Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebUSB Extension for Firefox

github.com

Post reply on HN
Print view View original

231–240 of 264 posts

Re: WebUSB Extension for Firefox

#231

Post by Brian_K_White »

vbezhenar wrote: post #216
Brian_K_White wrote: post #52

People are starting to ship even local apps only in the form of some html & js that only works on Chrome because only Chrome has webusb. Whether we like the idea of the browser having access to usb or not, I at least like even less the idea of being forced to install and use Chrome for the same reasons as the bad old days of being forced to use IE.

Do you like the idea of installing Windows and installing some chinese drivers and some weird tool instead? Because that's the alternative to WebUSB.

It doesn't matter whether we like or dislike things that don't exist. The world where app makers don't ship this way doesn't exist.

Re: WebUSB Extension for Firefox

#232

Post by colechristensen »

Brian_K_White wrote: post #197
colechristensen wrote: post #185

Earlier quoted context omitted.

I'm talking about no javascript, no additional requests besides the bare document, no sending any information back home. Dynamic behavior only by a simple declarative language.

You are trying to express something that is logically impossible. Not technically difficult or socio-economically difficult to get companies to agree to or get users to care about, simply not a valid string of words. There is no way not to send information back to the host. Merely requesting a document is sending information to a host. I don't mean all the extra metadata in the request header or cookies let alone the…

Ok tone it down a little.

Caching, distributed sharing, the lack of a redirect mechanism or cookies all can contribute particularly if the goal is kneecapping surveillance but not the platonic ideal of secrecy.

For example, you can't do very much surveillance with DNS or bittorrent.

Re: WebUSB Extension for Firefox

#233

Post by circuit10 »

M95D wrote: post #207
nezza-_- wrote: post #39

WebUSB is so great. I can ship a cross-platform application that accesses a hardware device without having to deal with all the platform specifics, and with decent sandboxing of my driver. I think one way to make it more "secure" against unwitting users would be to only support WebUSB for devices that have a WebUSB descriptor - would allow "origin" checking.

> I can ship a cross-platform application And you can also un-ship it whenever you want, leaving users with unusable devices they paid money for.

You can ship an offline, standalone HTML file you can open in your browser too (this might not happen often but my point is it's not inherent to the technology)

Re: WebUSB Extension for Firefox

#234

Post by Hendrikto »

bauratynov wrote: post #203

WebUSB as an extension is the right approach. The security concern isn't the API itself — it's the default-on expectation that Chrome created. Firefox's model of "opt-in via extension" gives power users what they need without expanding the attack surface for everyone else. I've used WebUSB for flashing keyboard firmware and it's genuinely better than downloading random executables from GitHub. The permission model is…

> In order to use this, you need to both install the extension in your browser and install a small program (separate from the browser) on your computer. This extra program is called the "native stub".

Idk. Sure it has security advantages, but that sounds like to much of a hassle for 90% of users.

Re: WebUSB Extension for Firefox

#236

Post by cosmic_cheese »

KomoD wrote: post #201
cosmic_cheese wrote: post #138

Earlier quoted context omitted.

There's a real risk of losing the ability to control your device if the manufacturer stops hosting their propertiary WebUSB app, too. Standard USB drivers aren't going to disappear from my disk and can be reverse engineered long after its manufacturer has dropped support or gone under.

My mouse uses a WebUSB app to configure stuff. I just downloaded all the files that it uses, and now I can use it offline. > and can be reverse engineered long after its manufacturer has dropped support or gone under Nothing really stops you from reverse-engineering a WebUSB app either.

The question is if users will consistently have the foresight to archive such web apps, especially if the manufacturer has set up their bots.txt such that The Internet Archive skips it.

Traditional programs are incedentally archived by nature of having to be downloaded. They sit in downloads folders, old backups, thumb drives, etc.

Re: WebUSB Extension for Firefox

#237

Post by [deleted] »

bigfishrunning wrote: post #187
tredre3 wrote: post #118

Earlier quoted context omitted.

> It's about the same. It's absolutely not the same. If I go to a WebUSB page to make my device work, it won't magically have access to all my private files and be able to upload them god knows where or to destroy them. Or access to my entire LAN. Or access to my other peripherals. Any local driver/software will be able to. (Yes I am familiar with sandboxing technologies, they still aren't the default way to distribu…

Yeah, but if you request webUSB access maliciously to some random device, an unsavvy user is likely to click ok without thinking about it. Its still very much a viable attack vector.

[deleted]

Re: WebUSB Extension for Firefox

#238

Post by toraway »

bigfishrunning wrote: post #187
tredre3 wrote: post #118

Earlier quoted context omitted.

