Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

191–200 of 448 posts

Re: Why Is This Website Port Scanning Me?

#191
post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

Server Sent Events and HTTP? With a modern setup it’s going to be sharing an HTTP/2 pipe anyway. Even handles disconnections gracefully/transparently if you’re clever about it. Can anyone expand on why this technique isn’t more common? I’m so sick of seeing folks reinvent HTTP (poorly) on top of WebSockets. I get if extreme low latency is (allegedly) a requirement.

From what I remember about SSE, no Microsoft browser supported them. It seems like they've finally added support to Edge this year though.

Re: Why Is This Website Port Scanning Me?

#193

Earlier quoted context omitted.

The alternative is to ask the user on a site basis.

That would be amazing, but it would never happen. Mom and Pop would always click "no" out of fear of the unknown, and my awesome feature wouldn't get used! It has to be enabled by default, they don't know what they're missing!

Surely everybody needs My Feature(TM)!

Re: Why Is This Website Port Scanning Me?

#194
post #145

Earlier quoted context omitted.

> Prevent WebRTC from leaking IP adresses A local IP?

Yes, oddly enough. It can be used by a website you visit to gain information about your local network which turns out to be incredibly effective for fingerprinting.

WebRTC can also leak your IP when you're hiding behind a VPN.

Re: Why Is This Website Port Scanning Me?

#195
post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

Server Sent Events and HTTP? With a modern setup it’s going to be sharing an HTTP/2 pipe anyway. Even handles disconnections gracefully/transparently if you’re clever about it. Can anyone expand on why this technique isn’t more common? I’m so sick of seeing folks reinvent HTTP (poorly) on top of WebSockets. I get if extreme low latency is (allegedly) a requirement.

SSE have a limit of 6 connections across all browser tabs

https://bugzilla.mozilla.org/show_bug.cgi?id=906896 https://bugs.chromium.org/p/chromium/issues/detail?id=275955

Re: Why Is This Website Port Scanning Me?

#196
post #186

Port scanning isn't malicious behavior. Port scanning is about equivalent to walking down the street and looking at the architecture of the buildings.

Your analogy might apply to a port scanner running over the Internet and looking at what ports are open on Internet-facing servers. (Though I would still argue the analogy is flawed there: port scanning Internet-facing servers is more like going up to each locked door on the street and writing down what kind of lock it has, in case you want to try to pick it later.) But a port scanner running inside the browser on my…

I agree. It's foolish to give websites permission to do that kind of thing. There's a very simple solution: don't give them permission. Turn off javascript. Yes, ebay will complain but it'll still work. The power is in your hands. No one is forcing you to use eBay either.

Giving arbitrary websites the ability to run arbitrary code on your machine is just asking for trouble. It's like someone who opens and executes every email attachment they receive. Try out NoScript temp-whitelist only mode that blocks by default and requires manual permission giving.

Re: Why Is This Website Port Scanning Me?

#197
post #149

Earlier quoted context omitted.

But that’s even worse! Native apps have even less (i.e. zero most of the time) sandboxing than the browser. This wouldn’t be a meaningful security improvement for anyone.

You use a much smaller set of applications than web sites. Moreover, you usually vet your applications and do not run random stuff. Application developers build up trust over time. Even if I want to use the web as hypertext + some Javascript for interactivity, every stupid web site can pull these shenanigans.

You use a much smaller set of applications than websites because websites exist.

You're imagining a world where the most popular dev environment goes away, and service providers decide to use HTML forms instead of forcing me to download an app every time I want to order a pizza. That world does not exist. The apps aren't going to go away, and your security model can't be, "people just won't install untrustworthy apps."

And put things in perspective here -- we're talking about a security vulnerability that allows port scanning primarily for fingerprinting purposes. A native app can not only port scan, it can literally just make POST requests to those open ports across separate domains. The security risks we're talking about are not even remotely equivocal.

Don't get me wrong, stuff like port-scanning should be fixed in web browsers. But even with these vulnerabilities, the web is still unquestionably the safest consumer-accessible application platform that we have today. Moving applications off of the web and back onto native platforms would be setting security back half a decade.

When someone comes to me and asks how they make their phone more secure and more private, the number one piece of advice I give them, every single time, is "avoid native apps and use websites instead. Don't install Facebook, use the website. Don't install random clicker games, browse them online instead."

The web has been a major asset in my quest to get friends and family not to install a bunch of random malware on their devices. Doubly so when you throw kids and younger users into the equation. I am eternally grateful that the web is advanced enough that people can join a Zoom meeting without installing Zoom on their computer.

Re: Why Is This Website Port Scanning Me?

#198

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> WebSockets ... haven’t ever wanted to use those. Ever. For anything. For any reason.

You’ve never used a web-app chat client?

> WebBluetooth

APIs like these don’t exist for the sake of regular unprivileged web-apps. They exist for the sake of browser extensions (or browser “apps”, or apps within a browser-projector like Electron), specifically in order to be used to add driver-like or service-like capabilities to devices like Chromebooks where the browser is the OS.

Re: Why Is This Website Port Scanning Me?

#199
post #177

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> Firefox also seemingly blocks access to 192.168/24 and 10/8 Chrome, OTOH, will happily open a websocket to these IP ranges. Another good reason not to use Chrome.

Uh... Why not block all private networks?

Re: Why Is This Website Port Scanning Me?

#200
post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

Web sockets, but redesigned to only connect to the host shown in the address bar, on port 443.

Doesn’t work if www.example.com is just an S3 bucket, with the actual website at api.example.com.
Post reply on HN