4 ms·

Reading through the W3C draft linked to in the announcement, localhost over HTTP will be considered probably secure.

• TazeTSchnitzel 12y ago
  Make sense: if you can run a web server, you don't need the browser's help to do a phishing attack.
  • organsnyder 12y ago
    Not necessarily. Any user could run a web server on an unprivileged port. While this is a far-fetched scenario—it requires the attacker having access to a different user's account on the machine, but not the victim's (if they had access to the victim's account, they wouldn't need to take these measures)—it is possible. The only solution is to restrict privileged status to privileged ports. However, that would also limit the usefulness of the exception, since dev servers usually run on unprivileged ports (that could be changed, of course).
    • thomasfoster96 12y ago
      I might suppose that web browser developers might be of the view that if someone has been able to run a web server on your computer (even under a different user account) and done so with malicious intentions, your security problems are beyond the control of a web browser. With that sort of access, the attacker might as well have made off with all of your HTTPS-only cookies and browser history, changed your DNS settings, etc.