4 ms·
Yes it is, but if you read closer, you will see that they are also planning to block access to secure websocket servers with public dns resolving to 127.0.0.1 a
by jorangreef 12y ago
Yes it is, but if you read closer, you will see that they are also planning to block access to secure websocket servers with public dns resolving to 127.0.0.1 and valid ssl certificates setup precisely for the purpose of being accessed by the public web. This is completely unnecessary.
- acqq 12y agoBut then malware can exploit every user of Dropbox, for example, it doesn't even need their own certificate. And even the users wo don't have Dropbox are vulnerable throgh Dropbox's DNS entry.
- jorangreef 12y agoThere are already plenty of public DNS records which resolve to 127.0.0.1. They're offered as services. For example, 37Signals have a domain resolving to localhost. Malware on a user's computer already has access to everything the user has. Malware on a website would be blocked by the mutual authentication and origin checking that Dropbox do after establishing the WSS connection. Malware in the form of a local daemon on a public computer where someone logs into Dropbox will not be able to authenticate with the web app.