5 ms·

irrc, eBay uses websocket connections [0] to scan the ports. Firefox doesn't offer an option to disable websockets in the about:config page. However, I have rea

irrc, eBay uses websocket connections [0] to scan the ports. Firefox doesn't offer an option to disable websockets in the about:config page. However, I have read about workarounds by setting network.websocket.max-connections=0 This is a global setting and is applied to all websites. I also wasn't able to test this myself yet. Are there any good extensions for blocking websockets on for specific domains? [0] https://nullsweep.com/why-is-this-website-port-scanning-me/ https://nullsweep.com/why-is-this-website-port-scanning-me/

hazz99 6y ago
To people reading this, many websites rely on websockets for real-time information. They would likely fallback to per-refresh HTTP requests, but it also may break a bunch of sites.
- narrowtux 6y ago
  As a developer on a product that uses websocket extensively, I'm afraid that this will lead to the already huge distrust in the technology. If IT admins get wind of this they'll just block it (or never unblock it since it's been blocked by some from day 1) and our product gets degraded experience.
  - dicknuckle 6y ago
    like dropping ICMP replies on firewalls. idiotic because it gives a very false sense of security. it's been a useless "security" practice since the 90s.
    - 1over137 6y ago
      But don't firewalls drop everything inbound by default? So it's more that people don't know they should create rules to allow ICMP, no?
      - concerned_user 6y ago
        Connection comes from your browser i.e. localhost to yourself, firewall is not setup to block such connections in most cases.
    - narrowtux 6y ago
      Yes, false sense of security hits the nail on the head. Fits right there with unnecessary password rules too.
    - rasz 6y ago
      Zonealarm's "!1ALERT!! x.x.x.x is h4x0r1ng you with ICMP packets!" sold $millions worth of placebo in early 2000. http://download.zonelabs.com/bin/media/pdf/ZA_Manual.pdf http://download.zonelabs.com/bin/media/pdf/ZA_Manual.pdf
- deleted 6y ago
  [deleted]
- anewdirection 6y ago
  You could say that about JS and I am not running that shit either.
dndvr 6y ago
Surely the websockets angle is a bit of a red herring? Ebay will have your IP from your request so they can run nmap against your machine from their server without your browser ever knowing about it. I also know of a bank that does similar via an old school sort of way, their online banking login page tries to load images from urls made up of your IP and various ports. Presumably these are targeting known ports for online banking malware C&C http traffic rather than remote desktop services though. And this is a bank that still uses frames 'for security', so it must be an old technique!
- wongarsu 6y ago
  Websockets bring them past the router and any other hardware firewall or NAT. Also various software only listens to localhost, on the assumption that local traffic is trustworthy. They could still portscan from afar and it would still be sketchy, but using Websockets makes it worse
  - dndvr 6y ago
    So does using websockets allow you to scan local IP ranges and find other devices on the LAN?
    - hedora 6y ago
      By the rule of all web technology sucks and is untrustworthy, they block 10.0.0.0 and 192.168.0.0, but inexplicably allow 172.16.0.0-172.31.255.255. (Or at least, that was what someone else claimed last time this came up on HN)
      - eganist 6y ago
        Who's "they" in this context? It's unclear to me if this refers to eBay or browser vendors.
    - disposekinetics 6y ago
      My understanding is it allows them to check for things listening on loopback, given they appear to be checking for SSH tunnels.
ilikenwf 6y ago
This won't actually disable websockets if I recall. There's a blocklist that may make it into uBO in the future that blocks 3rd party access to localhost and other IANA reserved IP addresses, though. https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3Aissue+is%3Aopen+label%3Aenhancement https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3A...
- the_pwner224 6y ago
  That link is incorrect. https://github.com/uBlockOrigin/uBlock-issues/issues/1070 https://github.com/uBlockOrigin/uBlock-issues/issues/1070
  - mycall 6y ago
    That thread was a fun rabbit hole. !/s

hazz99 6y ago

To people reading this, many websites rely on websockets for real-time information. They would likely fallback to per-refresh HTTP requests, but it also may break a bunch of sites.

narrowtux 6y ago
As a developer on a product that uses websocket extensively, I'm afraid that this will lead to the already huge distrust in the technology. If IT admins get wind of this they'll just block it (or never unblock it since it's been blocked by some from day 1) and our product gets degraded experience.
- dicknuckle 6y ago
  like dropping ICMP replies on firewalls. idiotic because it gives a very false sense of security. it's been a useless "security" practice since the 90s.
  - 1over137 6y ago
    But don't firewalls drop everything inbound by default? So it's more that people don't know they should create rules to allow ICMP, no?
    - concerned_user 6y ago
      Connection comes from your browser i.e. localhost to yourself, firewall is not setup to block such connections in most cases.
  - narrowtux 6y ago
    Yes, false sense of security hits the nail on the head. Fits right there with unnecessary password rules too.
  - rasz 6y ago
    Zonealarm's "!1ALERT!! x.x.x.x is h4x0r1ng you with ICMP packets!" sold $millions worth of placebo in early 2000. http://download.zonelabs.com/bin/media/pdf/ZA_Manual.pdf http://download.zonelabs.com/bin/media/pdf/ZA_Manual.pdf
deleted 6y ago
[deleted]
anewdirection 6y ago
You could say that about JS and I am not running that shit either.

dndvr 6y ago

Surely the websockets angle is a bit of a red herring? Ebay will have your IP from your request so they can run nmap against your machine from their server without your browser ever knowing about it. I also know of a bank that does similar via an old school sort of way, their online banking login page tries to load images from urls made up of your IP and various ports. Presumably these are targeting known ports for online banking malware C&C http traffic rather than remote desktop services though. And this is a bank that still uses frames 'for security', so it must be an old technique!

wongarsu 6y ago
Websockets bring them past the router and any other hardware firewall or NAT. Also various software only listens to localhost, on the assumption that local traffic is trustworthy. They could still portscan from afar and it would still be sketchy, but using Websockets makes it worse
- dndvr 6y ago
  So does using websockets allow you to scan local IP ranges and find other devices on the LAN?
  - hedora 6y ago
    By the rule of all web technology sucks and is untrustworthy, they block 10.0.0.0 and 192.168.0.0, but inexplicably allow 172.16.0.0-172.31.255.255. (Or at least, that was what someone else claimed last time this came up on HN)
    - eganist 6y ago
      Who's "they" in this context? It's unclear to me if this refers to eBay or browser vendors.
  - disposekinetics 6y ago
    My understanding is it allows them to check for things listening on loopback, given they appear to be checking for SSH tunnels.

ilikenwf 6y ago

This won't actually disable websockets if I recall. There's a blocklist that may make it into uBO in the future that blocks 3rd party access to localhost and other IANA reserved IP addresses, though. https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3Aissue+is%3Aopen+label%3Aenhancement https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3A...

the_pwner224 6y ago
That link is incorrect. https://github.com/uBlockOrigin/uBlock-issues/issues/1070 https://github.com/uBlockOrigin/uBlock-issues/issues/1070
- mycall 6y ago
  That thread was a fun rabbit hole. !/s