Hacker News Reader

prng2021

I thought IPs are trivial for hackers to spoof. Given that and the fact that providers like AWS publicly publish their IP ranges, I don’t understand why IP filtering is so common.

View on HN

I don’t know, but I think it isn’t trivial to spoof public IP addresses owned by organisations. However, it’s trivial to host something in Azure/AWS, so this whitelist would have to somehow distinguish between “MS/Amazon things” and “MS/Amazon customer things”. Probably that’s possible, but the lists are large and the potential for human error is always there.

But this is beside the point. IP whitelisting is problematic for many reasons, and big enterprise sometimes simply refuses to do it. That’s not to say that SCIM is reliant on whitelisting for authentication, it isn’t. However, any modern design of this would have made the connection outbound from the thing being provisioned.

as i understand it, it is trivial to make it look like traffic came from an ip by spoofing the reply address. It is much harder to capture return traffic over the internet. (you have to either compromise every router between you and them, or announce new bgp routes)

in this case, as the value is in the reply data it’s not really feasible (unless you are a three letter agency)

Reply on news.ycombinator.com