Let's guess what Google requires in 14 days or they kill our extension

Re:Let's guess what Google requires in 14 days or they kill ... by withinboredom on Wednesday May 13, 2020 @09:17PM (#23174036)

If you have a half-decent router or firewall, this won’t work from outside the network.

[ Parent | on HN ]

Re:Let's guess what Google requires in 14 days or they kill ... by mappu on Wednesday May 13, 2020 @10:59PM (#23174792)

My router (AVM FRITZ!Box) blocks DNS results for anything in the LAN range, as part of protection against rebind attacks.

But actually 127.0.0.1 seems unaffected:

    $ host 127.0.0.1.xip.io
    127.0.0.1.xip.io has address 127.0.0.1
    $ host 192.168.1.1.xip.io
    # no result

[ Parent | on HN ]

Re:Let's guess what Google requires in 14 days or they kill ... by viraptor on Wednesday May 13, 2020 @10:02PM (#23174368)

Huh? What kind of router would filter out 127.x responses by default? Also, this wouldn't work with DoH enabled which is where we're heading with browsers.

[ Parent | on HN ]

Re:Let's guess what Google requires in 14 days or they kill ... by fuzzy2 on Thursday May 14, 2020 @07:08AM (#23178041)

It’s about negating security mechanisms that rely on the request/target "origin".

[ Parent | on HN ]

Re:Let's guess what Google requires in 14 days or they kill ... by bmm6o on Thursday May 14, 2020 @03:42PM (#23184364)

Have you seen this fail? Drop box and spotify use this same trick, i assume it had wide support.

[ Parent | on HN ]