Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

221–230 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#221

Post by WhyNotHugo »

nothrabannosir wrote: post #174
3eb7988a1663 wrote: post #167

Earlier quoted context omitted.

I am still holding out hope that eventually at least Apple will offer fake permission grants to applications. Oh, app XYZ "needs" to see my contact list to proceed? Well it gets a randomized fake list, indistinguishable from the real one. Similar with GPS. I have been told that WhatsApp does not let you name contacts without sharing your address book back to Facebook.

In iOS you can share a subset of your contacts. This is functionally equivalent and works as you described for WhatsApp.

WhatsApp specifically needs phone numbers, and you can filter out which contacts you share, but not which fields. So if you family uses WhatsApp, you’d share those contacts, but you can’t share ONLY their phone number, WhatsApp also gets their birthdays, addresses, personal notes, and any other personal information which you might have.

I think this feature is pretty meaningless in the way that it’s implemented.

It’s also pretty annoying that applications know they have partial permission, so kept prompting for full permission all the time anyway.

Re: A proposal to restrict sites from accessing a users’ local network

#222

Post by bux93 »

pacifika wrote: post #17

Internet Explorer solved this with their zoning system right? https://learn.microsoft.com/en-us/previous-versions/troubles...

Although those were typically used to give ActiveX controls on the intranet unfettered access to your machine because IT put it in the group policy. Fun days.

Re: A proposal to restrict sites from accessing a users’ local network

#223

Post by JimDabell »

esnard wrote: post #212
buildfocus wrote: post #63

Earlier quoted context omitted.

This is a misunderstanding. Local network devices are protected from random websites by CORS, and have been for many years. It's not perfect, but it's generally quite effective. The issue is that CORS gates access only on the consent of the target server. It must return headers that opt into receiving requests from the website. This proposal aims to tighten that, so that even if the website and the network device bot…

Do you have a link talking about those Facebook's recent tricks? I think I missed that story, and would love to read an analysis about it

https://news.ycombinator.com/item?id=44169115

Re: A proposal to restrict sites from accessing a users’ local network

#224

Post by meindnoch »

reassess_blind wrote: post #211
paxys wrote: post #84

It's crazy to me that this has always been the default behavior for web browsers. A public website being able to silently access your entire filesystem would be an absurd security hole. Yet all local network services are considered fair game for XHR, and security is left to the server itself. If you are developer and run your company's webapp on your dev machine for testing (with loose or non-existent security defaul…

The local server has to send Access-Control-Allow-Origin: * for this to work, right? Are there any common local web servers or services that use that as the default? Not that it’s not concerning, just wondering.

No, simple requests [1] - such as a GET request, or a POST request with text/plain Content-Type - don't trigger a CORS preflight. The request is made, and the browser may block the requesting JS code from seeing the response if the necessary CORS response header is missing. But by that point the request had already been made. So if your local service has a GET endpoint like http://localhost:8080/launch_rockets, or a POST endpoint, that doesn't strictly validate the body Content-Type, then any website can trigger it.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

Re: A proposal to restrict sites from accessing a users’ local network

#225

Post by blacklion »

shantnutiwari wrote: post #214
nothrabannosir wrote: post #174

Earlier quoted context omitted.

In iOS you can share a subset of your contacts. This is functionally equivalent and works as you described for WhatsApp.

>In iOS you can share a subset of your contacts. the problem is, the app must respect that. WhatsApp, for all the hate it gets, does . "Privacy" focused Telegram doesnt-- it wouldnt work unless I shared ALL my contacts-- when I shared a few, it kept complaining I had to share ALL

Is it something specific to iOS Telegram client?

On Android Telegram works with denied access to the contacts and maintains its own, completely separate, contact list (shared with desktop Telegram and other copies logged in to same account). I'm using Telegram longer than I'm using smartphone and it has completely separate contact list (as it should be).

And WhatsApp cannot be used without access to contacts: it doesn't allow to create WatsApp-only contact and complains that it has no place to store it till you grant access to Phone contact list.

To be honest, I prefer to have separate contact lists on all my communication channel, and even sharing contacts between phone app and e-mail app (GMail) bothers me.

Telegram is good in this aspect, it can use its own contact list, not synchronized or shared with anything else, and WhatsApp is not.

Re: A proposal to restrict sites from accessing a users’ local network

#226

Post by reassess_blind »

meindnoch wrote: post #224
reassess_blind wrote: post #211

Earlier quoted context omitted.

The local server has to send Access-Control-Allow-Origin: * for this to work, right? Are there any common local web servers or services that use that as the default? Not that it’s not concerning, just wondering.

No, simple requests [1] - such as a GET request, or a POST request with text/plain Content-Type - don't trigger a CORS preflight. The request is made, and the browser may block the requesting JS code from seeing the response if the necessary CORS response header is missing. But by that point the request had already been made. So if your local service has a GET endpoint like http://localhost:8080/launch_rockets , or a…

I was thinking in terms of response exfiltration, but yeah, better put that /launch_rockets endpoint behind some auth.

Re: A proposal to restrict sites from accessing a users’ local network

#227

Post by account42 »

donnachangstein wrote: post #43
duskwuff wrote: post #32

Earlier quoted context omitted.

> Can you define "local network"? Sure - a destination is "local" if your machine has a route to that IP which isn't via a gateway. If your network is large enough that it consists of multiple routed network segments, and you don't have any ACLs between those segments, then yeah, you won't be fully protected by this browser feature. But you aren't protected right now either, so nothing's getting worse , it's just not…

> Sure - a destination is "local" if your machine has a route to that IP which isn't via a gateway. Fantastic. Well, Google doesn't agree The proposal defines it along RFC1918 address space boundaries. The spitballing back and forth in the GitHub issues about which imaginary TLDs they will or won't also consider "local" is absolutely horrifying.

Cool so it will protect 99.999% of home networks. Compared to 0% which are protected now. Sounds great!

Re: A proposal to restrict sites from accessing a users’ local network

#228

Post by rs186 »

Why is this a Chrome thing, not an Android thing?

I get that this could happen on any OS, and the proposal is from browser maker's perspective. But what about the other side of things, an app (not necessarily browser) talking to arbitrary localhost address?

Re: A proposal to restrict sites from accessing a users’ local network

#229

Post by account42 »

kuschku wrote: post #101
michaelt wrote: post #97

Earlier quoted context omitted.

I don't think this proposal will stop you visiting the management UI for devices like switches and NASes on the local network. You'll be able to visit http://192.168.0.1 and it'll work just fine? This is just about blocking cross-origin requests from other websites. I probably don't want every ad network iframe being able to talk to my router's admin UI.

That's not what I'm talking about. A common example is this: 1. I visit ui.manufacturer.tld 2. I click "add device" and enter 192.168.0.230, repeating this for my other local devices. 3. The website ui.manufacturer.tld now shows me a dashboard with aggregate metrics from all my switches and routers, which it collects by fetch(...) ing data from all of them. The manufacturers site is just a static page. It stores the…

That absolutely is a privacy nightmare.

Re: A proposal to restrict sites from accessing a users’ local network

#230

Post by rjh29 »

socalgal2 wrote: post #153

I wish they'd (Apple/Micrsoft/Google/...) would do similar things for USB and Bluetooth. Lately, every app I install, wants bluetooth access to scan all my bluetooth devices. I don't want that. At most, I want the app to have to declare in their manifest some specific device IDs (short list) that their app is allowed to connect to and have the OS limit their connections to only those devices. For for example the Bose…

Safari doesn't support Web MIDI apparently for this reason (fingerprinting), but it makes using any kind of MIDI web app impossible.
Post reply on HN