Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

351–360 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#351

Post by sedatk »

lobsterthief wrote: post #276
grrowl wrote: post #206

Earlier quoted context omitted.

I remember back in the day you could embed http://someothersite.com/forum/ucp.php?mode=logout "> in your forum signature and screw with everyone's sessions across the web

Haha I remember that. The solution at the time for many forum admins was to simply state that anyone found to be doing that would be permabanned. Which was enough to make it stop completely, at least for the forums that I moderated. Different times indeed.

Or you could just make the logout route POST-only. Problem solved.

Re: A proposal to restrict sites from accessing a users’ local network

#353

Post by HumanOstrich »

1vuio0pswjnm7 wrote: post #349

Explainer by non-Googler Is the so-called "modern" web browser too large and complex I never asked for stuff like "websockets"; I have to disable it, why I still prefer a text-only browser for reading HTML; it does not run Javascript, it does not do websockets, CSS, images or a gazillion other things; it does not even autoload resources It is relatively small, fast and reliable; very useful It can read larger HTML fi…

Going back to text-only browsers is not the solution.

Re: A proposal to restrict sites from accessing a users’ local network

#354

Post by fiddlerwoaroof »

TheDong wrote: post #213
fiddlerwoaroof wrote: post #202

Earlier quoted context omitted.

I don’t: NAT may have been a hack at first, but it’s my favorite feature provided by routers and why I disable ipv6 on my local network

Why do you like NAT? Does your router being slower and taking more CPU make you feel happy? Do you enjoy not seeing the correct IP in remote logs, thus making debugging issues harder? Do you like being able to naively nmap your local network fairly easily?

I like all the computers in my house appearing to remote servers as a single remote host. Avoids leaking details about my home network.

Re: A proposal to restrict sites from accessing a users’ local network

#355

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #349

Explainer by non-Googler Is the so-called "modern" web browser too large and complex I never asked for stuff like "websockets"; I have to disable it, why I still prefer a text-only browser for reading HTML; it does not run Javascript, it does not do websockets, CSS, images or a gazillion other things; it does not even autoload resources It is relatively small, fast and reliable; very useful It can read larger HTML fi…

Text-only browsers are not a "solution". That is not the point of the comment. Such simpler clients are not a problem.

The point is that gigantic, overly complex "browsers" designed for surveillance and advertising are the problem. They are not a solution.

Re: A proposal to restrict sites from accessing a users’ local network

#356

Post by will4274 »

sroussey wrote: post #2

I guess this would help Meta’s sneaking identification code sharing between native apps and websites with their sdk on them from communicating serendipitously through localhost, particularly on Android. [0] https://www.theregister.com/2025/06/03/meta_pauses_android_t...

surreptitiously

Re: A proposal to restrict sites from accessing a users’ local network

#357

Post by will4274 »

rs186 wrote: post #228

Why is this a Chrome thing, not an Android thing? I get that this could happen on any OS, and the proposal is from browser maker's perspective. But what about the other side of things, an app (not necessarily browser) talking to arbitrary localhost address?

Basically any inter-process communication (IPC). https://en.wikipedia.org/wiki/Inter-process_communication . There are fancier IPC mechanisms, but none as widely supported as just sending arbitrary data over a socket. It wouldn't surprise me if e.g. this is how Chrome processes communicate with each other.

Re: A proposal to restrict sites from accessing a users’ local network

#358

Post by apitman »

Sophira wrote: post #273
LegionMammal978 wrote: post #76

Earlier quoted context omitted.

The idea is, the malicious actor would use a 'simple request' that doesn't need a preflight (basically, a GET or POST request with form data or plain text), and manage to construct a payload that exploits the target device. But I have yet to see a realistic example of such a payload (the paper I read about the idea only vaguely pointed at the existence of polyglot payloads).

I can give an example of this; I found such a vulnerability a few years ago now in an application I use regularly. The target application in this case was trying to validate incoming POST requests by checking that the incoming MIME type was "application/json". Normally, you can't make unauthorized XHR requests with this MIME type as CORS will send a preflight. However, because of the way it was checking for this (che…

This is a great example; thanks.

Re: A proposal to restrict sites from accessing a users’ local network

#359

Post by esseph »

charcircuit wrote: post #176
jm4 wrote: post #148

Earlier quoted context omitted.

This sounds crazy to me. Why should websites ever have access to the local network? That presents an entirely new threat model for which we don’t have a solution. Is there even a use case for this for which there isn’t already a better solution?

>for which we don’t have a solution It's called ZTA, Zero Trust Architecture. Devices shouldn't assume the LAN is secure.

You got grandma running ZTA now?

This is a problem impacting mass users, not just technical ones.

Re: A proposal to restrict sites from accessing a users’ local network

#360

Post by esseph »

GeekyBear wrote: post #299
Gigachad wrote: post #204

Earlier quoted context omitted.

MacOS asked a permission dialog when I plug my AirPods in to charge. I have no idea what I’m even giving permission for but it pops up every time.

Asking you if you trust a device before opening a data connection to it is simply not the same thing as asking the person who just created a shortcut if they should be allowed to do that.

How do you know the person created the shortcut and not some malware trying to get a user to click on an executable and elevate permissions?
Post reply on HN