Ask HN: Why does the US Visa application website do a port-scan of my network?

edarchis · 2025-08-20T06:54:27 1755672867

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

mrtksn · 2025-08-20T08:30:20 1755678620

That would be quite clever for an incredibly horrible website. The other day my SO, who is a Turkish citizen, was filling up her visa application and after half an hour of meticulous form filling the system just kick her out. I think the session times out or something. If you haven't created an account or you haven't write down the current application ID everything is lost. In the process she was also directed to a non-.gov website for something during the process, I thought she was getting scammed but no.

It actually makes sense to have a paid service that makes this abomination less painful. Though they work with VFS Global for collecting the applications and relevant documents, the VFS Global itself is an abomination and doesn't help with the handling of the form filling anyway.

Recently EU streamlined the Schengen visa application process for Turkish citizens as those "visa agencies" that are the official agencies and the only way to apply for a visa for many countries don't actually help with anything and are scamming people by selling the "good hours" for the visa appointment on the black market. An agency was dropped for this and the scams by agencies were listed among the reasons to streamline the application process.

Both with US and EU people are losing scholarships etc. due to outrageous wait times that are sometimes are years ahead or there's an issue with the systems handling the applications.

I guess there must be an opportunity there to fix all this together with smaller stuff like handling transliteration and character encodings, I wonder if some of those scam site are not scams and actually help with it. An AI agent can be useful here.

gmueckl · 2025-08-20T16:28:43 1755707323

I had to deal with the DS-160 multiple times over the year. I don't think you give justice to how bad this website really is. I have started to notice that these "timeouts" are very random. At the worst times, the session "times out" immediately after login.

These random logouts happens more frequently during certain times of the day and seems to follow a semi-predictable pattern. It is almost certainly tied to system load in some way.

Also, the site's HTML and JavaScript are bloated beyond hope for what should be a fairly simple set of web forms. And itnhas been thisnway since at least 2018 with exactly zero improvements.

qingcharles · 2025-08-20T17:52:16 1755712336

One thing a developer sat in DC or SV with a 5G iPhone 16 doesn't realize too, is that if you are visiting these web sites with a phone plan that has a tiny monthly data allowance then this bloat can blow out an entire month in one sitting.

I worked with people on parole that were given free phones to use for job applications, finding their way around etc, and they would only get 3GB data a month. Some of the sites they visited were dropping 250MB of payload on the home page. You'd get some plans that would drop down to 2G, but try using that for Google Maps when you're trying to find a bus to get you across the city.

Dylan16807 · 2025-08-21T06:13:31 1755756811

> You'd get some plans that would drop down to 2G, but try using that for Google Maps when you're trying to find a bus to get you across the city.

Sure, I'll do my best to try it. I'll approximate the throttle by limiting chrome to 128kbps, 500ms delay, and 5% packet loss for fun.

With a fresh incognito session, google responds to "here to 4th street" in 10 seconds, and when I click to open maps it needs just under two minutes to load. Then I can click on the transit option and it needs another 10 seconds to update.

Not too bad for a cold cache. If I do it again with a hot cache it only takes 20 seconds to go through the whole process. And I expect the app to be similar to the hot cache situation. Even with 64kbps I'd expect reasonable results. Do any cell providers throttle worse than that?

I agree with your argument about bloat in general, but google in particular has a lot of good engineering resources and tries to work well on bad connections.

Also I would be in favor of some spectrum licensing rules that say you can't throttle below 1Mbps...

qingcharles · 2025-08-21T17:08:39 1755796119

The paper stats on 2G would make it seem like it should work in theory, especially if it's using EDGE or something, but it just consistently fails in the field. You'll get partial renders and then it will jam up. It's super, super frustrating to use. Because it is slow to render people start trying to swipe around the map to make it do something and that just cancels all the async downloads and restarts them.

There are probably a host of other telemetry things going on in your standard $20 Android handset in the background too, eating up all that bandwidth and causing all sorts of bottlenecks.

Agree it would be really nice to have some sane minimum speed.

Dylan16807 · 2025-08-21T19:03:07 1755802987

Well it's not ever going to be actual 2G. It's a throttle. I'm not sure how much worse it could get when you have a reasonably solid signal, but I guess nothing stops network engineers from doing something awful.

> Because it is slow to render people start trying to swipe around the map to make it do something

At a certain point it's the user's fault. And once it gets to the point where you can swipe around, the tile loading should be pretty visible.

And to add more emphasis to the app being usable, I can get driving directions fully offline, then click bus and now it needs one tiny server request to tell me.

rwmj · 2025-08-20T09:44:20 1755683060

You might be making the assumption that the US wants to make the process easier.

throw10920 · 2025-08-20T14:14:46 1755699286

Not to defend the US immigration system, but my experience is that this user-hostile behavior (modulo the port scanning lol) is endemic across US government websites - including those that nominally want to serve you, those that are at the state level instead of the federal level (such as the DMV sites), and those that are even internal for use by government employees only.

It's bad enough that in some cases I believe the designers should be threatened with legal penalties.

PaulHoule · 2025-08-20T16:55:06 1755708906

That e-filing web site for taxes has never worked for my son because he can’t complete the id.me process, it might be as simple as you are an unperson if you use an android phone or maybe because he’s just started in the workforce he does not have a long history of tax filing and credit history to match up with.

Two years in a row we’ve been able to fill out a 1040 and the NY state equivalent and make a paper submission in less time than it takes to reach an operator on hold.

These identity verification services look like a scam to me. LinkedIn incessantly hassles me to verify with CLEAR and it always fails without a clear error message, either “it just doesn’t work” or my hair has grown too much since I got my driver’s license or it is making me take my glasses off and comparing to a driver’s license photo where I am wearing glasses.

jofla_net · 2025-08-20T18:24:16 1755714256

>These identity verification services look like a scam to me.

Even if their intent is to run an 'honest' business, the method of bouncing a user around to god knows how many domains during the process becomes effectively indistinguishable from a compromised service, and the alternative of having each site host their own id verification system screams, HACK US. I can see users becoming increasingly accustomed to getting out their cards several times during a sign-up and not having the foggiest idea of where their information went to.

smithkl42 · 2025-08-20T17:37:18 1755711438

The id.me process is absolutely horrific.

IT4MD · 2025-08-20T21:14:11 1755724451

I'm not sure the word horrific is up to carrying the weight of just how bad id.me is. Still, a great effort.

Sohcahtoa82 · 2025-08-20T16:36:54 1755707814

> user-hostile behavior (modulo the port scanning lol) is endemic across US government websites

I discovered this when it was late at night and I was procrastinating going to bed and I was curious what my estimated Social Security benefit would be at retirement so I tried to log into mySSA and it said the website is closed from like 11 PM to 5 AM or something like that.

