Security of "private" or "local" addresses [LWN.net]

Security of "private" or "local" addresses

Posted Jul 24, 2026 9:33 UTC (Fri) by farnz (subscriber, #17727)
In reply to: Address types by mbunkus
Parent article: Firefox 153 released

In the browser context, the meaning is reversed from what you're saying - which is the "BeyondCorp" position of "everything must be treated as exposed to attackers anyway, so why not set things up such that you don't trust the local network more than the wider Internet?.

Browsers want to treat the local network as less trusted than the wider Internet, on the basis that it's more likely that someone has unintentionally trusted the local network than that they've unintentionally trusted the wider Internet.

to post comments

Security of "private" or "local" addresses

Posted Jul 24, 2026 10:27 UTC (Fri) by knewt (subscriber, #32124) [Link]

Isn't it actually the opposite of this? It's still that you're not trusting the wider Internet here, right?

The way the new restrictions work, iirc, is that a website from a 'less trusted' address space is not allowed to talk to devices from a 'more trusted' address space unless you give specific permission.

So a 'remote' website that wants to do so - eg, a device/iot management page that wants to talk directly to the device from within your browser, or the plex.tv web app talking directly to your local media server - is not trusted to talk to the local device by default.

And iirc it also goes local -> localhost. So in the common situation nowadays of having software running on your local machine that uses a web management interface as the UI, listening only on localhost, some random website - even a website running on another local machine - can't access that without you giving it permission.