A whole new world of phishing.
window.showDirectoryPicker opens up a whole new world
21–30 of 122 posts
Re: window.showDirectoryPicker opens up a whole new world
#22> Chrome introduced a new API, window.showDirectoryPicker() that allows the user to grant access to a directory on their computer and allow a website to read/write everything inside. I mean, what could go wrong? It's not like an user is tricked into uploading a file from a folder (let's say, the main "Documents" folder) and some malicious website steals all the files over there.
If you tried this out in Linux, for example, the system would block you from selecting folders that contain files that are flagged as dangerous or "system files". I'm assuming this was implemented across all OSes.
Re: window.showDirectoryPicker opens up a whole new world
#23First time I've heard about this. I'll have to look into the security model around it. I'm curious what safeguards are in place to prevent click jacking. I know showing a file picker """should""" be enough of a warning to users to be careful, but it's not hard to imagine a world where a couple of fish accidentally bite the bait of an allow-button, or because they followed instructions they incorrectly trusted.
This is something you should explain to the Firefox critics.
Re: window.showDirectoryPicker opens up a whole new world
#24Currently using this in socket2.me Not truly supported across all mobile browser currently, but it's certainly better than just one year ago.
https://caniuse.com/mdn-api_window_showdirectorypicker * Global 75.2% Mainly missing Safari and Firefox
This new IE6 called Chrome, I hate it.
Re: window.showDirectoryPicker opens up a whole new world
#25This isn't new, the API has been around for several years. Unfortunately Mozilla and Apple say they are never going to implement it because of security concerns https://github.com/mozilla/standards-positions/issues/154
It is a great API though, I wish the other browser vendors liked it! Because currently us PWA developers are really limited when trying to make apps that work with local data, at least in non-Chrome browsers.
Re: window.showDirectoryPicker opens up a whole new world
#26Phishers and exploit developers are celebrating and jumping for joy over yet another way to deploy their payload to their victims.
What are the many ways could this possibly go wrong?
Re: window.showDirectoryPicker opens up a whole new world
#27First time I've heard about this. I'll have to look into the security model around it. I'm curious what safeguards are in place to prevent click jacking. I know showing a file picker """should""" be enough of a warning to users to be careful, but it's not hard to imagine a world where a couple of fish accidentally bite the bait of an allow-button, or because they followed instructions they incorrectly trusted.
This is something you should explain to the Firefox critics.
Chrome and friends (Edge, Opera) are basically the new IE6 and only people who are new or forgetful will disagree. I hate Mozilla for missing up so bad with their stewardship of Firefox time and again, but alas, it is the only reasonable option on the table.
And while I do hate Mozilla, Google is to be disliked even more.
Re: window.showDirectoryPicker opens up a whole new world
#28So websites can now nag users to allow access to the root of their local disk and then read all their files and settings, all their SSH keys and other passwords?
From what I gather from the docs [1], this API gives you a FileSystemDirectoryHandle object, and then you just call getDirectoryHandle() on that to recursively read the the entire filesystem. The spec [2] has some vague suggestions about blacklisting certain particularly sensitive files, which doesn't seem reassuring.
[1] https://developer.chrome.com/docs/capabilities/web-apis/file...
[2] https://wicg.github.io/file-system-access/#privacy-wide-acce...
Re: window.showDirectoryPicker opens up a whole new world
#29First time I've heard about this. I'll have to look into the security model around it. I'm curious what safeguards are in place to prevent click jacking. I know showing a file picker """should""" be enough of a warning to users to be careful, but it's not hard to imagine a world where a couple of fish accidentally bite the bait of an allow-button, or because they followed instructions they incorrectly trusted.
Looks like these safeguards are in place: * System and root directories cannot be selected. * Can only being activated after user action. * Requires https. * Double-confirmation for write access. No API like this could ever be bulletproof, but it's a start I guess. Very cool API though, and it really does open up a whole new world of possibilities.
Those are some pretty flimsy safeguards. I don't keep my secrets in system directories and using HTTPS doesn't mean the site isn't malicious.
Re: window.showDirectoryPicker opens up a whole new world
#30So websites can now nag users to allow access to the root of their local disk and then read all their files and settings, all their SSH keys and other passwords? From what I gather from the docs [1], this API gives you a FileSystemDirectoryHandle object, and then you just call getDirectoryHandle() on that to recursively read the the entire filesystem. The spec [2] has some vague suggestions about blacklisting certain…
Root directory would be on that blacklist for sure.
Those "vague suggestions" actually seem to include some pretty specific examples.
> A user’s entire "home" directory. Individual files and directories inside the home directory should still be allowed, but user agents should not generally let users give blanket access to the entire directory.