I couldn't believe it. I could understand a weekly several-hour maintenance/batch processing window, but DAILY?

crote · 2025-08-21T12:30:40 1755779440

It starts to make a lot more sense when you realise there is a huge group in the US actively trying to make the government fail. It's pretty hard to make a good and user-friendly website when every few years some high-level people try to kneecap you.

These aren't unsolvable problems. The UK, for example, had invested a lot of time and effort into making their websites user-friendly. In most countries filing taxes online is something you can do during your lunch break - without paying the Turbotax maffia. Driver's license? You can order that online, and make an appointment for a 15-minute window to pick it up.

If interacting with the government is painful, it is almost always because someone benefits from it being painful.

xenadu02 · 2025-08-20T17:29:58 1755710998

Gaming of the procurement system. The websites are all written by big consulting outfits. Not to mention the disaster that is big corporate IT projects combined with government rules.

Obama had the Digital Service (that Trump shut down) which paid higher salaries. Those folks were sharp and everything they touched was actually decent.

As I noted this is not unique to government. Large corporate projects at the Fortune 500 are often the same sort of consultant-driven crap.

anticensor · 2025-08-20T20:19:33 1755721173

Digital Service didn't shut down, it just temporarily got retasked to DOGE.

dragonwriter · 2025-08-20T20:32:13 1755721933

It wasn't temporarily retasked, it was reorganized and permanently repurposed and renamed the US DOGE Service, and then within that reorganized service, a subordinate temporary organization was created called the US DOGE Service Temporary Organization that was scheduled to sunset not later than July 4, 2026. (All but 65 of USDS's pre-reorg employees were also fired as part of the reorg, and 21 of those remaining 65 employees did a mass resignation.)

If you visit their website, you will notice that except for historical documents, there is no full name branding at all; mostly only the logo and the occasional "USDS", when prior to the reorg (as can be seen on the Wayback machine) the original full name was prominent.

Our_Benefactors · 2025-08-20T15:14:15 1755702855

This. The website for buying treasury products is straight out of the year 2002. The login is so bad I would never consider buying them there - the service fee charged by brokerages is absolutely worth it in this case.

ryandrake · 2025-08-20T15:27:45 1755703665

Which brokerages charge fees for purchasing US Treasuries? Schwab definitely doesn't.

Really the only reason you need TreasuryDirect is for buying Series I bonds (and maybe a few other niche Treasury products), which are not available through brokerages.

aianus · 2025-08-20T17:48:13 1755712093

Schwab folds their fees into their bid/ask spread, they're not doing it for free.

PaulHoule · 2025-08-20T16:56:47 1755709007

Back when interest rates peaked around that period I bought a huge number of I bonds which were a great investment —- got fired by my broker because I interrupted a sales presentation with “why don’t I just buy I bonds?”

Back then I thought Treasury Direct was great.

teiferer · 2025-08-20T15:29:10 1755703750

Makes it obvious which lobby has a hand in this, doesn't it?

IT4MD · 2025-08-20T13:05:27 1755695127

That would be an abysmally poor assumption currently.

clarkmoody · 2025-08-20T14:00:42 1755698442

The purpose of a system is what it does.

dfxm12 · 2025-08-20T13:31:29 1755696689

I'd invoke Hanlon's razor, but in this case, it's certainly both malice and stupidity...

cossatot · 2025-08-20T15:25:37 1755703537

They are so frequently intertwined

qingcharles · 2025-08-20T17:54:52 1755712492

The web front ends are awful, but the back ends are even worse. The backlogs for some of these applications is insane. I was at a US embassy one time and got talking to a girl who had just had her application approved after an 18 year wait.

LorenPechtel · 2025-08-20T19:12:03 1755717123

18 year wait for approval or 18 year wait for family sponsored immigrant visa? Because from some countries those do have 18 year backlogs.

qingcharles · 2025-08-20T20:11:03 1755720663

I believe it was the latter, if memory serves correct.

cromka · 2025-08-20T10:58:15 1755687495

You use the same system for Business visas. Hard to imagine US wouldn’t want those as easy as possible.

jazzypants · 2025-08-20T13:22:54 1755696174

You don't have a good enough imagination for how stupid our current leadership really is.

more_corn · 2025-08-20T14:52:21 1755701541

I guarantee the visa system was created before the current administration.

snapetom · 2025-08-20T15:34:12 1755704052

I don’t know if you’re US-based or not but in the US, government work has the stigma of attracting the bottom of the barrel. It is nearly impossible to get fired for performance reasons. Combine low pay and high job security, and you’re not going to attract the most innovative, motivated, or competent people.

Early in my career, I was warned that if I took a job with the state of California, I’d be stuck there for my whole career. I’d be unhirable in the private sector.

klipt · 2025-08-20T16:41:18 1755708078

> high job security

Not so much after DOGE fired entire departments for dubious reasons.

I don't know why anyone would work for the federal government now - pay still sucks, and job security has been demonstrated to no longer be guaranteed.

snapetom · 2025-08-20T18:48:07 1755715687

Recent events isn't going to change decades of stigma and reputation. People aren't saying, "Oh cool, they purged the low performers. I'll go work for the government!"

xp84 · 2025-08-20T15:24:19 1755703459

During 8 years of Obama and 4 years of Biden, none of this was different or better. Perhaps this isn't a partisan political issue.

schlauerfox · 2025-08-20T15:39:59 1755704399

From 2014 until it was, in effect, obliterated by DOGE actions this year there was the "United States Digital Service", a crack team of programmers, a sort of skunkworks who worked to improve U.S. government websites of departments that wanted the help. So it seems to be partisan to want good websites, but there are countless people involved in politics with many agendas.

nkoren · 2025-08-20T11:08:35 1755688115

Hard to imagine that the US wouldn't be as paranoid, self-sabotaging, and bureaucratically inept as possible? </sarcasm>

conductr · 2025-08-20T13:12:45 1755695565

As a US citizen, I feel it’s opposite. Hard to imagine they’d want anything related to visas to be easy.

jimz · 2025-08-20T11:45:56 1755690356

[flagged]

cogogo · 2025-08-20T12:06:39 1755691599

My wife, a green card holder, applied for citizenship in April and was naturalized yesterday (from an EU country). Not that I don’t believe it could be true but where are you getting the 3-4yr timeline? If that’s accurate she/we may have dodged a massive bullet.

bluGill · 2025-08-20T12:26:59 1755692819

Spouses always get better treatment as there is a voter who would be mad otherwise. They check for scam marriages but otherwise hurry the process through - if they don't a voter contacts their congressman to push the process. That voter will also likely know a lot of other voters and thus influence the next election while someone not married is unlikely to have that local network to use.

filoleg · 2025-08-20T13:27:56 1755696476

This is patently false for one reason - once someone has a U.S. green card and has met the residency requirement to apply for citizenship, the application form and process are the same for everyone, regardless of how they got their green card (through work, marriage, asylum, investment, etc.).

