Why Is This Website Port Scanning Me?
Every time I hear about some shiny new feature being added to a browser, I think...<p>1) Will I ever actually use this<p>2) How is this gonna screw me over<p>WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven&#x27;t ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!)<p>Edit: Fantastic. You can&#x27;t disable it in Firefox. So what, does Firefox need a freaking iptables implementation now? [1]<p>1 - <a href="https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1091016" rel="nofollow">https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=1091016</a><p>&quot;The only theoretical reason for the WebSocket pref these days is the possibility to disable it easily in case there is a security issue found in the protocol itself or so.&quot;<p>The protocol itself is the security issue. ALL OF IT.<p>Edit 2: So I don&#x27;t have the time to investigate every new fad when it comes out. I originally thought WebSockets were raw sockets, but they aren&#x27;t. Firefox blocks access to port 22 -- I was hoping all privileged ports, but it seems just those. Opening a WebSocket to netcat dumps out a HTTP request, so it seems unlikely that you&#x27;d be able to talk with anything that doesn&#x27;t talk HTTP and WebSockets. Firefox also seemingly blocks access to 192.168&#x2F;24 and 10&#x2F;8.<p>This makes me less angry. But what STILL make me angry is that I have to sit and research about some stupid thing that I don&#x27;t want and can&#x27;t turn off. Sooner or later, some web dev is gonna argue that all sites should be loaded over WebSockets because his bloated javascript stack performs marginally better, and then WebSockets <i>won&#x27;t</i> be something I can turn off. Websites will just whitepage.<p>Edit 4: Done researching this now. I went to ebay on Firefox, and wasn&#x27;t getting websocket scans. But I&#x27;ve got a stack of uBlock and NoScript... maybe that&#x27;s interfering with it some how? Opened up a stock config for google-chrome -- that&#x27;s my browser for &quot;some dumb new web tech that isn&#x27;t working in Firefox&quot; -- not seeing any scans when I open up inspector and click &quot;WS&quot;.<p>Regardless, his point still stands. You can totally use WebSockets as a port scanner for localhost, assuming the Content Security Policy allows it. Now I gotta go update my nginx configs...