61–70 of 101 posts
I know this might be a silly question but I vaguely remember a (very) old iPhone jailbreak that involved going to a website on your pc and plugging your iPhone into it. I never really investigated how it worked, does anybody remember that or how it accomplished that?
Earlier quoted context omitted.
It's an incredibly bad idea, at work for the one Chromium browser we permit (Edge), we have to use policies to block this and several dozen major security vulnerabilities that exist solely because they make cool Google I/O demos.
Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites. The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse. The situation today is you buy a random USB g…
> disclaimer: I work for Google, have nothing to do with Chrome
…depends on how you’re squinting.
Earlier quoted context omitted.
Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites. The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse. The situation today is you buy a random USB g…
It depends on your threat model. “A trusted party ships high-quality drivers” is a good model but bundling it with the browser, where you run all sorts of code from third parties, can be difficult from the perspective of exposed attack surface. I would expect that someone in the position that ‘ocdtrekkie probably blocks installing random third-party drivers on those machines anyways, so now there’s new a way for webs…
You have to compare it to the options we have available today, not an implausibly perfect implementation that doesn't exist.
Let's imagine there is some bug that means if I grant access to a device, then more access than intended is actually granted. That sounds bad, but let's compare that to the non-Web USB model, where you have no option but granting unlimited unrestricted access to everything... now it doesn't sound so bad :)
Isn't "if you can find an 0day exploitable bug you can get access to everything" better than "You don't need a bug, because you already have access to everything"?
> …depends on how you’re squinting.
Umm, I know what I work on?
This is cool, but both safari and firefox will not implement it: https://usefulangle.com/web-updates/post/80/firefox-decines-... I assume this is because of security concerns.
This is cool, but both safari and firefox will not implement it: https://usefulangle.com/web-updates/post/80/firefox-decines-... I assume this is because of security concerns.
That article is from 2020…
Sometimes they implement a seemingly innocuous API like WebMIDI, and boom, fingerprinting: https://twitter.com/denschub/status/1582730985778556931?s=20...
Earlier quoted context omitted.
It's an incredibly bad idea, at work for the one Chromium browser we permit (Edge), we have to use policies to block this and several dozen major security vulnerabilities that exist solely because they make cool Google I/O demos.
Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites. The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse. The situation today is you buy a random USB g…
Earlier quoted context omitted.
It depends on your threat model. “A trusted party ships high-quality drivers” is a good model but bundling it with the browser, where you run all sorts of code from third parties, can be difficult from the perspective of exposed attack surface. I would expect that someone in the position that ‘ocdtrekkie probably blocks installing random third-party drivers on those machines anyways, so now there’s new a way for webs…
> pwn your computer because the high-quality USB implementation wasn’t that high quality after all. You have to compare it to the options we have available today, not an implausibly perfect implementation that doesn't exist. Let's imagine there is some bug that means if I grant access to a device, then more access than intended is actually granted. That sounds bad, but let's compare that to the non-Web USB model, whe…
> Umm, I know what I work on?
As do I, and it would probably be more accurate to write "I work for Google, but not on Chrome".