Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A proposal to restrict sites from accessing a users’ local network

github.com

Post reply on HN
Print view View original

381–390 of 392 posts

Re: A proposal to restrict sites from accessing a users’ local network

#381

Post by blacklion »

rcxdude wrote: post #372
blacklion wrote: post #371

Earlier quoted context omitted.

It is all very wired. > a) you'd like encryption between the UI and the device No, I don't. It is on my local network. If device has public IP and I want to browse my collection when I'm out of my local network, then I do, but then Let's encrypt solved this problem many years ago (10 years!). If device doesn't have public IP but I punch hole in my NAT or install reverse proxy on gateway, then I'm tech-savvy enough to…

Even on a local network, you should probably not be sending e.g. passwords around in plaintext. Let's encrypt is a solution for someone who's tech-savvy enoug to set it up, not the average user. > Its all look over-engineered in the sake of what? Of imitating desktop app in browser? Pretty much, yeah. And not just desktop app, but mobile app as well. The overhead of supporting multiple platforms, especially across a…

> Even on a local network, you should probably not be sending e.g. passwords around in plaintext.

Why not? There is only me, my wife and my cat. Guests has separate network, of course :) If my network is compromised I have much bigger problems than password to video collection.

> Let's encrypt is a solution for someone who's tech-savvy enoug to set it up, not the average user.

caddy (web server) can provision Let's Encrypt cert transparently for user. I don't say Plex user should install caddy, but Plex server can have same mechanism built-in. If user is tech-savvy enough to install Plex.

> And not just desktop app, but mobile app as well

To be good they should have completely different structure and screen layouts for Mobile and Desktop no matter which "toolkit" is used, though — different screen sizes, different screen orientation, different input devices (touch and mouse are VERY different in UX and decent Desktop UI needs good keyboard controls, OH WAI~~~)...

Re: A proposal to restrict sites from accessing a users’ local network

#382

Post by LegionMammal978 »

drexlspivey wrote: post #374
LegionMammal978 wrote: post #337

Earlier quoted context omitted.

Do you know of any such node that doesn't check the Content-Type of requests and also has no authentication?

Bitcoin Core if you disable authentication

There's no such thing, short of forking it yourself. You can set the username and password to admin:admin if you want, but Bitcoin Core's JSON-RPC server requires an Authorization header on every request [0], and you can't put an Authorization header on a cross-origin request without a preflight.

[0] https://github.com/bitcoin/bitcoin/blob/v29.0/src/httprpc.cp...

Re: A proposal to restrict sites from accessing a users’ local network

#383

Post by esseph »

GeekyBear wrote: post #380
esseph wrote: post #377

Earlier quoted context omitted.

Programs running during the user session are often running as that user. The "correct answer" to this is probably that there isn't a good answer here. Security is a damn minefield and it's getting worse every day.

There is no universe in which it makes sense to ask the very user who just created a shortcut if they should have permission to create that shortcut. This is why Microsoft was so widely mocked for just how bad their initial implementation of UAC was.

"iPhone Shortcuts always asks permission to access file"

https://discussions.apple.com/thread/254931245

iOS Shortcut danger

https://cyberpress.org/unveiling-risks-of-ios-shortcuts/

But anywho, cve.org lists 78 shortcut vulnerabilities across many platforms.

I know you'd like to believe the world we live in shouldn't require permissions for a user to create a shortcut and then access it, but that... Is actually the world we live in, and have been in for a very long time.

Security is hard and it's not getting any easier as system complexity increases.

If you don't believe me, ask your favorite LLM. I asked Gemini and got back what I expected to.

Re: A proposal to restrict sites from accessing a users’ local network

#384

Post by drexlspivey »

LegionMammal978 wrote: post #382
drexlspivey wrote: post #374

Earlier quoted context omitted.

Bitcoin Core if you disable authentication

There's no such thing, short of forking it yourself. You can set the username and password to admin:admin if you want, but Bitcoin Core's JSON-RPC server requires an Authorization header on every request [0], and you can't put an Authorization header on a cross-origin request without a preflight. [0] https://github.com/bitcoin/bitcoin/blob/v29.0/src/httprpc.cp...

Good to know, I remember you used to be able to disable it via config but looks like I was wrong

Re: A proposal to restrict sites from accessing a users’ local network

#385

Post by bmacho »

Gigachad wrote: post #203
xp84 wrote: post #66

Earlier quoted context omitted.

