News for hackers. Stuff that matters.

A comment on Internet Draft: Let 'localhost' be localhost. Parent comment

Re:Internet Draft: Let 'localhost' be localhost by icebraining on Monday August 07, 2017 @04:41PM (#14951076)
Why?
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by IshKebab on Monday August 07, 2017 @05:22PM (#14951383)
I guess anyone on 127.0.0.1 can pretend to that address. Very unlikely to matter.
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by jwilk on Monday August 07, 2017 @05:48PM (#14951545)
Same-site scripting:

http://seclists.org/bugtraq/2008/Jan/270

[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by icebraining on Monday August 07, 2017 @06:05PM (#14951651)
Interesting. Still, that requires the attacker to be already running a process on the victim's machine, even if with reduced privileges. Nowadays that's rare, since there's no reason not to give each user its own network namespace, at the very least.
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by brazzledazzle on Monday August 07, 2017 @04:51PM (#14951153)
Just a guess: CORS-related attacks
[ Parent | on HN ]
Re:Internet Draft: Let 'localhost' be localhost by icebraining on Monday August 07, 2017 @05:08PM (#14951279)
How would that work?
[ Parent | on HN ]