any minute takers?
", "time": "2025-07-25T09:33:10Z"}, {"author": "Shivan Sahib", "text": "thanks Tara!
", "time": "2025-07-25T09:34:59Z"}, {"author": "Shivan Sahib", "text": "@meetcho we can't see the speaker online
", "time": "2025-07-25T09:35:28Z"}, {"author": "Shivan Sahib", "text": "Gunes Acar (one of the authors on this paper) had presented at PEARG 7 (!) years ago
", "time": "2025-07-25T09:39:30Z"}, {"author": "Martin Thomson", "text": "Gunes has done some really good work in this area
", "time": "2025-07-25T09:39:50Z"}, {"author": "Martin Thomson", "text": "This was a particularly good find.
", "time": "2025-07-25T09:40:03Z"}, {"author": "Martin Thomson", "text": "Arguably, this is a failing of the Android platform (iOS doesn't have the problem because it doesn't allow servers to operate like this).
", "time": "2025-07-25T09:41:51Z"}, {"author": "Shivan Sahib", "text": "I thought iOS had the same capability?
", "time": "2025-07-25T09:42:27Z"}, {"author": "Martin Thomson", "text": "My understanding is that you can't run servers in the background on iOS.
", "time": "2025-07-25T09:42:53Z"}, {"author": "Steve Hill", "text": "Is there a legitimate reason for an app to ever bind to 127.0.0.1 / ::1 or could that binding simply be prohibited?
", "time": "2025-07-25T09:43:14Z"}, {"author": "Martin Thomson", "text": "This whole SDP munging thing is a red herring, you don't need it.
", "time": "2025-07-25T09:43:16Z"}, {"author": "Shivan Sahib", "text": "yeah
", "time": "2025-07-25T09:43:30Z"}, {"author": "Martin Thomson", "text": "Steve: there is no reason to allow apps to communicate with each other over loopback.
", "time": "2025-07-25T09:43:42Z"}, {"author": "Steve Hill", "text": "(or at least, hidden behind a separate permission that most apps wouldn't acquire)
", "time": "2025-07-25T09:43:46Z"}, {"author": "Martin Thomson", "text": "A solution here would partition the network by app, so that apps can communicate with others on the network, but not each other.
", "time": "2025-07-25T09:44:03Z"}, {"author": "Jonathan Hoyland", "text": "I wonder if the use of localhost is why my password manager sometimes suggests passwords for one app in others.
", "time": "2025-07-25T09:44:13Z"}, {"author": "Martin Thomson", "text": "These platforms have ways for apps to communicate with each other.
", "time": "2025-07-25T09:44:26Z"}, {"author": "Steve Hill", "text": "I guess even if 127.0.0.1 / ::1 is prohibited, the device's other IPs could be used (but it would be harder since the JS would need to determine the IPs first)
", "time": "2025-07-25T09:45:09Z"}, {"author": "Martin Thomson", "text": "Steve: yes, you need to cut off all use of local interfaces. You can't stop use of hairpinning at a NAT (provided that the NAT address is visible) but that's far less of a problem.
", "time": "2025-07-25T09:45:52Z"}, {"author": "Martin Thomson", "text": "There are some DNS filters or firewalls that blocked the Yandex approach because of this use of loopback in responses from public resolvers.
", "time": "2025-07-25T09:48:24Z"}, {"author": "Martin Thomson", "text": "Meta's approach was more robust.
", "time": "2025-07-25T09:48:36Z"}, {"author": "Marco Munizaga", "text": "How did yandex use https on localhost? (or am I misunderstanding?)
", "time": "2025-07-25T09:49:42Z"}, {"author": "Steve Hill", "text": "Any legal implications for companies using sidechannels to bypass normal permissions?
", "time": "2025-07-25T09:50:52Z"}, {"author": "Shivan Sahib", "text": "I believe they got strongly worded emails from Google
", "time": "2025-07-25T09:51:36Z"}, {"author": "Steve Hill", "text": "Ah, \"strongly worded emails\", the best kind of deterrant :)
", "time": "2025-07-25T09:51:55Z"}, {"author": "Lorenzo Miniero", "text": "@Marco Munizaga I think it wasn't https, it was STUN/TURN, so UDP
", "time": "2025-07-25T09:52:54Z"}, {"author": "Marco Munizaga", "text": "\n\n3.The Yandex script sends a request to their servers to obtain obfuscated parameters.
\n
\n4. These obfuscated parameters are send to the localhost via both HTTP and HTTPS.
from https://localmess.github.io
", "time": "2025-07-25T09:53:54Z"}, {"author": "Martin Thomson", "text": "I understand that the strongly worded emails were in the spirit of \"you violated the terms of the app store agreement; please make a case for why we shouldn't pull your apps from the store\"
", "time": "2025-07-25T09:54:11Z"}, {"author": "Shivan Sahib", "text": "Local Network Access by Chromium is a strong mitigation, we (Brave) will adapt that once it's stable
", "time": "2025-07-25T09:54:15Z"}, {"author": "Martin Thomson", "text": "We are shipping LNA in Firefox very soon (I reviewed the user documentation this week)
", "time": "2025-07-25T09:54:58Z"}, {"author": "Lorenzo Miniero", "text": "Marco Munizaga said:
\n\n\n\n\n\n3.The Yandex script sends a request to their servers to obtain obfuscated parameters.
\n
\n4. These obfuscated parameters are send to the localhost via both HTTP and HTTPS.
