On: Ask HN: Why does the US Visa application website do a port-scan of my network?

[galaxy_gas]

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them

1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

[meitham → galaxy_gas]

Madness! How do I harden my network against that?

[bawolff → meitham]

Chrome is already in the process of killing it https://developer.chrome.com/blog/local-network-access

[ahdanggit → bawolff]

The company I work for has a legitimate service that runs on the loopback (it provides our web apps APIs for some device integration) hopefully its just as simple as the user accepting the prompt else we'll be drowning in support. We had to go the path of the local service because they killed NPAPI. I've been thinking about using web serial as an alternative but Firefox doesn't support it.

That being said, I think this is an overall win, hopefully Firefox implements it in a consistent manner as well.

[ayewo → ahdanggit]

How is your company's service started on the loopback interface? You bundle a web server that is installed alongside a native app?

[galaxy_gas → ayewo]

This how many of them work for transporting vs traditional old way of registering url scheme and requiring user interacts --- Discord, Blizzard net, Riot Client ... all localhost listener's that can interact

[ahdanggit → ayewo]

Roughly, yes. Customers (or more often, their IT department) runs our installer which installs the server as a windows service.

[dns_snek → meitham]

Enable "Block Outsider Intrusion into LAN" filter list in uBlock Origin.

[meitham → dns_snek]

Thank you!

[ale42 → meitham]

You should actually harden your browser or PC... to block any unwanted requests. Apparently some browser extensions can do that.

[bmacho → meitham]

It would be the job of the operating system to give or take away the ability of your browser to access your local network. But you can run your browser in a container/vm and disable localhost. (And use a separate browser for localhost only if you need it.)

[ahdanggit → galaxy_gas]

my bank did this on the site they sent me to in order to activate my new card.