Hacker News Reader

Of course, this can be done against anybody who hits a web page, instead of just against machines on your local network.

But yeah, binding services to 0.0.0.0 on your machine is a recipe for disaster too.

View on HN

Usually you're behind either NAT or a firewall though.

So long as you have a DNS resolver which respects TTLs, you could be behind anything - they're dynamically changing DNS to point at your localhost. It's not the remote server making the connections, it's your web browser. At which point, it can be exfiltrated, thanks for the DNS tricks which get around CORS.

That doesn't make sense. A web browser is just a TCP connection after all. If the port isn't open on the server there's no way to connect to it.

Reply on news.ycombinator.com