Brave will allow users to choose which sites can access local network resources.
Starting in version 1.54, [the browser] Brave will automatically block website port scanning, a practice that a surprisingly large number of sites were found engaging in a few years ago. According to this list compiled in 2021 by a researcher who goes by the handle G666g1e, 744 websites scanned visitors’ ports, most or all without providing notice or seeking permission in advance. eBay, Chick-fil-A, Best Buy, Kroger, and Macy’s were among the offending websites.
this raises my antennae way up but i have to admit, although being probed makes my skin crawl, i don’t actually understand what bad actors can do. it seems bad but that could be fud.
more distressing is the wall of shame; if even slightly true, this is hideous. typing just obvious things i know from just one screenful of a 700±line document: state farm, lending tree, citibank, glassdoor, iberia. for some reason financial firms are heavily represented here.
anyone have any knowledge in this domain? and if it’s an actual problem, what’s the best way to put a ring around it? the actor is inside your browser, so the usual firewall tricks don’t apply.
The Nice:
This is possible because the original web protocol allows sites with CORS disabled to be able to still access 127.0.0.1
This allows for websites to assist in setting up installed programs, and plugged in devices. (Long before the days of Electron) or registering warranty. It can also allow locally installed software to communicate with their web counterparts. Your local Steam website could potentially host a site on 127.0.0.1 and tell steampowered.com what games are installed.
It can also be used to see if someone is remoting into your computer (or similarly acting malware) and thusly increasing fraud likelihood score, or asking for 2FA. Think grandmas getting scammed over the phone. This is why it is so prevalent on banking sites.
The Naughty:
This can also be used as part of a larger scheme to uniquely Identify users and help detect fraud. Identifying users speeds up login and can reduce local storage duplication even in the case of cookie clearing. They scan as much data about you as they possibly can: 1rdt and 3rd party cookies, local storage, browser size, screen size, operating system, browser, what extensions do you have installed, what ports you have open, etc etc. Faster login and fraud detection sound like noble goals, but in reality these are used to generate an ad profile about you. The more data they collect on you the higher a price ad agencies will pay to advertise. In some cases they will have your name and DOB (think Google and Facebook) but modern systems are complex enough that they don’t need that anymore. In many cases their match of you is more accurate then a literal fingerprint.
Now most people don’t have ports open so I don’t know of, off hand, any websites that are doing this but it’s entirely possible. Did you open a port for World of Warcraft? If so we can target WoW and RPG ads to you, etc.
The evil
However you feel about large corporations fingerprinting your online presence this is a reconnaissance technique used by bad actors to find insecurities on your network and device so they can identify ones to hack.
Consider this analogy: imagine if a corporation went around door to door checking to see if your door is unlocked. They tell you and the government that the reason they are doing that is to see who is liable to get broken into. They also take this data and use it to send you advertisements for door locks. Now someone else goes around door to door dressed like the corporation and actually breaks into your house. The robber definitely broke the law, but was facilitated by the corporation that was borderline breaking the law.
If you implement a system where they have to ask before testing your lock (like Brave is) you can get the best of both worlds, but you alone are responsible for identifying bad actors.
You can do this in any browser using uBlock Origin, just enable the built in Block Outsider Intrusion into LAN list in the Privacy category. (it’s disabled by default)
Browsers already have CORS protections which will block XHR/fetch requests, so I was a little confused before reading the article. I find it interesting how they’re using websockets to bypass that
My guess is fraud detection - detecting when an account is being accessed from the machine of a customer that a phone scammer talked into installing remote access software. It’s of course not 100% but can be used to e.g. increase a risk score.
Unusual transaction + no other risk factors? Allow. Unusual transaction + other risk factors? Block or require 2FA or similar.
I cannot fathom what a respectable website would need with a port scan. They should normally just be listening to/broadcasting on 80/443. Is it looking to see if the normal html ports are remapped? That’s the only reason I could imagine.
Well, you’re not gonna like this but every pentesting / vulnerability scan starts with a port scan. It’s really there to probe a PC for anything interesting. Although it’s not strictly illegal because you’re just kindly asking a PC to handover any meta information on what is currently running on the PC exposed to the internet, the trajectory is clear and in the contrast the goal is opaque which makes it shady af.
You’re not gonna like this but the Computer Fraud and Abuse Act in the US is so ridiculously broad that damn near anything that you do to/in a network that the owner doesn’t permit could be illegal.
A law is only as good as it’s enforcement. Combine this with the major questions doctrine infecting our courts any “broad” law can be ignored by the courts on whimsy.
