undefined | Better HN

0 pointsowaislone6y ago0 comments

So if a local service allows WS connections, can data be scrapped off such a service?

0 comments

3 comments · 1 top-level

dvdkhlng6y ago· 2 in thread

Yes, the primary (or only) reason to even implement a WS server connection is exactly to allow data to be scrapped off using a web-browser.

E.g. Asterisk nowadays allows enabling SIP protocol access over websocket so that you can run a javascript VoIP client from inside a browser [1] (and WebRTC for the media layer).

[1] https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+...

owaisloneOP6y ago

Sure but such servers would always implement authentication when deployed to the web but a lot of such services could run locally unauthenticated to serve local apps. For example services to power electron apps. This tells me data from such services can be stolen very easily.

dvdkhlng6y ago

Electron apps have much more access permissions than a normal website. I don't know technical details of how electron apps interact with the bundled chrome, however this post [1] suggests that electron apps can just talk low-level TCP protocol, no need to wrap everything in an additional websocket protocol layer.

[1] https://stackoverflow.com/questions/41674063/is-it-possible-...

j / k navigate · click thread line to collapse