Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

331–340 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#331

Post by kayodelycaon »

mixmastamyk wrote: post #309
derefr wrote: post #95

Earlier quoted context omitted.

In an ideal world, the browser could act as an mDNS client, discovering local services, so that it could then show the pretty name of the relevant service in the security prompt. In the world we live in, of course, almost nothing on your average LAN has an associated mDNS service advertisement.

They don’t? Every time I install an OS I turn that stuff off, because I don’t fully understand it. Or is avahi et al another thing?

Avahi handles zeroconf networking, which is mDNS and DNS-SD.

Re: A proposal to restrict sites from accessing a users’ local network

#332

Post by mixmastamyk »

bombela wrote: post #329
mixmastamyk wrote: post #312

Earlier quoted context omitted.

There’s something about ip6 addresses being big as a guid that makes them hard to remember. Seem like random gibberish, like a hash. But I can look at an ip4 address like a phone number, and by looking tell approximately its rules. Maybe there’s a standard primer on how to grok ip6 addresses, and set up your network but I missed it. Also devices typically take 2 or 4 ip6 addresses for some reason so keeping on top of…

At home, with both ip v4 and v6. For any device exposed on the Internet, I add a static IPv6 address with the host part the same as the IPv4 adress. example: 2001:db8::192.168.0.42 This makes it very easy to remember, correlate and firewall.

Ok, that parses somehow in Python, matches, and is apparently legit. ;-)

    >>> from ipaddress import IPv6Address as address
    >>> address('2001:db8::192.168.0.42')
    IPv6Address('2001:db8::c0a8:2a')
    >>> int('2a', 16)
    42
Openwrt doesn't seem to make ipv6 static assignment easy unfortunately.

Re: A proposal to restrict sites from accessing a users’ local network

#333

Post by spr-alex »

The existing PNA is easily defeated for bugs that can be triggered with standard cross origin requests. For example PNA does nothing to stop a website from exploiting some EOL devices I have with POST requests and img tags.

This is a much better approach.

Re: A proposal to restrict sites from accessing a users’ local network

#334

Post by spr-alex »

buildfocus wrote: post #63
mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

This is a misunderstanding. Local network devices are protected from random websites by CORS, and have been for many years. It's not perfect, but it's generally quite effective. The issue is that CORS gates access only on the consent of the target server. It must return headers that opt into receiving requests from the website. This proposal aims to tighten that, so that even if the website and the network device bot…

I made a CTF challenge 3 years ago that proves why local devices are not so protected. exploitv99 bypasses PNA with timing as the other commentor points out.

https://github.com/adc/ctf-midnightsun2022quals-writeups/tre...

Re: A proposal to restrict sites from accessing a users’ local network

#336

Post by mixmastamyk »

vel0city wrote: post #321
mixmastamyk wrote: post #312

Earlier quoted context omitted.

There’s something about ip6 addresses being big as a guid that makes them hard to remember. Seem like random gibberish, like a hash. But I can look at an ip4 address like a phone number, and by looking tell approximately its rules. Maybe there’s a standard primer on how to grok ip6 addresses, and set up your network but I missed it. Also devices typically take 2 or 4 ip6 addresses for some reason so keeping on top of…

A few tips: When just looking at hosts in your network with their routable IPv6 address, ignore the prefix. This is the first few segments, probably the first four in most cases for a home network (a /64 network) When thinking about firewall rules or having things talk to each other, ignore things like "temporary" IP addresses. So looking at this example: Connection-specific DNS Suffix . : home.arpa IPv6 Address. . .…

Helps, thanks a lot!

But as you can see this is still an explosion of complexity for the home user. More than 4x (32 --> 128), feels like x⁴ (though might not be accurate).

I like your idea of "whatever..." There should be a "lan" variable and status could be shown factored, like "$lan::2000" to the end user perhaps.

I do use DNS all the time, like "printer.lan", "gateway.lan", etc. But don't think I'm using in the router firewall config. I use openwrt on my router but my knowledge of ipv6 is somewhat shallow.

Re: A proposal to restrict sites from accessing a users’ local network

#337

Post by LegionMammal978 »

drexlspivey wrote: post #124
LegionMammal978 wrote: post #76

Earlier quoted context omitted.

The idea is, the malicious actor would use a 'simple request' that doesn't need a preflight (basically, a GET or POST request with form data or plain text), and manage to construct a payload that exploits the target device. But I have yet to see a realistic example of such a payload (the paper I read about the idea only vaguely pointed at the existence of polyglot payloads).

It can send a json-rpc request to your bitcoin node and empty your wallet

Do you know of any such node that doesn't check the Content-Type of requests and also has no authentication?

Re: A proposal to restrict sites from accessing a users’ local network

#338

Post by globular-toast »

benob wrote: post #335

Isn't it time for disallowing browsers to connect to anything outside same origin pages except for actual navigation? Servers can do all the hard work of gathering content from here and there.

Is it possible to do this today with browser extensions? I ran noscript 10 years ago and it was really tough. Kinda felt like being gaslit constantly. I could go back, only enabling sites selectively, but it's not going to work for family. Wondering if just blocking cross origin requests would be more feasible.

Re: A proposal to restrict sites from accessing a users’ local network

#339

Post by broguinn »

Thorrez wrote: post #256
broguinn wrote: post #251

Earlier quoted context omitted.

This Web Security lecture by Feross Aboukhadijeh has a great example of Zoom's zero-day from 2019 that allowed anyone to force you to join a zoom meeting (and even cause arbitrary code execution), using a local server: https://www.youtube.com/watch?v=wLgcb4jZwGM&list=PL1y1iaEtjS... It's not clear to me from Google's proposal if it also restricts access to localhost, or just your local network - it'd be great if it we…

>edit: localhost won't be restricted: It will be restricted. This proposal isn't completely blocking all localhost and local IPs. Rather, it's preventing public sites from communicating with localhost and local IPs. E.g: * If evil.com makes a request to a local address it'll get blocked. * If evil.com makes a request to a localhost address it'll get blocked. * If a local address makes a request to a localhost address…

Ahh, thanks for clarifying! It's the origin being compared, not the context - of course.

Re: A proposal to restrict sites from accessing a users’ local network

#340

Post by globular-toast »

rerdavies wrote: post #112

I worry that there are problems with Ipv6. Can anyone explain to me if there actually is a way to determine whether an IPv6 is site local? If not, the proposal is going to have problems on IPv6-only networks. I have an struggled with this issue in the past. I have an IoT application whose websever wants to reject any requests from a non-local address. After failing to find a way to distinguish IPv6 local addresses, I…

HTTPS doesn't care about IP addresses. It's all based on domain names. You can get a certificate for any domain you own. You can also set said domain to resolve to any address you like, including a "local" one.

NAT has rotted people's brains unfortunately. RFC 1918 is not really the way to tell if something is "local" or not. 25 years ago I had 4 publicly routable IPv4 addresses. All 4 of these were "local" to me despite also being publicly routable.

An IP address is local if you can resolve it and don't have to communicate via a router.

It seems too far gone, though. People seem unable to separate RFC 1918 from the concept of "local network".

Post reply on HN