A proposal to restrict sites from accessing a users’ local network • Hacker News Board

Re: A proposal to restrict sites from accessing a users’ local network

#321

Post by vel0city » Thu, Jun 05, 2025, 5:03 PM UTC

mixmastamyk wrote: post #312

vel0city wrote: post #302

Earlier quoted context omitted.

You can make those IPv6 IP addresses permanent and long-lived. They don't need to be short-lived addresses. Also, I've seen lots of home firewalls which will identify a device based on MAC address for match criteria and let you set firewall rules based on those, so even if their IPv6 address does change often it still matches the traffic.

There’s something about ip6 addresses being big as a guid that makes them hard to remember. Seem like random gibberish, like a hash. But I can look at an ip4 address like a phone number, and by looking tell approximately its rules. Maybe there’s a standard primer on how to grok ip6 addresses, and set up your network but I missed it. Also devices typically take 2 or 4 ip6 addresses for some reason so keeping on top of…

A few tips:

When just looking at hosts in your network with their routable IPv6 address, ignore the prefix. This is the first few segments, probably the first four in most cases for a home network (a /64 network) When thinking about firewall rules or having things talk to each other, ignore things like "temporary" IP addresses.

So looking at this example:

   Connection-specific DNS Suffix  . : home.arpa
   IPv6 Address. . . . . . . . . . . : 2600:1700:63c9:a421::2000
   IPv6 Address. . . . . . . . . . . : 2600:1700:63c9:a421:e17f:95dd:11a:d62e
   Temporary IPv6 Address. . . . . . : 2600:1700:63c9:a421:9d5:6286:67d9:afb7
   Temporary IPv6 Address. . . . . . : 2600:1700:63c9:a421:4471:e029:cc6a:16a0
   Temporary IPv6 Address. . . . . . : 2600:1700:63c9:a421:91bf:623f:d56b:4404
   Temporary IPv6 Address. . . . . . : 2600:1700:63c9:a421:ddca:5aae:26b9:a53c
   Temporary IPv6 Address. . . . . . : 2600:1700:63c9:a421:fc43:7d0a:7f8:e4c8
   Link-local IPv6 Address . . . . . : fe80::7976:820a:b5f5:39c3%18
   IPv4 Address. . . . . . . . . . . : 192.168.20.59
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::ec4:7aff:fe7f:d167%18
                                       192.168.20.254

Ignore all those temporary ones. Ignore the longer one. You can ignore 2600:1700:63c9:a421, as that's going to be the same for all the hosts on your network, so you'll see it pretty much everywhere. So, all you really need to remember if you're really trying to configure things by IP address is this is whatever-is-my-prefix::2000.

But honestly, just start using DNS. Ignore IP addresses for most things. We already pretty much ignore MAC addresses and rely on other technologies to automatically map IP to MAC for us. Its pretty simple to get a halfway competent DNS setup going on, so many home routers will have things going by default, and its just way easier to do things in general. I don't want to have to remember my printer is at 192.168.20.132 or 2600:1700:63c9:a421::a210 I just want to go to http://brother or ipp://brother.home.arpa and have it work.

Re: A proposal to restrict sites from accessing a users’ local network

#322

Post by avidiax » Thu, Jun 05, 2025, 5:14 PM UTC

bmacho wrote: post #287

One of the very few security inspired restrictions I can wholeheartedly agree with. I don't want random websites be able to read my localhost. I hope it gets accepted and implemented sooner than later. OTOH it would be cool if random websites were able to open up and use ports on my computer's network, or even on my LAN, when granted permission of course. Browser-based file- and media sharing between my devices, or g…

> OTOH it would be cool if random websites were able to open up and use ports on my computer's network

That's what WebRTC does. There's no requirement that WebRTC is used to send video and audio as in a Zoom/Meet call.

That's how WebTorrent works.

https://webtorrent.io/faq

Re: A proposal to restrict sites from accessing a users’ local network

#323

Post by hnav » Thu, Jun 05, 2025, 5:23 PM UTC

afiori wrote: post #305

sidewndr46 wrote: post #266

Earlier quoted context omitted.

This is also a misunderstanding. CORS only applies to the Layer 7 communication. The rest you can figure out from the timing of that. Significant components of the browser, such as Websockets have no such restrictions at all

A WebSocket starts as a normal http request, so it is subject to cors if the initial request was (eg if it was a post)

websockets aren't subject to CORS, they send the initiating webpage in the Origin header but the server has to decide whether that's allowed.

Re: A proposal to restrict sites from accessing a users’ local network

#324

Post by 3abiton » Thu, Jun 05, 2025, 5:59 PM UTC

paxys wrote: post #84

It's crazy to me that this has always been the default behavior for web browsers. A public website being able to silently access your entire filesystem would be an absurd security hole. Yet all local network services are considered fair game for XHR, and security is left to the server itself. If you are developer and run your company's webapp on your dev machine for testing (with loose or non-existent security defaul…

I majored in CS and I had no idea that was possible: public websites you access have access to your local network. I have to take time to process this. Beside what is suggested in the post, are there any ways to limit this abusive access?

