4 ms·
The ability to interact with the device directly from your web browser (no app install needed!) is a big step ahead.
by fabrice_d 10y ago
The ability to interact with the device directly from your web browser (no app install needed!) is a big step ahead.
- paulddraper 10y agoEh. Either way I'm going to download and run software.
- deleted 10y ago[deleted]
- chatmasta 10y agoIsn't that already possible? If a device has a local IP that exposes an API, then your web browser can talk to it via JavaScript.
- OrangeTux 10y ago"This approach is also error prone. If you later happen to access some other service with the same private IP, on some other local network (for example, 192.168.1.1:80), that service can steal the cookies stored by the first service. The services have to be careful about using caching because you might get the cached page for the first service when you visit the second service."
- 7952 10y agoSurely TLS solves that?
- deleted 10y ago[deleted]
- chatmasta 10y agoVery interesting. Is that also an attack vector on private VPNs? 1. Identify the internal layout of a corporate VPN. 2. Pick a service on, say 10.1.2.3:80 3. Trick user into joining either rogue AP, or rogue VPN 4. Serve an identical service on 10.1.2.3:80 on your network