Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

31–40 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#31

Post by profmonocle »

Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites.

One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large.

A better definition of "local IP" would be whether the IP is in the same subnet as the client, i.e. look up the client's own IP and subnet mask and determine if a packet to a given IP would need to be routed through the default gateway.

Re: A proposal to restrict sites from accessing a users’ local network

#32

Post by duskwuff »

donnachangstein wrote: post #23
duskwuff wrote: post #19

Earlier quoted context omitted.

Or probing your local network for vulnerable HTTP servers, like insecure routers or web cameras. localhost is just the tip of the iceberg.

Can you define "local network"? Probably not. Most large enterprises own publicly-routable IP space for internal use. Internal doesn't mean 192.168.0.0/24. foo.corp.example.com could resolve to 9.10.11.12 and still be local. What about IPv6? It's a nonsense argument fraught with corner cases.

> Can you define "local network"?

Sure - a destination is "local" if your machine has a route to that IP which isn't via a gateway.

If your network is large enough that it consists of multiple routed network segments, and you don't have any ACLs between those segments, then yeah, you won't be fully protected by this browser feature. But you aren't protected right now either, so nothing's getting worse, it's just not getting better for your specific use case.

Re: A proposal to restrict sites from accessing a users’ local network

#33

Post by donnachangstein »

kulahan wrote: post #28
donnachangstein wrote: post #12

Earlier quoted context omitted.

[flagged]

I agree fully with him. I don’t care what part of your job gets harder, or what software breaks if you can’t make it work without unnecessarily invading my privacy. You could tell me it’s going to shut down the internet for 6 months and I still wouldn’t care. You’ll have to come up with a really strong defense for why this shouldn’t happen in order to convince most users.

[flagged]

Re: A proposal to restrict sites from accessing a users’ local network

#34

Post by kccqzy »

profmonocle wrote: post #31

Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites. One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large. A better definition of "local IP" would b…

The article spends a lot of effort defining the words "local" and "private" here. It then says:

> Note that local -> local is not a local network request

So your use case won't be affected.

Re: A proposal to restrict sites from accessing a users’ local network

#35

Post by RagingCactus »

ronsor wrote: post #3

Do note that since the removal of NPAPI plugins years ago, locally-installed software that intends to be used by one or more public websites has to run an HTTP server on localhost. It would be really annoying if this use case was made into an unreasonable hassle or killed entirely. (Alternatively, browser developers could've offered a real alternative, but it's a bit late for that now.)

I don't believe this is true, as https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... exists. It does need an extension to be installed, but I think that's fair in your comparison with NPAPI.

Re: A proposal to restrict sites from accessing a users’ local network

#36

Post by skybrian »

While this will help to block many websites that have no business making local connections at all, it's still very coarse-grained.

Most websites that need this permission only need to access one local server. Granting them access to everything violates the principle of least privilege. Most users don't know what's running on localhost or on their local network, so they won't understand the risk.

Re: A proposal to restrict sites from accessing a users’ local network

#37

Post by kccqzy »

AStonesThrow wrote: post #11

Chris Siebenmann weighs in with thoughts on: Browers[sic] can't feasibly stop web pages from talking to private (local) IP addresses (2019) https://utcc.utoronto.ca/~cks/space/blog/web/BrowsersAndLoca...

The split horizon DNS model mentioned in that article is to me insane. Your DNS responses should not change based on what network you are connected to. It breaks so many things. For one, caching breaks because DNS caching is simplistic and is only cached with a TTL: no way to tell your OS to associate a DNS cached response to a network.

I understand why some companies want this, but doing it on the DNS level is a massive hack.

If I were the decision maker I would break that use case. (Chrome probably wouldn't though.)

Re: A proposal to restrict sites from accessing a users’ local network

#38

Post by GlacierFox »

donnachangstein wrote: post #33
kulahan wrote: post #28

Earlier quoted context omitted.

I agree fully with him. I don’t care what part of your job gets harder, or what software breaks if you can’t make it work without unnecessarily invading my privacy. You could tell me it’s going to shut down the internet for 6 months and I still wouldn’t care. You’ll have to come up with a really strong defense for why this shouldn’t happen in order to convince most users.

[flagged]

I like your "you've been *** my ass for 35 years, please feel free to keep doing it for all eternity" attitude.

Re: A proposal to restrict sites from accessing a users’ local network

#40

Post by lucideer »

mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

> normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

MacOS currently does this (per app, not per site) & most users just click yes without a second thought. Doing it per site might create a little more apprehension, but I imagine not much.

Post reply on HN