Re:Leaking silhouettes of cross-origin images
by kornbattery on Wednesday January 13, 2021 @03:45AM
(#25759679)
I'd say it's bad design to have everything important in the open just because it's behind a firewall; it's got a huge blast radius when something goes wrong.
Securing your services regardless of where they are in the network should be go the go to
Re:Leaking silhouettes of cross-origin images
by MrStonedOne on Wednesday January 13, 2021 @05:45PM
(#25769039)
I'd say accessing an internal ip counts as credentials, but i wouldn't be shocked if chrome disagreed.
There are other cases. Does you company have internal tools exposed via the intranet? If you happen to know the URI scheme, from say an ex-employee, you're able to exfiltrate information if you get a current employee on VPN to open your page. This becomes a tool in a layered attack. Sure it's careless to have such anonymous endpoint on your intranet. But there's a reason why anonymous images can't be plainly read back.