Ah apologies, you're right: it was Meta that used STUN/TURN too
", "time": "2025-07-25T09:55:12Z"}, {"author": "Steve Hill", "text": "@Marco: This is an assumption but, if you own example.com and have local.example.com resolve to 127.0.0.1, you can get a valid certificate for local.example.com and bundle it with your app. This would allow HTTPS to be negotiated with local.example.com, which is the local app.
", "time": "2025-07-25T09:55:33Z"}, {"author": "Shivan Sahib", "text": "@martin that's awesome
", "time": "2025-07-25T09:55:38Z"}, {"author": "Ignacio Castro", "text": "Would love to hear a take from Meta, if there is anyone in the room
", "time": "2025-07-25T09:59:20Z"}, {"author": "Marco Munizaga", "text": "Steve Hill said:
\n\n\n@Marco: This is an assumption but, if you own example.com and have local.example.com resolve to 127.0.0.1, you can get a valid certificate for local.example.com and bundle it with your app. This would allow HTTPS to be negotiated with local.example.com, which is the local app.
\n
This is wild. If I can change the DNS resolution, then I could present my own server as a Yandex one with their own certificate.
", "time": "2025-07-25T10:00:08Z"}, {"author": "Steve Hill", "text": "@Marco you would need to convince a CA to give you a certificate for the domain that you're spoofing.
", "time": "2025-07-25T10:00:56Z"}, {"author": "Marco Munizaga", "text": "Yandex gave me the certificate (bundled in the app), right?
", "time": "2025-07-25T10:01:32Z"}, {"author": "Steve Hill", "text": "@Marco in this case, Yandex own yandex.com, so can legitimately get a certificate for anything.yandex.com. Which servers whey put that cert + key on is up to them, including a web server running in an app that you install on your phone
", "time": "2025-07-25T10:02:18Z"}, {"author": "Steve Hill", "text": "@Marco oh, good point, but presumably it wasnt a wwildcard cert, so can only be used to spoof that one subdomain
", "time": "2025-07-25T10:02:42Z"}, {"author": "Steve Hill", "text": "@Marco but yes, there are probably some interesting security problems for Yandex right there :)
", "time": "2025-07-25T10:03:14Z"}, {"author": "Alisha Ukani", "text": "Hi everyone, I'm the presenter of this work -- happy to answer questions while the video is playing in addition to the live Q&A
", "time": "2025-07-25T10:04:02Z"}, {"author": "Shivan Sahib", "text": "thanks for being around at this ungodly hour Alisha :)
", "time": "2025-07-25T10:04:54Z"}, {"author": "Sara Dickinson", "text": "Sorry Ignacio - I didn't see you in the queue! I presume it was a question for the previous speaker?
", "time": "2025-07-25T10:05:13Z"}, {"author": "Martin Thomson", "text": "Same origin doesn't really protect users as much as it protects the integrity of site information from other sites.
", "time": "2025-07-25T10:05:53Z"}, {"author": "Shivan Sahib", "text": "The video is lagging, at least for me remotely, not sure how it is in the rom
", "time": "2025-07-25T10:07:53Z"}, {"author": "Jonathan Hoyland", "text": "Yeah, the video is lagging horribly
", "time": "2025-07-25T10:08:04Z"}, {"author": "Peter Koch", "text": "no video in the onsite tool
", "time": "2025-07-25T10:08:17Z"}, {"author": "Jonathan Hoyland", "text": "@Alisha, could you possibly share the YT link here?
", "time": "2025-07-25T10:08:21Z"}, {"author": "Alisha Ukani", "text": "Here's the video link: https://www.youtube.com/watch?v=141KiubKtnI
\nare there slides?
", "time": "2025-07-25T10:08:50Z"}, {"author": "Shivan Sahib", "text": "", "time": "2025-07-25T10:09:00Z"}, {"author": "Martin Thomson", "text": "because I could follow along if there were slides in addition to the video
", "time": "2025-07-25T10:09:02Z"}, {"author": "Lorenzo Miniero", "text": "@Sara Dickinson there's an ethernet cable on the chair desk, if you weren't using it already
", "time": "2025-07-25T10:09:22Z"}, {"author": "Lorenzo Miniero", "text": "If you're on the wifi that may be part of the cause
", "time": "2025-07-25T10:09:31Z"}, {"author": "Eric Kinnear", "text": "@Alisha no audio in the room
", "time": "2025-07-25T10:11:37Z"}, {"author": "Jonathan Hoyland", "text": "No audio coming through
", "time": "2025-07-25T10:11:38Z"}, {"author": "Andrew Campling", "text": "No audio remotely either
", "time": "2025-07-25T10:11:44Z"}, {"author": "Eric Kinnear", "text": "No worries if you miss anything, presenting it alongside the slide share would be great!
", "time": "2025-07-25T10:12:43Z"}, {"author": "Jonathan Hoyland", "text": "This was a really cool talk, thank-you so much Alisha.
", "time": "2025-07-25T10:22:26Z"}, {"author": "Allison Mankin", "text": "Thank you for the great talk, @Alisha, in the middle of the night there.
", "time": "2025-07-25T10:25:51Z"}, {"author": "Alisha Ukani", "text": "Thanks everyone!
", "time": "2025-07-25T10:26:12Z"}, {"author": "Martin Thomson", "text": "PEARG probably isn't the right place for standardization of these primitives. These are all crypto-heavy things. Though this group might have something to contribute in terms of deciding WHAT.
", "time": "2025-07-25T10:57:20Z"}]