4 ms·
Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using n
by Karliss 5y ago
Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to implement proper authentication checks for something they consider a local service vulnerabilities like this will keep appearing.
- stefan_ 5y ago> Browsers need to stop connecting to anything other than what's typed into the navigation bar. Yes, indeed!
- Xelbair 5y agooh how i would love this future.
- hdjjhhvvhga 5y agoUnfortunately, the companies that control today's web have a different view, and they are the ones in charge.
- cryptonym 5y agoAt this point of time, I give it 10min before we get a magic_proxy nginx module, then your script src will be /magic_proxy/www.evilthirdpary.com/slow_multi_megabyte_script.js You can still import all nasty third parties required by marketing department, bypassing first party protections and leading to even worse security. Or maybe maintain allow lists, basically that's a Content Security Policy. Future is now old man.
- Pxtl 5y agoAt least then the server has to deal with the security implications of talking directly to the advertiser, instead of pushing the risk wholly to the client.
- cryptonym 5y agoIn the end the script is running on client, dealing with user data, not server data. Client is still taking the risk. On moral/legal issues, integrating script from third or first party hostname sounds like technical detail. If you select partner to run their code on your pages, you should be responsible checking user consent when applicable and taking responsibility. British Airways has been fined £20m even if that script was not on their servers.
- Xelbair 5y agosure, but as other person stated -servers deals with that, and all legal implications about data protection apply to them - it's harder to weasel out of it that way.
- MarkSweep 5y agoThis already here, but made with a subdomain that CNAMEs to a tracker domain: https://arxiv.org/abs/2102.09301 https://arxiv.org/abs/2102.09301
- seoaeu 5y agoA web browser that doesn’t support links isn’t much of a web browser
- e12e 5y ago... Or images? I suppose one might enforce a draconian same-origin policy.. But that would no longer be "the web" I think.
- faeyanpiraat 5y agoExplicitly clicking on a link is almost like typing it in the url bar, so that can be an exception
- niros_valtos 5y agoThe problem isn’t using one tech or another, but the fact that malicious extensions can be installed and we cannot detect it.
- silon42 5y agoAlso, using browser as UI should not mean downloading JS ever.
- scandinavian 5y ago> And it needs to be opt out not opt in In this case it's an extension that's not installed by default.
- Karliss 5y agoI am talking about default behavior of browsers and network libraries used to implement services listening to network requests. Not whether installing an extension whose purpose is interacting between locally running IDE and locally running VM can be considered opting in it interacting with network in any way.
- formerly_proven 5y agoIn this case the application used websockets, which is supported by browsers natively - but another thing to keep in mind is that any website can send somewhat controlled HTTP requests (not subject to CORS/preflight) to just about anything, regardless of if that's an HTTP server or not. If the receiving side is permissive enough, things might happen. Possibly unwanted things.
- nine_k 5y agoWhat if browsers learned to connect to Unix sockets? And windows named pipes? And users could control these endpoints by the usual filesystem permissions? One can dream.