Once you are eligible to apply, the whole process is basically form N400->biometrics->interview (just doublechecking your name and other paper info, takes 5 minutes)->civics test->ceremony.

However, the timelines and process for getting the green card itself is different depending on the nature of your visa, and they will indeed try to check for scam marriages before you get your green card (if you were applying for it through the marriage visa).

klipt · 2025-08-20T16:43:34 1755708214

Not exactly, if you're married to a citizen the residence requirement is 3 years not 5, and the form clearly distinguishes the 3 and 5 year options (3 years requires extra evidence of marriage and spouse's US citizenship)

filoleg · 2025-08-20T18:18:38 1755713918

Yes, I am aware, which is why my grandparent comment said “[…] once someone […] has met the residency requirement to apply for citizenship.”

The amount of time one has to wait before meeting the residency requirement (aka before they can apply for the US citizenship) depends on other circumstances. With the default being 5 years (technically 4 years and 9 months, because by the time process finishes and you get your citizenship, you will hit the required 5y mark, so they officially let people apply at 4y9mo mark; there is even a first-party "early filing calculator" tool[0]), and the number going down depending on whether it was through marriage, whether you served in the US military and applied for the expedited process, etc.

However, my post explicitly mentioned that I was talking about the time one has to wait after they apply for the US citizenship, to which this has zero relevance.

0. https://www.uscis.gov/archive/uscis-early-filing-calculator

bluGill · 2025-08-20T16:25:24 1755707124

I stand corrected.

cogogo · 2025-08-20T13:26:20 1755696380

I would love to see data that backs this up. While definitely plausible the pathway she followed to naturalization was based on time in country and not our marriage. I didn’t need to push but I’ve generally found my congressman (who is also almost our neighbor) to be pretty unresponsive on any other issue.

My understanding - which may not be correct - is the length of the process primarily depends on your country of origin and secondarily on how you are eligible. Very interested in any source showing that a relatively normal process has pushed out from months to years.

ecshafer · 2025-08-20T13:44:12 1755697452

3-4 year timeline makes more sense for Greencard application to Naturalization, that was 4.5 years for my wife. But its not 3-4 years N400 to Naturalization, no way.

Timelines for USCIS depends heavily on where you are, since some offices just have more people to go through than others. So I have talked to people that one step might be 4 months for them and a year for another person.

giantg2 · 2025-08-20T12:12:16 1755691936

I don't see how blaming the pre-existing website on the current administration makes sense.

wat10000 · 2025-08-20T13:32:09 1755696729

Indeed, the real problem is a pervasive attitude that the USA is the best country in the world by far and everyone is clamoring to get in. We don't really care if foreigners come or not, and they'll come anyway, so why bother making the process friendly?

speakfreely · 2025-08-20T13:22:47 1755696167

It's not new. Rabid ideologues on the other side blamed Obama for things that pre-dated his administration, as well. Some people just can't be rational when it comes to politicians they don't like.

reaperducer · 2025-08-20T12:30:57 1755693057

I don't see how blaming the pre-existing website on the current administration makes sense.

Many federal web sites were very quickly altered or replaced by the new administration.

This is common. Work begins on some web sites immediately after the election. For example, when a new president is sworn in, the White House web site flips immediately.

More to the parent poster's point, it has been widely reported in the legitimate media repeatedly that many federal web sites have been replaced or significantly altered by the current administration. There's an entire pseudo-department for it that also makes headlines for its greater transgressions.

Add to that severe and sudden budget and staffing cuts, and like all government functions -- you get what you pay for.

DaSHacka · 2025-08-20T13:32:25 1755696745

So you claim the visa website was also changed by this administration?

shazbotter · 2025-08-20T14:05:53 1755698753

People really really dislike when you point out that the democrats are also broadly anti immigration in practice. They forget Biden deported 4.6 million people vs Trump's 2 million.

ThrowMeAway1618 · 2025-08-20T21:20:24 1755724824

[flagged]

shazbotter · 2025-08-21T14:05:59 1755785159

I hadn't even considered that some right wing folks would be bothered by that statistic, as if deportations were good, actually. But no, I'm sure it does bother some folks in the right.

zzzeek · 2025-08-20T12:39:47 1755693587

Elon Musk set out hundreds of very young and arrogant programmers to modify code throughout the federal government including to change decades old code used by Treasury, Social Security, etc. While this went on he would tweet idiotic statements like "Dead people are getting social security!" (because he didn't understand the deceased have beneficiaries) and "we're giving social security to people who are 150 years old!" (because he and we presume some subset of his young programmers didn't understand date fields being set to the epoch indicated the date of birth/death had not been recorded).

All this is to say we probably shouldn't assume any current US government website, especially ones that have to do with immigration, hasn't been completely modified by this team.

monkeyelite · 2025-08-20T13:48:40 1755697720

Is your claim that they found zero people fraudulently collecting social security through a dead relative?

zzzeek · 2025-08-20T18:39:30 1755715170

no, this is an entirely bad faith representation of my words as written

he most certainly did not understand that the vast majority of what he perceived as "dead people getting benefits" were completely legitimate cases where beneficiaries were receiving those benefits and/or the data was encoded without a real birth/death date

since you appear to be of the opinion that Musk was somehow indicating a useful fact of some kind, here's mainstream media reporting of the claims made by Trump and Musk (we can assume Trump was advised by Musk) and their extreme inaccuracy:

https://apnews.com/article/social-security-payments-deceased...

monkeyelite · 2025-08-21T02:44:27 1755744267

> since you appear to be of the opinion that Musk was somehow indicating a useful fact of some kind,

No but I am glad he took action to fix it.

The Cobol 150 year thing is also incorrect and was widely criticized in tech circles: https://retrocomputing.stackexchange.com/questions/31288/did...

zzzeek · 2025-08-21T14:19:23 1755785963

Musk wasn't criticizing COBOL he was criticizing a specific thing he misunderstood in social security code which people in that thread said as much. I think you're trying to see something you want to see there.

swat535 · 2025-08-20T14:10:43 1755699043

If there is any conclusion to be drawn here, it is that the United States doesn't want foreigners in their land (for tourism or otherwise).

I'm not sure I see the upside of moving to a nation knowing that its citizens actively despise my existence.

AnotherGoodName · 2025-08-20T14:50:44 1755701444

The VISA appointment scheduling site rate limits to a ridiculous degree these days. As in refresh your page within 10seconds and get a 429 error.

That's probably because of the fact that the appointments are near impossible to get, they only allow booking a few months out and it's always completely booked. So everyone was refreshing (or if clever botting) to get an appointment slot.

karel-3d · 2025-08-20T09:49:41 1755683381

As I wrote elsewhere; they subcontract the bot protection to F5, an external company that I see for some reason a lot on old/horrible banking websites.

