Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

211–220 of 448 posts

Re: Why Is This Website Port Scanning Me?

#211

Post by kchr »

souterrain wrote: post #86
marcojrfurtado wrote: post #80

Earlier quoted context omitted.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

Port scanning from a user’s browser is effectively sneaking behind a user’s firewall. The only legitimate reasons I can envision are security research, and this, to me, is such a small edge case that I’m not sure such access is ever warranted. I’d be all for a user notification that says “fnord.com wants to access 192.168.0.10 on tcp/443, which seems to be a web server on your home/work network. Are you sure you want…

This. It could even have a "remember my choice for this domain/subdomain".

Re: Why Is This Website Port Scanning Me?

#212

Post by Minor49er »

typ wrote: post #179
fxtentacle wrote: post #127

Earlier quoted context omitted.

Web browsers really are the new operating systems. Chrome OS was far ahead of its time, both in its general user hostility and in its excessive resource consumption for seemingly mundane tasks. Like when your roommate's YouTube streaming makes your Excel-like app horribly slow, because your new spreadsheet app needs high-speed internet for no obvious reason. BTW, WebRTC and WebAssembly were great for crypto mining tr…

Strictly speaking, it is more like the shell of the distributed operating system.

Which is also funny because, if I remember correctly, IE was deeply integrated into Windows Explorer and the desktop was essentially rendered by the browser. I remember being able to even change my wallpaper to a custom HTML page in Windows

Re: Why Is This Website Port Scanning Me?

#213

Post by detaro »

fxtentacle wrote: post #209
detaro wrote: post #203

Earlier quoted context omitted.

> Before, they had to port their crypto miner to JavaScript by hand No, cross-compilers to JS are and were thing too, and were used by cryptominers.

Yes, but before webrtc they were easy to block.

What do cryptominers need WebRTC for?

Re: Why Is This Website Port Scanning Me?

#215

Post by derefr »

souterrain wrote: post #107
marcosdumay wrote: post #95

Earlier quoted context omitted.

> to the localhost scope or the Intranet scope That's too little. All access from a different origin should be blocked by default, not only to local nets.

I stand corrected. I think yours is the correct approach. How shall origin be defined? I can envision the likes of Microsoft which have many, many second-level domains making calls between them. We can’t allow the site itself to grant access. How would this be managed, other than “please stop and think what a domain name is supposed to be before spraying your product across twelve of them?”

To be clear, evil.com can define sub.evil.com to resolve to 127.0.0.1. You basically can’t look at domains to mean anything much. You have to look at IP addresses.

(Which is in turn made harder by IPv6 public addressing, where you can’t just block the private IP range because you might not be behind a NAT in the first place, instead only behind a firewall. So your address A::B, can route to your Intranet peer A::C, which isn’t public-routable, but is a public address. But there’s nothing, other than the firewall, that says that that’s not a public address. It’s a hard problem!)

Re: Why Is This Website Port Scanning Me?

#216

Post by billme »

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

>> “ Edit 4: Done researching this now. I went to ebay on Firefox, and wasn't getting websocket scans.“

...Just in case you missed it and you’re using Linux, from the article...

“I thought it might be because I run Linux, so I created a new Windows VM and sure enough, I saw the port scan occurring in the browser tools from the ebay home page”

Re: Why Is This Website Port Scanning Me?

#217

Post by foobiekr »

kchr wrote: post #199
pdonis wrote: post #177

Earlier quoted context omitted.

> Firefox also seemingly blocks access to 192.168/24 and 10/8 Chrome, OTOH, will happily open a websocket to these IP ranges. Another good reason not to use Chrome.

Uh... Why not block all private networks?

Probably IoT.

Re: Why Is This Website Port Scanning Me?

#218

Post by bcrosby95 »

derefr wrote: post #198
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> WebSockets ... haven’t ever wanted to use those. Ever. For anything. For any reason. You’ve never used a web-app chat client? > WebBluetooth APIs like these don’t exist for the sake of regular unprivileged web-apps. They exist for the sake of browser extensions (or browser “apps”, or apps within a browser-projector like Electron), specifically in order to be used to add driver-like or service-like capabilities to d…

Before websockets webapp chat features would use long polling. Not sure if all current ones require websockets or if they have a fallback mechanism.

Re: Why Is This Website Port Scanning Me?

#219

Post by kchr »

hedora wrote: post #164
badRNG wrote: post #2

This raises the question: Is port scanning without consent a violation of the CFAA? Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA. I recall hearing about someone either being arrested or convicted due to port scanning a courthouse, but it was many years ago and I can't find the case with a cursory Google search. I have to wonder what val…

Bypassing a firewall to run a port scan is almost certainly illegal. That’s what these sites are doing.

I agree with the sentiment, but by visiting the site and running the code, I believe you bypassed the firewall on your own.

Re: Why Is This Website Port Scanning Me?

#220

Post by michaelt »

jschwartzi wrote: post #144
craftinator wrote: post #122

Earlier quoted context omitted.

Whatever happened to a control panel to turn off all of the things you Don't Want? All of these protocols should have triple toggle switches, Enabled, Ask, Disabled. If something on the page doesn't load because that protocol is disabled, it logs to the console so you can turn on what you need for that page. I get that adding lots of user controls makes state management difficult, but there are tried and true ways to…

Firefox is open-source, so you could add that. I would really appreciate being able to turn WebUSB WebBluetooth and WebRTC off entirely as those expose a lot of devices that I need not to be exposed to the Internet.

I'm pretty sure someone at Firefox has decided the settings panel should be 'clean' and 'easy to use' rather than providing maximum control.

I mean, there's a lot in about:config that the settings panel doesn't support.

Post reply on HN