221–230 of 264 posts
Earlier quoted context omitted.
Running directly in the browser is also not how I'd want to do USB.
Then don't install the extension
It will probably come natively one day in Firefox, and we should push back against such attack vectors.
WebUSB is so great. I can ship a cross-platform application that accesses a hardware device without having to deal with all the platform specifics, and with decent sandboxing of my driver. I think one way to make it more "secure" against unwitting users would be to only support WebUSB for devices that have a WebUSB descriptor - would allow "origin" checking.
WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's model of "opt-in via extension" gives power users what they need without expanding the attack surface for everyone else. I've used WebUSB for flashing keyboard firmware and it's genuinely better than downloading random executables from GitHub. The permission model is…
The whole point of WebUSB is to create a tool that works with USB device, without all the risks and issues of installing external programs. If I need to install a program, browser extension, just to work with a given tool, I probably would just prefer an ordinary program without browser at all. Chrome approach is correct. It allows user to work with USB devices without exposing computer to the risks of installing a h…
WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's model of "opt-in via extension" gives power users what they need without expanding the attack surface for everyone else. I've used WebUSB for flashing keyboard firmware and it's genuinely better than downloading random executables from GitHub. The permission model is…
WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's model of "opt-in via extension" gives power users what they need without expanding the attack surface for everyone else. I've used WebUSB for flashing keyboard firmware and it's genuinely better than downloading random executables from GitHub. The permission model is…
The whole point of WebUSB is to create a tool that works with USB device, without all the risks and issues of installing external programs. If I need to install a program, browser extension, just to work with a given tool, I probably would just prefer an ordinary program without browser at all. Chrome approach is correct. It allows user to work with USB devices without exposing computer to the risks of installing a h…
Earlier quoted context omitted.
The whole point of WebUSB is to create a tool that works with USB device, without all the risks and issues of installing external programs. If I need to install a program, browser extension, just to work with a given tool, I probably would just prefer an ordinary program without browser at all. Chrome approach is correct. It allows user to work with USB devices without exposing computer to the risks of installing a h…
You have to balance the this ease of use with increasing potential attack and fingerprinting surface. Correct approach is something in the middle - a separate off-by-default setting or recommended official extension.
Sometimes security and usability contradict with each other.
WebUSB has been used by projects like GrapheneOS, ESPHome, and Meshtastic. Google has used WebUSB to let users convert Stadia controllers to regular bluetooth input devices. Some manufacturers of keyboards use WebUSB for their configuration utilities. It's an incredibly useful API, and it's secure. You have to explicitly pick a device to give access to. Mozilla's attitude in refusing to natively implement it seems ne…
> It's an incredibly useful API, and it's secure. Citation needed. Web browsers, with their many CVEs, do not look like the pinnacle of security.
Earlier quoted context omitted.
The whole point of WebUSB is to create a tool that works with USB device, without all the risks and issues of installing external programs. If I need to install a program, browser extension, just to work with a given tool, I probably would just prefer an ordinary program without browser at all. Chrome approach is correct. It allows user to work with USB devices without exposing computer to the risks of installing a h…
...in your opinion. the firefox team disagrees.
Earlier quoted context omitted.
> The spec is still in draft because Apple refuses to let it move forward This is untrue. Web standards need two independent implementations. Google can’t convince any other rendering engine besides their own to implement it. It doesn't take a single no from Apple to veto it; it takes a single yes from anybody outside of Blink to move it forward. Nobody is doing that. Here is what Mozilla have to say about WebUSB: >…
Apple has provided no alternative, and no suggestions for how to improve the draft. They are not helping advance the draft only for selfish reasons. They also won't allow any other browser on iOS for the same selfish reasons. Apple continues to use abusive business tactics, and it's why they are being sued by the DOJ in an antitrust lawsuit. Them not implementing and not even suggesting changes to WebUSB and WebBluet…
WebUSB isn't a driver, it relies on underlying usb drivers. What is the need here for a webpage that also needs to access specific hardware not exposed generically?
Earlier quoted context omitted.
> I thought this was a safe space for hackers to express enthusiasm about pushing their own hardware and software further (and in this case even in a comparatively safe way). Nothing is preventing said experimentation nor discussion of it. I am merely offering my more conservative views of the situation as a contrast to the echo chamber gungho nature of the experimentation. Just because we can doesn't mean we should…
>Sadly, someone else will and weaponize it in an uncontrollable manner. Except it isn't "uncontrollable". You have to explicitly allow every single website to use WebUSB . Without that explicit allowance, the website can't access anything. Plenty of things can be weaponized, even household utensils. Should we ban all forks? The sky is not falling, and WebUSB is not going to cause it to fall.
You could always write a native app. It's always been possible that way.