DaSHacka · 2025-08-20T13:34:04 1755696844

F5 is huge in enterprise and academia for firewall/VPN/load-balancer services

svnee · 2025-08-20T18:19:58 1755713998

Hey, this is actually something I have a keen interest in as I'm fighting my government (as an MP) to drop those scammers where possible. Do you have any media links to send me about them selling the "good hours" on the black market?

Even if the US has a horrible visa system – as I can attest, despite only having to do it every 5 years – the EU countries could benefit from attracting talent by being more welcoming. So that is part of my mission as an MP and tech-entrepreneur. Any help and pointers is welcome.

mrtksn · 2025-08-20T19:02:48 1755716568

Hi, about the Schengen visa situation in Turkey you can find articles like these that describe how the appointments are on the black market(In Turkish but I'm sure AI will do good job translating):

https://www.bbc.com/turkce/articles/cz5r2l43kn2o

https://medyascope.tv/2024/01/22/vize-sorunu-kontrolden-cikt...

On the social media the anecdotes differ but some say they were able to get the visa appointments bots, others say it was agency personel selling it to them under the table. Maybe its really the agency personel, or maybe it's people running bots to snap appointments and sell those pretending to be from the agency - can't know for sure but there are multiple services where people purchase appointments unofficially.

In general the news situation in Turkey isn't very good as with the law enforcement but as you can see even BBC took notice.

Generally speaking, these visa agencies are very unfriendly and unreachable. They seem to just collect the money, provide no personalized help at all. My GF had some questions about her US visa application, we were not able to reach VFS Global. The phone numbers provided don't work, it's not even like taking long to speak with a human, the phone just gives you calling error.

She previously used the same company for her Schengen visa for a company event in Paris, of course unreachable again and no appointments available. Because she works at a French corporation, she was able to ask a high ranking French person in the company who has a contact with the French embassy and they arranged the appointment shortly.

sharno · 2025-08-20T16:16:45 1755706605

Whenever I'm filling a long form on an official website, I feel like I'm racing against an invisible clock because of this session time out thing that happened to me countless times.

dansimco · 2025-08-20T15:26:58 1755703618

I had this problem too last year. I found, at the time, it was the website was poorly managing the session in some browsers causing the timeout countdown to not be reset on activity. I had to find a windows computer and use microsoft edge I think (maybe it was chrome). But no browser on my mac would not have that issue.

dent9 · 2025-08-20T18:47:24 1755715644

> In the process she was also directed to a non-.gov website for something during the process, I thought she was getting scammed but no.

No clue if this specific instance if scam but such scams have indeed been done before

https://www.bbc.com/news/articles/cdr56vl410go

> According to Ablakwa, a locally recruited staff member and "collaborators" were allegedly involved in a "fraudulent" scheme whereby they extracted money from visa and passport applicants.

> It is alleged that the scheme consisted of creating an unauthorised link on the embassy's website to redirect visa and passport applicants to a private firm where they were "charged extra for multiple services" without the knowledge of the foreign ministry.

> Ablakwa added that the staff member "kept the entire proceeds" in their private account, and that the scheme had been going on for five years.

> Applicants seeking visas were charged unapproved fees ranging from almost $30 (£22) to $60 by the private firm.

paganel · 2025-08-20T09:43:28 1755683008

The hard truth of it all is that both the US and (partially) the EU don’t want to make this easier because seeing as wanting “outside” people is now a political liability. You may want to adjust your expectations around that.

mrtksn · 2025-08-20T09:55:28 1755683728

Turkish tourist are desired, Turks love spending money on restaurants and activities especially since the prices in Turkey have become more expensive than most of the EU. Greeks even introduced special non-Schengen on-arrival visa valid on the Greek islands especially for the Turks. Besides that, EU has "green passport" exception for the Turkish nationals, where they can travel visa-free on this kind of passport that is provided to individuals that meet certain criteria and millions of such passports were issued.

The rejection rates are also not bad and EU has a "return agreement" with Turkey, which is designed to keep the middle eastern refugees in Turkey(essentially, if you come from Turkey EU can send you back to Turkey right away ).

Crime rates for Turks show up among the lowest ones, unlike others from the region. So I don't think that EU is trying to reduce visas for Turks.

rat9988 · 2025-08-20T10:38:05 1755686285

You are looking at it from Turkish perspective unfortunately.

mrtksn · 2025-08-20T10:44:48 1755686688

I am EU citizen, I happen to know the Turkish perspective only because spent some years in Turkey and in fact it is the Turkish perspective that that EU doesn't want them and intentionally makes things harder but the moment you look at what's actually going on you see that this is not the case, just a Turkish fantasy about the "evil West and snobby Europeans". Considering that last year 50K Turks applied for asylum in EU and another 100K overstayed their visa, IMHO EU can be considered pretty generous actually with only 15% rejection rate since Turkey is the 2nd country with most applications after China.

https://home-affairs.ec.europa.eu/news/visa-applications-rea...

https://ec.europa.eu/eurostat/statistics-explained/index.php...

jimz · 2025-08-20T11:59:01 1755691141

B-visa rejection rate for Turkey in FY24, as per the US State Department, was 19.78%, btw. https://travel.state.gov/content/dam/visas/Statistics/Non-Im...

peterfirefly · 2025-08-20T15:20:03 1755703203

[flagged]

mrtksn · 2025-08-20T15:43:07 1755704587

>I'm Danish and we have lots of Turks. They are generally much nicer than the Danes but almost all of them are dunces

That's rich coming from someone who doesn't understand what the Schengen visa is about. FYI it's not about settling in Denmark, it's for up to 90 days stays in 180 periods for tourism and business purposes.

But hey, the inventors of of the mRNA vaccine are both Turkish immigrants to Germany and there are plenty of other quite successful Turkish immigrants in all kind of industries and the academia. Maybe the problem isn't Turks but you? Thank god your racism isn't shared by that many Europeans.

peterfirefly · 2025-08-20T19:43:28 1755719008

There is clearly something wrong with you.

mrtksn · 2025-08-20T21:46:53 1755726413

is this how you cope with your aging in front of a computer?

lazide · 2025-08-20T12:35:02 1755693302

The US gov’t has been actively targeting CANADA, one of the countries historically closest trading partners and allies.

Maybe in the EU it’s all good, but expect a lot of turbulence in the US.

eviks · 2025-08-20T10:42:21 1755686541

That doesn't explain the same poor operational quality before it became a liability

supportengineer · 2025-08-20T15:26:11 1755703571

>> the system just kick her out

The "waterfall model" is a toxic way of thinking that pervades corporate management. Simplistic minds can't fathom any states other than "done" or "not done". Corporations are determined to crush the human soul. That is why it's not a progressive series of forms, saving your progress all along.

smithkl42 · 2025-08-20T17:40:55 1755711655

More-or-less agreed about the waterfall model, but you can't blame horrific US government website performance on "corporations" or "corporate management". This is precisely the sort of thing that would get you fired in any real-world corporation that wants to survive, and it's precisely the fact that you can't get fired by the federal government that allows this sort of thing to continue.

testdelacc1 · 2025-08-20T07:32:08 1755675128

Another data point - 5he Indian visa system is similar. The official website ending in .gov.in, which is hard to find, offers a visa for $10 and minimal hassle. The scam websites, with better SEO sell the same shit for $80. They’re just proxying your application to the real website and pocketing the difference.

