The Brave team has announced that the privacy-focused browser will soon introduce new restriction controls, allowing users to specify how long websites can access local network resources.
See also: Brave: The Summarizer feature for Search is here!
Locally hosted resources may include images or files needed or used by web programs on your device. Other local resources may include access to devices on your network, such as NAS instances, locally hosted servers, shared network printer files, shared network device/computer data, etc.
It is common for websites and local web applications to request access to local resources in order to track users or collect information about the software running on the user 's computer .
“Surprisingly, most browsers allow websites to access these local resources just as easily as they access other resources on the internet,” Brave explains.
This practice has been documented since at least 2020 on websites such as eBay, Citibank, Chick-fil-A, and many others, as part of an anti-fraud script used on the relevant websites.
See also: Brave: New anti-tracking feature Forgetful Browsing
Brave says that all major modern browsers, including Chrome and Firefox, allow websites to request access to local resources and use them without restrictions.
Safari blocks these requests even when they come from secure public websites as a side effect of its security measures and not as a specific design decision to stop this dangerous practice.
Brave introduces a localhost access permission to address this problem, while allowing trusted websites to access local resources for a limited time.
“Brave is the only browser that will block requests to localhost resources from both secure and insecure public websites, while maintaining a compatibility path for websites that users trust,” the Brave team promises.
“Starting with version 1.54 (current version is v1.52), Brave for desktop and Android will include more robust features for controlling which websites can access local network resources and for how long they can do so.”
By default, no website will be granted permission to access localhost resources, so users can manually grant it by going to “brave://settings/content/localhostAccess” on desktop or “Settings > Site settings > Localhost Access” on Android.
In addition to this new permissions mechanism, Brave will use filter list rules to block scripts and websites that abuse localhost access.
At the same time, Brave will maintain and update an allow-list of trusted websites that will be allowed to ask users to allow them to access local network on their first visit.
Requests to localhost resources from a localhost context will still be allowed without requiring special permissions.
Information source: bleepingcomputer.com
