Why Is This Website Port Scanning Me?

Post by 101404 » Thu, May 21, 2020, 8:38 AM UTC

souterrain wrote: post #86

marcojrfurtado wrote: post #80

Earlier quoted context omitted.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

Port scanning from a user’s browser is effectively sneaking behind a user’s firewall. The only legitimate reasons I can envision are security research, and this, to me, is such a small edge case that I’m not sure such access is ever warranted. I’d be all for a user notification that says “fnord.com wants to access 192.168.0.10 on tcp/443, which seems to be a web server on your home/work network. Are you sure you want…

Post by engineeringwoke » Thu, May 21, 2020, 11:10 AM UTC

neurostimulant wrote: post #345

klodolph wrote: post #329

Earlier quoted context omitted.

These kind of complaints are based on a misunderstanding of how JS works or how the browser works. You can do the same exact thing in JS right now. In fact, if anything, JavaScript makes this way easier than WASM. With JS, you can just use something like Rollup or Webpack to put your analytics code in the same code.

Yeah but using webpack is not how majority of websites deployed, so it's probably not worth the effort for ads companies to support it. They will consider this when webpack/wasm become mainstream enough (approaching 50% web), which may or may not happen. Probably won't happened but the thought always linger in my mind.

Post by franga2000 » Thu, May 21, 2020, 12:21 PM UTC

Post by gorhill » Thu, May 21, 2020, 1:26 PM UTC

gorhill wrote: post #382

jhhh wrote: post #327

Earlier quoted context omitted.

Ublock origin says it supports ABP filter rules which allow for whitelisting sites which seems like it should allow something approximating: ~site.com$websocket *,~site.com$websocket However this seems like it's invalid syntax because switching your example to this opens all websocket use back up tested via https://websocketstest.com/

That is not valid ABP filter syntax. This is what you want: *$websocket,domain=~site1.com For more than a single site: *$websocket,domain=~site1.com|site2.com|... I would personally suggest people to just enable advanced user mode and create rules such as: * 127.0.0.1 * blocked To block all request attempts to 127.0.0.1.

    *$websocket,domain=~site1.com|~site2.com|~...

Post by vbezhenar » Thu, May 21, 2020, 1:40 PM UTC

justinclift wrote: post #397

vbezhenar wrote: post #365

Earlier quoted context omitted.

In Kazakhstan we have e-government website. This website allows users to use crypto-tokens to access government services (every citizen can get a digital certificate representing his identity). This website used to run Java applet. This applet was signed and it could access restricted APIs to access USB device. So website talked to applet and applet talked to USB device to sign data. After major web browsers disabled…

> So government website now uses JavaScript to connect to 127.0.0.1:12345 using websocket. It sounds like random other websites (Ebay, etc) would be able to interact with people's USB devices this way too. Maybe without people knowing?