Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What are some interesting uses of WebUSB you have come across?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 101 posts

Re: What are some interesting uses of WebUSB you have come across?

#91

Post by scrollaway »

dheera wrote: post #71
arkadiyt wrote: post #44

The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin. But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass: - https://www.yubico.c…

Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.

This gets us back to TOTP seeds in password managers. IMO that's a good model; physical stuff gets lost, broken, stolen, etc (hence one reason why you should not rely on SMS: It relies on a physical SIM card, and a physical device).

What is the advantage of yubikey over TOTP in that scenario though?

Re: What are some interesting uses of WebUSB you have come across?

#92

Post by LecroJS »

djbeadle wrote: post #78
dheera wrote: post #71

Earlier quoted context omitted.

Hmm this might not quite be WebUSB territory but it would be interesting to put a Yubikey in the cloud so it could be accessed from anywhere.

I've written this comment before bu what you need is a remotely controlled finger for pressing YubiKeys: https://bert.org/2020/10/01/pressing-yubikeys/

This is hilarious. The “final thoughts” section really hit home for me. Thanks for sharing

Re: What are some interesting uses of WebUSB you have come across?

#93

Post by hbogert »

samgranieri wrote: post #52

I can flash the firmware on my ergodox ez with it. That’s pretty wild

Came here to say that. That oryx configurator is indeed pretty slick.

https://configure.zsa.io/

Blew my mind that it worked flawlessly almost 3 years ago already.

Re: What are some interesting uses of WebUSB you have come across?

#94

Post by CamperBob2 »

bobkazamakis wrote: post #90
CamperBob2 wrote: post #76

Earlier quoted context omitted.

So because a few bad actors might abuse it, and some users will fall into the traps laid for them, none of us get to use it. I reject this way of thinking. Letting bad guys dictate how you live your life and how you use your computer just doesn't scale that well.

systems that allow such brazen exploitation cease to exist, so who cares about scalability?

Do they cease to exist because of gatekeepers, criminals, or both?

Re: What are some interesting uses of WebUSB you have come across?

#95

Post by dmitriid »

taviso wrote: post #85
ocdtrekkie wrote: post #79

Earlier quoted context omitted.

This is a technical view, not a human-centric view. There is absolutely a level of warnings that will generally work. Not always, but I've found a number of people in the process of being socially engineered trip up on the UAC prompt and become more suspicious, to the point of booting a scammer out of their PC... and calling me. Likely because of the full-screen effect design and the short, but relatively scary langu…

Web USB can realistically improve security for billions of people globally. It will improve security for me and my family, and we're all humans. Sure, it's not a magic a wand that solves all problems, or makes malware disappear. I wish it did, but the fact that it doesn't is not a good reason to reject it. It's deployed to billions of people globally, can you show me any evidence at all that there is any Web USB soci…

https://www.wired.com/story/chrome-yubikey-phishing-webusb/

Immediately after WebUSB shipped in Chrome: "security researchers Markus Vervier and Michele Orrù detailed a method that exploits a new and obscure feature of Google's Chrome browser to potentially bypass the account protections of any victim using the Yubikey Neo".

The fact that fishing (and fingerprinting etc.) isn't reported widely doesn't mean it doesn't happen. After all you trust Chrome to properly implement everything and take care of things. And yet here's an example of a different hardware standard, WebMIDI: https://twitter.com/denschub/status/1582730985778556931 (note the comment: "Chrome still allows web developers to enumerate attached MIDI devices without user consent or even a notification")

Re: What are some interesting uses of WebUSB you have come across?

#96

Post by [deleted] »

drjasonharrison wrote: post #61
braingenious wrote: post #50

I know this might be a silly question but I vaguely remember a (very) old iPhone jailbreak that involved going to a website on your pc and plugging your iPhone into it. I never really investigated how it worked, does anybody remember that or how it accomplished that?

It might have used the Netscape Plugin Application Programming Interface (NPAPI) https://en.wikipedia.org/wiki/NPAPI . However it would have involved a step of downloading and installing a plugin, a few extra clicks.