> It's about the same. It's absolutely not the same. If I go to a WebUSB page to make my device work, it won't magically have access to all my private files and be able to upload them god knows where or to destroy them. Or access to my entire LAN. Or access to my other peripherals. Any local driver/software will be able to. (Yes I am familiar with sandboxing technologies, they still aren't the default way to distribu…

Yeah, but if you request webUSB access maliciously to some random device, an unsavvy user is likely to click ok without thinking about it. Its still very much a viable attack vector.

  > you request webUSB access maliciously to some random device
  > an unsavvy user is likely to click ok
That's not how WebUSB works, the user always has to pick the device themselves from a list. The list cannot have a device pre-selected, and the "Connect" button is greyed out until the user makes a choice themselves.

The default "wtf? get this out of my face" path for a confused user is "Cancel".

The list can be filtered with vendorId filters defined ahead of time, but even if only a single device qualifies the user still has to chose to click it to enable the "Connect" button.

Once a device has been selected, it is considered "paired" to that specific site and the site can see its presence if available on future page loads. The user can revoke access/"unpair" from the site permissions button.

See example below of the pairing process:

https://imgur.com/a/HkpHBW5

Re: WebUSB Extension for Firefox

#239

Post by leptons »

bcjdjsndon wrote: post #229
leptons wrote: post #133

Earlier quoted context omitted.

Apple has provided no alternative, and no suggestions for how to improve the draft. They are not helping advance the draft only for selfish reasons. They also won't allow any other browser on iOS for the same selfish reasons. Apple continues to use abusive business tactics, and it's why they are being sued by the DOJ in an antitrust lawsuit. Them not implementing and not even suggesting changes to WebUSB and WebBluet…

> So the alternative is installing questionable drivers from questionable websites that give an attacker full-access to the entire computer. This is far less good for security, and is unfortunately the norm right now WebUSB isn't a driver, it relies on underlying usb drivers. What is the need here for a webpage that also needs to access specific hardware not exposed generically?

>WebUSB isn't a driver, it relies on underlying usb drivers.

I never said WebUSB "was a driver". But it does not rely on specific usb device drivers being installed for specific devices.

>What is the need here for a webpage that also needs to access specific hardware not exposed generically?

There are already plenty. You don't need to ask me because you'll likely just shit on what I write, so here's a list compiled by someone else:

https://github.com/webusb/awesome

That just scratches the surface.

I'm more interested in WebBluetooth, which Apple is also blocking from standardization. I manufacture a bluetooth enabled device that I'd like to have a simple web application to interface with, rather than needing to pay Apple for the privledge to develop an app for their app store, where they can then extort me for $$$ for any sales made through the app.

It's no different for WebUSB, it has many, many uses, but Apple is choosing profit over progress.

Re: WebUSB Extension for Firefox

#240

Post by toraway »

troupo wrote: post #199
oofdere wrote: post #174

Earlier quoted context omitted.

> On iOS they only pop up the menu when they try to access the required functionality, and there's a limited number of things they can do. great! your web browser does the exact same thing! > 26 more potential permissions [1] from a browser are fine because a) it's just a single permission window and b) the browser exists in total vacuum from all other user experiences. your argument is a non-sequitur; if I go instal…

> your argument is a non-sequitur Browsers don't exist in a vacuum. And yet everyone treats "yet another security pop up" as it does. > those OS permissions are confusing and obtuse, dare I say useless, and yet they still exist, and of course they cause fatigue! So let's add more? > whereas if you go to a webusb tool And yet you continue to pretend that it's only WebUSB that exists, or that users haven't been conditi…

The user has to choose a device themselves. The only enabled button when a WebUSB prompt appears is "Cancel" until they make a choice themselves.

A confused user will likely hit the only available button to "Cancel" which ends the process without granting any permissions.

By design it's a more conservatively designed approval prompt compared to e.g. accessing a camera or microphone where users get presented with a equally weighted "yes/no" decision.

https://imgur.com/a/5glTxvh

Also, the website can't enumerate connected devices until access is granted individually. The API call to request a device allows filtering by pre-defined vendor IDs, but with no visibility into what's connected. Meaning an attacker has to choose between:

1. showing a list of a half dozen options, which will confuse the user and likely make them cancel, or 2. narrowly target it hoping for a single result to improve odds they blindly choose it, which increases odds no devices will appear at all.

And since they can't enumerate devices until granted access, that prevents a targeted attack with e.g. a red flashing "WARNING: Your computer is infected! Pick 'USB 10/100/1000 LAN' and click 'Connect' to erase viruses immediately!"

Post reply on HN