5 ms·

New Google Chrome feature blocks attacks against home networks

59 points by Wasserpuncher 3y ago

Despegar 3y ago
New Google Chrome feature blocks attacks from something websites shouldn't be able to access in the first place.
- redder23 3y ago
  Well have you looked at the example? Browsers should be able to a access anY IP on the LAN. If that url is not password protected and let you just change settings via URL its really not the browsers fault for supposedly "giving access". Well thinking about it, it should probably not be possible in an iframe but they would just trick you clicking a link instead. People to not secure their routers and have default passes that is the big issue here. So of course them mitigating that makes sense. Simple never giving access would mean people can not open their router interfaces, self hosted stuff on SBCs ... so you make no sense.
  - betaby 3y ago
    > People to not secure their routers and have default passes that is the big issue here. Is it really? ISPs in USA/Canada/France/etc give customers WiFi routers with random passwords for many years.
    - traverseda 3y ago
      It's not random, it's the devices Mac address and some isp-specific value hashed together and truncated. Don't tell anyone though since that's a pretty big security risk.
      - betaby 3y ago
        Do you have a link for the algorithm? Really interesting.
    - zokier 3y ago
      https://arstechnica.com/information-technology/2024/02/doj-turns-tables-on-russian-hackers-uses-their-malware-to-wipe-out-botnet/ https://arstechnica.com/information-technology/2024/02/doj-t... > That malware, which worked as a botnet for the Russian hacking group Fancy Bear, was removed in January 2024 under a secret court order as part of "Operation Dying Ember," according to the FBI's director. It affected routers running Ubiquiti's EdgeOS, but only those that had not changed their default administrative password
      - betaby 3y ago
        Those are not ISP given devices. While it's bad-bad, Ubiquiti is a SOHO vendor and post-purchase configuration is expected.
- rnmmrnm 3y ago
  It's easy to be smart about it after the fact. Back then it was hard to tell WWW is gonna be the the standard protocol for most people to interact with the internet.
- blacksmith_tb 3y ago
  And it doesn't even block, it preflights the requests, and if the device exists and responds, it will only block if the device sets a special header? Which of course no existing devices will, so it's going to do very little good - nothing for existing IoT gear, and likely not much more for new devices, unless all those manufacturers rapidly embrace setting the new header. To me it seems like it'd be a far more obvious approach to just throw up a dialog that says "the current page wants to connect to things on your home network, does that seem reasonable to you, or should I continue to block that?"
  - diogocp 3y ago
    > it will only block if the device sets a special header? No. It will block by default. If the header is present, it will allow the request. > just throw up a dialog that says "the current page wants to connect to things on your home network In many (probably most) cases it is just a work site trying to connect to an internal service on your work VPN, and the warnings would get annoying very quickly.
    - blacksmith_tb 3y ago
      Ah, that makes a little more sense, though it will break any legitimate uses we might have now - not sure if the Home Assistant web UI talks to local devices by IP (or maybe only via their .local?) That's probably still a good tradeoff, and I am sure if they left it all up to the user plenty of people would click 'ok' without understanding, but it'd be nice to have that as an option.
ublocker 3y ago
1. Force uBlock Origin out. 2. Reimplement its features selectively. uBlock Origin comes with a filter called 'Block Outsider Intrusion into LAN'[0]. [0] https://github.com/uBlockOrigin/uAssets/blob/master/filters/lan-block.txt https://github.com/uBlockOrigin/uAssets/blob/master/filters/... Migrate to Firefox and install uBlock Origin, you will have this feature and more.
- charcircuit 3y ago
  Chrome has had a builtin ad blocker for years.
  - ssss11 3y ago
    I know nothing of this Chrome ad blocker, but you have to ask yourself, is it really an ad blocker if it’s owned and maintained by the largest adtech company on earth hellbent on maximising profits from ads?
    - charcircuit 3y ago
      Yes, it's in Google's best interest to maximize the amount of time people spend on the web, doing searches, to go to different websites. Websites with spammy ads can cause people to use the web less, causing them to search less, causing Google to be able to show less advertisements.
      - orf 3y ago
        It’s in googles best interest to maximise the amount of time people spend on the web not viewing their adverts? What on earth?
        charcircuit 3y ago
        It's correlated. When people spend more time on the web, they do more Google searches, which will show more ads. So both the time spent not viewing their ads AND the time spent viewing their ads both increase.

