Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

11–20 of 264 posts

Re: WebUSB Extension for Firefox

#11

Post by exe34 »

lpcvoid wrote: post #6
gear54rus wrote: post #3

Earlier quoted context omitted.

And I'll just fire up a chrome instance which I specifically keep for when my daily driver firefox decides to spazz out and not implement basics in 2026 :'(

How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.

You can ask them to type one of the following sentences:

"I know what I'm doing, and giving a random website access to my USB host is the right thing to do."

"I'm an idiot."

Re: WebUSB Extension for Firefox

#12

Post by Retr0id »

skydhash wrote: post #8
Retr0id wrote: post #5

Earlier quoted context omitted.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

That sounds like a Windows problem.

I'm not familiar with the Windows platform but although you can have userspace USB drivers on linux, you still need to be able to run code that can talk to the sysfs interface.

Re: WebUSB Extension for Firefox

#13

Post by sva_ »

I recently flashed GrapheneOS on a Pixel for a friend. I was very surprised that you can do this entire process from the browser using WebUSB - the only downside being that it required me to launch Chromium.

Re: WebUSB Extension for Firefox

#14

Post by lpcvoid »

zb3 wrote: post #9
lpcvoid wrote: post #6

Earlier quoted context omitted.

How do you make sure that technically illiterate people don't just click away the requestDevice() popup? IMHO a browser offering device level USB access is a security nightmare and there is no way this can ever be made safe and convenient at the same time.

They can click everything away, so maybe educate them or buy an ios device for your relatives instead of breaking computing for everyone else.

Fair, but remember that we are the Maybe an about:config switch to enable it would be enough to stop casuals from pwning their peripherals.

Re: WebUSB Extension for Firefox

#15

Post by Lerc »

skydhash wrote: post #8
Retr0id wrote: post #5

Earlier quoted context omitted.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

That sounds like a Windows problem.

The Linux problem is more

Hope every time you want to interface with a USB device.

Re: WebUSB Extension for Firefox

#16

Post by monegator »

Retr0id wrote: post #5
Orygin wrote: post #2

No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

you do know microsoft OS 2.0 descriptors are a thing, right? or that you can force the unknown device to use WinUSB

but really most devices you want to interface to via webusb are CDC and DFU so.. problem solved?

Re: WebUSB Extension for Firefox

#17

Post by 1313ed01 »

Retr0id wrote: post #5
Orygin wrote: post #2

No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

Sounds like something that could have a standalone usb-driver-container or special chromium fork for the 0.00001% of users that need it instead of bloating every browser with yet another niche API and the inevitable security holes it will bring.

Re: WebUSB Extension for Firefox

#18

Post by rafram »

Retr0id wrote: post #5
Orygin wrote: post #2

No thanks. I'll accept it in my browser when they fix the security implications this raises, and when the Spec is no longer in draft.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

On macOS, I think I've installed device drivers exactly once in the last decade, and they were for a weird printer.

Re: WebUSB Extension for Firefox

#19

Post by monegator »

skydhash wrote: post #8
Retr0id wrote: post #5

Earlier quoted context omitted.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

That sounds like a Windows problem.

Not really, as long as the firmware developers used OS 2.0 descriptors

(For the rare occurences that our customer is using 7 or earlier, we tell them to use zadig and be done with it.)

Re: WebUSB Extension for Firefox

#20

Post by Retr0id »

monegator wrote: post #16
Retr0id wrote: post #5

Earlier quoted context omitted.

The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.

you do know microsoft OS 2.0 descriptors are a thing, right? or that you can force the unknown device to use WinUSB but really most devices you want to interface to via webusb are CDC and DFU so.. problem solved?

I'm unfamiliar with the Windows platform but that sounds like something that still requires executing code locally.
Post reply on HN