4 ms·

This is scary. I've always left locally running services unprotected for convenience given they can't be accessed from outside. I can imagine a lot of people ru

This is scary. I've always left locally running services unprotected for convenience given they can't be accessed from outside. I can imagine a lot of people running local apps, servers or databases without any auth that could contain sensitive information. Would a webpage be able scrape data from such services? Any way to disable this completely in Firefox and Chrome?

dvdkhlng 6y ago
No, webpage javascript is limited to using websocket protocol [1] for connections. That means your database or IP camera, or VoIP phone or router are safe for now. Though the websocket connection establishment seems to allow the javascript to differntiate between a closed and an open TCP socket and a TCP socket that speaks websocket. [1] https://en.wikipedia.org/wiki/WebSocket https://en.wikipedia.org/wiki/WebSocket
- owaislone 6y ago
  So if a local service allows WS connections, can data be scrapped off such a service?
  - dvdkhlng 6y ago
    Yes, the primary (or only) reason to even implement a WS server connection is exactly to allow data to be scrapped off using a web-browser. E.g. Asterisk nowadays allows enabling SIP protocol access over websocket so that you can run a javascript VoIP client from inside a browser [1] (and WebRTC for the media layer). [1] https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+mini-HTTP+Server https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+...
    - owaislone 6y ago
      Sure but such servers would always implement authentication when deployed to the web but a lot of such services could run locally unauthenticated to serve local apps. For example services to power electron apps. This tells me data from such services can be stolen very easily.
      - dvdkhlng 6y ago
        Electron apps have much more access permissions than a normal website. I don't know technical details of how electron apps interact with the bundled chrome, however this post [1] suggests that electron apps can just talk low-level TCP protocol, no need to wrap everything in an additional websocket protocol layer. [1] https://stackoverflow.com/questions/41674063/is-it-possible-to-create-a-tcp-client-with-electron https://stackoverflow.com/questions/41674063/is-it-possible-...

dvdkhlng 6y ago

No, webpage javascript is limited to using websocket protocol [1] for connections. That means your database or IP camera, or VoIP phone or router are safe for now. Though the websocket connection establishment seems to allow the javascript to differntiate between a closed and an open TCP socket and a TCP socket that speaks websocket. [1] https://en.wikipedia.org/wiki/WebSocket https://en.wikipedia.org/wiki/WebSocket

owaislone 6y ago
So if a local service allows WS connections, can data be scrapped off such a service?
- dvdkhlng 6y ago
  Yes, the primary (or only) reason to even implement a WS server connection is exactly to allow data to be scrapped off using a web-browser. E.g. Asterisk nowadays allows enabling SIP protocol access over websocket so that you can run a javascript VoIP client from inside a browser [1] (and WebRTC for the media layer). [1] https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+mini-HTTP+Server https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+...
  - owaislone 6y ago
    Sure but such servers would always implement authentication when deployed to the web but a lot of such services could run locally unauthenticated to serve local apps. For example services to power electron apps. This tells me data from such services can be stolen very easily.
    - dvdkhlng 6y ago
      Electron apps have much more access permissions than a normal website. I don't know technical details of how electron apps interact with the bundled chrome, however this post [1] suggests that electron apps can just talk low-level TCP protocol, no need to wrap everything in an additional websocket protocol layer. [1] https://stackoverflow.com/questions/41674063/is-it-possible-to-create-a-tcp-client-with-electron https://stackoverflow.com/questions/41674063/is-it-possible-...