Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

281–290 of 448 posts

Re: Why Is This Website Port Scanning Me?

#281

Post by anderspitman »

hanniabu wrote: post #271
segfaultbuserr wrote: post #167

It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 - Can requests to 127.0.0.1 be used to fingerprint the browser [0] and has been fixed since then. Scanning localhost is a dangerous way to fingerprint the user if there are local open ports. If you are not using Tor Browser and want to fix the security hole…

> If you are not using Tor Browser and want to fix the security hole without disabling WebSocket completely, running the web browser in a separate network namespace is a workaround - you get a loopback interface which is independent from the main namespace, and you create a NAT interface within the network namespace to allow outgoing traffic. It's also a possibility for a website to probe other machines, such as the…

You can look into tools like firejail to make this easier.

Re: Why Is This Website Port Scanning Me?

#282

Post by fxtentacle »

zlsa wrote: post #266
fxtentacle wrote: post #249

Earlier quoted context omitted.

To connect to arbitrary IPs and ports to send home the results of the calculations.

Which can be done with HTTP as well.

Yes, but that is A LOT easier to filter and detect, because then it'll be using the XHR API and HTTP protocol, whereas WebRTC allows free-form protocols.

Re: Why Is This Website Port Scanning Me?

#283

Post by coronadisaster »

datenwolf wrote: post #118
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

You forgot WebUSB – I wish I was joking, but I'm not: https://developer.mozilla.org/en-US/docs/Web/API/USB

dont these features allow web apps to compete with native mobile apps? I really don't like the app or play store... so if that is one way to get away from them, that is a good thing.

Re: Why Is This Website Port Scanning Me?

#284

Post by anderspitman »

pennaMan wrote: post #195
90minuteAPI wrote: post #178

Earlier quoted context omitted.

Server Sent Events and HTTP? With a modern setup it’s going to be sharing an HTTP/2 pipe anyway. Even handles disconnections gracefully/transparently if you’re clever about it. Can anyone expand on why this technique isn’t more common? I’m so sick of seeing folks reinvent HTTP (poorly) on top of WebSockets. I get if extreme low latency is (allegedly) a requirement.

SSE have a limit of 6 connections across all browser tabs https://bugzilla.mozilla.org/show_bug.cgi?id=906896 https://bugs.chromium.org/p/chromium/issues/detail?id=275955

If you're using HTTP/2 this problem goes away.

Re: Why Is This Website Port Scanning Me?

#286

Post by discreditable »

Deimorz wrote: post #268
discreditable wrote: post #65

From the title I assumed this was going to be something else. I remember some sites used to port scan you on registration. This was to check if registrations were from an open proxy, which was a very strong bot indicator. I might be misremembering but I think Slashdot used to do it. There were also some plugins for phpBB forums that did it too. I used one back in the day and it helped quite a bit with spam registrati…

Yes, I definitely remember Slashdot doing it, but it was more often than just on registration. Here's an article from 2014 about it, which says that it happens on every login and posting a comment: https://soylentnews.org/article.pl?sid=14/04/09/1925245 At the bottom of that post it says the code was added on 2008-04-16 19:07:46 +0000.

That sounds right. To test I ran a capture on my gateway and it seems like they aren't scanning 8080 or 3128 on login or post nowadays.

Re: Why Is This Website Port Scanning Me?

#287

Post by anderspitman »

Curious what HN thinks about this hypothetical: Imagine you have a web app designed to talk to a specific backend server API. It's also common for users to run instances of the server on their local machine. How would you feel about the app checking a (single) well-known port to see if there's a local server running, and prompting the user: "we detected you're running a local copy of the server, do you want to connect to it?"

This doesn't seem to be done very often, and the public cases usually seem to be pretty ugly (Zoom). But I could see it being useful. Imagine for example an app for browsing S3 directories, that could also detect if you're running a minio server and allow you to connect to it, and transfer data back and forth between your different backends.

Re: Why Is This Website Port Scanning Me?

#288

Post by Wowfunhappy »

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

I realize Hacker News isn't a hivemind, but I see these two assertions frequently, and I find the contradiction striking:

1. Why are web browsers becoming application platforms? Web browsers are document readers, and we should treat them as such.

2. Why does Zoom (or Slack, or insert-thing-here) want me to download a native app? I should be able to do it in my web browser!

I sympathize with both philosophies, but they cannot co-exist.

Re: Why Is This Website Port Scanning Me?

#289

Post by swalsh »

I can think of a legitimate use case for this. If you watch some of these scammer youtube videos, one common thing they seem to do is get on a screensharing application, and have the user log into their bank account. From there, the scammer inspects the html, and manipulates the values to trick the victim.

A bank knowing if someone else is watching your screen is a decent security measure.

Re: Why Is This Website Port Scanning Me?

#290

Post by tjoff »

jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

A server most definitely should not be looking at what random services a client has available.
Post reply on HN