4 ms·

So if a local service allows WS connections, can data be scrapped off such a service?

• dvdkhlng 6y ago
  Yes, the primary (or only) reason to even implement a WS server connection is exactly to allow data to be scrapped off using a web-browser. E.g. Asterisk nowadays allows enabling SIP protocol access over websocket so that you can run a javascript VoIP client from inside a browser [1] (and WebRTC for the media layer). [1] https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+mini-HTTP+Server https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+...
  • owaislone 6y ago
    Sure but such servers would always implement authentication when deployed to the web but a lot of such services could run locally unauthenticated to serve local apps. For example services to power electron apps. This tells me data from such services can be stolen very easily.
    • dvdkhlng 6y ago
      Electron apps have much more access permissions than a normal website. I don't know technical details of how electron apps interact with the bundled chrome, however this post [1] suggests that electron apps can just talk low-level TCP protocol, no need to wrap everything in an additional websocket protocol layer. [1] https://stackoverflow.com/questions/41674063/is-it-possible-to-create-a-tcp-client-with-electron https://stackoverflow.com/questions/41674063/is-it-possible-...