5 ms·

Ugh, why did they have to use Flash... https://tls13.mitm.watch/ https://tls13.mitm.watch/ I know they mention it here: > It uses Adobe Flash, because that’s

Ugh, why did they have to use Flash... https://tls13.mitm.watch/ https://tls13.mitm.watch/ I know they mention it here: > It uses Adobe Flash, because that’s the only widespread cross-platform way to get access to raw sockets from a browser. But there's really no other way???

roblabla 9y ago
That's actually a huge annoyance of mine. There's no stable, cross-platform web API to get raw sockets, and I'm not sure why.
- slrz 9y ago
  How would that interact with the Same-Origin Policy?
  - kevincox 9y ago
    Since you wouldn't have access to cookies I don't think it would be the end of the world. However you would have access to the users LAN which would likely make many local devices' vulnerabilities exploitable. All in all it is probably a bad idea with the current state of IoT, home routers, printers...
    - Spivak 9y ago
      Giving a web page access to any part of the user's environment not explicitly given to is malicious data exfiltration waiting to happen.
- QasimK 9y ago
  Imagine if every webpage (JavaScript) could open sockets to any location and port - sounds like a significant security issue.
  - misterbowfinger 9y ago
    I just don't get how that's different than anything that's not a webapp
    - slrz 9y ago
      You probably don't run arbitrary untrusted applications on your computer but you execute arbitrary untrusted Javascript all day when visiting web sites. To make this seemingly crazy thing work at all, some restrictions have to be imposed on that untrusted JS code.
  - banachtarski 9y ago
    They essentially can via the WebRTC api, albeit in a more cumbersome way. There's nothing inherently insecure about it and the onus rests on the serving party and the browser itself to ensure no foul play is happening.
    - lmz 9y ago
      Doesn't WebRTC have a handshake protocol to ensure that the other end expects the WebRTC media stream?
      - banachtarski 9y ago
        If you allow a browser to open sockets to random places, it's the exact same principle! The onus is on the listener to ensure that the people communicating respect the agreed upon protocol.
        tokenizerrr 9y ago
        Then every browser could be used to send spam. It would be horrible. Imagine that every person who visits a compromised page immediately started sending spam emails over smtp. Or spam irc messages.
        9y ago
- Franciscouzo 9y ago
  There's this [0] standard that nobody implements, AFAIK the security risks could be mitigated by asking for confirmation from the user. [0] https://www.w3.org/TR/tcp-udp-sockets/ https://www.w3.org/TR/tcp-udp-sockets/
  - Paul-ish 9y ago
    I'm not sure users would understand what they are being asked. Plus, whenever someone wants to do something dangerous in the browser, they say "Oh, we will ask the user". If everyone got their way, users would be inundated with dialogs.
deleted 9y ago
[deleted]
jchw 9y ago
I really don't think there should be a way, frankly. This shouldn't be tested from a webapp.
fulafel 9y ago
Raw sockets are not required for TCP protocols, need root privileges and hopefully are not used by flash. Terminology problem?

roblabla 9y ago

That's actually a huge annoyance of mine. There's no stable, cross-platform web API to get raw sockets, and I'm not sure why.

slrz 9y ago
How would that interact with the Same-Origin Policy?
- kevincox 9y ago
  Since you wouldn't have access to cookies I don't think it would be the end of the world. However you would have access to the users LAN which would likely make many local devices' vulnerabilities exploitable. All in all it is probably a bad idea with the current state of IoT, home routers, printers...
  - Spivak 9y ago
    Giving a web page access to any part of the user's environment not explicitly given to is malicious data exfiltration waiting to happen.
QasimK 9y ago
Imagine if every webpage (JavaScript) could open sockets to any location and port - sounds like a significant security issue.
- misterbowfinger 9y ago
  I just don't get how that's different than anything that's not a webapp
  - slrz 9y ago
    You probably don't run arbitrary untrusted applications on your computer but you execute arbitrary untrusted Javascript all day when visiting web sites. To make this seemingly crazy thing work at all, some restrictions have to be imposed on that untrusted JS code.
- banachtarski 9y ago
  They essentially can via the WebRTC api, albeit in a more cumbersome way. There's nothing inherently insecure about it and the onus rests on the serving party and the browser itself to ensure no foul play is happening.
  - lmz 9y ago
    Doesn't WebRTC have a handshake protocol to ensure that the other end expects the WebRTC media stream?
    - banachtarski 9y ago
      If you allow a browser to open sockets to random places, it's the exact same principle! The onus is on the listener to ensure that the people communicating respect the agreed upon protocol.
      - tokenizerrr 9y ago
        Then every browser could be used to send spam. It would be horrible. Imagine that every person who visits a compromised page immediately started sending spam emails over smtp. Or spam irc messages.
        9y ago
Franciscouzo 9y ago
There's this [0] standard that nobody implements, AFAIK the security risks could be mitigated by asking for confirmation from the user. [0] https://www.w3.org/TR/tcp-udp-sockets/ https://www.w3.org/TR/tcp-udp-sockets/
- Paul-ish 9y ago
  I'm not sure users would understand what they are being asked. Plus, whenever someone wants to do something dangerous in the browser, they say "Oh, we will ask the user". If everyone got their way, users would be inundated with dialogs.

deleted 9y ago

[deleted]

jchw 9y ago

I really don't think there should be a way, frankly. This shouldn't be tested from a webapp.

fulafel 9y ago

Raw sockets are not required for TCP protocols, need root privileges and hopefully are not used by flash. Terminology problem?