This is so true. The modern Mac is a sea of Allow/Don't Allow prompts, mixed with the slightly more infantilizing alternative of the "Block" / "Open System Preferences" where you have to prove you know what you're doing by manually browsing for the app to grant the permission to, to add it to the list of ones with whatever permission. They're just two different approaches with the same flaw: People with no clue how t…

A better option would be to put Mark Zuckerberg in prison for deploying malware to a massive number of people.

And everyone that worked on it, also everyone that still keep working at any division at Meta after knowing that it is organized crime.

Re: A proposal to restrict sites from accessing a users’ local network

#386

Post by bmacho »

3abiton wrote: post #324
paxys wrote: post #84

It's crazy to me that this has always been the default behavior for web browsers. A public website being able to silently access your entire filesystem would be an absurd security hole. Yet all local network services are considered fair game for XHR, and security is left to the server itself. If you are developer and run your company's webapp on your dev machine for testing (with loose or non-existent security defaul…

I majored in CS and I had no idea that was possible: public websites you access have access to your local network. I have to take time to process this. Beside what is suggested in the post, are there any ways to limit this abusive access?

There are no mechanisms in browsers yet. Best you can do is using the OS to forbid your whole browser to access your local network. (And use another browser only for your local network.) Ask ChatGPT for methods to sandbox your browser.

Re: A proposal to restrict sites from accessing a users’ local network

#387

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #349

Explainer by non-Googler Is the so-called "modern" web browser too large and complex I never asked for stuff like "websockets"; I have to disable it, why I still prefer a text-only browser for reading HTML; it does not run Javascript, it does not do websockets, CSS, images or a gazillion other things; it does not even autoload resources It is relatively small, fast and reliable; very useful It can read larger HTML fi…

Perhaps the best thing about the text-only browser I use is that I, the www user, can edit and compile it quickly and easily.

Whereas with the so-called "modern" browser, designed by committee,, all control over changes to fix issues rests with so-called "tech" companies that cater and are beholden to onlline advertising, namely, the commercial exploitatioon of the www user as an ad target.

Generally,^1 with so-called "modern" browsers, the "right to repair" is meaningless. Only a handful of companies make "repairs".

1. Exceptions usuallly try to match the complexity of the so-called "modern" browser, not reduce it. Generally, "features" are copied, not removed. The www user is not expected to compille the source code nor edit it to their liking.

Re: A proposal to restrict sites from accessing a users’ local network

#388

Post by GeekyBear »

esseph wrote: post #383
GeekyBear wrote: post #380

Earlier quoted context omitted.

There is no universe in which it makes sense to ask the very user who just created a shortcut if they should have permission to create that shortcut. This is why Microsoft was so widely mocked for just how bad their initial implementation of UAC was.

"iPhone Shortcuts always asks permission to access file" https://discussions.apple.com/thread/254931245 iOS Shortcut danger https://cyberpress.org/unveiling-risks-of-ios-shortcuts/ But anywho, cve.org lists 78 shortcut vulnerabilities across many platforms. I know you'd like to believe the world we live in shouldn't require permissions for a user to create a shortcut and then access it, but that... Is actually the wo…

If the user manually creating a shortcut is so dangerous, why did Microsoft remove that permissions prompt when they fixed their terrible initial UAC implementation?

Re: A proposal to restrict sites from accessing a users’ local network

#389

Post by bombela »

mixmastamyk wrote: post #332
bombela wrote: post #329

Earlier quoted context omitted.

At home, with both ip v4 and v6. For any device exposed on the Internet, I add a static IPv6 address with the host part the same as the IPv4 adress. example: 2001:db8::192.168.0.42 This makes it very easy to remember, correlate and firewall.

Ok, that parses somehow in Python, matches, and is apparently legit. ;-) >>> from ipaddress import IPv6Address as address >>> address('2001:db8::192.168.0.42') IPv6Address('2001:db8::c0a8:2a') >>> int('2a', 16) 42 Openwrt doesn't seem to make ipv6 static assignment easy unfortunately.

Oh yes, it is part of the spec for IPv6 addresses text representation :)

https://www.rfc-editor.org/rfc/rfc4291#section-2.2

Re: A proposal to restrict sites from accessing a users’ local network

#390

Post by 3abiton »

bmacho wrote: post #386
3abiton wrote: post #324

Earlier quoted context omitted.

I majored in CS and I had no idea that was possible: public websites you access have access to your local network. I have to take time to process this. Beside what is suggested in the post, are there any ways to limit this abusive access?

There are no mechanisms in browsers yet. Best you can do is using the OS to forbid your whole browser to access your local network. (And use another browser only for your local network.) Ask ChatGPT for methods to sandbox your browser.

Thanks! I have already setup iptables rules for vms to deny them local network access. I'll use the same trick for local access now i guess.
Post reply on HN