Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

341–350 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#341

Post by kulahan »

Aeolun wrote: post #125
kulahan wrote: post #28

Earlier quoted context omitted.

I agree fully with him. I don’t care what part of your job gets harder, or what software breaks if you can’t make it work without unnecessarily invading my privacy. You could tell me it’s going to shut down the internet for 6 months and I still wouldn’t care. You’ll have to come up with a really strong defense for why this shouldn’t happen in order to convince most users.

It just means I run a persistent client on your device that is permanently connected to the mothership, instead of only when you have your browser open.

I’m so glad most people don’t truly consider software devs to be real engineers, because this is a perfect example of why that word deserves so much more respect than this field gives it.

Re: A proposal to restrict sites from accessing a users’ local network

#342

Post by ImPostingOnHN »

moralestapia wrote: post #293
ImPostingOnHN wrote: post #271

Earlier quoted context omitted.

> Proof? ... Anything? I saw them ask for it in the post you're responding to. I am also asking for it right now. That's 2 people asking for it so far. > Link to issue? Mailing list? That is not necessary.

Wow, so Google is sitting on a time machine that can see the future. Amazing!

What an interesting, non-sequitur response.

Re: A proposal to restrict sites from accessing a users’ local network

#343

Post by socalgal2 »

Thorrez wrote: post #263
socalgal2 wrote: post #153

I wish they'd (Apple/Micrsoft/Google/...) would do similar things for USB and Bluetooth. Lately, every app I install, wants bluetooth access to scan all my bluetooth devices. I don't want that. At most, I want the app to have to declare in their manifest some specific device IDs (short list) that their app is allowed to connect to and have the OS limit their connections to only those devices. For for example the Bose…

Are you talking about web apps, mobile apps, desktop apps, or browser extensions?

All of them.

Re: A proposal to restrict sites from accessing a users’ local network

#344

Post by h4ck_th3_pl4n3t »

buildfocus wrote: post #63
mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

This is a misunderstanding. Local network devices are protected from random websites by CORS, and have been for many years. It's not perfect, but it's generally quite effective. The issue is that CORS gates access only on the consent of the target server. It must return headers that opt into receiving requests from the website. This proposal aims to tighten that, so that even if the website and the network device bot…

> Local network devices are protected from random websites by CORS

C'mon. We all know that 99% of the time, Access-Control-Allow-Origin is set to * and not to the specific IP of the web service.

Also, CORS is not in the control of the user while the proposal is. And that's a huge difference.

Re: A proposal to restrict sites from accessing a users’ local network

#345

Post by AndriyKunitsyn »

IshKebab wrote: post #78
thesdev wrote: post #68

Off-topic: Is the placement of the apostrophe right in the title? Should it be "a users' local network" (current version) or "a user's local network"?

It should be "from accessing a user's local network", or "from accessing users' local networks".

Why do you think so? How is "a users' local network" significantly different from "a children's book"?

Re: A proposal to restrict sites from accessing a users’ local network

#346

Post by _cenw »

lyu07282 wrote: post #296
formerly_proven wrote: post #234

Earlier quoted context omitted.

That highly ranked comments on HN (an audience with way above average-engineer interest in software and security) get this wrong kinda explains why these things keep being an issue.

I don't know why you are getting downvoted, you do have a point. Some of the comments appear knowing what CORS headers are, but neither their purpose nor how it relates to CSRF it seems, which is worrying. It's not meant as disparaging. My university thought a course on OWASP thankfully, otherwise I'll probably also be oblivious.

If you're going cross-domain with XHR, I'd hope you're mostly sending json request bodies and not forms.

Though to be fair, a lot of web frameworks have methods to bind named inputs that allow either.

Re: A proposal to restrict sites from accessing a users’ local network

#347

Post by bsder »

socalgal2 wrote: post #153

I wish they'd (Apple/Micrsoft/Google/...) would do similar things for USB and Bluetooth. Lately, every app I install, wants bluetooth access to scan all my bluetooth devices. I don't want that. At most, I want the app to have to declare in their manifest some specific device IDs (short list) that their app is allowed to connect to and have the OS limit their connections to only those devices. For for example the Bose…

> Lately, every app I install, wants bluetooth access to scan all my bluetooth devices.

Blame Apple and Google and their horrid BLE APIs.

An app generally has to request "ALL THE PERMISSIONS!" to get RSSI which most apps are using as a (really stupid, bug prone, broken) proxy for distance.

What everybody wants is "time of flight"--but for some reason that continues to be mostly unsupported.

Re: A proposal to restrict sites from accessing a users’ local network

#348

Post by bstsb »

James_K wrote: post #303
sidewndr46 wrote: post #266

Earlier quoted context omitted.

This is also a misunderstanding. CORS only applies to the Layer 7 communication. The rest you can figure out from the timing of that. Significant components of the browser, such as Websockets have no such restrictions at all

Won't the browser still append the "Origin" field to WebSocket requests, allowing servers to reject them?

yes, and that's exactly how discord's websocket communication checks work (allowing them to offer a non-scheme "open in app" from the website).

they also had some kind of RPC websocket system for game developers, but that appears to have been abandoned: https://discord.com/developers/docs/topics/rpc

Re: A proposal to restrict sites from accessing a users’ local network

#349

Post by 1vuio0pswjnm7 »

Explainer by non-Googler

Is the so-called "modern" web browser too large and complex

I never asked for stuff like "websockets"; I have to disable it, why

I still prefer a text-only browser for reading HTML; it does not run Javascript, it does not do websockets, CSS, images or a gazillion other things; it does not even autoload resources

It is relatively small, fast and reliable; very useful

It can read larger HTML files that make so-called "modern" web browsers choke

It does not support online ad services

The companies like Google that force ads on www users are known for creating problems for www users and then proposing solutions to them; why not just stop creating the problems

Re: A proposal to restrict sites from accessing a users’ local network

#350

Post by ars »

buildfocus wrote: post #63
mystifyingpoi wrote: post #10

I like this on the first glance. The idea of a random website probing arbitrary local IPs (or any IPs for that matter) with HTTP requests is insane. I wouldn't care if it breaks some enterprise apps or integrations - enterprises could reenable this "feature" via management tools, normal users could configure it themselves, just show a popup "this website wants to control local devices - allow/deny".

This is a misunderstanding. Local network devices are protected from random websites by CORS, and have been for many years. It's not perfect, but it's generally quite effective. The issue is that CORS gates access only on the consent of the target server. It must return headers that opt into receiving requests from the website. This proposal aims to tighten that, so that even if the website and the network device bot…

> but Facebook's recent tricks where websites secretly talked to apps on your phone have broken that assumption - websites might be in cahoots with local network servers to work against your interests.

This isn't going to help for that. The locally installed app, and the website, can both, independently, open a connection to a 3rd party. There's probably enough fingerprinting available for the 3rd party to be able to match them.

Post reply on HN