It would be good if the Indian government could block the scammers but I guess it’s a lower priority for the moment.

somenameforme · 2025-08-20T12:54:08 1755694448

Not sure if this is the case for India, but I've experienced similar situations for other countries, but the 'scam websites' actually provided a real service - if you needed some ultra-urgent processing (like you only realized you needed a visa to this country before boarding a flight, once you were already at the airport check-in...) they were able to provide 30 minute approval, whereas the official site's accelerated processing was 24 hours.

So obviously the only way they could to this is with government contacts meaning the government themselves could already do it, but a lot of immigration stuff everywhere is full of people taking kickbacks.

testdelacc1 · 2025-08-20T17:33:06 1755711186

No the scammers were slower than the official Indian website.

sumedh · 2025-08-20T08:41:54 1755679314

The scam websites are probably owned by someone who works in the Indian govt.

datadrivenangel · 2025-08-20T14:01:40 1755698500

This was the case with Ghana. The Embassy in the US had an unofficial offical partnership with an expediter scam (charge more for faster shipping, looks very official). They fired the whole visa staff when it finally came to light. Probably because someone forgot to let their manager's manager in on the scam.

p3rls · 2025-08-20T11:19:29 1755688769

Almost certainly, entire industries have been given over to indian scammers and their government allies.

cyanydeez · 2025-08-20T12:04:57 1755691497

Modhi, for one

tonyhart7 · 2025-08-20T13:55:29 1755698129

damn bro, how bad situation on there????

I know that Indian scam stereotype is racist and bad but how much it is "that bad"

bluGill · 2025-08-20T12:31:21 1755693081

I found the real website, but the application never went through, always some issue. My boss told me which service to use and everything just worked. (I could expense that service so cost didn't bother me)

ghaff · 2025-08-20T15:53:43 1755705223

My understanding is that India visa processing improved quite a bit. Back when I was speaking internationally quite a bit, I actually had to cancel trips to India on two separate occasions because of delays in getting visas. (Once was under the old visa system and the other was because of delays in switching to a new system. Both times were through a visa expediting service.)

ChrisRR · 2025-08-20T11:08:51 1755688131

I'm not too familiar with network side stuff. What would a port scan be able to detect that would indicate that you're a scammer?

Thorrez · 2025-08-20T12:03:16 1755691396

Just a guess, but maybe a typical bot has a webserver, ssh server, some other servers running on the same machine, whereas a typical Visa applicant doesn't.

immibis · 2025-08-20T14:03:32 1755698612

Or a browser automation server (Marionette/CDP). I seem to remember watching a presentation where it was mentioned you could detect them this way, <s>but I don't remember where or what it was called.</s> this one: https://www.youtube.com/watch?v=4nZD6ee2Xo8 (WHY2025: Stealth Web Scraping Techniques for OSINT)

dns_snek · 2025-08-20T08:09:59 1755677399

Huh, how do you imagine that would work? This "scan" is happening inside client-side javascript, delivering the file through a proxy wouldn't "detect" anything about the proxy.

JosephRedfern · 2025-08-20T08:27:00 1755678420

I imagine it may not be a proxy in the true sense, but a headless browser that's "proxying" the application process rather than the network traffic itself.

alistairSH · 2025-08-20T09:44:12 1755683052

Proxy is being used in the traditional sense here. It’s common for a business (scam or legit) to handle visa applications on behalf of customers.

jaimehrubiks · 2025-08-20T06:56:44 1755673004

This is a very clever answer.

actionfromafar · 2025-08-20T07:44:53 1755675893

If the proxy scams are just a little clever, they'll run the proxy on an another IP.

1oooqooq · 2025-08-20T12:18:33 1755692313

it's riddled with scams, and thinking any of this will detect any of the things you mention is very foolish, native and show a total lack of understanding of the scams. of you think using a proxy is essential for visa scam, i would even know where to begin to correct you.

it's one hundred per cent clueless privacy invasion. they are probably also opening ports via other means and using that for side channel ID like Facebook does.

just like any other documentation scam, the only weak point is on the "last mile" that's why you will always have a human interviewer.

the visa process is abusive and unpractical because people will work around any hurdle and their kpi will never be affected no matter how crappy they manage to make to whole process. or how many doge kids implement useless privacy invasion tech just because.

karel-3d · 2025-08-20T09:35:13 1755682513

It's coming from a F5 script, which is a company that sells anti-bot protection amid other things. (It's coming from obfuscated script at /TSPD, which is a F5 thing.)

https://www.f5.com/

karel-3d · 2025-08-20T09:46:42 1755683202

TS seems to be short for TrafficShield (a product of some company F5 acquired in early 2000s) and PD seems to be Proactive Defense (?)

jpeggtulsa · 2025-08-21T03:15:36 1755746136

Isn't F5 the company that makes nginx?

wlonkly · 2025-08-22T14:34:10 1755873250

That bought nginx, but yes!

karel-3d · 2025-08-21T15:00:24 1755788424

I didn't know that! But apparently yes

b3lvedere · 2025-08-20T11:38:23 1755689903

"Since looking into it, I noticed that uBlock Origin already has the default list "Block Outsider Intrusion into LAN" but it wasn't enabled."

Never knew that this existed. Thank you!

nerflad · 2025-08-20T13:32:37 1755696757

Checking out the initial request on github for this feature I wonder why is this necessary? What access to the local network does the browser provide, or need to provide, and why isn't this something developers are more concerned about? I had a feeling this was possible as I see lots of mdns requests when I connect to certain things running sockets.

https://github.com/uBlockOrigin/uAssets/issues/4318

dannyw · 2025-08-20T15:14:36 1755702876

There are certainly use cases, but whether they’re warranted is a good question.

One popular router maker offers a ‘magic URL’ (domain name) that scans your network for the gateway management page, and redirects. It’s not necessary, but it certainly helps novice users. Having worked in IT support,

I’ve also purchased hardware devices that have a web management UI; which connects directly instead of proxying through a cloud.