59 points by Wasserpuncher 3y ago

Despegar 3y ago

New Google Chrome feature blocks attacks from something websites shouldn't be able to access in the first place.

redder23 3y ago
Well have you looked at the example? Browsers should be able to a access anY IP on the LAN. If that url is not password protected and let you just change settings via URL its really not the browsers fault for supposedly "giving access". Well thinking about it, it should probably not be possible in an iframe but they would just trick you clicking a link instead. People to not secure their routers and have default passes that is the big issue here. So of course them mitigating that makes sense. Simple never giving access would mean people can not open their router interfaces, self hosted stuff on SBCs ... so you make no sense.
- betaby 3y ago
  > People to not secure their routers and have default passes that is the big issue here. Is it really? ISPs in USA/Canada/France/etc give customers WiFi routers with random passwords for many years.
  - traverseda 3y ago
    It's not random, it's the devices Mac address and some isp-specific value hashed together and truncated. Don't tell anyone though since that's a pretty big security risk.
    - betaby 3y ago
      Do you have a link for the algorithm? Really interesting.
  - zokier 3y ago
    https://arstechnica.com/information-technology/2024/02/doj-turns-tables-on-russian-hackers-uses-their-malware-to-wipe-out-botnet/ https://arstechnica.com/information-technology/2024/02/doj-t... > That malware, which worked as a botnet for the Russian hacking group Fancy Bear, was removed in January 2024 under a secret court order as part of "Operation Dying Ember," according to the FBI's director. It affected routers running Ubiquiti's EdgeOS, but only those that had not changed their default administrative password
    - betaby 3y ago
      Those are not ISP given devices. While it's bad-bad, Ubiquiti is a SOHO vendor and post-purchase configuration is expected.
rnmmrnm 3y ago
It's easy to be smart about it after the fact. Back then it was hard to tell WWW is gonna be the the standard protocol for most people to interact with the internet.
blacksmith_tb 3y ago
And it doesn't even block, it preflights the requests, and if the device exists and responds, it will only block if the device sets a special header? Which of course no existing devices will, so it's going to do very little good - nothing for existing IoT gear, and likely not much more for new devices, unless all those manufacturers rapidly embrace setting the new header. To me it seems like it'd be a far more obvious approach to just throw up a dialog that says "the current page wants to connect to things on your home network, does that seem reasonable to you, or should I continue to block that?"
- diogocp 3y ago
  > it will only block if the device sets a special header? No. It will block by default. If the header is present, it will allow the request. > just throw up a dialog that says "the current page wants to connect to things on your home network In many (probably most) cases it is just a work site trying to connect to an internal service on your work VPN, and the warnings would get annoying very quickly.
  - blacksmith_tb 3y ago
    Ah, that makes a little more sense, though it will break any legitimate uses we might have now - not sure if the Home Assistant web UI talks to local devices by IP (or maybe only via their .local?) That's probably still a good tradeoff, and I am sure if they left it all up to the user plenty of people would click 'ok' without understanding, but it'd be nice to have that as an option.

ublocker 3y ago

1. Force uBlock Origin out. 2. Reimplement its features selectively. uBlock Origin comes with a filter called 'Block Outsider Intrusion into LAN'[0]. [0] https://github.com/uBlockOrigin/uAssets/blob/master/filters/lan-block.txt https://github.com/uBlockOrigin/uAssets/blob/master/filters/... Migrate to Firefox and install uBlock Origin, you will have this feature and more.

charcircuit 3y ago
Chrome has had a builtin ad blocker for years.
- ssss11 3y ago
  I know nothing of this Chrome ad blocker, but you have to ask yourself, is it really an ad blocker if it’s owned and maintained by the largest adtech company on earth hellbent on maximising profits from ads?
  - charcircuit 3y ago
    Yes, it's in Google's best interest to maximize the amount of time people spend on the web, doing searches, to go to different websites. Websites with spammy ads can cause people to use the web less, causing them to search less, causing Google to be able to show less advertisements.
    - orf 3y ago
      It’s in googles best interest to maximise the amount of time people spend on the web not viewing their adverts? What on earth?
      - charcircuit 3y ago
        It's correlated. When people spend more time on the web, they do more Google searches, which will show more ads. So both the time spent not viewing their ads AND the time spent viewing their ads both increase.