Re: A proposal to restrict sites from accessing a users’ local network

#325

Post by grahamj » Thu, Jun 05, 2025, 6:03 PM UTC

I don’t see this mentioned anywhere but Safari on iOS already does this. If you try to access a local network endpoint you’ll be asked to allow it by Safari, and the permission is per-site.

Re: A proposal to restrict sites from accessing a users’ local network

#326

Post by skybrian » Thu, Jun 05, 2025, 6:10 PM UTC

nine_k wrote: post #50

skybrian wrote: post #36

While this will help to block many websites that have no business making local connections at all, it's still very coarse-grained. Most websites that need this permission only need to access one local server. Granting them access to everything violates the principle of least privilege. Most users don't know what's running on localhost or on their local network, so they won't understand the risk.

A comprehensive implementation would be a firewall. Which CIDRs, which ports, etc. I wish there were an API to build such a firewall, e.g. as a part of a browser extension, but also a simple default UI allowing to give access to a particular machine (e.g. router), to the LAN, to a VPN, based on the routing table, or to "private networks" in general, in the sense Windows ascribes to that. Also access to localhost sepa…

I think something like Tailscale is the way to go here.

Re: A proposal to restrict sites from accessing a users’ local network

#327

Post by apazzolini » Thu, Jun 05, 2025, 6:13 PM UTC

reyqn wrote: post #294

potholereseller wrote: post #51

Earlier quoted context omitted.

It appears to not have been enabled by default on my instance of uBlock; it seems a specific filter list is used to implement this [0]; that filter was un-checked; I have no idea why. The contents of that filter list are here [1]; notice that there are exceptions for certain services, so be sure to read through the exceptions before enabling it. [0] Filter Lists -> Privacy -> Block Outsider Intrusion into Lan [1] htt…

This filter broke twitch for me. I had to create custom rules for twitch if I wanted to use it with this filter enabled.

Would you mind sharing those custom rules?

Re: A proposal to restrict sites from accessing a users’ local network

#328

Post by Too » Thu, Jun 05, 2025, 6:32 PM UTC

paxys wrote: post #84

It's crazy to me that this has always been the default behavior for web browsers. A public website being able to silently access your entire filesystem would be an absurd security hole. Yet all local network services are considered fair game for XHR, and security is left to the server itself. If you are developer and run your company's webapp on your dev machine for testing (with loose or non-existent security defaul…

What’s even crazier is that nobody learned this lesson and new protocols are created with the same systematic vulnerabilities.

Talking about MCP agents if that’s not obvious.

Re: A proposal to restrict sites from accessing a users’ local network

#329

Post by bombela » Thu, Jun 05, 2025, 6:34 PM UTC

mixmastamyk wrote: post #312

vel0city wrote: post #302

Earlier quoted context omitted.

You can make those IPv6 IP addresses permanent and long-lived. They don't need to be short-lived addresses. Also, I've seen lots of home firewalls which will identify a device based on MAC address for match criteria and let you set firewall rules based on those, so even if their IPv6 address does change often it still matches the traffic.

There’s something about ip6 addresses being big as a guid that makes them hard to remember. Seem like random gibberish, like a hash. But I can look at an ip4 address like a phone number, and by looking tell approximately its rules. Maybe there’s a standard primer on how to grok ip6 addresses, and set up your network but I missed it. Also devices typically take 2 or 4 ip6 addresses for some reason so keeping on top of…

At home, with both ip v4 and v6. For any device exposed on the Internet, I add a static IPv6 address with the host part the same as the IPv4 adress.

example: 2001:db8::192.168.0.42

This makes it very easy to remember, correlate and firewall.

Re: A proposal to restrict sites from accessing a users’ local network

#330

Post by kayodelycaon » Thu, Jun 05, 2025, 6:39 PM UTC

blacklion wrote: post #225

shantnutiwari wrote: post #214

Earlier quoted context omitted.

>In iOS you can share a subset of your contacts. the problem is, the app must respect that. WhatsApp, for all the hate it gets, does . "Privacy" focused Telegram doesnt-- it wouldnt work unless I shared ALL my contacts-- when I shared a few, it kept complaining I had to share ALL

Is it something specific to iOS Telegram client? On Android Telegram works with denied access to the contacts and maintains its own, completely separate, contact list (shared with desktop Telegram and other copies logged in to same account). I'm using Telegram longer than I'm using smartphone and it has completely separate contact list (as it should be). And WhatsApp cannot be used without access to contacts: it does…

I’ve never allowed Telegram on iOS to access my contacts, camera, or microphone and it’s worked just fine.