Ultimately this is probably one thing that should be behind a permission request (like webcam access), but it’s not a feature without value.

lol768 · 2025-08-20T13:49:44 1755697784

It's being looked at.

https://bugzilla.mozilla.org/show_bug.cgi?id=1481298

theyinwhy · 2025-08-20T18:13:06 1755713586

7 year old ticket updated and prioritized because of https://localmess.github.io/

sitkack · 2025-08-21T00:22:17 1755735737

This is how it always is with Firefox, you hit some bug and then find that it was entered YEARS ago, while they burn focus on things like Pocket.

adastra22 · 2025-08-20T15:44:33 1755704673

I’m flabbergasted that this is even allowed. Who thought it was a good idea to allow any web page you visit to access your local network?

johncolanduoni · 2025-08-20T15:52:22 1755705142

Internal apps on non-private IP addresses occasionally use this. There is a standard called Private Network Access[1] that requires these requests to have preflights like CORS requests. Only Chrome has implemented it so far.

[1]: https://wicg.github.io/private-network-access/

adastra22 · 2025-08-20T16:50:05 1755708605

Why though? What is the use case that demands this? It'd better be a real pressing need because the security risks are immense and obvious. This is a backdoor to every network firewall.

johncolanduoni · 2025-08-21T03:12:46 1755745966

It’s more that it wasn’t prevented back when the web was first coming together, because security wasn’t on almost anyone’s minds at all. There wasn’t a hole added at some point; it’s just that browsers didn’t specifically block domains that resolve to public IPs from accessing domains that resolve to private IPs.

Realistically, it’s a backdoor to every network firewall that has existed for the entire era in which browsers were used in “secured” internal networks also connected to the internet. Everyone has either designed with it in mind, or gotten lucky that nobody tried to use it on them for like 30 years. I think it’s good to put away this footgun, but there’s no useful blame to assign here.

adastra22 · 2025-08-21T14:46:07 1755787567

i thought it was prevented by standard browser cross-domain security checks. Thats why I'm so surprised.

johncolanduoni · 2025-08-22T03:05:57 1755831957

Requests that need a CORS preflight will fail with any browser from the last 20 years, yes. The private IP addresses are not any more vulnerable than `www.google.com` is from `www.notgoogle.com` for cross-origin policy (subdomain-sensitive policies have a small extra vulnerability). But you’re right that doing this kind of thing without nefarious intent is an insane edge case and it should be opt-in. People spray `Access-Control-Allow-Origin: *` like it’s DDT in the 50s and half ass security in general when it’s on an intranet, so an extra guardrail is still worth it.

psd1 · 2025-08-20T19:46:41 1755719201

I'm hazy on the details, but:

Home Assistant has a well-known public name that opens your local instance. On first access, you need to give it the name or ip of your instance, which is saved in browser storage. This supports deep links into your config from forum posts.

My mum also had a shitty D-Link wifi mesh device, which was packaged as an appliance. I cannot speak lowly enough about that garbage device, but then, I am not really the target market. iirc it had something similar; a public dns name for local appliance mgmt.

adastra22 · 2025-08-21T14:48:35 1755787715

How is that the same thing? That is a DNS entry that resolves to an internal IP. That lets a user explicitly type a domain and get something internal. That wouldn’t allow cnn.com to ports scan my fridge.

b3lvedere · 2025-08-21T21:09:25 1755810565

I remember Fritzbox devices doing the same. Wasn’t a real problem until someone actually hijacked the fritz.box domain.

balamatom · 2025-08-20T14:55:33 1755701733

Massively improved my security posture with this. Thanks all!

buyucu · 2025-08-20T15:40:26 1755704426

Likewise I didn't know it existed, but it was enabled on my laptop and mobile browsers.

dd_xplore · 2025-08-20T11:56:56 1755691016

Is that available in lite version too? Now that the origin js being phased out

LarMachinarum · 2025-08-20T14:44:47 1755701087

… or you can instead phase out those browsers who try to force blocker restrictions i.e. spyware on you (e.g. chrome and such), and use one of the browsers where you can use the full-featured (not "lite") uBlock Origin instead, e.g. Firefox.

Filligree · 2025-08-20T15:37:33 1755704253

Firefox might be an okay browser, but that would imply supporting Mozilla.

I've been meaning to switch to Vivaldi. Just as soon as the onboarding dialog stops crashing.

Rastonbury · 2025-08-20T18:31:54 1755714714

I wonder how bad does Mozilla have to be that you have to continue using Chrome without ublock?

Filligree · 2025-08-21T10:25:14 1755771914

Worse than it is now, I suppose.

tos1 · 2025-08-21T06:49:58 1755758998

I'm curious: What's your reasons for not wanting to support Mozilla?

Filligree · 2025-08-21T10:41:31 1755772891

I disagree with their politics, I'm concerned by the multiple privacy incidents, and I generally refuse to support them until they refocus on Firefox instead of all the other stuff they're doing.

If they worked only on Firefox, I'd have nothing against them. As it stands, I can't even donate to Firefox if I want to.

daveidol · 2025-08-20T12:24:12 1755692652

It’s only being phased out on Chrome, by Google.

ddlsmurf · 2025-08-20T13:25:49 1755696349

Yes, to make us safer, now you enable developer mode and disable signature checking to install it locally, thanks Google

maleldil · 2025-08-20T14:03:52 1755698632

Soon, you won't be able to install it locally because the API it relies on will no longer be available. Use Firefox.

Bnjoroge · 2025-08-20T15:59:25 1755705565

Or Microsoft Edge

maleldil · 2025-08-20T18:35:22 1755714922

Microsoft will eventually (TBD) remove Manifest v2 support from Edge, too[1].

> Manifest V2 extensions will no longer function in Microsoft Edge, even with the use of enterprise policies.

[1] https://learn.microsoft.com/en-us/microsoft-edge/extensions/...

fc417fc802 · 2025-08-20T19:57:19 1755719839

Isn't that because Edge has been a wrapper around Chromium for a while now? Presumably support will follow upstream.

Ntrails · 2025-08-20T17:31:55 1755711115

I thought Edge also did not support true ad blocking?

nicce · 2025-08-20T12:02:54 1755691374

You can't change browser? Or is there something bigger happening?

surajrmal · 2025-08-20T14:37:21 1755700641

Not everyone wants to change browsers.

LarMachinarum · 2025-08-20T14:50:24 1755701424

then again, if the makers of one big browser (and via there also the derived browsers) start force-shoving spyware upon you (by restricting blockers), it comes down to a decision of how you set your priorities. Personally, It's a clear cut red line, but you do you.

bilalq · 2025-08-20T13:35:53 1755696953

Just checked, and it seems like it is. Not enabled by default for some reason.

buyucu · 2025-08-20T15:40:52 1755704452

It is not being phased out for Firefox.

M95D · 2025-08-20T06:54:35 1755672875

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com, connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work.

Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew and it contains 90% of websites I visit.