[deleted]

Re: What are some interesting uses of WebUSB you have come across?

#97

Post by taviso »

dmitriid wrote: post #95
taviso wrote: post #85

Earlier quoted context omitted.

Web USB can realistically improve security for billions of people globally. It will improve security for me and my family, and we're all humans. Sure, it's not a magic a wand that solves all problems, or makes malware disappear. I wish it did, but the fact that it doesn't is not a good reason to reject it. It's deployed to billions of people globally, can you show me any evidence at all that there is any Web USB soci…

https://www.wired.com/story/chrome-yubikey-phishing-webusb/ Immediately after WebUSB shipped in Chrome: "security researchers Markus Vervier and Michele Orrù detailed a method that exploits a new and obscure feature of Google's Chrome browser to potentially bypass the account protections of any victim using the Yubikey Neo". The fact that fishing (and fingerprinting etc.) isn't reported widely doesn't mean it doesn't…

The attack here was that if you get tricked into giving a phishing site your password and Web USB access to your U2F key and then you press your U2F key, then the attacker can bypass the 2FA. I highly doubt this ever happened in real life, it was just a proof of concept.

In my opinion, the Chrome team overreacted and blocked all WebUSB access to any U2F/HID device.

Now if you want to update the firmware or configure your key you need to download an .exe and run it instead, which seems unfortunate to me.

If the phisher had said "Your U2F firmware is out of date, please download and run this update to continue", would that have been a vulnerability? That could also bypass 2FA (or anything else, for that matter).

Re: What are some interesting uses of WebUSB you have come across?

#98

Post by ocdtrekkie »

taviso wrote: post #97
dmitriid wrote: post #95

Earlier quoted context omitted.

https://www.wired.com/story/chrome-yubikey-phishing-webusb/ Immediately after WebUSB shipped in Chrome: "security researchers Markus Vervier and Michele Orrù detailed a method that exploits a new and obscure feature of Google's Chrome browser to potentially bypass the account protections of any victim using the Yubikey Neo". The fact that fishing (and fingerprinting etc.) isn't reported widely doesn't mean it doesn't…

The attack here was that if you get tricked into giving a phishing site your password and Web USB access to your U2F key and then you press your U2F key, then the attacker can bypass the 2FA. I highly doubt this ever happened in real life, it was just a proof of concept. In my opinion, the Chrome team overreacted and blocked all WebUSB access to any U2F/HID device. Now if you want to update the firmware or configure…

That is a trivial phishing path. In fact, the phishing site could easily justify that process as being required for security! "We need access to your YubiKey to use it to sign you in" seems extremely plausible.

Re: What are some interesting uses of WebUSB you have come across?

#99

Post by [deleted] »

ocdtrekkie wrote: post #98
taviso wrote: post #97

Earlier quoted context omitted.

The attack here was that if you get tricked into giving a phishing site your password and Web USB access to your U2F key and then you press your U2F key, then the attacker can bypass the 2FA. I highly doubt this ever happened in real life, it was just a proof of concept. In my opinion, the Chrome team overreacted and blocked all WebUSB access to any U2F/HID device. Now if you want to update the firmware or configure…

That is a trivial phishing path. In fact, the phishing site could easily justify that process as being required for security! "We need access to your YubiKey to use it to sign you in" seems extremely plausible.

[deleted]

Re: What are some interesting uses of WebUSB you have come across?

#100

Post by roxgib »

memen wrote: post #24
roxgib wrote: post #7

Does a device need to specifically support WebUSB, or will it work with any USB device so long as the web page supports it? Or is it the browser that needs to support the device? I found contradictory information on this when searching.

The website has to start the interaction with the USB device, it can be any USB device (not sure anymore, but i think you had to filter for Vendor ID). The browser needs to support WebUSB, currently only Chrome. On the USB device you can implement the WebUSB descriptor to link to your own website. This will give a notification on your desktop to open your website.

Thanks, I think I misunderstood the last bit to mean the USB device needed to specifically support WebUSB.
Post reply on HN