As sooner this happens, the better.
A proposal to restrict sites from accessing a users’ local network
291–300 of 392 posts
Re: A proposal to restrict sites from accessing a users’ local network
#292Earlier quoted context omitted.
But how do you check the source IP if everyone is behind NAT? Take the following example (all IPs are examples): 1. University uses 10./8 internally, with 10.1./16 and 10.2./16 being students, 10.3./16 being admin, 10.4. being natsci institute, 10.5. being tech institute, etc. 2. You use radius to assign users to IP ranges depending on their group membership 3. If you access the website from one of these IP ranges, g…
Ohh, your Example Documentation was sooo close to being RFC-compliant! Except for those unnecessary abbreviations of CIDR notation, and... You can use 203.0.113.0/24 in your examples because it is specifically reserved for this purpose by IETF/IANA: https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4
I usually try to write comments with proper notation and proper example values, but if — like in this instance — I'm interrupted IRL and lose my draft, I'll focus on getting my idea across at all rather than writing the perfect comment. Even if that leads to excessive abbreviations, slightly off example values, inconsistency between you/I/passive voice or past/present/future tense.
In this case the comment you see is the third attempt, ultimately written on a phone (urgh), but I hope the idea came across nonetheless.
Re: A proposal to restrict sites from accessing a users’ local network
#293Earlier quoted context omitted.
>I'm asking for it. Proof? Link to issue? Mailing list? Anything? I think you just made that up.
> Proof? ... Anything? I saw them ask for it in the post you're responding to. I am also asking for it right now. That's 2 people asking for it so far. > Link to issue? Mailing list? That is not necessary.
Wow, so Google is sitting on a time machine that can see the future.
Amazing!
Re: A proposal to restrict sites from accessing a users’ local network
#294uBlock / uMatrix does this by default, I believe. I often see sites like Paypal trying to probe 127.0.0.1. For my "security", I'm sure...
It appears to not have been enabled by default on my instance of uBlock; it seems a specific filter list is used to implement this [0]; that filter was un-checked; I have no idea why. The contents of that filter list are here [1]; notice that there are exceptions for certain services, so be sure to read through the exceptions before enabling it. [0] Filter Lists -> Privacy -> Block Outsider Intrusion into Lan [1] htt…
This filter broke twitch for me. I had to create custom rules for twitch if I wanted to use it with this filter enabled.
Re: A proposal to restrict sites from accessing a users’ local network
#295make this malicious website and show me that it works. I have doubts.
Re: A proposal to restrict sites from accessing a users’ local network
#296Earlier quoted context omitted.
Exactly you can also trigger forms for POST or DELETE etc. this is called CSRF if the endpoint doesn't validate some token in the request. CORS only protects against unauthorized xhr requests. All decades old OWASP basics really.
That highly ranked comments on HN (an audience with way above average-engineer interest in software and security) get this wrong kinda explains why these things keep being an issue.
I don't know why you are getting downvoted, you do have a point. Some of the comments appear knowing what CORS headers are, but neither their purpose nor how it relates to CSRF it seems, which is worrying. It's not meant as disparaging. My university thought a course on OWASP thankfully, otherwise I'll probably also be oblivious.
Re: A proposal to restrict sites from accessing a users’ local network
#297Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites. One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large. A better definition of "local IP" would b…
Is it a gross generalization to say that if you're visiting a site whose name resolves to a private IP address, it's a part of the same organizational entity as your computer is? The proposal here would consider that site local and thus allowed to talk to local. What are the implications? Your employer whose VPN you're on, or whose physical facility you're located in, can get some access to the LAN where you are. In…
> Is it a gross generalization to say that if you're visiting a site whose name resolves to a private IP address, it's a part of the same organizational entity as your computer is?
Yes. That's a gross generalization.
I support applications delivered via site-to-site VPN tunnels hosted by third parties. In the Customer site the application is accessed via an RFC 1918 address. It is is not part of the Customer's local network, however.
Likewise, I support applications that are locally-hosted but Internet facing and appear on a non-RFC1918 IP address even though the server is local and part of the Customer's network.
Access control policy really should be orthogonal to network address. Coupling those two will enivtably lead to mismatches to work around. I would prefer some type of user-exposed (and sysadmin-exposed, centrally controllable) method for declaring the network-level access permitted by scripts (as identified by the source domain, probably).
Re: A proposal to restrict sites from accessing a users’ local network
#298This seems like a silly solution, considering we are in the middle of IPv6 transition, where local networks use public addresses.
Whatever happened to IPv6 site-local and link local address ranges (address ranges that were specifically defined as address ranges that would not cross router or WAN boundaries? They were in the original IPv6 standards, but don't seem to be implemented or supported. Or at least they aren't implemented or supported by my completely uconfigurable home cable router povided by my ISP.
IPv6 in normal ethernet/wlan like uses requires link-local to for functioning neighbour discovery (equivalent for v4's ARP) so it's very likely it works. Not meant for normal application usage though. Site local was phased out in favour of ULA etc.
But if you're not using global addresses you're probably doing it wrong. Global addressing doesn't mean you're globally reachable, confusing addressing vs reachability is the source of a lot of misunderstandings. You can think of it as "everyone gets their own piece of unique address space, not routed unless you want it to be".
Re: A proposal to restrict sites from accessing a users’ local network
#299Earlier quoted context omitted.
Windows Vista would spawn a permissions prompt when users did something as innocuous as creating a shortcut on their desktop. Microsoft deserved to be mocked for that implementation.
MacOS asked a permission dialog when I plug my AirPods in to charge. I have no idea what I’m even giving permission for but it pops up every time.
Asking you if you trust a device before opening a data connection to it is simply not the same thing as asking the person who just created a shortcut if they should be allowed to do that.
Re: A proposal to restrict sites from accessing a users’ local network
#300Earlier quoted context omitted.
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 are all private addresses per RFC1918 and documents superseding it(5735?). If it's like 66.249.73.128/27 or 164.13.12.34/12, those are "global" IP. 1: https://www.rfc-editor.org/rfc/rfc1918 2: https://www.rfc-editor.org/rfc/rfc5735 3: https://en.wikipedia.org/wiki/Private_network
Yes that's the point: many of our work PCs have global public IPs from something like 128.130.0.0/15 (not this actual block, but something similar), and many internal services are on 10.0.0.0/8. I'm not sure I get exactly how the proposal is addressing this. How does it know that 128.130.0.0/15 is actually internal and should be considered for content loaded from an external site?
The proposal doesn't need to address this because it doesn't even consider the global public IP of 128.130.0.0/15 in your example. If you visit a site on 10.0.0.0/8 that accesses resources on 10.0.0.0/8 it's allowed. But if you visit a random other site on the internet it will be (by default) forbidden to access the internal resource at 10.0.0.0/8.