On my system https://ceac.state.gov/genniv/ tries to connect to captcha.com, google-analytics, googletagmanager, 127.0.0.1 and "burp" (a local hostname that doesn't exist in my network). Interestigly, the browser console doesn't list connection attempts to localhost or burp. If I allow 127.0.0.1 and "tcpdump -i lo", I see connections to port 8888, which isn't open.

noja · 2025-08-20T07:12:37 1755673957

How does uMatrix handle the Facebook tracking pixel, or the replacement which is the Conversions API Gateway?

This is a container that FB gives you to host that lives under your domain (it can be your main domain) that slurps up user data and sends it to Facebook from the server side. You embed some JS in your website, and they hoover up the data.

M95D · 2025-08-20T07:57:57 1755676677

It doesn't handle it. Anyway, there's no way to know what a website does on the server site. Even a completely static website could be sending the server logs somewhere.

There are options to not load JS, images, XMLHttpRequests, frames, cookies, for each site, but it doesn't list individual files.

noja · 2025-08-20T09:44:14 1755683054

Then why use it? They're number one.

M95D · 2025-08-21T07:41:33 1755762093

No other extension is giving me control like uMatrix does, even considering it's limits.

thaumasiotes · 2025-08-20T07:22:20 1755674540

> On my system https://ceac.state.gov/genniv/ tries to connect to captcha.com, google-analytics, googletagmanager, 127.0.0.1 and "burp" (a local hostname that doesn't exist in my network).

That will be this burp: https://portswigger.net/burp/documentation/desktop/tools/pro...

Sounds like they don't want you to analyze their site.

user070223 · 2025-08-20T07:56:49 1755676609

uMatrix is archived and I think uBlockOrigin is now advised to use(which incorporate uMatrix by enabling advanced settings)

For those who want to try blocking more stuff you can enable hard mode and bind relax blocking mode keyboard shortcut

I'd recommend also enabling filter lists(I advice yokoffing/filterlists and your region/language)

https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

M95D · 2025-08-20T09:08:03 1755680883

But uBlockOrigin UI is so much worse...

Besides, uMatrix works fine. It's that kind of program that doesn't need any updates.

rapnie · 2025-08-20T14:05:24 1755698724

I would really like an intuitive UI for people who don't want to do 'a project' to get their config tight.

M95D · 2025-08-21T08:01:22 1755763282

But it is intuitive... I don't know what you mean.

You can't manage a whitelist with a single big red on/off button, if that's what you want.

akimbostrawman · 2025-08-21T09:29:00 1755768540

You technically can, that is what community website rule Recipe are for.

M95D · 2025-08-22T09:40:48 1755855648

I didn't knew community/public whitelists exist, nor any browser extension that uses whitelists and blocks all other connections by default, like uMatrix does. Do you have any examples?

account42 · 2025-08-20T09:14:36 1755681276

Until uBO has an even remotely usable interface for this use case people (including myself) will continue to use uMaxtrix or forks of it instead.

freedomben · 2025-08-20T17:47:49 1755712069

Amen. I would (and did!) switch browsers to continue using uMatrix rather than go without (and uBO is not a replacement)

Semaphor · 2025-08-20T08:22:56 1755678176

I reluctantly switched to only uBo because of uM bugs. But the UI/UX is just a huge step backwards to enable mobile usability.

OJFord · 2025-08-20T08:50:13 1755679813

uBO advanced settings still isn't as flexible as uMatrix was though, fwiw. (I did give in and switch in the end though.)

aembleton · 2025-08-20T09:30:20 1755682220

With uBO I can't block cookies by domain.

quietfox · 2025-08-20T07:21:13 1755674473

It seems to try to check if you are using the Burp Suite on their web application.

samsonradu · 2025-08-20T06:57:03 1755673023

How does it manage to hide the requests to 127.0.0.1 from the network tab?

worthless-trash · 2025-08-20T07:35:00 1755675300

The requests are not made, because some operating systems prevent this.

If you're on OSX, the permission to "discover on the local network" prevents it from happening ( System Settings -> Privacy & Security -> Local Network -> yourbrowser )

Could also be 'network' permissions on firefox ( Go to Settings > Privacy & Security > Permissions ) which is on a per site level, but iirc that could be set site-wide at some point.

The other browsers likely have similar configs, but this is what I have found.

snowwrestler · 2025-08-20T14:09:17 1755698957

Looks like this is new to MacOS 15 Sequoia, as I don’t see a Local Network option in Sonoma.

M95D · 2025-08-20T07:11:44 1755673904

I have no ideea. Possibly that's a limitation of Chrome+Firefox developer tools (I get the feeling it's the same code)?

But I found what "burp" is: https://portswigger.net/burp/communitydownload

culturestate · 2025-08-20T07:37:47 1755675467

It seems like they only make the localhost requests on your first visit. If you open devtools in incognito mode (or just clear the cookies) before accessing https://ceac.state.gov/genniv/ you should see those 127.0.0.1 attempts as ERR_CONNECTION_REFUSED in the network tab.

Somewhat more worryingly, Little Snitch doesn't report them at all, though that might just be because they were already blocked at the browser.

inferiorhuman · 2025-08-20T09:25:16 1755681916

This is what I see.

https://i.imgur.com/lvjg2YQ.png

hoherd · 2025-08-20T10:30:48 1755685848

> 400_random_url_with_numbers_403

That looks so much like test code that was shipped to prod.

Searches for that string on GH does return results.

sylware · 2025-08-20T09:25:02 1755681902

Whitelisting seems to be the way to go. With IPv6 and OS generated IPs (up to what the ISP domestic router allows) could be very efficient.

lordofgibbons · 2025-08-20T11:31:44 1755689504

How and why do browsers allow this? Why wouldn't the browser ask for permission in the same way that it does for Microphone access?

It's insane to allow any random website to port scan my LAN. If this wasn't a "feature", I would have considered this a high severity vulnerability

JJJollyjim · 2025-08-20T11:47:01 1755690421

Chrome doesn't allow it - local network services have to opt-in to being fetchable from public sites (https://github.com/WICG/private-network-access), although they're replacing it with a user-permission-based approach (https://github.com/WICG/local-network-access).

(There is some language online suggesting PNA has not actually shipped, but I experienced it myself in stable Chrome several years ago, so I am unsure of the current state).

Firefox doesn't implement either approach -- I assume this is indicative of their lack of development resources.

adithyassekhar · 2025-08-20T14:42:07 1755700927

> Firefox doesn't implement either approach -- I assume this is indicative of their lack of development resources.

Since ublock had this as a feature for a long time, I'm sure they are aware of it. Unlike other non funded oss projects, Firefox can't and shouldn't shield themselves with this lack of development resource excuse. They have millions.

johncolanduoni · 2025-08-20T15:57:13 1755705433

A trillion dollar company (that loves huge vanity projects) gave up on maintaining a browser because it was too much work and just ship a Chrome fork now. I won’t defend Mozilla’s allocation of their resources, but even if they put it all into the “right” Firefox features the web platform is too complex and too much of a moving target for a company with mere centi-million revenues.

adithyassekhar · 2025-08-20T17:21:40 1755710500

To be honest they weren't trying to build a better browser. Atleast not anymore, earlier edge was nice. They just wanted more data for ads / money. Going the chrome way was more profitable for them.

