Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What are some interesting uses of WebUSB you have come across?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 101 posts

Re: What are some interesting uses of WebUSB you have come across?

#71

Post by dheera »

arkadiyt wrote: post #44

The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin. But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass: - https://www.yubico.c…

Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.

Re: What are some interesting uses of WebUSB you have come across?

#73

Post by taviso »

saagarjha wrote: post #69
taviso wrote: post #64

Earlier quoted context omitted.

> pwn your computer because the high-quality USB implementation wasn’t that high quality after all. You have to compare it to the options we have available today, not an implausibly perfect implementation that doesn't exist. Let's imagine there is some bug that means if I grant access to a device, then more access than intended is actually granted. That sounds bad, but let's compare that to the non-Web USB model, whe…

I think we're talking past each other. If the two alternatives are "I need to use a random native USB driver to talk to this" and "I can use WebUSB" then WebUSB is probably better. But in reality a lot of devices actually already have drivers for that class in the OS, or there's a way to write some sort of restricted driver on that platform doesn't require loading things into the kernel. In that case I'm now using a…

> But in reality a lot of devices actually already have drivers for that class in the OS

Great, then you don't need to install anything or use Web USB, it's a no-op!

Still, until we can get Microsoft to ship every driver for every device, we still need a solution that works today.

> In that case I'm now using a browser where random websites can either trick me into giving them access to my USB devices with a click,

You can already be tricked into granting complete access to your machine with a few clicks, that's malware. It's a huge ongoing problem that can only be solved by limiting the ability to run third party code. That's a really high price to pay.

Sure, you could be socially engineered into granting an attacker access to a USB device. The only solution is to have no way for you to grant access to USB devices. There is no amount of confirmation or warning you couldn't be tricked into dismissing by a social engineer.

You will also need to uninstall Remote Desktop and OpenSSH, because you could also be socially engineered into configuring them to allow access. It's a common scam to trick people into downloading TeamViewer, so we will also need to remove your Administrator access and setup AppLocker with a strict policy.

> or forcefully access them via an exploit on a surface that is generally amenable to such things

That's not how it works. When a vulnerability is described as "arbitrary code execution", that means the code can do anything, not just access functionality that exists in the browser. If you were to use a browser without WebUSB support, an arbitrary code execution exploit would still be able to interact with USB devices.

The only added complexity here is after you've granted access to a device, otherwise the attack surface is entirely tractable.

Re: What are some interesting uses of WebUSB you have come across?

#74

Post by taviso »

blooalien wrote: post #68
taviso wrote: post #56

Earlier quoted context omitted.

Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites. The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse. The situation today is you buy a random USB g…

Assuming security is a well implemented "first class citizen" and not an afterthought, yes…

Let's assume it's an absolute trash fire, the latest of all afterthoughts.

That's still better than "just download and run this exe as Administrator".

Re: What are some interesting uses of WebUSB you have come across?

#75

Post by dsfgagdsaf »

dheera wrote: post #71
arkadiyt wrote: post #44

The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin. But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass: - https://www.yubico.c…

Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.

what is interesting about that, and what purpose would it serve?

Re: What are some interesting uses of WebUSB you have come across?

#76

Post by CamperBob2 »

protonscientist wrote: post #38
BiteCode_dev wrote: post #16

This is cool, but both safari and firefox will not implement it: https://usefulangle.com/web-updates/post/80/firefox-decines-... I assume this is because of security concerns.

Am I alone in thinking even its Chrome implementation is a massive security risk? The fact that users can grant any webpage COMPLETE control of a USB attached device is astonishing. Live webpages shouldn't be able to access this feature - can't wait for fake jailbreak and backup services to start cropping up.

So because a few bad actors might abuse it, and some users will fall into the traps laid for them, none of us get to use it.

I reject this way of thinking. Letting bad guys dictate how you live your life and how you use your computer just doesn't scale that well.

Re: What are some interesting uses of WebUSB you have come across?

#77

Post by ocdtrekkie »

taviso wrote: post #60
ocdtrekkie wrote: post #57

Earlier quoted context omitted.

