reply on: “Localhost tracking” explained. It could cost Meta 32 billion. \ stacker news ~security

pull down to refresh

21 sats \ 3 replies \ @kepford 16 Jun \ on: “Localhost tracking” explained. It could cost Meta 32 billion. security

Its pretty interesting how this works

Yep, so clever that it's simple.

Brave browser does prevent this by default, at least this is my understanding. It does seem like a good browser security default would be to block remote sites from calling localhost. I am sure there are sites this would break but it could warn you that a site attempted this and allow you to allow it.

0 sats \ 0 replies \ @optimism 17 Jun

I was gearing up to test this when i made an addressing error. Turns out it even blocks "cross-site" from http://127.0.0.1 to http://localhost from the same tcp port.