Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

371–380 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#371

Post by blacklion »

rcxdude wrote: post #370
blacklion wrote: post #240

Earlier quoted context omitted.

Why local Plex which you need to install & run (it is already Server) cannot provide its own UI to browser, without 3rd party sites? It is absurd design, IMHO. I'll never allow this in my network. It looks security nightmare. Today it shows me dashboard (of what? Several my Plex servers?), tomorrow it is forced to report pirated movies to police. No, thanx.

HTTPS, basically. I've gone around and around in circles on this for a device I work on. You'd like to present an HTTPS web UI, because a) you'd like encryption between the UI and the device, and b) browsers lock down a lot of APIs, sometimes arbitrarily, behind being in a 'secure context' (ironically, including the cryptography APIs!). But your device doesn't control it's IP address or hostname, and may not even hav…

It is all very wired.

> a) you'd like encryption between the UI and the device

No, I don't. It is on my local network. If device has public IP and I want to browse my collection when I'm out of my local network, then I do, but then Let's encrypt solved this problem many years ago (10 years!). If device doesn't have public IP but I punch hole in my NAT or install reverse proxy on gateway, then I'm tech-savvy enough to obtain Let's Encrypt cert for it, too.

> b) browsers lock down a lot of APIs, sometimes arbitrarily

Why does GUI which is served from server co-hosted with mediaserver needs any special APIs at all? It can generate all content on server side and basic JS is enough to add visual effects for smooth scrolling, drop-down menus, etc.

Its all look over-engineered in the sake of what? Of imitating desktop app in browser? Looks like it creates more problems than writing damn native desktop app. In QT, for example, which will be not-so-native (but more native than any site or Electron) but work on all 3 major OSes and *BSD from single sources.

Re: A proposal to restrict sites from accessing a users’ local network

#372

Post by rcxdude »

blacklion wrote: post #371
rcxdude wrote: post #370

Earlier quoted context omitted.

HTTPS, basically. I've gone around and around in circles on this for a device I work on. You'd like to present an HTTPS web UI, because a) you'd like encryption between the UI and the device, and b) browsers lock down a lot of APIs, sometimes arbitrarily, behind being in a 'secure context' (ironically, including the cryptography APIs!). But your device doesn't control it's IP address or hostname, and may not even hav…

It is all very wired. > a) you'd like encryption between the UI and the device No, I don't. It is on my local network. If device has public IP and I want to browse my collection when I'm out of my local network, then I do, but then Let's encrypt solved this problem many years ago (10 years!). If device doesn't have public IP but I punch hole in my NAT or install reverse proxy on gateway, then I'm tech-savvy enough to…

Even on a local network, you should probably not be sending e.g. passwords around in plaintext. Let's encrypt is a solution for someone who's tech-savvy enoug to set it up, not the average user.

> Its all look over-engineered in the sake of what? Of imitating desktop app in browser?

Pretty much, yeah. And not just desktop app, but mobile app as well. The overhead of supporting multiple platforms, especially across a broad range of devices, is substantial. Wep applications sidestep a lot of that and can give you a polished UX across basically every device, especially e.g. around the installation process (because there doesn't need to be one).

Re: A proposal to restrict sites from accessing a users’ local network

#373

Post by [deleted] »

avidiax wrote: post #322
bmacho wrote: post #287

One of the very few security inspired restrictions I can wholeheartedly agree with. I don't want random websites be able to read my localhost. I hope it gets accepted and implemented sooner than later. OTOH it would be cool if random websites were able to open up and use ports on my computer's network, or even on my LAN, when granted permission of course. Browser-based file- and media sharing between my devices, or g…

> OTOH it would be cool if random websites were able to open up and use ports on my computer's network That's what WebRTC does. There's no requirement that WebRTC is used to send video and audio as in a Zoom/Meet call. That's how WebTorrent works. https://webtorrent.io/faq

[deleted]

Re: A proposal to restrict sites from accessing a users’ local network

#374

Post by drexlspivey »

LegionMammal978 wrote: post #337
drexlspivey wrote: post #124

Earlier quoted context omitted.