I thought Mozilla was different.

sitkack · 2025-08-21T00:24:11 1755735851

They are also firing as many senior folks as possible. You should revisit what ever argument you are trying to make.

johncolanduoni · 2025-08-21T03:04:48 1755745488

Microsoft? Were they firing as many senior folks as possible in 2018 when they announced they would give up on EdgeHTML and Chakra? Or in early 2020 when it actually came together? That’s not my recollection of the FAANG-ish job market at the time these decisions were made.

If you meant Mozilla, they’re a total indefensible trashfire for sure. But I’m not convinced they could have succeeded with their resources.

e40 · 2025-08-20T12:00:06 1755691206

That extension has "Access your data for all websites" ... I really don't get how anyone can give that permission to anyone that isn't well known (a company with a lot on the line) or a person famous for their work (the uBO dev) who has stated he will never sell to anyone or do bad things.

"Hacks and Hops" doesn't even have a valid home page. The extension links to https://g666gle.me/ which does not exist. The domain name itself does not want to make me give access to all my data for all websites to them.

As nice as this extension seems, I would ever in a million years install it.

jeffbee · 2025-08-20T13:37:00 1755697020

Unfortunately this level of incoherence is almost universal on HN and similar forums. You'd have to be completely out of your mind to install this extension, but people for some reason believe they can install privacy. They got whipped into fearing nebulous online actors so much that they'll download FSB rootkits dressed as VPNs. The minimal set of actions a rational person would take after realizing they've been tricked into installing this extension is setting their entire PC on fire and then running it over with their car, while moving all of their bank accounts to new accounts, in person, and changing all of their passwords using a brand new device.

galaxy_gas · 2025-08-20T06:29:28 1755671368

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them

1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

meitham · 2025-08-20T06:56:29 1755672989

Madness! How do I harden my network against that?

bawolff · 2025-08-20T07:18:59 1755674339

Chrome is already in the process of killing it https://developer.chrome.com/blog/local-network-access

ahdanggit · 2025-08-20T09:16:42 1755681402

The company I work for has a legitimate service that runs on the loopback (it provides our web apps APIs for some device integration) hopefully its just as simple as the user accepting the prompt else we'll be drowning in support. We had to go the path of the local service because they killed NPAPI. I've been thinking about using web serial as an alternative but Firefox doesn't support it.

That being said, I think this is an overall win, hopefully Firefox implements it in a consistent manner as well.

ayewo · 2025-08-20T16:28:13 1755707293

How is your company's service started on the loopback interface? You bundle a web server that is installed alongside a native app?

galaxy_gas · 2025-08-20T18:13:17 1755713597

This how many of them work for transporting vs traditional old way of registering url scheme and requiring user interacts --- Discord, Blizzard net, Riot Client ... all localhost listener's that can interact

ahdanggit · 2025-08-20T17:30:05 1755711005

Roughly, yes. Customers (or more often, their IT department) runs our installer which installs the server as a windows service.

dns_snek · 2025-08-20T08:20:58 1755678058

Enable "Block Outsider Intrusion into LAN" filter list in uBlock Origin.

meitham · 2025-08-20T11:48:41 1755690521

Thank you!

ale42 · 2025-08-20T07:01:56 1755673316

You should actually harden your browser or PC... to block any unwanted requests. Apparently some browser extensions can do that.

bmacho · 2025-08-20T09:35:54 1755682554

It would be the job of the operating system to give or take away the ability of your browser to access your local network. But you can run your browser in a container/vm and disable localhost. (And use a separate browser for localhost only if you need it.)

ahdanggit · 2025-08-20T09:12:56 1755681176

my bank did this on the site they sent me to in order to activate my new card.

dns_snek · 2025-08-20T08:11:52 1755677512

The "port scan" just seems to be a local connection to 127.0.0.1:8888. I don't know what purpose it serves on this page, but our government websites often use this technique to communicate with native software for digitally signing documents.

Are you seeing connection attempts to other IPs?

junon · 2025-08-20T08:55:37 1755680137

Might also be card readers, debug servers, etc.

Could also be incompetence :D until I fixed it, deploying from my local machine rather than CD resulted in one of the baked in URLs being localhost rather than the public host on the project I'm working on now. Their local development server might just be at port 8888. Wouldn't surprise me.

dns_snek · 2025-08-20T10:38:09 1755686289

I looked at the website again and noticed that the request paths looked odd, one of them being `/400_random_url_with_numbers_403`. I googled that and it looks like it's part of a client-side bot detection script that's testing something, the explanation isn't very informative.

https://my.f5.com/manage/s/article/K000138794

> These requests are caused by the bot profile to test the different browser capabilities.

> 'http://127.0.0.1:xxxx' request is a call to the localhost/client machine, which is normal when trying to protect assets like end-server using ant-bot defense. It does not have any impact regarding application page load.

tifkap · 2025-08-20T09:22:17 1755681737

This is most likely an attempt to connect to a webserver on your own device to collect data and/or do tracking.

Remember back in June when Facebook/meta got caught tracking users trough a webserver on Android phone thought Messenger and Instagram? Same thing.

See: https://news.ycombinator.com/item?id=44169115 and https://news.ycombinator.com/item?id=44175940

dannyw · 2025-08-20T15:19:37 1755703177

Why do you say that’s most likely?

This is a common pattern for connecting to smart cards / hardware security devices. Probably a service or hardware that’s run on official CBP machines that should be disabled for prod, but forgot.

77pt77 · 2025-08-20T15:44:42 1755704682

This is by far the most likely reason.

I personally use pages that authenticate via a smartcard using this exact scheme.

There is a Java "plugin" that is nothing but a mini webserver that listens on a specific port and performs authentication.

darkwater · 2025-08-20T12:26:04 1755692764

How are you so sure?

gethly · 2025-08-20T08:08:59 1755677339

Just a little side note - in this context, it makes sense if the website tries to connect to a local port because you might be running a card reader(ie. terminal). This is how it works with some(all?) EU countries that have a chip in their ID cards, or even vehicle registration cards, which you can use to access sensitive information or perform certain administrative tasks on government websites.

Although, from personal experience, it used to require java and it worked only on internet explorer and since it has been retired and replaced with chromium, i am not sure what is the way to make it work nowadays, as i have not been able to figure out to use it when i needed the last time.

layer8 · 2025-08-20T13:17:18 1755695838

It requires installing a local service that bridges between the browser and the smartcard driver (what Java applets did in earlier years). The web app then communicates with the service via requests on localhost. The card-specific driver and bridge service are often bundled together for installation.