The Native File System API allows web apps to save directly to files • Hacker News Board

Re: The Native File System API allows web apps to save directly to files

#91

Post by bad_user » Wed, Sep 09, 2020, 8:42 AM UTC

rainforest wrote: post #79

anoncareer0212 wrote: post #54

Earlier quoted context omitted.

The histrionics here are astounding considering they're about a _Save As_ dialog.

It appears I could use this to ask a victim to "select your downloads folder" to save files to and then steal or overwrite any file in it.

If the permissions system in place is clear and potent enough, I don't see the problem.

You can also ask people to simply download and install an app that can do whatever it wants.

It's 2020 and we still can't build web apps that can read and write to local files. Browsers are no longer useful just for reading text.

Re: The Native File System API allows web apps to save directly to files

#92

Post by chromedev » Wed, Sep 09, 2020, 8:43 AM UTC

snvzz wrote: post #69

chromedev wrote: post #58

Earlier quoted context omitted.

Which has policies that can be enabled to block it if necessary

Users click "accept" to make things work. Filesystem access is going to have nefarious consequences.

That's not how policies work. Schools, organizations and even home users can enable policies to block this feature altogether as well as many others:

https://cloud.google.com/docs/chrome-enterprise/policies/

Re: The Native File System API allows web apps to save directly to files

#93

Post by wdb » Wed, Sep 09, 2020, 8:52 AM UTC

Might not be appreciated opinion here but Personally, I think, the web starts to get feature parity in some way with Adobe Flash. Flash could do most of this back in the day and now the web is getting it too.

Re: The Native File System API allows web apps to save directly to files

#94

Post by eecc » Wed, Sep 09, 2020, 9:07 AM UTC

I’d feel safer if all applications could only access files tagged with an unique ID for the application.

But then applications will start asking access for all of $HOME and we’re back to square one

Re: The Native File System API allows web apps to save directly to files

#95

Post by imwillofficial » Wed, Sep 09, 2020, 9:09 AM UTC

saagarjha wrote: post #67

inetknght wrote: post #52

Earlier quoted context omitted.

> This means that if you can save a malicious DLL next to that executable you can make a perfectly legitimate executable run malicious code. Some people install browsers onto a USB drive -- or even run a browser directly from their Downloads directory. Such people are easy targets for this type of thing.

Running a browser from the downloads directory is unlikely to work correctly on macOS.

It’s funny you say this, because I did exactly this yesterday. I downloaded chromium and forgot I had not yet dragged it to my applications folder and I was running it for a few hours out of my downloads folder.

Re: The Native File System API allows web apps to save directly to files

#96

Post by imwillofficial » Wed, Sep 09, 2020, 9:13 AM UTC

pjmlp wrote: post #66

nuker wrote: post #8

Earlier quoted context omitted.

It won't work on iPhones, which means no one will use it, I hope.

In plenty of countries iPhone has 0% market share, the local companies don't care about iPhone support.

Name one.

Re: The Native File System API allows web apps to save directly to files

#97

Post by tinus_hn » Wed, Sep 09, 2020, 9:14 AM UTC

sayhello wrote: post #43

jaredcwhite wrote: post #7

There is no way this isn't going to open up massive security holes. Even if the browser puts up alert after alert, people are just going to randomly click buttons and then all of a sudden wonder why some random web app is deleting all their files and adding malware. And the spec docs aren't exactly reassuring. This is an exact quote! "This API could be used by websites to try to store and/or execute malware on the us…

I worked on this. The quote is true, in all honesty. Same as downloading and running applications from the web. We do our best to make sure the scenario listed doesn't happen. For instance, on Windows, after a writer is closed, we apply the Mark-of-the-Web, apply SafeBrowsing checks and finally call a system API which may trigger an anti-virus check. On the Mac, we apply the equivalent of Mark-of-the-Web. You may hav…

On Windows any directory where users start programs is a ‘sensitive’ directory. With of course the prime case the ‘downloads’ directory.

Re: The Native File System API allows web apps to save directly to files

#98

Post by imwillofficial » Wed, Sep 09, 2020, 9:15 AM UTC

chromedev wrote: post #88

giantrobot wrote: post #86

Earlier quoted context omitted.

"Will always" is a phrase Google does not know the meaning of.

For filesystem access they are beholden to their enterprise users as well and Chromium still has a lot of open source developers that aren't simply looking out for Google's best interests. If they became overly hostile, then I'm sure we'd see a fork at some point. I'm not saying they are perfect, but a lot of Chromium hate is unfounded and exaggerated.

AMP waves “hello”

Re: The Native File System API allows web apps to save directly to files

#99

Post by anaganisk » Wed, Sep 09, 2020, 9:15 AM UTC

kissgyorgy wrote: post #78

sayhello wrote: post #43

Earlier quoted context omitted.

I worked on this. The quote is true, in all honesty. Same as downloading and running applications from the web. We do our best to make sure the scenario listed doesn't happen. For instance, on Windows, after a writer is closed, we apply the Mark-of-the-Web, apply SafeBrowsing checks and finally call a system API which may trigger an anti-virus check. On the Mac, we apply the equivalent of Mark-of-the-Web. You may hav…

I'm sure you worked hard and thought a lot about the security of this, but you have to be really arrogant to think that this will be fine because you thought about everything. I'm pretty sure this will open up a lot more possibilities for malware, viruses, harmful web pages than the convenience it will provide.

Yeah, they sure thought about everything thats why ad networks abuse the hell out of every API they implemented to fingerprint people, like AudioContext Api, battery API and what not.

Re: The Native File System API allows web apps to save directly to files

#100

Post by anaganisk » Wed, Sep 09, 2020, 9:22 AM UTC

cromwellian wrote: post #57

ausjke wrote: post #3

Earlier quoted context omitted.

nowadays' security is that you have to manually grant permission, which for most people, esp non-technical people, they will normally just press Y, so yeah, the default sandbox protection will be gone for most people.

You have to do more than just hit 'Y', you have to navigate in a file chooser and pick the file to save, or write.

Sure why not, let me just create a blog post, with exact steps on how to make your windows more colorfull, and make users inject my DLLs into filesystem. The user will do exactly if i give him exact copy paste paths and commands. And voila.