Top all-time · #10366
nem.ec
Personal blog · blog.nem.ecprogrammingsecurity
nem.ec is a personal blog at blog.nem.ec about programming and security. Since 2015, 7 different Hacker News readers have linked it 7 times, most often “eBay is port scanning visitors to their website”. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
Linked for posts on browser tracking and local-network probing, such as eBay's WebSocket localhost port scanning from 2020. Commenters cite them as sources for these techniques.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
...
Most-linked posts?
- eBay is port scanning visitors to their website6 people · 6 mentions · first linked 2020-06-06
What Hacker News says?
PSA: If you have an https web site that needs to talk to your server in localhost, that localhost server does not have to run https since localhost is considered potentially trustworthy. It will not trigger the mixed content errors (for Chrome and Firefox – Safari does not do this for now, but it is in the works: https://bugs.webkit.org/show_bug.cgi?id=171934 ) I have seen some companies do the following too: They e…
Comment linking /2020/05/24/ebay-port-scanning/
on “Deno 1.6 supports compiling TypeScript to a single executable”Submitted eBay is port scanning visitors to their website as a story · 478 points
HN discussionWelcome to the automated account suspension age of the internet, where companies shoot first and don't care later, as the amount of false positives is not worth putting any meagerly (if there's any already) real, physical support to resolve. This can apply to smaller companies too, for other but equally pricey reasons. The amount of fraudulent activity attempts online may warrant those aggressive measures from their…
Comment linking /2020/05/24/ebay-port-scanning/
on “Tell HN: I was permanently banned from eBay in one hour”Submitted Magic Methods in C# as a story · 2 points
HN discussionBrowser fingerprinting can get creative at times, to say the least. eBay's WebSocket port scanner [1] and Reddit's abuse of DRM and JavaScript JIT exploits [2] from years ago are two examples of the kind of in-depth introspection you can perform completely in the background using nothing more than simple non-permission-gated APIs. [1] https://blog.nem.ec/2020/05/24/ebay-port-scanning/ [2] https://iter.ca/post/reddit…
Comment linking /2020/05/24/ebay-port-scanning/
on “AliExpress runs silent WebAudio fingerprinting that breaks Bluetooth multipoint”Submitted eBay is port scanning visitors to their website (2020) as a story · 1 points
HN discussionA similar type of timing attack can be used to port scan your local machine (and other devices on your local network) from your browser. https://github.com/Flu1dTeam/PortScanner A while ago, eBay got caught doing this. https://blog.nem.ec/2020/05/24/ebay-port-scanning/
Comment linking /2020/05/24/ebay-port-scanning/
on “Brute-forcing a macOS user’s real name from a browser using mDNS”