Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Native File System API allows web apps to save directly to files

web.dev

Post reply on HN
Print view View original

81–90 of 155 posts

Re: The Native File System API allows web apps to save directly to files

#81

Post by daleharvey »

kissgyorgy wrote: post #78
sayhello wrote: post #43

Earlier quoted context omitted.

I worked on this. The quote is true, in all honesty. Same as downloading and running applications from the web. We do our best to make sure the scenario listed doesn't happen. For instance, on Windows, after a writer is closed, we apply the Mark-of-the-Web, apply SafeBrowsing checks and finally call a system API which may trigger an anti-virus check. On the Mac, we apply the equivalent of Mark-of-the-Web. You may hav…

I'm sure you worked hard and thought a lot about the security of this, but you have to be really arrogant to think that this will be fine because you thought about everything. I'm pretty sure this will open up a lot more possibilities for malware, viruses, harmful web pages than the convenience it will provide.

The alternatives arent that people just dont use it, the alternative is are that people download some random executable that has much larger security vector, ie some electron app that has unlimited file system access.

Re: The Native File System API allows web apps to save directly to files

#82

Post by viraptor »

cromwellian wrote: post #33
jaredcwhite wrote: post #7

There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…

This is just a variation on as far as read-access is concerned. For write access, it certainly could be used to store malware on a user's system, but so can "Save As" or clicking a link with HTTP headers that triggers a download. Basically, the "Save As" dialog from browsers have the same issues. It is not downloading malware that is the issue, it's executing it. So unless you can trick the user into navigating to an…

> It is not downloading malware that is the issue, it's executing it.

That line is very thin. Local DLLs, application configs setting path to executables, even desktop.ini (https://threat.tevora.com/usb-drives-desktop-ini-and-ntlm-ha...) and that's before we get into NTFS alternative streams and other really out there ideas.

If you can choose which path you download to, the user has lost. Even if they never actively execute the file.

Same on *nix. If you can add something to bashrc, or drop a new file in desktop autostart, who cares about the executable bit.

And sometimes you can point out bad ideas without reading the spec. WebUSB was that kind of bad idea even before someone figured out exactly how they can read one time codes from security dongles that way. (https://www.yubico.com/support/security-advisories/ysa-2018-...)

Re: The Native File System API allows web apps to save directly to files

#83

Post by im3w1l »

inetknght wrote: post #52
armada651 wrote: post #41

Earlier quoted context omitted.

It's important not to forget about drive-by DLL injection when making the "execution is the problem" argument. Lots of executables on Windows link to DLLs that are not protected by the "KnownDLLs" protection. This means that if you can save a malicious DLL next to that executable you can make a perfectly legitimate executable run malicious code. I haven't read into the API yet to determine how it protects against thi…

> This means that if you can save a malicious DLL next to that executable you can make a perfectly legitimate executable run malicious code. Some people install browsers onto a USB drive -- or even run a browser directly from their Downloads directory. Such people are easy targets for this type of thing.

Installers would be the most common I think.

Re: The Native File System API allows web apps to save directly to files

#84

Post by im3w1l »

snvzz wrote: post #42
cromwellian wrote: post #35

Earlier quoted context omitted.

BTW, for anyone who has children who are doing distance learning during COVID, the vast majority of school districts are using the Web, not native apps on desktop or iOS for the kids to do collaborative learning and submit work. From what I've seen, they're basically creating APIs like this that set on top of GDrive, DropBox, and File Upload / Server-directed File-Save. So in essence, all this new API is mostly buyin…

>So in essence, all this new API is mostly buying you is offline mode. There's been, for a long time, local storage APIs. This is filesystem access, which is very different.

I think adding a virtual file system to the local storage API's might be fine. One which cannot be mounted easily by non-technical users but has a viewer which allows dragging files into and out of it.

Re: The Native File System API allows web apps to save directly to files

#85

Post by kijin »

sayhello wrote: post #43
jaredcwhite wrote: post #7

There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…

I worked on this. The quote is true, in all honesty. Same as downloading and running applications from the web. We do our best to make sure the scenario listed doesn't happen. For instance, on Windows, after a writer is closed, we apply the Mark-of-the-Web, apply SafeBrowsing checks and finally call a system API which may trigger an anti-virus check. On the Mac, we apply the equivalent of Mark-of-the-Web. You may hav…

Which paths are "sensitive" depends on which other programs the user has installed. Would Chrome recognize ~/.mozilla as a sensitive path? How about adding arbitrary content to ~/.ssh/authorized_keys?

Re: The Native File System API allows web apps to save directly to files

#86

Post by giantrobot »

chromedev wrote: post #59
kitsunesoba wrote: post #11

Earlier quoted context omitted.

Seems like it can be disabled in flags for now, which I just went in and did. That flag is bound to disappear at some point though… might become necessary to wrap browsers in an isolating sandbox or VM just to be sure they can't touch things they're not supposed to.

It has a policy as well and will always allow you to disable it. No need for hyperbole.

"Will always" is a phrase Google does not know the meaning of.

Re: The Native File System API allows web apps to save directly to files

#87

Post by t0astbread »

I'm gonna throw an unpopular opinion out there: The real issue is not that phones or browsers have too much capabilities but rather that people fundamentally don't understand how to use computers. Locking things down and removing features doesn't really solve the problem just like wrapping your child in bubble wrap before crossing the street instead of teaching it to look both ways for cars doesn't solve the problem. Digitalization is being sold as a land of opportunities but no one ever tells people what the software they're using is actually capable of and how to control it. And that's why people vote for digital elections and accept all permissions and cookies and shrug mass surveillance off with "they know everything about me anyways".

Re: The Native File System API allows web apps to save directly to files

#88

Post by chromedev »

giantrobot wrote: post #86
chromedev wrote: post #59

Earlier quoted context omitted.

It has a policy as well and will always allow you to disable it. No need for hyperbole.

"Will always" is a phrase Google does not know the meaning of.

For filesystem access they are beholden to their enterprise users as well and Chromium still has a lot of open source developers that aren't simply looking out for Google's best interests. If they became overly hostile, then I'm sure we'd see a fork at some point. I'm not saying they are perfect, but a lot of Chromium hate is unfounded and exaggerated.

Re: The Native File System API allows web apps to save directly to files

#89

Post by chromedev »

anaganisk wrote: post #73
chromedev wrote: post #61

Earlier quoted context omitted.

Data is easily harvested in Firefox and Safari too

Exactly, the focus must be on trying to mitigate it, not make it more easier.

Should they block online email providers too because someone might send a phishing email?

Re: The Native File System API allows web apps to save directly to files

#90

Post by anhner »

sayhello wrote: post #45
maple3142 wrote: post #17

It seems like I can replace an Electron app which only needs (a part) of File System access to browser.

Precisely. You'll also gain the ability to update your apps cheaply (via the web) and bonus security points by not being beholden to Electron updates.

more like "you won't have a choice but to always use the newest version of the app"
Post reply on HN