81–90 of 101 posts
Web MiniDisc: https://github.com/asivery/webminidisc
https://docs.arduino.cc/learn/starting-guide/the-arduino-web...
Earlier quoted context omitted.
Why is installing software a distinct action, but granting device access not? Malware is a huge ongoing problem, which suggests this distinction doesn't really exist. I think we have to accept that there is no way to perfectly eliminate social engineering without also locking down legitimate access to devices. There will be some percentage of users who will click through all the warnings and confirmation prompts, jus…
So the issue is we are talking about different dimensions of improvement. I concede that WebUSB is better sandboxed than executing a driver installer (likely running as admin or root) in terms of the blast radius . However, WebUSB is catastrophically worse than an installer in terms of the ability of the infection to occur in the first place. Both because of the aforementioned difficulty of user process of software i…
We're not talking about any vulnerability here, this is social engineering. There is no amount of confirmation that can be required or warnings added that a confidence trickster cannot walk you through dismissing. The only solution is to limit what you're allowed to do with your own computer.
That's a really high price to pay.
Earlier quoted context omitted.
Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.
what is interesting about that, and what purpose would it serve?
You have no cash, no wallet, no cards, no phone, no yubikey, nothing.
There's a public library next door where you can use an internet terminal to log into your Google Voice and G-mail and send an e-mail for help or call your family without needing cash on hand. Those websites enforce 2FA, so this is the solution to that.
(I realize this breaks the premise of 2FA, but it will get you back safely, which is probably more important on your Maslow hierarchy than some infosec policy.)
Earlier quoted context omitted.
> But in reality a lot of devices actually already have drivers for that class in the OS Great, then you don't need to install anything or use Web USB, it's a no-op! Still, until we can get Microsoft to ship every driver for every device, we still need a solution that works today. > In that case I'm now using a browser where random websites can either trick me into giving them access to my USB devices with a click, Y…
This is a technical view, not a human-centric view. There is absolutely a level of warnings that will generally work. Not always, but I've found a number of people in the process of being socially engineered trip up on the UAC prompt and become more suspicious, to the point of booting a scammer out of their PC... and calling me. Likely because of the full-screen effect design and the short, but relatively scary langu…
Sure, it's not a magic a wand that solves all problems, or makes malware disappear. I wish it did, but the fact that it doesn't is not a good reason to reject it.
It's deployed to billions of people globally, can you show me any evidence at all that there is any Web USB social engineering happening?
Earlier quoted context omitted.
So the issue is we are talking about different dimensions of improvement. I concede that WebUSB is better sandboxed than executing a driver installer (likely running as admin or root) in terms of the blast radius . However, WebUSB is catastrophically worse than an installer in terms of the ability of the infection to occur in the first place. Both because of the aforementioned difficulty of user process of software i…
I think I need to see some data to back up your claim that Web USB makes socially engineering "catastrophically worse". Web USB is deployed today for a billion users, and yet attackers still seem to prefer malware or walking victims through installing TeamViewer, correct? We're not talking about any vulnerability here, this is social engineering. There is no amount of confirmation that can be required or warnings add…
WebUSB is new, non-standard, of course, and last time I tried it required feature flagging (it's saving grace... at the time). Compromises through extensions are probably more likely for a while, but WebUSB will probably be more exciting for persistence, considering you could flash an entire hardware device with malicious code, that the user has already demonstrated comfort connecting back to their PC.
Earlier quoted context omitted.
I think I need to see some data to back up your claim that Web USB makes socially engineering "catastrophically worse". Web USB is deployed today for a billion users, and yet attackers still seem to prefer malware or walking victims through installing TeamViewer, correct? We're not talking about any vulnerability here, this is social engineering. There is no amount of confirmation that can be required or warnings add…
Ah, but before they got tricked into TeamViewer, they were likely compromised once or twice over by Google: It's likely the link to the scammer's screen came from a Google ad that directed a user to a browser hijacking web extension, all of which has roughly the same level of difficulty as WebUSB. Then after that, a scammer may talk them through the process of downloading a RAT. (Though TeamViewer has not been popula…
It sure opened the door to a lot of scams, and was far from a perfect solution. Yet it does seem to have had a net positive effect. Maybe that can be true of other technologies sometimes :)
Let's leave it there, I don't think there's anything else to add.
The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin. But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass: - https://www.yubico.c…
Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.
Earlier quoted context omitted.
Am I alone in thinking even its Chrome implementation is a massive security risk? The fact that users can grant any webpage COMPLETE control of a USB attached device is astonishing. Live webpages shouldn't be able to access this feature - can't wait for fake jailbreak and backup services to start cropping up.
So because a few bad actors might abuse it, and some users will fall into the traps laid for them, none of us get to use it. I reject this way of thinking. Letting bad guys dictate how you live your life and how you use your computer just doesn't scale that well.