POS systems printing directly to USB thermal printers
What are some interesting uses of WebUSB you have come across?
51–60 of 101 posts
Re: What are some interesting uses of WebUSB you have come across?
#52I can flash the firmware on my ergodox ez with it. That’s pretty wild
Re: What are some interesting uses of WebUSB you have come across?
#53I was looking into Android phone hacking and was surprised to discover https://webadb.com/ . It's a web equivalent of adb (Android Debug Bridge), which can install applications on a device connected over USB, among other things.
Very cool project but knowing how much access adb gives to your phone I wouldn't trust it unless you're self-hosting.
I've deployed an internal version of the upstream project (ya-webadb [1]) before. It can be built as a static site, and the upstream version publishes to GitHub pages, so it's really easy to self-host.
Re: What are some interesting uses of WebUSB you have come across?
#54This is cool, but both safari and firefox will not implement it: https://usefulangle.com/web-updates/post/80/firefox-decines-... I assume this is because of security concerns.
It should be an opt-in feature behind browser flag or only available for enterprise users IMO.
Re: What are some interesting uses of WebUSB you have come across?
#55I think flipper might use it.
Re: What are some interesting uses of WebUSB you have come across?
#56Earlier quoted context omitted.
Am I alone in thinking even its Chrome implementation is a massive security risk? The fact that users can grant any webpage COMPLETE control of a USB attached device is astonishing. Live webpages shouldn't be able to access this feature - can't wait for fake jailbreak and backup services to start cropping up.
It's an incredibly bad idea, at work for the one Chromium browser we permit (Edge), we have to use policies to block this and several dozen major security vulnerabilities that exist solely because they make cool Google I/O demos.
Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites.
The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse.
The situation today is you buy a random USB gadget (e.g. a fitness tracker), but you can't use it without also installing the accompanying software/drivers. That effectively gives the manufacturer complete control of your computer. All you really wanted was for them to sync your step count, but you have no option but to give them complete remote access to your computer.
With Web USB you can allow vendor.com to access device 1234:5678 only, and revoke that access whenever you like.
Sure, maybe you could be tricked into clicking through all the confirmations and granting https://fakevendor.com access to a device. That could be bad - but no worse (and probably a lot better) than being tricked into downloading and running fakedriver.exe.
(disclaimer: I work for Google, have nothing to do with Chrome)
Re: What are some interesting uses of WebUSB you have come across?
#57Earlier quoted context omitted.
It's an incredibly bad idea, at work for the one Chromium browser we permit (Edge), we have to use policies to block this and several dozen major security vulnerabilities that exist solely because they make cool Google I/O demos.
Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites. The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse. The situation today is you buy a random USB g…
I explain in a neighboring comment: https://news.ycombinator.com/item?id=34563795
It's crucially important that Googlers are divorced of the belief a permission popup on the top of the screen is adequate indication of intent/informed consent. People approve these all the time without understanding what it's for.
Installing software is, at minimum, a very distinct action which users are aware of doing. Generally, they install a limited number of applications for specific purposes, whereas they may visit literally thousands of websites a month. Pretending these two things can be interchangeable is silly.
I am not entirely opposed to being able to use a browser as the UI for an activity like this, but it should require a higher bar to activate it for a specific server to talk to a specific device. Even web extension installs remain far too easy to not be maliciously abused widely. (Chrome extensions remain the primary malware I see in the wild.)
EDIT: The HN gods have me rate limited so hopefully you'll see my response here to the below comment:
Installing software is a complex process. It entails navigating to the correct site, locating a download, fishing it out of the downloads bar (many seniors cannot find this, by the way, it absolutely baffles them), opening it, usually acknowledging that you know it's an executable program, and then navigating the install wizard.
A software engineer would reasonably believe simplifying this is a good thing, but as noted, people regularly accept malware into their browser and do not even consciously realize they did it because it involves a single click.
People absolutely get misled into installing bad software, but they always know they actually did it, it's impossible to follow that chain without having some idea you're doing something.
Accepting malware isn't the answer, understanding people is. There is no technical solution for security, because it's a human problem.
Re: What are some interesting uses of WebUSB you have come across?
#58I know this might be a silly question but I vaguely remember a (very) old iPhone jailbreak that involved going to a website on your pc and plugging your iPhone into it. I never really investigated how it worked, does anybody remember that or how it accomplished that?
I remember trying that on a 3G or 3GS long ago. But I have no idea how it worked.
Re: What are some interesting uses of WebUSB you have come across?
#59Not sure if Web Serial APIs count, but I'll run with it.
I created a two-part project: a web app you configure ad simulate a few* peripherals in, and a bridge device that can interact with the simulated peripherals. Essentially, a bridge between the physical microprocessor you've programmed, and the web app. Doesn't work on Firefox because those APIs aren't available however.
* few being one of seven-segment display, "ultrasonic sensor", and a simple LED.
Re: What are some interesting uses of WebUSB you have come across?
#60Earlier quoted context omitted.
Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites. The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse. The situation today is you buy a random USB g…
I explain in a neighboring comment: https://news.ycombinator.com/item?id=34563795 It's crucially important that Googlers are divorced of the belief a permission popup on the top of the screen is adequate indication of intent/informed consent. People approve these all the time without understanding what it's for. Installing software is, at minimum, a very distinct action which users are aware of doing. Generally, they…
Why is installing software a distinct action, but granting device access not?
Malware is a huge ongoing problem, which suggests this distinction doesn't really exist.
I think we have to accept that there is no way to perfectly eliminate social engineering without also locking down legitimate access to devices. There will be some percentage of users who will click through all the warnings and confirmation prompts, just like there is some percentage of users that will run malware. That's bad, but you're letting the perfect be the enemy of the good.
Your argument could also apply to ssh, a small number of users could be socially engineered into sharing their id_rsa. This happens, we often find them checked into github, for example. Does this mean we should go back to telnet? No, for the vast majority of cases ssh is a huge imperfect improvement.
Likewise, in the vast majority of cases, Web USB is a huge imperfect improvement over installing drivers.