6 ms·
Deprecate 0.0.0.0 for Private Network Access
- aa_is_op 2y agoRelated: https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser https://www.oligo.security/blog/0-0-0-0-day-exploiting-local...
- dytir 2y agoHN discussion: https://news.ycombinator.com/item?id=41184219 https://news.ycombinator.com/item?id=41184219 But nothing new: https://research.nccgroup.com/2023/04/27/state-of-dns-rebinding-in-2023/ https://research.nccgroup.com/2023/04/27/state-of-dns-rebind... https://github.com/nccgroup/singularity/wiki/Protection-Bypasses https://github.com/nccgroup/singularity/wiki/Protection-Bypa...
- fch42 2y agothanks for those refs!
- ikekkdcjkfke 2y agoI believe uBlockOrigin browser extension has a filter to restrict local access
- ndriscoll 2y ago> Digitally “fingerprinting” the users of a website is a known technique that has many purposes. The most common legitimate use is to identify returning users Incidentally, this is not a legitimate use-case. It's insane to me that companies act like blatant violations of the CFAA are okay. You are not authorized to start scanning a user's private network and making requests to internal services because they loaded a web page. The engineers, managers, and product people involved in doing that kind of thing should be prosecuted for it.
- otabdeveloper4 2y ago[flagged]
- diggan 2y ago> Chrome's PNA protection can be bypassed using the IP address 0.0.0.0 to access services listening on the localhost on macOS and Linux. It seems they're saying if you have a service listening to localhost (private), Chrome is supposed to not resolve 0.0.0.0 (public) to localhost, yet it currently does so. So seems to me they're solving a security bug. But if I got this right, it's surprising how it got like that in the first place, doesn't make sense in any scenario I can think of to resolve 0.0.0.0 to localhost? Why would a browser try to resolve 0.0.0.0 to anything in the first place?
- otabdeveloper4 2y ago[flagged]
- Titan2189 2y agoWait, so you're suggesting developers shouldn't adhere to specs but instead develop their tools / libraries according to whatever they feel it is the cool kids currently do?
- rolph 2y agoi fail to see much difference with: >>develop their tools / libraries according to whatever they feel it is the cool kids currently do?<< versus: >>adhere to the letter of the spec maliciously instead of understanding current practice.<<
- otabdeveloper4 2y agoYes, I do. You should be following de-facto real world standards, not fantasy ones. Especially if security is involved.
- robertlagrant 2y agoIf there are de facto real world standards, why not write them down?
- p1mrx 2y agoNo mention of [::]? Maybe they'll discover that one in a couple years.
- jesprenj 2y agoShouldn't they instead add 0.0.0.0/8 to the list of private networks, because it's possible that 0.0.0.0/8 might be private?
- schoen 2y agoWe (i.e. my colleague Dave Taht) got this to work in Linux several years ago. If you have a Linux kernel since 5.2, you can use 0.0.0.0/8 (except 0.0.0.0 itself) as an ordinary IPv4 network.
- amluto 2y agoI can’t tell from reading the Chrome page (https://developer.chrome.com/blog/private-network-access-preflight/ https://developer.chrome.com/blog/private-network-access-pre...) or the linked WICG draft: do these new protections apply to the usual CORS-bypassing requests: form submissions and ordinary navigation?
- archo 2y agopls excuse my aged brain, now with a new blood clot. IIRC adding 0.0.0.0 0.0.0.0 to your hosts file helps ??? On macOS; % ping 0.0.0.0 PING 0.0.0.0 (0.0.0.0): 56 data bytes ping: sendto: Socket is not connected ping: sendto: Socket is not connected Request timeout for icmp_seq 0 ping: sendto: Socket is not connected Request timeout for icmp_seq 1 ping: sendto: Socket is not connected Request timeout for icmp_seq 2 ping: sendto: Socket is not connected Request timeout for icmp_seq 3 % ping 0 PING 0 (0.0.0.0): 56 data bytes ping: sendto: Socket is not connected ping: sendto: Socket is not connected Request timeout for icmp_seq 0 ping: sendto: Socket is not connected Request timeout for icmp_seq 1 ping: sendto: Socket is not connected Request timeout for icmp_seq 2 ping: sendto: Socket is not connected Request timeout for icmp_seq 3 ping: sendto: Socket is not connected Is this correct ???
- TacticalCoder 2y ago> IIRC adding 0.0.0.0 0.0.0.0 to your hosts file helps ? Yup because typically you're not running a webserver on 0.0.0.0, especially not one that listen on ports 80/443 (say in dev you may be listening to 8080 or something). I mean: on Linux if you ping 0.0.0.0 (or the shortcut "ping 0"), you'll be getting answers from 127.0.0.1. But as I don't run a webserver on my machine (except a dev one at times, on a specific port which is not 80/443/8080 etc.), routing domains to 0.0.0.0 still works. I also used in the past dnsmasq to automatically reply NX_DOMAIN when the browser attempts to resolve 0.0.0.0 but atm I'm not even bothering (maybe I should do it again after reading TFA though). P.S: it's another aging brain answering, so take this with a grain of salt