Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Native File System API allows web apps to save directly to files

web.dev

Post reply on HN
Print view View original

41–50 of 155 posts

Re: The Native File System API allows web apps to save directly to files

#41

Post by armada651 »

cromwellian wrote: post #33
jaredcwhite wrote: post #7

There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…

This is just a variation on as far as read-access is concerned. For write access, it certainly could be used to store malware on a user's system, but so can "Save As" or clicking a link with HTTP headers that triggers a download. Basically, the "Save As" dialog from browsers have the same issues. It is not downloading malware that is the issue, it's executing it. So unless you can trick the user into navigating to an…

It's important not to forget about drive-by DLL injection when making the "execution is the problem" argument.

Lots of executables on Windows link to DLLs that are not protected by the "KnownDLLs" protection. This means that if you can save a malicious DLL next to that executable you can make a perfectly legitimate executable run malicious code.

I haven't read into the API yet to determine how it protects against this, but it's definitely more nuanced than the argument you're making.

Re: The Native File System API allows web apps to save directly to files

#42

Post by snvzz »

cromwellian wrote: post #35
cromwellian wrote: post #33

Earlier quoted context omitted.

This is just a variation on as far as read-access is concerned. For write access, it certainly could be used to store malware on a user's system, but so can "Save As" or clicking a link with HTTP headers that triggers a download. Basically, the "Save As" dialog from browsers have the same issues. It is not downloading malware that is the issue, it's executing it. So unless you can trick the user into navigating to an…

BTW, for anyone who has children who are doing distance learning during COVID, the vast majority of school districts are using the Web, not native apps on desktop or iOS for the kids to do collaborative learning and submit work. From what I've seen, they're basically creating APIs like this that set on top of GDrive, DropBox, and File Upload / Server-directed File-Save. So in essence, all this new API is mostly buyin…

>So in essence, all this new API is mostly buying you is offline mode.

There's been, for a long time, local storage APIs.

This is filesystem access, which is very different.

Re: The Native File System API allows web apps to save directly to files

#43

Post by sayhello »

jaredcwhite wrote: post #7

There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…

I worked on this. The quote is true, in all honesty. Same as downloading and running applications from the web.

We do our best to make sure the scenario listed doesn't happen. For instance, on Windows, after a writer is closed, we apply the Mark-of-the-Web, apply SafeBrowsing checks and finally call a system API which may trigger an anti-virus check.

On the Mac, we apply the equivalent of Mark-of-the-Web. You may have noticed that when you open the file, sometimes it asks you to ensure the provenance of the file?

Basically, it's a similar procedure as for file downloads.

Edit:

I forgot to say that "sensitive" directories are not allowed. Think C:\Windows, etc.

https://source.chromium.org/chromium/chromium/src/+/master:c...

Re: The Native File System API allows web apps to save directly to files

#44

Post by notaplumber »

Browsers having unfettered access to users files is something which should be mitigated against on all platforms, not fleshed out into an ill-conceived feature, it goes in complete contrary to browser sandboxing efforts in Chrome itself for different process types (renderer/gpu/utility), but also work like OpenBSD has done with pledge(2)/unveil(2).

On OpenBSD, all processes of chromium, including the main browser process are tightly pledged and unveiled by default, write access to the users home directory is limited to only a few paths (~/Downloads), and a few config directories. As a consequence, users are rather forcibly taught safer usage pattern of copying files into the unveiled paths when uploading, which as Bob Beck alludes to in his slides below, is a reasonable compromise to every website having access to your ssh keys.

https://www.openbsd.org/papers/bsdcan2019-unveil/mgp00022.ht...

https://github.com/openbsd/ports/tree/master/www/chromium/fi...

Re: The Native File System API allows web apps to save directly to files

#45

Post by sayhello »

maple3142 wrote: post #17

It seems like I can replace an Electron app which only needs (a part) of File System access to browser.

Precisely. You'll also gain the ability to update your apps cheaply (via the web) and bonus security points by not being beholden to Electron updates.

Re: The Native File System API allows web apps to save directly to files

#46

Post by sayhello »

0xy wrote: post #5

Every time Chrome adds a new API it is nearly always abused by ad networks and tracking companies to fingerprint users. If you're bored one day you should consider reverse engineering some ad network code. You'll be stunned at the insidious practices used.

We made sure that the activation of the API is gated by:

1) User Activation checks 2) When access to the file system is requested, a File Picker is necessary 3) When the API is in use, there are plenty of indication that it's being used

We put a lot of thought in Privacy and Security, as we do for all APIs.

Re: The Native File System API allows web apps to save directly to files

#47

Post by ffpip »

chromedev wrote: post #13
jaredcwhite wrote: post #7

There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…

Do we need to just create a dummy proof OS for people that are oblivious and click yes to everything? Otherwise, why not give people choice? I mean you could create a pop up asking people for their passwords today on any browser, so how is adding a feature that requires permission any different?

> why not give people choice ?

https://news.ycombinator.com/item?id=24403392

https://news.ycombinator.com/item?id=20044430

Re: The Native File System API allows web apps to save directly to files

#48

Post by kyriakos »

nuker wrote: post #8
jaredcwhite wrote: post #7

There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…

It won't work on iPhones, which means no one will use it, I hope.

Push notifications don't work on iPhones and yet a lot of sites use them, some in a spammy way but some I actually allowed on my phone and are quite useful.

Re: The Native File System API allows web apps to save directly to files

#49

Post by sriku »

sayhello wrote: post #46
0xy wrote: post #5

Every time Chrome adds a new API it is nearly always abused by ad networks and tracking companies to fingerprint users. If you're bored one day you should consider reverse engineering some ad network code. You'll be stunned at the insidious practices used.

We made sure that the activation of the API is gated by: 1) User Activation checks 2) When access to the file system is requested, a File Picker is necessary 3) When the API is in use, there are plenty of indication that it's being used We put a lot of thought in Privacy and Security, as we do for all APIs.

If I disable the file system API, can an "is file system API available" check be used as a bit to fingerprint my browser?

Re: The Native File System API allows web apps to save directly to files

#50

Post by or-gate »

sayhello wrote: post #46
0xy wrote: post #5

Every time Chrome adds a new API it is nearly always abused by ad networks and tracking companies to fingerprint users. If you're bored one day you should consider reverse engineering some ad network code. You'll be stunned at the insidious practices used.

We made sure that the activation of the API is gated by: 1) User Activation checks 2) When access to the file system is requested, a File Picker is necessary 3) When the API is in use, there are plenty of indication that it's being used We put a lot of thought in Privacy and Security, as we do for all APIs.

> We put a lot of thought in Privacy and Security, as we do for all APIs.

but somehow, data is heavily harvested thru browsers(chrome), apps(android). Do you even test your APIs with a sample audience, like real tech ignorant people and see how they are blind to all those and just click yes, and don't care?

Post reply on HN