Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

21–30 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#21

Post by pacifika »

donnachangstein wrote: post #20
pacifika wrote: post #17

Internet Explorer solved this with their zoning system right? https://learn.microsoft.com/en-us/previous-versions/troubles...

Ironically, Chrome partially supported and utilized IE security zones on Windows, though it was not well documented.

Oh yeah forgot about that, amazing.

Re: A proposal to restrict sites from accessing a users’ local network

#22

Post by hollerith »

donnachangstein wrote: post #18
zaptheimpaler wrote: post #16

Earlier quoted context omitted.

I'm sure it will require some work, but this is the price of security. The idea that any website I visit can start pinging/exploiting some random unsecured testing web server I have running on localhost:8080 is a massive security risk.

[flagged]

The whole browser is a massive security leak. What genius thought it was a good idea for the web page I visit in the morning to get the weather forecast to be able to run arbitrary code and to communicate with arbitrary hosts on my local network?

Re: A proposal to restrict sites from accessing a users’ local network

#23

Post by donnachangstein »

duskwuff wrote: post #19
zaptheimpaler wrote: post #16

Earlier quoted context omitted.

I'm sure it will require some work, but this is the price of security. The idea that any website I visit can start pinging/exploiting some random unsecured testing web server I have running on localhost:8080 is a massive security risk.

Or probing your local network for vulnerable HTTP servers, like insecure routers or web cameras. localhost is just the tip of the iceberg.

Can you define "local network"? Probably not. Most large enterprises own publicly-routable IP space for internal use. Internal doesn't mean 192.168.0.0/24. foo.corp.example.com could resolve to 9.10.11.12 and still be local. What about IPv6? It's a nonsense argument fraught with corner cases.

Re: A proposal to restrict sites from accessing a users’ local network

#25

Post by mystifyingpoi »

donnachangstein wrote: post #23
duskwuff wrote: post #19

Earlier quoted context omitted.

Or probing your local network for vulnerable HTTP servers, like insecure routers or web cameras. localhost is just the tip of the iceberg.

Can you define "local network"? Probably not. Most large enterprises own publicly-routable IP space for internal use. Internal doesn't mean 192.168.0.0/24. foo.corp.example.com could resolve to 9.10.11.12 and still be local. What about IPv6? It's a nonsense argument fraught with corner cases.

Not to be snarky, but that's a good example of "perfect being the enemy of good". You are totally right that there are corner cases, sure. But that doesn't stop us from tackling the low hanging fruit first. Which is, as you say, localhost and LAN (if present).

Re: A proposal to restrict sites from accessing a users’ local network

#26

Post by loumf »

hulitu wrote: post #24

> A proposal to restrict sites from accessing a users' local network A proposal to treat webbrowsers as malware ? Why would a webbrowser connect to a socket/internet ?

The proposal is directed at the websites in the browser (using JS, embedded images or whatever), not the code that implements the browser.

Re: A proposal to restrict sites from accessing a users’ local network

#27

Post by aaomidi »

donnachangstein wrote: post #12
mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

[flagged]

I’m sorry but this proposal is absolutely monumentally important.

The fact that I have to rely on random extensions to accomplish this is unacceptable.

Re: A proposal to restrict sites from accessing a users’ local network

#28

Post by kulahan »

donnachangstein wrote: post #12
mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

[flagged]

I agree fully with him. I don’t care what part of your job gets harder, or what software breaks if you can’t make it work without unnecessarily invading my privacy. You could tell me it’s going to shut down the internet for 6 months and I still wouldn’t care.

You’ll have to come up with a really strong defense for why this shouldn’t happen in order to convince most users.

Post reply on HN