Will this work on Firefox Android? I recently wanted to try the printervention.app website to print from my phone over an OTG cable.
WebUSB Extension for Firefox
71–80 of 264 posts
Re: WebUSB Extension for Firefox
#72Earlier quoted context omitted.
Web USB and Web Bluetooth are amazing. I've used the former for the excellent Web MiniDisc [1], and the latter to flash custom firmware [2] on cheap Xiaomi Bluetooth LE thermometer/hygrometer devices that Home Assistant can pick up. Truly opening new possibilities, since I wouldn't have been comfortable running some sketchy script or local binary. [1] https://web.minidisc.wiki/ [2] https://github.com/pvvx/ATC_MiTherm…
> Web USB and Web Bluetooth are amazing. Comments like this scare me. Things look amazing when people with benevolent intentions are making interesting things, but as soon as someone with malevolent intentions does something that becomes the reason we can't have nice things people will start asking if this is something we should have actually done. I just have no faith in humanity, and do not understand why we think…
> Comments like this scare me.
Sorry to hear that. I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way).
> I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources.
The browser already has all that access, it's just further granting it to web apps, and on a page-by-page, device-by-device, explicitly user opt-in basis at that.
And as I've mentioned, the alternative here is to install a potentially untrusted native application that gets the same access and so much more.
If that's what the Github page tells users to do, many of them will just do it without thinking twice. Is that better?
Re: WebUSB Extension for Firefox
#73Earlier quoted context omitted.
> breaking computing for everyone else How is not implementing a Draft spec, which may compromise security badly, breaking computing? Overreacting much?
This is not just an isolated incident, it's the whole trend of limiting capabilities in the name of security and that's what I was referring to. However in this particular case, even the security argument doesn't hold, either I: a) know that I want to use USB - in that case I'll switch browsers or download a native binary (even more unsafe), it's not that I'd decide that I no longer want to flash my smartphone b) I d…
A native binary can be verified by anti malware systems, and once installed and working, poses no security risk.
A 0day in a browser for the WebUSB system would allow any website to mess with arbitrary USB devices connected to your computer.
While the browser sandbox is generally safe, it is also a huge target, and with a security risk like that, it wouldn't surprise me if it's a prime target for black hats.
Re: WebUSB Extension for Firefox
#74WebUSB is so great. I can ship a cross-platform application that accesses a hardware device without having to deal with all the platform specifics, and with decent sandboxing of my driver. I think one way to make it more "secure" against unwitting users would be to only support WebUSB for devices that have a WebUSB descriptor - would allow "origin" checking.
Let's please not (or at most, add a scary warning for non-tagged devices), as this would break the use case for at least all retrocomputing.
Re: WebUSB Extension for Firefox
#75Earlier quoted context omitted.
Web USB and Web Bluetooth are amazing. I've used the former for the excellent Web MiniDisc [1], and the latter to flash custom firmware [2] on cheap Xiaomi Bluetooth LE thermometer/hygrometer devices that Home Assistant can pick up. Truly opening new possibilities, since I wouldn't have been comfortable running some sketchy script or local binary. [1] https://web.minidisc.wiki/ [2] https://github.com/pvvx/ATC_MiTherm…
> Web USB and Web Bluetooth are amazing. Comments like this scare me. Things look amazing when people with benevolent intentions are making interesting things, but as soon as someone with malevolent intentions does something that becomes the reason we can't have nice things people will start asking if this is something we should have actually done. I just have no faith in humanity, and do not understand why we think…
What if we implement them but hide them deep in the settings or as experimental feature inside the hidden developer menu, behind multiple warning messages and password prompts? Only the very determined developers and advanced users would be able to unlock them. Then it's safe enough?
Re: WebUSB Extension for Firefox
#76Earlier quoted context omitted.
Running directly in the browser is also not how I'd want to do USB.
When the alternative is downloading arbitrary executables I find the browser sandbox to be a reassurance.
Except the sandbox is a huge target already, and breaking it means any website can now access and mess with your usb devices. If you can develop an exploit for Chrome's WebUSB system, you potentially have millions upon millions of targets available.
Downloading an arbitrary executable can be made safe (via multiple avenues: trust, anti virus software, audits, artifact signing, reproducible builds, etc) and once the software is vetted, it exposes (or it should at least) little to no attack vector during daily use.
Re: WebUSB Extension for Firefox
#77Earlier quoted context omitted.
The security implications of not having WebUSB are having to install untrustworthy native drivers every time you want to interface with a USB device.
On macOS, I think I've installed device drivers exactly once in the last decade, and they were for a weird printer.
macOS allows USB access without installing a driver, so that's probably why. The "driver" is just part of the app.
Re: WebUSB Extension for Firefox
#78Earlier quoted context omitted.
> Web USB and Web Bluetooth are amazing. Comments like this scare me. Things look amazing when people with benevolent intentions are making interesting things, but as soon as someone with malevolent intentions does something that becomes the reason we can't have nice things people will start asking if this is something we should have actually done. I just have no faith in humanity, and do not understand why we think…
> Comments like this scare me. Sorry to hear that. I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). > I just have no faith in humanity, and do not understand why we think this is a good idea to give a browser this much access to local system resources. The browser already has all that access, it…
> I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way).
Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should is often left out of the conversation. At some point, the net negative that comes from the use of something "cool" is never contemplated by those creating the something "cool" simply because they would never fathom using the "cool" for "uncool" purposes. Sadly, someone else will and weaponize it in an uncontrollable manner. If the creators can't think of how it can happen, it is vital that those not so involved in the creation speak up when there are potential issues.
Re: WebUSB Extension for Firefox
#79Earlier quoted context omitted.
So instead of using trusted vendors or requiring tools with auditable code, we just allow everyone to be able to access the user’s devices?
What a concept. We could call it "Personal Computing."
Not really that personal when every webpage is itching to put their hands on it.
Re: WebUSB Extension for Firefox
#80Earlier quoted context omitted.
You can ask them to type one of the following sentences: "I know what I'm doing, and giving a random website access to my USB host is the right thing to do." "I'm an idiot."
I love this because the idiots would type out that they know what they're doing and the pros would save time by typing "I'm an idiot."
hah I did think of the second one, but the first didn't occur to me.