A portscan from the outside, I can dig that (still don’t like it), but sneaking one inside your network via a legit webpage (when you see ebay as legit at least) that’s bad.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
The Nice: This is possible because the original web protocol allows sites with CORS disabled to be able to still access 127.0.0.1 This allows for websites to assist in setting up installed programs, and plugged in devices. (Long before the days of Electron) or registering warranty. It can also allow locally installed software to communicate with their web counterparts. Your local Steam website could potentially host a site on 127.0.0.1 and tell steampowered.com what games are installed. It can also be used to see if someone is remoting into your computer (or similarly acting malware) and thusly increasing fraud likelihood score, or asking for 2FA. Think grandmas getting scammed over the phone. This is why it is so prevalent on banking sites.
The Naughty: This can also be used as part of a larger scheme to uniquely Identify users and help detect fraud. Identifying users speeds up login and can reduce local storage duplication even in the case of cookie clearing. They scan as much data about you as they possibly can: 1rdt and 3rd party cookies, local storage, browser size, screen size, operating system, browser, what extensions do you have installed, what ports you have open, etc etc. Faster login and fraud detection sound like noble goals, but in reality these are used to generate an ad profile about you. The more data they collect on you the higher a price ad agencies will pay to advertise. In some cases they will have your name and DOB (think Google and Facebook) but modern systems are complex enough that they don’t need that anymore. In many cases their match of you is more accurate then a literal fingerprint. Now most people don’t have ports open so I don’t know of, off hand, any websites that are doing this but it’s entirely possible. Did you open a port for World of Warcraft? If so we can target WoW and RPG ads to you, etc.
The evil However you feel about large corporations fingerprinting your online presence this is a reconnaissance technique used by bad actors to find insecurities on your network and device so they can identify ones to hack.
Consider this analogy: imagine if a corporation went around door to door checking to see if your door is unlocked. They tell you and the government that the reason they are doing that is to see who is liable to get broken into. They also take this data and use it to send you advertisements for door locks. Now someone else goes around door to door dressed like the corporation and actually breaks into your house. The robber definitely broke the law, but was facilitated by the corporation that was borderline breaking the law.
If you implement a system where they have to ask before testing your lock (like Brave is) you can get the best of both worlds, but you alone are responsible for identifying bad actors.
You can do this in any browser using uBlock Origin, just enable the built in
Block Outsider Intrusion into LANlist in thePrivacycategory. (it’s disabled by default)Here it is if you wanna look at it: https://github.com/uBlockOrigin/uAssets/blob/master/filters/lan-block.txt (but no need to paste it into ublock, it’s built in just disabled)
I do not see it in Ublock’s settings. Under Privacy I see:
You need to look under filter lists.
Got it, thanks!
Browsers already have CORS protections which will block XHR/fetch requests, so I was a little confused before reading the article. I find it interesting how they’re using websockets to bypass that
Wouldn’t this most likely be for fingerprinting?
My guess is fraud detection - detecting when an account is being accessed from the machine of a customer that a phone scammer talked into installing remote access software. It’s of course not 100% but can be used to e.g. increase a risk score.
Unusual transaction + no other risk factors? Allow. Unusual transaction + other risk factors? Block or require 2FA or similar.
Ah that would make sense, thank you
I cannot fathom what a respectable website would need with a port scan. They should normally just be listening to/broadcasting on 80/443. Is it looking to see if the normal html ports are remapped? That’s the only reason I could imagine.
Well, you’re not gonna like this but every pentesting / vulnerability scan starts with a port scan. It’s really there to probe a PC for anything interesting. Although it’s not strictly illegal because you’re just kindly asking a PC to handover any meta information on what is currently running on the PC exposed to the internet, the trajectory is clear and in the contrast the goal is opaque which makes it shady af.
You’re not gonna like this but the Computer Fraud and Abuse Act in the US is so ridiculously broad that damn near anything that you do to/in a network that the owner doesn’t permit could be illegal.
A law is only as good as it’s enforcement. Combine this with the major questions doctrine infecting our courts any “broad” law can be ignored by the courts on whimsy.
you’re more than free to, as they say, “fuck around and find out”. I hope for your sake you have the money and time to deal with lawyers and court
I’m not talking about myself, I’m talking about major corporations that do whatever they please (in the US) and the rest of us just have to deal with.
A portscan from the outside, I can dig that (still don’t like it), but sneaking one inside your network via a legit webpage (when you see ebay as legit at least) that’s bad.
I don’t have any prior knowledge about it but it looks pretty invasive, I found this interesting article about it:
And this Firefox extension to block sites from scanning local ports:
inside the addons page: eBay is port scanning visitors to their website - and they aren’t the only ones
that one is very interesting if one has any coding background
Well this is disturbing.
Many thanks for the Firefox extension tip!