandboxed. This will bring performance and security.
Post reply on HN