Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What are some interesting uses of WebUSB you have come across?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 101 posts

Re: What are some interesting uses of WebUSB you have come across?

#41

Post by [deleted] »

jaygreco wrote: post #34
c0nsumer wrote: post #30

VIA, as you mentioned, is one of the niftiest I've seen. I just wish that VIA was a bit more robust, particularly around macros... I want to do something that does separate key down and key up events with pauses between. Unfortunately, VIA doesn't do that. And worse, my keyboard (Keychron K3 Pro) doesn't yet have a public firmware build for QMK, so I can't do it directly in there either... (I'm trying to write a macr…

VIA is an awesome resource for the community and really lowers the bar on entry (our users no longer need to or are expected to compile their own firmware just to tweak keys) as well as just being convenient and nice to have. My only gripe is that they moved to web-only from “native” apps instead of offering both, but if that’s what needed to happen to bump up the development velocity, so be it. Re: the delays, I thi…

[deleted]

Re: What are some interesting uses of WebUSB you have come across?

#42

Post by f_devd »

TazeTSchnitzel wrote: post #32

I was looking into Android phone hacking and was surprised to discover https://webadb.com/ . It's a web equivalent of adb (Android Debug Bridge), which can install applications on a device connected over USB, among other things.

Very cool project but knowing how much access adb gives to your phone I wouldn't trust it unless you're self-hosting.

Re: What are some interesting uses of WebUSB you have come across?

#43

Post by ocdtrekkie »

protonscientist wrote: post #38
BiteCode_dev wrote: post #16

This is cool, but both safari and firefox will not implement it: https://usefulangle.com/web-updates/post/80/firefox-decines-... I assume this is because of security concerns.

Am I alone in thinking even its Chrome implementation is a massive security risk? The fact that users can grant any webpage COMPLETE control of a USB attached device is astonishing. Live webpages shouldn't be able to access this feature - can't wait for fake jailbreak and backup services to start cropping up.

It's an incredibly bad idea, at work for the one Chromium browser we permit (Edge), we have to use policies to block this and several dozen major security vulnerabilities that exist solely because they make cool Google I/O demos.

Re: What are some interesting uses of WebUSB you have come across?

#44

Post by arkadiyt »

The reason hardware 2fa keys like yubikeys are unphishable is that the browser controls the usb communication with the hardware key and passes the origin of the page to it - the page itself can't spoof an origin.

But with WebUSB a page _can_ communicate directly to a yubikey and pretend it's being asked to authenticate on a different origin. It's been fixed now but it was an interesting bypass:

- https://www.yubico.com/support/issue-rating-system/security-...

- https://www.wired.com/story/chrome-yubikey-phishing-webusb/

Re: What are some interesting uses of WebUSB you have come across?

#45

Post by ocdtrekkie »

moondev wrote: post #22
BiteCode_dev wrote: post #16

This is cool, but both safari and firefox will not implement it: https://usefulangle.com/web-updates/post/80/firefox-decines-... I assume this is because of security concerns.

Security or privacy (thumbprinting)? To be fair I'm still exploring it, once you choose a USB device when prompted, is that access for the session or longer?

I think it might be session, but the issue is that most users simply accept permission popups, often without consciously recognizing they did. I've cleaned out the notifications permissions on browsers for dozens of people; all of them denied allowing various websites to spam them with notifications.

Re: What are some interesting uses of WebUSB you have come across?

#50

Post by braingenious »

I know this might be a silly question but I vaguely remember a (very) old iPhone jailbreak that involved going to a website on your pc and plugging your iPhone into it. I never really investigated how it worked, does anybody remember that or how it accomplished that?
Post reply on HN