I explain in a neighboring comment: https://news.ycombinator.com/item?id=34563795 It's crucially important that Googlers are divorced of the belief a permission popup on the top of the screen is adequate indication of intent/informed consent. People approve these all the time without understanding what it's for. Installing software is, at minimum, a very distinct action which users are aware of doing. Generally, they…

Why is installing software a distinct action, but granting device access not? Malware is a huge ongoing problem, which suggests this distinction doesn't really exist. I think we have to accept that there is no way to perfectly eliminate social engineering without also locking down legitimate access to devices. There will be some percentage of users who will click through all the warnings and confirmation prompts, jus…

So the issue is we are talking about different dimensions of improvement. I concede that WebUSB is better sandboxed than executing a driver installer (likely running as admin or root) in terms of the blast radius. However, WebUSB is catastrophically worse than an installer in terms of the ability of the infection to occur in the first place. Both because of the aforementioned difficulty of user process of software installation, as well as the additional checks the OS and/or third party antivirus does, as opposed to Google's fairly limited abuse detection capabilities (just Safe Browsing in WebUSB's case, I imagine?).

This is a problem I have talked about many times before regarding Google's security outlook. On Project Zero there's a ton of interesting and surely exciting work into novel ways to compromise systems. ...That work has basically no bearing on improving security for the billions of users who will never be targeted in such a niche technical way.

Real world compromise tends to just be social engineering people into doing what Google explicitly permits websites to do. You could remove malicious activity from a billion users right now by simply... deleting the Notifications API from Chrome, which is principally used to spam ads. Because people mash that allow button all the time, every time.

I'd best guess I see ten times the malware in Chrome (either hijacker extensions delivered by the Chrome Web Store, push notifications from random adult websites, or both) than actual installed malicious software on a given Windows machine.

And this is fixable! Google could fix this with WebUSB and make a net positive all around! Likely by redesigning permission granting in the browser to require deeper user intent. But it would require a fundamental change in how Google understands and perceives security (and it'd likely reduce engagement stats for some features, which various teams would fight), and I've been beating this drum for several years and I don't really expect it to change.

(In fact, one specific change I could recommend: I think APIs like WebUSB, as well as the Notifications API and similar, should probably be completely blocked unless you install a PWA. It's not as much process as a Windows software install, but it's a clear gate to allowing a site more ability, and installing and removing apps is a far easier concept to explain to users than navigating the site privacy settings.)

Re: What are some interesting uses of WebUSB you have come across?

#78

Post by djbeadle »

dheera wrote: post #71
arkadiyt wrote: post #44

The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin. But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass: - https://www.yubico.c…

Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.

I've written this comment before bu what you need is a remotely controlled finger for pressing YubiKeys: https://bert.org/2020/10/01/pressing-yubikeys/

Re: What are some interesting uses of WebUSB you have come across?

#79

Post by ocdtrekkie »

taviso wrote: post #73
saagarjha wrote: post #69

Earlier quoted context omitted.

I think we're talking past each other. If the two alternatives are "I need to use a random native USB driver to talk to this" and "I can use WebUSB" then WebUSB is probably better. But in reality a lot of devices actually already have drivers for that class in the OS, or there's a way to write some sort of restricted driver on that platform doesn't require loading things into the kernel. In that case I'm now using a…

> But in reality a lot of devices actually already have drivers for that class in the OS Great, then you don't need to install anything or use Web USB, it's a no-op! Still, until we can get Microsoft to ship every driver for every device, we still need a solution that works today. > In that case I'm now using a browser where random websites can either trick me into giving them access to my USB devices with a click, Y…

This is a technical view, not a human-centric view. There is absolutely a level of warnings that will generally work. Not always, but I've found a number of people in the process of being socially engineered trip up on the UAC prompt and become more suspicious, to the point of booting a scammer out of their PC... and calling me. Likely because of the full-screen effect design and the short, but relatively scary language of the prompt.

You've posited effectively that if we cannot stop people from compromising their computer we should not bother to try. Either let them be owned with a trivial popup and a single press, or remove their agency entirely.

However, a better approach to security would be to take responsibility for designs that allow easy compromise, and build systems designed to drastically reduce the likelihood a user compromises their machines.

We can't stop people from finding a shady installer for a driver on a file sharing site hosted in Russia and running it, but we can make 99% of people less likely to do it with good design.

Post reply on HN