It can send a json-rpc request to your bitcoin node and empty your wallet

Do you know of any such node that doesn't check the Content-Type of requests and also has no authentication?

Bitcoin Core if you disable authentication

Re: A proposal to restrict sites from accessing a users’ local network

#375

Post by cpburns2009 »

paxys wrote: post #71
skybrian wrote: post #36

While this will help to block many websites that have no business making local connections at all, it's still very coarse-grained. Most websites that need this permission only need to access one local server. Granting them access to everything violates the principle of least privilege. Most users don't know what's running on localhost or on their local network, so they won't understand the risk.

> Most users don't know what's running on localhost or on their local network, so they won't understand the risk. Yes, which is why they also won't understand when the browser asks if you'd like to allow the site to visit http://localhost:3146 vs http://localhost:8089 . A sensible permission message ("allow this site to access resources on your local network") is better than technical mumbo jumbo which will make them…

While that message has less jargon, most users still won't understand what "resources on your local network" means. They'll blindly accept it.

Re: A proposal to restrict sites from accessing a users’ local network

#377

Post by esseph »

GeekyBear wrote: post #159
AStonesThrow wrote: post #157

Earlier quoted context omitted.

I once encountered malware on my roommate’s Windows 98 system. It was a worm designed to rewrite every image file as a VBS script that would replicate and re-infect every possible file whenever it was clicked or executed. It hid the VBS extensions and masqueraded as the original images. Creation of a shortcut on Windows is not necessarily innocuous. It was a common first vector to drop malware as users were accustome…

A user creating a shortcut manually is not something that requires a permissions prompt. If you want to teach users to ignore security prompts, then completely pointless nagging is how you do it.

Programs running during the user session are often running as that user.

The "correct answer" to this is probably that there isn't a good answer here.

Security is a damn minefield and it's getting worse every day.

Re: A proposal to restrict sites from accessing a users’ local network

#378

Post by Thorrez »

socalgal2 wrote: post #343
Thorrez wrote: post #263

Earlier quoted context omitted.

Are you talking about web apps, mobile apps, desktop apps, or browser extensions?

All of them.

I think webapps already have to ask for permission for USB and bluetooth.

Desktop apps on Windows and Linux are generally able to do anything. Read any file, etc. Locking them down with a permission system would be a big change.

Re: A proposal to restrict sites from accessing a users’ local network

#379

Post by mrguyorama »

formerly_proven wrote: post #234
lyu07282 wrote: post #198

Earlier quoted context omitted.

Exactly you can also trigger forms for POST or DELETE etc. this is called CSRF if the endpoint doesn't validate some token in the request. CORS only protects against unauthorized xhr requests. All decades old OWASP basics really.

That highly ranked comments on HN (an audience with way above average-engineer interest in software and security) get this wrong kinda explains why these things keep being an issue.

I'm betting HN is vastly more normal people and manager types than people want to admit.

None of us had to pass a security test to post here. There's no filter. That makes it pretty likely that HN's community is exactly as shitty as the rest of the internet's.

People need to stop treating this community like some club of enlightened elites. It's hilariously sad and self-congratulatory.

Re: A proposal to restrict sites from accessing a users’ local network

#380

Post by GeekyBear »

esseph wrote: post #377
GeekyBear wrote: post #159

Earlier quoted context omitted.

A user creating a shortcut manually is not something that requires a permissions prompt. If you want to teach users to ignore security prompts, then completely pointless nagging is how you do it.

Programs running during the user session are often running as that user. The "correct answer" to this is probably that there isn't a good answer here. Security is a damn minefield and it's getting worse every day.

There is no universe in which it makes sense to ask the very user who just created a shortcut if they should have permission to create that shortcut.

This is why Microsoft was so widely mocked for just how bad their initial implementation of UAC was.

Post reply on HN