3 ms·
> it might also end up breaking websites That's what I was trying to get at: Are any websites using this legitimately to communicate with local applications? I
by lxgr 2y ago
> it might also end up breaking websites
That's what I was trying to get at: Are any websites using this legitimately to communicate with local applications? If so, isn't that a pretty big fingerprinting and attack vector (how are websites authenticating themselves to these local applications and vice versa)?
- ghxst 2y agoPotentially? Typically nowadays if you have some application on the host and a browser component (like a password manager) you would use a native messaging host and extension. There's also deep links / intents type communication. But if neither of those fit your use case I guess you would be able to have something running on localhost, maybe for something like an FTP server it would be more common. The ports that these scripts typically scan are those of known automation tools as well as malware, example is port 9222 for Chrome Devtools Protocol. Edit: Also any local network equipment probably uses local ips a lot, they often have web UIs that have legitimate use cases for this.