Proposing this in 2025. While probably knowing about this problem since Chrome was released (2008).
Why not treat any local access as if it were an access to a microphone?
A proposal to restrict sites from accessing a users’ local network
201–210 of 392 posts
Re: A proposal to restrict sites from accessing a users’ local network
#202Earlier quoted context omitted.
Globally routable doesn't mean you don't have firewalls in between filtering and blocking traffic. You can be globally routable but drop all incoming traffic at what you define as a perimeter. E.g. the WAN interface of a typical home network. The concept is frequently misunderstood in that IPv4 consumer SOHO "routers" often combine a NAT and routing function with a firewall, but the functions are separate.
That makes sense. I do love the idea of living in a world without NAT.
I don’t: NAT may have been a hack at first, but it’s my favorite feature provided by routers and why I disable ipv6 on my local network
Re: A proposal to restrict sites from accessing a users’ local network
#203Earlier quoted context omitted.
I can't believe that anyone still thinks a popup permission modal offers any type of security. Windows UAC has shown quite definitively that users will always click through any modal in their way without thought or comprehension. Besides that, approximately zero laypersons will have even the slightest clue what this permission means, the risks involved, or why they might want to prevent it. All they know is that the…
This is so true. The modern Mac is a sea of Allow/Don't Allow prompts, mixed with the slightly more infantilizing alternative of the "Block" / "Open System Preferences" where you have to prove you know what you're doing by manually browsing for the app to grant the permission to, to add it to the list of ones with whatever permission. They're just two different approaches with the same flaw: People with no clue how t…
A better option would be to put Mark Zuckerberg in prison for deploying malware to a massive number of people.
Re: A proposal to restrict sites from accessing a users’ local network
#204Earlier quoted context omitted.
> The modern Mac is a sea of Allow/Don't Allow prompts Remember when they used to mock this as part of their marketing? https://www.youtube.com/watch?v=DUPxkzV1RTc
Windows Vista would spawn a permissions prompt when users did something as innocuous as creating a shortcut on their desktop. Microsoft deserved to be mocked for that implementation.
MacOS asked a permission dialog when I plug my AirPods in to charge. I have no idea what I’m even giving permission for but it pops up every time.
Re: A proposal to restrict sites from accessing a users’ local network
#205Earlier quoted context omitted.
The computer I use at work (and not only mine, many many of them) has a public IP address. Many internal services are on 10.0.0.0/8. How is this being taken into account?
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 are all private addresses per RFC1918 and documents superseding it(5735?). If it's like 66.249.73.128/27 or 164.13.12.34/12, those are "global" IP. 1: https://www.rfc-editor.org/rfc/rfc1918 2: https://www.rfc-editor.org/rfc/rfc5735 3: https://en.wikipedia.org/wiki/Private_network
Yes that's the point: many of our work PCs have global public IPs from something like 128.130.0.0/15 (not this actual block, but something similar), and many internal services are on 10.0.0.0/8. I'm not sure I get exactly how the proposal is addressing this. How does it know that 128.130.0.0/15 is actually internal and should be considered for content loaded from an external site?
Re: A proposal to restrict sites from accessing a users’ local network
#206Earlier quoted context omitted.
No, a preflight (OPTIONS) request is sent by the browser first prior to sending the request initiated by the application. I would be surprised if it is possible for the client browser to control this OPTIONS request more than just the URL. I am curious if anyone else has any input on this topic though. Maybe there is some side-channel timing that can be used to determine the existence of a device, but not so sure abo…
This tag: triggers a local network GET request without any CORS involvement.
I remember back in the day you could embed http://someothersite.com/forum/ucp.php?mode=logout"> in your forum signature and screw with everyone's sessions across the web
Re: A proposal to restrict sites from accessing a users’ local network
#207Earlier quoted context omitted.
The idea is, the malicious actor would use a 'simple request' that doesn't need a preflight (basically, a GET or POST request with form data or plain text), and manage to construct a payload that exploits the target device. But I have yet to see a realistic example of such a payload (the paper I read about the idea only vaguely pointed at the existence of polyglot payloads).
You don't even need to be exploiting the target device, you might just be leaking data over that connection. https://news.ycombinator.com/item?id=44169115
Yeah, I think this is the reason this proposal is getting more traction again.
Re: A proposal to restrict sites from accessing a users’ local network
#208Earlier quoted context omitted.
This tag: triggers a local network GET request without any CORS involvement.
I remember back in the day you could embed http://someothersite.com/forum/ucp.php?mode=logout "> in your forum signature and screw with everyone's sessions across the web
No post body was provided.
Re: A proposal to restrict sites from accessing a users’ local network
#209The web is currently just “controlled code execution” on your device. This will never work if not done properly. We need a real “web 3.0” where web apps can run natively and containerized, but done correctly, where they are properly sandboxed. This will bring performance and security.
The underlying problem is that we are trying to run untrusted code safel, with very few restrictions on its capabilities.
Re: A proposal to restrict sites from accessing a users’ local network
#210Earlier quoted context omitted.
> normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny". MacOS currently does this (per app, not per site) & most users just click yes without a second thought. Doing it per site might create a little more apprehension, but I imagine not much.
People accept permission prompts from apps because they conciously downloaded the app and generally have an idea about the developer and what the app does. If a social media app asks for permission to your photos it's easy to understand why, same with a music streamer wanting to connect to your smart speaker. A random website someone linked me to wanting to access my local network is a very different case. I'm absolu…
To be clear: implementing this in browser on a per site basis would be a massive improvement over in-OS/per-app granularity. I want this popup in my browser.
But I was just pointing out that, while I'll make good use of it, it still probably won't offer sufficient protection (from themselves) for most.