Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode Detection API

developer.mozilla.org

Post reply on HN
Print view View original

131–140 of 141 posts

Re: Barcode Detection API

#131

Post by unqueued »

Nextgrid wrote: post #96
unqueued wrote: post #92

Earlier quoted context omitted.

Users should not have to rely on the network being isolated for security. Even when I have an offline network, I still use SSH whenever possible. Yes, I don't benefit from initial verification, but I pin the certificate from then on. I don't think that the current "all or nothing" paradigm that we use with SSL in browsers makes any sense. I have been really disappointed over the last few years deploying network conne…

Let’s say I sell a physical device that allows you to use a browser as its UI. You just plug an Ethernet cable and point your browser to its web server. Security is done by physical access. Anything else is just extra complexity and points of failure, and if an attacker can get physical access to the LAN cable, he can just as well walk to the machine directly and change the settings on the control panel. HTTPS, with…

> HTTPS, with its current UX, would be a net negative in this case.

I would just replace "HTTPS" with "SSH", and see if that statement is still reasonable.

Even though SSH is not perfect when you can't verify the initial connection to a host on a local network, using TELNET instead is not a solution.

I have yet to hear a reason why HTTP is better than self signed and pinned HTTPS; why possibly insecure is worse than insecure.

The only justifications I have heard are UX justifications, and those are really just a critique of the UX, not the protocol.

> Security is done by physical access. Anything else is just extra complexity and points of failure, and if an attacker can get physical access to the LAN cable, he can just as well walk to the machine directly and change the settings on the control panel.

That is an extremely fragile solution.

By default ethernet is very open. It is very easy to bridge it with other devices or routers to announce themselves and start routing. It happens all the time on what are supposed to be closed networks, I've seen it.

And many networks are semi-offline. You may need to have limited internet access. Or the network configuration may change in the future.

Re: Barcode Detection API

#132

Post by nwsm »

michaelt wrote: post #47
Gigachad wrote: post #26

Earlier quoted context omitted.

Isn't that the point of webassembly? Just seems like we are still moving in the wrong direction on trying to move the whole of NPM in to the browser web apis, rather than building a solid base you can build anything on.

High performance barcode decoding (e.g. scandit) uses the GPU. After all, a modern cell phone could be producing 4k 30fps video, and high performance barcode decoders will detect linear barcodes with lines a single pixel wide, even in the presence of moderate noise/blur/overexposure (e.g. the barcode on a shiny can of coke) Of course, I've got no idea if browsers will provide high performance barcode reading, or some…

Do you have any examples of what a more general image processing API would feature? Everything between reading pixels and reading barcodes is a mystery to me.

Re: Barcode Detection API

#133

Post by Nextgrid »

unqueued wrote: post #131
Nextgrid wrote: post #96

Earlier quoted context omitted.

Let’s say I sell a physical device that allows you to use a browser as its UI. You just plug an Ethernet cable and point your browser to its web server. Security is done by physical access. Anything else is just extra complexity and points of failure, and if an attacker can get physical access to the LAN cable, he can just as well walk to the machine directly and change the settings on the control panel. HTTPS, with…

> HTTPS, with its current UX, would be a net negative in this case. I would just replace "HTTPS" with "SSH", and see if that statement is still reasonable. Even though SSH is not perfect when you can't verify the initial connection to a host on a local network, using TELNET instead is not a solution. I have yet to hear a reason why HTTP is better than self signed and pinned HTTPS; why possibly insecure is worse than…

> That is an extremely fragile solution.

> By default ethernet is very open. It is very easy to bridge it with other devices or routers to announce themselves and start routing. It happens all the time on what are supposed to be closed networks, I've seen it.

The reason for using Ethernet and browsers is that both are built into pretty much every computer, don't require any drivers, admin privileges or persistent software.

The idea is to replace USB, serial or some other point-to-point link which would require platform-specific drivers and client software. Most peripheral connections for printers, etc don't employ encryption on the control cables and the world hasn't ended, so physical security here is good enough in practice for the majority of purposes.

Re: Barcode Detection API

#134

Post by numlock86 »

schwartzworld wrote: post #127
numlock86 wrote: post #112

Cool. Another feature that Firefox won't support. Same with the WebSerial API and others. I sort of understand their reasoning that they want to make a web browser and not an application platform, but that's where the web is shifting to ... or rather has already for a long time. And people wonder why every new tech/browser is based on Chromium all the time. Well, this is one of the many reasons.

Why would Firefox implement non-standard APIs?

I get what you are trying to bring up as an argument, but even Firefox doesn't argue this way. See their answers on issues related to these kind of APIs.

Re: Barcode Detection API

#135

Post by xg15 »

imajoredinecon wrote: post #69
gruez wrote: post #40

>Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers. What's the point of this? I understand why you might want this for APIs that expose private user information, but this just performs some computation. You could do the same thing with a js library or webassembly. Is this just to punish http sites?

There might be more to the privacy characteristics of an API like this than meets the eye. For instance, if a user grants camera permissions scoped to http://insecure.website in order to scan a QR code and get it detected, it might be surprising to the user that on-path attackers would be able to see the user’s camera snaps. Making the API work in a degraded mode in insecure contexts (e.g. by disabling particularly p…

I don't get it. The privacy risk in there is from getUserMedia(), which is already (correctly) https-only. There is no privacy risk coming from the barcode API itself.

Re: Barcode Detection API

#136

Post by xg15 »

cloudwizard wrote: post #130
arjvik wrote: post #75

Earlier quoted context omitted.

Internal domains, where getting a certificate to client devices is painful

It works in secure contexts. internal domains with .localhost name are considered secure. https://developer.mozilla.org/en-US/docs/Web/Security/Secure... Locally-delivered resources such as those with http://127.0.0.1 URLs, http://localhost and http://*.localhost URLs (e.g. http://dev.whatever.localhost/ ), and file:// URLs are also considered to have been delivered securely.

Yes, because they are hardwired to point to your own machine. You cannot use those to deploy an internal webapp.

Re: Barcode Detection API

#137

Post by xg15 »

It's a nice feature, but, honest question, why is this a web API?

I don't see anything this has to do with browsers. This could be implemented perfectly well in a library.

Re: Barcode Detection API

#139

Post by fennecfoxy »

bob1029 wrote: post #23

This stuff has been a nightmare for us for a long time. We have to scan pdf417 barcodes from physical identification as part of our offering. Recently, we stumbled upon some cheap USB keyboard emulator 2d scanners that can pick these up very reliably. For our product/customers, this is a viable path. We have tested probably 30 different webcams by this point. The only 2 that are as reliable as the handheld CCD scanne…

Idk but whatever library the NHS website is using to scan the QR codes on LFTs is flawless, as soon as the camera view opens it immediately scans, you'd miss it if you blinked.

Re: Barcode Detection API

#140

Post by OJFord »

olvrng wrote: post #125
OJFord wrote: post #122

Earlier quoted context omitted.

As always, some fragment of Android actually got there before Apple (to put it in the Camera app), but no, it's not standard. My current phone (Nokia 3.4) doesn't have it, but previous one (Motorala One) did. Ironic, since I chose them for being about as close to stock as you can get, both in the 'Android One' programme (so also comparatively LTS).

It's always included in Google Lens (and Nokia 3.4 uses Android One). You can open Google Lens and point to the QR code.

Yes I said I chose them for being Android One, not that it wasn't.

I didn't know Lens had it, I've never used it. (I have all Google apps disabled.)

Post reply on HN