Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

211–220 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#211

Post by reassess_blind »

paxys wrote: post #84

It's crazy to me that this has always been the default behavior for web browsers. A public website being able to silently access your entire filesystem would be an absurd security hole. Yet all local network services are considered fair game for XHR, and security is left to the server itself. If you are developer and run your company's webapp on your dev machine for testing (with loose or non-existent security defaul…

The local server has to send Access-Control-Allow-Origin: * for this to work, right?

Are there any common local web servers or services that use that as the default? Not that it’s not concerning, just wondering.

Re: A proposal to restrict sites from accessing a users’ local network

#212

Post by esnard »

buildfocus wrote: post #63
mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

This is a misunderstanding. Local network devices are protected from random websites by CORS, and have been for many years. It's not perfect, but it's generally quite effective. The issue is that CORS gates access only on the consent of the target server. It must return headers that opt into receiving requests from the website. This proposal aims to tighten that, so that even if the website and the network device bot…

Do you have a link talking about those Facebook's recent tricks? I think I missed that story, and would love to read an analysis about it

Re: A proposal to restrict sites from accessing a users’ local network

#213

Post by TheDong »

fiddlerwoaroof wrote: post #202
ryanisnan wrote: post #133

Earlier quoted context omitted.

That makes sense. I do love the idea of living in a world without NAT.

I don’t: NAT may have been a hack at first, but it’s my favorite feature provided by routers and why I disable ipv6 on my local network

Why do you like NAT?

Does your router being slower and taking more CPU make you feel happy?

Do you enjoy not seeing the correct IP in remote logs, thus making debugging issues harder?

Do you like being able to naively nmap your local network fairly easily?

Re: A proposal to restrict sites from accessing a users’ local network

#214

Post by shantnutiwari »

nothrabannosir wrote: post #174
3eb7988a1663 wrote: post #167

Earlier quoted context omitted.

I am still holding out hope that eventually at least Apple will offer fake permission grants to applications. Oh, app XYZ "needs" to see my contact list to proceed? Well it gets a randomized fake list, indistinguishable from the real one. Similar with GPS. I have been told that WhatsApp does not let you name contacts without sharing your address book back to Facebook.

In iOS you can share a subset of your contacts. This is functionally equivalent and works as you described for WhatsApp.

>In iOS you can share a subset of your contacts.

the problem is, the app must respect that.

WhatsApp, for all the hate it gets, does.

"Privacy" focused Telegram doesnt-- it wouldnt work unless I shared ALL my contacts-- when I shared a few, it kept complaining I had to share ALL

Re: A proposal to restrict sites from accessing a users’ local network

#215

Post by reassess_blind »

numpad0 wrote: post #92

Personally I had completely forgotten that anyone and anything can do this right now. TLDR, IIUC, right now, random websites can try accessing contents on local IPs. You can try to blind load e.g. http://192.168.0.1/cgi-bin/login.cgi from JavaScript, iterating through a gigantic malicious list of such known useful URLs, then grep and send back whatever you want to share with advertisers or try POSTing backdoors to pr…

The server has to allow cross origin requests for it to return a response though, right?

Re: A proposal to restrict sites from accessing a users’ local network

#216

Post by A4ET8a8uTh0_v2 »

loaph wrote: post #160
jm4 wrote: post #148

Earlier quoted context omitted.

This sounds crazy to me. Why should websites ever have access to the local network? That presents an entirely new threat model for which we don’t have a solution. Is there even a use case for this for which there isn’t already a better solution?

I've used https://pairdrop.net/ before to share files between devices on the same LAN. It obviously wouldn't have to be a website, but it's pretty convenient since all my devices I wanted to share files on already have a browser.

Same use case, but I remember getting approval prompts ( though come to think of it, those were not mandated, but application specific prompts to ensure you consciously choose to share/receive items ). To your point, there are valid use cases for it, but some tightening would likely be beneficial.

Re: A proposal to restrict sites from accessing a users’ local network

#217

Post by A4ET8a8uTh0_v2 »

mystified5016 wrote: post #46
lucideer wrote: post #40

Earlier quoted context omitted.

> normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny". MacOS currently does this (per app, not per site) & most users just click yes without a second thought. Doing it per site might create a little more apprehension, but I imagine not much.

I can't believe that anyone still thinks a popup permission modal offers any type of security. Windows UAC has shown quite definitively that users will always click through any modal in their way without thought or comprehension. Besides that, approximately zero laypersons will have even the slightest clue what this permission means, the risks involved, or why they might want to prevent it. All they know is that the…

Maybe. But eventually they will learn. In the meantime, other users, who at least try to stay somewhat safe ( if it is even possible these days ), can make appropriate adjustments.

Re: A proposal to restrict sites from accessing a users’ local network

#218

Post by A4ET8a8uTh0_v2 »

qwertox wrote: post #201

Proposing this in 2025. While probably knowing about this problem since Chrome was released (2008). Why not treat any local access as if it were an access to a microphone?

I would love for someone with more knowledge to opine on this, because, to me, it seems like it would actually be the most sane default state.

Re: A proposal to restrict sites from accessing a users’ local network

#219

Post by G_o_D »

Browser should just allow per-site settings or global allow/deny all to allow deny permission to localhost

So thats user will be in control

cant just write a extension that blocks access to domains based on origin

So user can just add facebook.com as origin to block all facebook* sites from sending any request to any registered url in these case localhost/127.0.0.1 domains

DNR api allows blocking based on initiatorDomains

Re: A proposal to restrict sites from accessing a users’ local network

#220

Post by rjmunro »

xp84 wrote: post #96
profmonocle wrote: post #31

Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites. One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large. A better definition of "local IP" would b…

Is it a gross generalization to say that if you're visiting a site whose name resolves to a private IP address, it's a part of the same organizational entity as your computer is? The proposal here would consider that site local and thus allowed to talk to local. What are the implications? Your employer whose VPN you're on, or whose physical facility you're located in, can get some access to the LAN where you are. In…

Don't some internet providers to large scale NAT (CGNAT), so customers each get a 10.x address instead of a public one? I'm not sure if this is a problem or not. It sounds like it could be.
Post reply on HN